Remember the “locked box puzzle” recounted on a “Security Now!” podcast (Episode #33, titled “Symmetric Block Ciphers”, 30 Mar 2006)?
Steve Gibson says:
… Leo and I answer last week's Puzzler/Brain-Teaser which explored the idea of using two private one-time pad "keys," like two padlocks, to securely convey a message between two parties, neither of whom would have the other's key. Then we continue our ongoing tour of fundamental crypto-technology by describing the operation of Symmetric Block Ciphers …
Steve Gibson and Leo Laporte agreed that an eavesdropper seeing ALICE's cipher text before and after encryption could XOR both together and derive her secret key. However, if a complex, commutative cipher which doesn't use simple XORing to encrypt is used then I think the key exchange would be secure and the key exchange would work.
For example: Bob encrypts a message with his key. Alice encrypts Bob's encrypted above message with her key. ALICE sends above encrypted message back to Bob. Bob decrypts Alice's above message with his key. BOB sends above to ALICE. ALICE decrypts above with her key. Alice can now read BOB'S original decrypted cipher text and they didn't need to exchange keys. An eavesdropper attack will not work if the algorithm is not a simple XOR-ing of plain text and key.
This cipher is a commutative, complex algorithm.
Starting with a text file containing one character, an m
. The symbol m
is hex 6d
01101101
. Â
is hex c2
. 11000010 is 'm' encrypted by bob and then sent to alice. ø is hex d8 11011000
is Alice's encryption of Â
which Bob decrypts to £
and sends to Alice. £
is hex a3
10100011
which alice decrypts to m
with her key. m
is Alice’s decryption result. An eavesdropper sees Â
Alice's message before her encryption. the eavesdropper sees ø alice's msg after her encryption. the eavesdropper XORs Â
and ø
. 11000010 Â 11011000 ø 00011010
the eavesdropper's XOR result = 1a
in hex. If an eavesdropper attack worked he would have found E
hex 45
01001001
which is first letter of Alice's key.
This seems to be a simpler key exchange than PGP etc. All that's needed is that both parties use the same crypto-program and agree on an authenticator.
I confess to being a hobbyist. If anyone wants the C# program and/or the source code for the cipher (which targets Microsoft Windows), they may have it/them.
Below is example with longer, random keys.
Plaintext:
this is a test.
Bob's key:
kZtOfS0kKqcRLjTNPh7OjcJKZZFLjmm5OVm02YlrBQN0zI9SxOD1zJjQcpetUbX
Bob's ciphertext to Alice:
1IÎ.8Ío#"ëìAùJ'
Alice's key:
O1yfuV7MpX3n4wtefUhr6YctRaeCcrrzH7LqLNRUQCMVZuL5Mr0Bw3qMeIT92hg
Alice's ciphertext to Bob:
µRÖ³#ïÓO,fzkÆaå
Bob decodes Alice's above which = below:
øqqøð<ª>P¸&@<
and sends above back to Alice which Alice decodes, yielding:
this is a test.
To authenticate, simply add agreed upon passwords in plain text inside the message but not part of the message's ciphertext. needed only for last 2 exchanges. E.g.: µRÖ³#ïÓO,fzkÆaå apassword
.