4
$\begingroup$

I'm reversing a cryptographic algorithm. This is part of the encryption function translated to python (starting from assembly code):

cleartext = [ 0x24,0x11,0x33,0x63,0xbc,0x59,0x07,0x5b,0x96,0x4b,0x07,0x15,0x2d,0x23,0x4b,0x70 ]
clearlen = 16

# Init the dictionary
cdict = [ 0 ] * 256
for i in range(256):
  cdict[i] = i

v1 = 0
# Load the dictionary
for i in range(256):
  v1 += (cleartext[ i % clearlen ] + cdict[i])
  v1 = v1 & 0xFF
  v2 = cdict[v1] ^ cdict[i]
  cdict[i] = v2
  v3 = cdict[v1] ^ v2
  cdict[v1] = v3
  cdict[i] ^= v3

Then this array of 256 bytes is used to extract clearlen bytes which are XORed with a key. I didn't translate it to python yet.

I was trying to understand if this was a known cryptographic algorithm, or it is completely custom. So far I was not able to identify it. Do you?

$\endgroup$
5
$\begingroup$

That would appear to be RC4, which is a well known (if not well trusted) cryptographical algorithm, original designed by Ron Rivest.

The part you quoted is the Key Setup Algorithm, which is run before you actually encrypt/decrypt anything. The part which is written in an unusual (but correct) way is the last 5 lines, which does a swap of cdict[i] and cdict[v1] - more typically, it is written with just 2 reads and 2 writes and two temp variables in the obvious fashion; for some reason they decided to use some 'clever' logic with xors (and two temp variables, 4 reads, 3 writes).

| improve this answer | |
$\endgroup$
  • $\begingroup$ gosh, you are right! Or at least...partially right, but now I understand more. There is one difference which didn't allowed me to recognize it: this initialization in RC4 is done with the key, not with the clear text (like in this case)...but these can be swapped, so I think that you put me on the right path. Thanks! $\endgroup$ – cips Mar 21 at 16:48
  • 2
    $\begingroup$ @cips: it would appear that the programmer tried to put in some small effort to make it less obvious what they're doing; calling the key the 'cleartext', and doing the swap in an obscure way. Or did you insert the variable names? $\endgroup$ – poncho Mar 21 at 18:16
  • $\begingroup$ I actually inserted the variable name, based on the usage of the variable in the program, or at least on what I thought it was the usage. But you are probably right, it was a kind of obfuscation. Thanks! $\endgroup$ – cips Mar 23 at 16:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.