The Break Which Made
By: Sid Sun
Tags: Programming, Software, Software Development

The Development of CodeMK2

While I would love to go over every line of some of the most exciting C code I have written so far, I think I’ll save it for another day and just go over the basics.

Fundamentals

As I understood it at the time the implementation of the CodeMK2 was to have a few components: getting some value from a user-provided passphrase, something to implement encoding and decoding along with helpers to decide encode or decode, file output, etc. Having no idea I was stumbling into the realm of Cryptography, I started working on how I might achieve secrecy and being the naïve programmer I was, I ended up settling with ASCII (limiting CodeMK2 to English text files) to convert chars to integers and developed equations for encoding and decoding.

Equations

The equations are based on simple mathematical operations

Encryption :

((a / PassPhrase) + ASCII) * SPP

Decryption :

(Code — (a / PassPhrase)) / SPP

Where:

a: A prime number PassPhrase: Integer derived from passphrase file SPP: Calculated from PassPhrase by running each digit through SunCode (Note that since we are only working with digits, SunCode is equivalent to BSD) and concatenating the result ASCII: The input character to be encoded Code: The encoded int to be decoded to original ASCII

The reason of SPP and PassPhrase to be different is that during the design I assumed security by obscurity approach meaning one might not know even given the equations SPP is derived from PassPhrase which would make solving the equation with two seemingly unknown variables harder. The prime number was initially supposed to be generated somehow randomly for each run but that never came to light and is unlikely to.

If you have any experience with Cryptography or Cryptanalysis you must be able to make out several flaws in the design (and how it vastly deviates from standard cyphers) and how it would fall apart quite simply and not offer much in the name of security given one has info on the algorithm but it might help to keep in mind that CodeMK2 was designed with little information and several concepts have been reinvented in the cypher.

P.S. Thanks to Chakshu Khanna a peer and a friend for pointing out during the development of the algorithm about a flaw which might have otherwise passed by unnoticed.

PassPhrase calculation and the break

The PassPhrase calculation phase of CodeMK2 follows the following order:

Read characters for passphrase from a text file and get their ASCII Calculate the total number of digits in ASCII for each character and add them Do the deduction of the ASCII in the following manner: For input: “ABCD”, the Deduction happens as: ascii(‘A’)-ascii(‘B’)-ascii(‘C’)-ascii(‘D’) To obtain PassPhrase take the absolute of output of the deduction and divide it by the count previously calculated

Notice the division.

Why the division? I figured if you could obtain the same deduction from different length inputs, that wouldn’t be ideal; this was the over-engineering break previously mentioned.

The problem is:

The division leaves behind decimals which are truncated and therefore if the input is similar, it gets the same PassPhrase which leads to the break.

The solution? Stop the division altogether or substitute with another operation. Why wasn’t it implemented? By January ’20 when I discovered the break I had a little more knowledge of Cryptography and soon after discovering the break I had an idea of using SHA for the key, and so I decided to replace the Cypher with something more standard and potentially secure leading to my research in Symmetric Cryptography for roughly 3 months resulting in the development of the above-mentioned block cypher successors.

Postface

While the above is a good account of how not to design a cypher and why not over-engineer without sufficient knowledge about the implications of the same; it is also, in my opinion, an extraordinary account of how I would consider I became a developer; the development of CodeMK2 would not only leave me with great insights and know-hows of C but also make me comfortable in working with any language provided the time. During the development of CodeMK2 I had to learn the concepts of CLI argument processing, working with files and adding additional functionalities like built-in upgrades as well as multiprocessing, piping and inline input/output the latter three, unfortunately, haven’t been introduced to the mainline branch yet and are unlikely to be. The discovery of the break also led to me studying Cryptography (which is extremely intriguing) and thereby some Mathematical concepts, how a lot of them interact, the similarities and insights into security continue to inspire and better equip me to continue undertaking interesting projects with security incorporated by default as well as understanding the practices used by various platforms for security.