1
$\begingroup$

I am a student in the process of creating a firewall circumvention program based on smuggling data inside of legitimate HTTP. I have limited cryptographic knowledge.

I need a way to encrypt my higher-level protocol such that I get a random bytestream indistinguishable from random data that can then be disguised as images/video/etc. I plan to use symmetric encryption with pre-shared keys for simplicity reasons - cryptography is not the primary focus of the project, and it is not designed for real-world use.

I've been looking at the "off-the-shelf" recommended encryption algorithms and they all seem to have associated data. As I understand it associated data is not encrypted, just protected from tampering. Having associated data inside my "video stream"/"file upload" would make it quite easy to fingerprint and block.

I looked at using ChaCha20-Poly1305 provided by Rust's Orion library (https://docs.rs/orion/latest/orion/hazardous/aead/xchacha20poly1305/index.html), but even that appears to have a external authentication tag (Though I'm not 100% sure - does it?).

What would you recommend for this? I care about security but not to a huge degree - this is only a school project and it would be encapsulating HTTPS, so if broken only metadata about what websites are being visited would be visible.

Thank you.

$\endgroup$

1 Answer 1

2
$\begingroup$

You are looking for an encryption algorithm which produces ciphertexts that are completely indistinguishable from random. Your comments:

I've been looking at the "off-the-shelf" recommended encryption algorithms and they all seem to have associated data.

Actually, that's not a problem. Yes, many encryption algorithms support associated data; however that's meant to be a facility for you to use; there's no requirement that you use it. You can have empty associated data without any issue.

You also bring up the authentication tag (which is data that is used to verify that the ciphertext hasn't been modified in transit) - since that is typically indistinguishable from a random string, it does not conflict with your requirements.

Now, one thing that may show up as nonrandom is the nonce (also known as IV) - some modes insist that we never repeat the nonce, and so what is common practice is to use a counter to generate successive nonces when we generate ciphertexts - as such, such a successive counter may show up as nonrandom.

The way to address that is easy: use a mode that doesn't require such nonrepeating nonces. Such modes would include CBC mode (with random IV's; you might want to include something like an HMAC or KMAC to the ciphertext if you care about detecting changes to the ciphertext) or an SIV mode (which generates its own IV, and in a manner which appears to be random). OpenSSL (actually, any reasonably complete crypto library) would do CBC mode for you (and possibly SIV as well).

BTW: the terminology of what you're trying to do (hide a message within an innocuous appearing larger message) is called Steganography; you might want to google that for ideas on how to embed this random ciphertext into your HTTP messages (images, html text, whatever)

$\endgroup$
2
  • $\begingroup$ Thank you for the help! $\endgroup$ Jul 18, 2023 at 14:19
  • $\begingroup$ OP could also give some thought to the size of the ciphertext. You may be able to do fingerprinting on size alone. For instance, determining the likely block size of the cipher, or the likely header size of the cipher (tag, iv, siv), & matching that against profiles of common cipher fingerprints. $\endgroup$
    – aiootp
    Jul 24, 2023 at 16:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.