1
$\begingroup$

Theoretically, is it secure to first encode a string using Base64 and then XOR it with a random key or are there potential weaknesses that could be exploited?

Obviously this doesn't make any sense in practice, but I was curious whether this would be just as secure as XORing and then Base64ing.

$\endgroup$
2
$\begingroup$

Theoretically, is it secure to first encode a string using Base64 and then XOR it with a random key or are there potential weaknesses that could be exploited?

No this is secure. It may even be slightly more secure if the encoding removes some size information.

However, XOR encryption is only secure if it closely matches a one-time pad, certainly not a many time pad; i.e. the key stream that is XOR'ed now needs to be as long as the base 64 encoded message. In the case a many-time pad is used the base 64 encoding will likely provide more information about the plaintext to the attacker.

Obviously this doesn't make any sense in practice, but I was curious whether this would be just as secure as XORing and then Base64ing.

Well, if it makes sense depends, sometimes things like XML and JSON strings need to be encrypted, and that basically means encrypting the embedded base 64 encoding (if any).

However, there is practically no reason to base 64 encode before encryption if you already have a binary message format. Besides that, you are much better off using a good AEAD scheme than some XOR based cipher, even if that resembles a one-time pad.

$\endgroup$
2
  • $\begingroup$ If a many-time pad is used, what exactly are the weaknesses? I. e. why does using one reveal more information to the attacker? $\endgroup$
    – hhhhhhhh
    Aug 13 at 9:10
  • $\begingroup$ There are many questions here about that, but this one from 2012 is probably the best starting point. $\endgroup$
    – Maarten Bodewes
    Aug 13 at 9:15
2
$\begingroup$

If you take a secret plaintext $P$ of length $n$ and a single-use key $K$, also of length $n$, which is randomly generated (in the cryptographic sense of the term), the ciphertext $C = P \oplus K$ obtained by xoring them does not reveal anything about $P$ to an adversary who does not know $K$, other than the length of $P$. As far as the adversary is concerned, $P$ could be any of the strings of length $n$.

If you first encode the plaintext in Base64 and usee a key $K'$ of length $n' = \mathsf{length}(\mathsf{Base64}(P))$, the ciphertext $C' = \mathsf{Base64}(P) \oplus K'$ does not reveal anything other than the length of $\mathsf{Base64}(P)$, which is in a one-to-one correspondence with the length of $P$. So xoring the Base64 encoding is just as good as xoring the original message.

Note that it's critical that the key is random. If the key itself is encoded in Base64, i.e. if you publish a ciphertext $\mathsf{Base64}(P) \oplus \mathsf{Base64}(K)$, this will leak quite a bit of information about the message. Xoring a random key works because for each position in the ciphertext, every character is possible for the plaintext, corresponding to every character for the key. But, for example, if a character in $\mathsf{Base64}(P) \oplus \mathsf{Base64}(K)$ has bit 0x40 set (assuming an ASCII-based encoding), there's a $52/64$ chance that the corresponding character in $\mathsf{Base64}(P)$ is one of 0123456789-/, because there's a $52/64$ chance that the corresponding character in $\mathsf{Base64}(P)$ is a letter.

While encrypting the result of Base64 encoding does not leak more information that encrypting the original message, the process of doing the Base64 encoding or decoding can leak information about the message through side channels.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.