2
$\begingroup$

My intention is not to make spam here, but I came across this project in Github: https://github.com/andrewhodel/nexor

It's an algorithm called Nexor, it promises encryption with unlimited key sizes.

The only problem is that it lacks pseudo-random permutation (PRP).

Can some advanced user or cryptanalyst tell me if it's safe?

$\endgroup$
2
  • 2
    $\begingroup$ How do you make a million bit key? I can (easily), but how does Nexor? Oh, hi. $\endgroup$
    – Paul Uszak
    Commented Dec 28, 2021 at 2:31
  • $\begingroup$ Generate a output from /dev/hwrng if your processor has a TRNG and use as a OTP. $\endgroup$ Commented Dec 29, 2021 at 0:28

1 Answer 1

10
$\begingroup$

Looking very briefly at the source, it's just using the output of /dev/urandom to generate keys, then using that as a (poor) One-Time Pad. /dev/urandom is just a ChaCha20-based RNG with some decent seeding from various hardware entropy sources.

This is not secure. The key is the same length as the plaintext, but the keystream is derived from the 512-byte internal state of ChaCha. So instead of having to transmit one message over a secure channel after using this tool you'd have to transmit two, and you're still bound by the size of the internal state of ChaCha. You could get the same security by just encrypting with ChaCha20, and could get even better security (resistance against active attacks) by encrypting with ChaCha20-Poly1305.

I recommend using age (Actually Good Encryption) for encrypting files. It's actually a good use of ChaCha20-Poly1305.

$\endgroup$
6
  • $\begingroup$ Absolutely no criticism Carl, but this forum must at some point debate at what point do you 'roll your own' encryptions vs 'standard' libraries. 'Own' are even marketed on this site. Note that there is no other field of human endeavour where everything is placed into one basket. Cui bono? $\endgroup$
    – Paul Uszak
    Commented Dec 28, 2021 at 3:10
  • 2
    $\begingroup$ I agree that rolling one's own can be valuable! It's excellent as a learning process, it's sometimes necessary for new functionality (implementing research), sometimes it's good and well done for a new library with appropriate review (like age, or monocypher, or minisign in the last few years). But this library isn't a secure stream cipher, it's not a secure OTP, and it has no advantages over a more established system. It's not even obviously a learning exercise. I think having options are good, but I also think having strong defaults among those options is good! $\endgroup$ Commented Dec 28, 2021 at 15:41
  • 1
    $\begingroup$ Also, I try to shape my answers based on the apparent experience of the questioner. For you, I certainly wouldn't need to explain why /dev/urandom isn't a source to use for a One-Time Pad, or the disadvantages of One-Time Pads: you're quite familiar with that. We may disagree about whether there's a meaningful distinction between a TRNG and a PRNG, but I suspect we both agree that a CSPRNG output stream getting XORed with the plaintext is a stream cipher, with the entropy pool (and reseeding data) as the key. $\endgroup$ Commented Dec 28, 2021 at 15:47
  • $\begingroup$ Note that this is not a real criticism of the library. Its aim is to encrypt the password on the transfer. Which has no meaning since we have TLS. $\endgroup$
    – kelalaka
    Commented Dec 28, 2021 at 15:50
  • 1
    $\begingroup$ It's not even about that, it's about the problem of transferring the key material securely. 256 bit keys will be enough for the next few billion years, even against planet-sized quantum computers. Transferring the key material of a one-time pad is exactly as hard as transferring the plaintext. If you can transfer key material ahead of time on a secure channel that will later become insecure they're useful. In most other cases they don't add any security, despite being unbreakable! (Also I don't believe TRNGs exist, but that's a metaphysical argument. HWRNGs certainly exist.) $\endgroup$ Commented Dec 30, 2021 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.