Re: [Cfrg] Crystalline Cipher

[Mike Hamburg <[e-mail]>]

But you see Mark, he did break it.

This is why I wrote to you (off-list) about why cryptographers don't 
like this sort of interaction, and why I tried to brush you off 
originally.  We'll spend some effort and break your code, but you won't 
agree that it's broken and nobody will be happy.  It's just a waste of 
time all around.

We cryptographers want to build things on our ciphers, not just use them 
to send compressed files around.  To do that with confidence, the 
ciphers must be a firm foundation, not something that itself needs to be 
protected by compression or whatever your next excuse will be.  If you 
need to protect the cipher in this way, it is already broken.

-- Mike

On 5/20/2015 11:36 PM, Mark McCarron wrote:
> Hi Tony,
>
> I have examined this issue in depth.  The repeated pattern that you 
> pointed out does not lead to a break in the cipher.  That image is 
> drawn from a file filled with 0x00 which is a junk test in the context 
> of Crystalline.  Due to the way in which Crystalline encrypts, such 
> patterns are unobservable in files that contain data.  Further, that 
> pattern is the result of using a limited set of colours to represent 
> the entire range of values.  When you examine the byte stream, it is 
> chaotic and the salt/key/plaintext are mathematically unrecoverable. 
>  Basically, what you are seeing is a bias introduced by long runs of 
> the same initial value.  It is easily resolved through the use of 
> compression as can be seen in this image:
>
> http://i.imgur.com/3DLWNTc.jpg
>
> So, its a bit of a red herring in any practical sense.  Try to use it 
> to break the cipher, it doesn't work.
>
> Regards,
>
> Mark McCarron
>
>     --- Ursprüngliche Nachricht ---
>     *Von:* Tony Arcieri <[e-mail]>
>     *Datum:* 21.05.2015 02:34:45
>     *An:* Mark McCarron <[e-mail]>
>     *Betreff:* Re: [Cfrg] Crystalline Cipher
>
>     On Wed, May 20, 2015 at 3:59 PM, Mark McCarron
>     <[e-mail] <mailto:[e-mail]>> wrote:
>
>         I'm somewhat disappointed in your reply, as I presumed that
>         someone with a stated interest in ciphers would be eager to
>         investigate anything new to pop up that didn't have obvious
>         holes in it.
>
>     Hi Mark,
>     I did investigate your scheme, and I'm afraid to say it's
>     obviously broken. It appears to be an implementation of a Knuth
>     Shuffle with a few added bells and whistles.
>     This image, which I believe you produced, shows repeated patterns
>     in the ciphertext:
>     https://i.imgur.com/MWmMc0J.png
>     Likewise, there are severe failures on Chi Squared tests:
>     http://www.freecx.co.uk/cryptanalysis/Crystalline/
>     Specifically:
>     http://www.freecx.co.uk/cryptanalysis/Crystalline/bias-result_(1)_10MB.txt
>     <http://www.freecx.co.uk/cryptanalysis/Crystalline/bias-result_%281%29_10MB.txt>
>
>     Overall Chi Squared value is 7474.808 (threshold 18.4753)
>     Overall likely non-uniform (>99%)
>
>     http://www.freecx.co.uk/cryptanalysis/Crystalline/bias-result_(2)_10MB.txt
>     <http://www.freecx.co.uk/cryptanalysis/Crystalline/bias-result_%282%29_10MB.txt>
>
>     Overall Chi Squared value is 13485.34 (threshold 30.5779)
>     Overall likely non-uniform (>99%)
>
>     http://www.freecx.co.uk/cryptanalysis/Crystalline/bias-result_(4)_10MB.txt
>     <http://www.freecx.co.uk/cryptanalysis/Crystalline/bias-result_%284%29_10MB.txt>
>
>     Overall Chi Squared value is 20607.94 (threshold 52.1914)
>     Overall likely non-uniform (>99%)
>
>     http://www.freecx.co.uk/cryptanalysis/Crystalline/bias-result_(8)_10MB.txt
>     <http://www.freecx.co.uk/cryptanalysis/Crystalline/bias-result_%288%29_10MB.txt>
>
>     Overall Chi Squared value is 45699.52 (threshold 91.81917)
>     Overall likely non-uniform (>99%)
>
>     I think the biggest problem though is all of this has already been
>     pointed out to you repeatedly in other forums and you completely
>     refuse to acknowledge that your cipher fails to meet the absolute
>     most minimum criteria for a secure cipher.
>     If your cipher were secure, this image would not contain obvious
>     repeating patterns:
>     https://i.imgur.com/MWmMc0J.png
>     If your cipher were secure, it would pass all randomness tests.
>     There are many more requirements for a secure cipher, but your
>     cipher fails to meet the baseline requirements.
>     -- 
>     Tony Arcieri
>
>
> ---
> Free, fast and secure email: https://www.eclipso.eu