Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Reading through some documentation on a piece of software, it claims that a 4-6 digit number is created using a 256-bit encryption process for the purposes of access control. The whole process works as follows:

  1. A 4-6 digit "start code" (key?) is chosen by the user and programmed into the client software and into the management software as a new "client software record".
  2. Using the management software, a new access code that will open the client software can be generated by selecting the previously created client software record.

It is clear that the 4-6 digit start code is used to introduce some form of uniqueness to each instance of the client software, and that start code is used to generate the resulting access code which when entered into the start screen of the client software, will allow the software to open.

My question is how could that process be using 256-bit encryption?

One thing which is clear is that there are only 10^6 possible combinations to open the client software thus in theory it wouldn't make much difference whether encryption or hashing is used to generate an access code.

Why such as number only access control is used is beyond the scope of this question. I am aware that this is pretty poor access control for software. Am just intrigued by the claim of 256-bit encryption.

share|improve this question
    
Of course this can be done. A 256 bit block cipher is a pseudo random permutation of bits. You need some kind of method to handle the conversion from a number to bits (and vice versa) and some way to convert to / from the block size. You could also swap plaintext and key. It is more a question if the scheme makes sense security wise. –  owlstead Jul 15 '13 at 10:29

2 Answers 2

I believe the claim of using "256-bit encryption" is primarily being done for marketing purposes.

Despite the best efforts of industry experts there are many people with a limited understanding of cryptography, and they associate "bigger key sizes" with "better security." (While this is generally true, it's a very narrow view that excludes many important security factors; besides, key size differences become almost trivial beyond a certain threshold.) Sadly, that's a surprisingly large number of people.

Marketers know the money coming from people who don't understand the details spends just as well as money from people who do.

So what can you do about it, or what should you do about it? Perform a security analysis reviewing what the product is capable of, given the facts you have. Is six digits enough to stop people from guessing in the time limit given them? Do they have a three-tries-then-lockout mechanism? What is the value to you of the system they're protecting? What is your risk exposure should it be violated? Are there other access controls in place, and should there be?

share|improve this answer
    
A marketing claim was my first thought but didn't feel that my understanding of cryptography could justify that thought. It certainly can come across as a misleading claim as it could imply that the whole security model is far superior to what it actually is. –  emjx Jul 16 '13 at 8:06
    
They might be internally encrypting your start code with AES-256 to protect it, which is all the marketer needs to know to sell "256-bit encryption". But it says nothing about how that key is managed, or if an attacker can simply brute force guess all 6 digit numbers to gain access, or disassemble the code to reveal the key. Marketers don't have to understand a feature to sell it. But without knowing more details, I'd review the company's products more carefully - how do you know what else they've misstated? –  John Deters Jul 16 '13 at 13:29
    
Very true. There is nothing to stop a simple brute force guess of the 6 digit number and indeed simple PHP or Perl or C# get requests could cycle through all combinations. The only obstacle would appear to be time or potential IP lock out through too many requests. –  emjx Jul 16 '13 at 13:37

Step 1: Contact the software provider or author. Say you want the exact details on how all these codes are generated.

Step 2: Wait for their reply. This will be something like: "That's proprietary/secret information, we can't release it to you."

Step 3: Conclude they're clueless about security [1]. So their security can probably be broken in 15 minutes by any competent person who chose to put in the effort!

[1] https://en.wikipedia.org/wiki/Kerckhoffs's_principle

share|improve this answer
5  
-1 Kerckhoffs's principle says that any cryptosystem should be secure even if public. There's no inverse to this, e.g. that any non-public cryptosystem is by definition insecure. –  orlp Jul 15 '13 at 12:23
    
@user7576 - I am aware that the resulting access code is of low security value (i.e. only 1m combinations), I am more interested in how a claim could be made that 256-bit encryption is used to generate that access code. It would seem to me that the method of generating the access code is not that relevant (as long as the same access code can be generated in both the client and management software using the same key). –  emjx Jul 15 '13 at 14:55
    
This does not address the question. –  Steel City Hacker Jul 16 '13 at 20:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.