0
$\begingroup$

When implementing a XOR cipher with a pseudo-random key equal in length to the plaintext, Is there a significant difference in potential key strength between keys drawn from a pool of either 1000 or 5000 possible characters? (that is, each character in the key may be any one of up to five thousand possible characters) Or is this not likely to be a deciding factor in overall security for a simple XOR?

Edit: I apologize if my original phrasing was ambiguous. I have hopefully improved it a bit. (Character pool = A group of distinct character from which the cipher key may be generated.)

Improve this question
$\endgroup$
20
  • 2
    $\begingroup$ By "Character pool", do you mean each character is sampled from a set of $1000$ or $5000$ possible characters, or a key of length $1000$? $\endgroup$
    – Cryptographeur
    Nov 23, 2013 at 9:27
  • $\begingroup$ I agree, without defining "character pool" there is no answering this question. This seems to yet another scheme to create a very slow stream cipher out of a one-time pad. $\endgroup$
    – Maarten Bodewes ♦
    Nov 23, 2013 at 18:06
  • $\begingroup$ As the question is, it is not possible to answer it. Could you add a definition of "character pool", and how it relates to your pseudo-random key? $\endgroup$
    – Paŭlo Ebermann
    Nov 23, 2013 at 18:54
  • 1
    $\begingroup$ @Daniel: How are you "randomly selecting " the predefined characters and how is this table of characters generated? If as you say you don't care that the Mersenne is not cryptographically secure, why worry about the quasi-randomness of your key? $\endgroup$
    – William Hird
    Dec 1, 2013 at 20:02
  • 1
    $\begingroup$ @e-sushi Thanks for the tip! I will look into it. :) $\endgroup$
    – Daniel
    Dec 1, 2013 at 21:36

1 Answer 1

Reset to default
1
$\begingroup$

There are a reasonable number of assumptions I'm going to have to make to try and answer this question. For perfect security, we require that the keystream is truely random, and never reused (OTP,shannon).

I've decided to add in a short answer here: STOP! There's absolutely no need to use a reduced character set thing anyway - you can just use your random number generator to generate a random byte and then treat your plaintext as a series of bytes rather than as characters.

Now, I take it you're intending to obey the no-reuse requirement, which leaves us with the question of what happens when my data isn't quite random enough? Firstly, lets try and work out what a pool of 1000 characters would mean. To run an xor-cipher, we somehow translate the string of characters into a string of bits, using one of many character encodings. There are $2^8=256$ bits in a byte, so I deduce that by character you mean that each character is encoded into two-bytes (which is roughly how UTF-16 seems to work if you don't require very strange characters), meaning there are a total of $2^{16}=65536$ possible characters.

Now, how are you picking $1000$, or indeed $5000$ from them? If they're not randomly sampled from the total options, then you risk letting through some very significant information. For example, if your set is based around "common" characters then because of the way the character sets are constructed there are certain bits which are more likely to be set / not set in your collection of characters.

If you have managed to sample them totally randomly, then at the very least you're loosing out against a naive attack since there are only $1/5$ of the values to check.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.