Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

What should I read to learn more about AES? #25

Open
angeloped opened this issue Dec 25, 2018 · 4 comments
Open

What should I read to learn more about AES? #25

angeloped opened this issue Dec 25, 2018 · 4 comments

Comments

@angeloped
Copy link

angeloped commented Dec 25, 2018

import pyaes, base64
from hashlib import md5

mykey="holeaaaaaaaaaaaaaaaaaaaaaaaaaa"
yourkey="holeeaaaaaaaaaaaaaaaaaaaabcaaaa"

class ENCRYPTION:
	def __init__(self,key):
		self.salt256 = "theseaissaltyb8ecbaacbd68de040cd78eb2ed5889130cceb4c49268ea4d506"
		self.aes = pyaes.AESModeOfOperationCTR(md5((self.salt256+key).encode()).hexdigest().encode("ascii"))
	def encrypt(self,data):
		return base64.b64encode(self.aes.encrypt(data))
	def decrypt(self,data):
		return self.aes.decrypt(base64.b64decode(data.encode()))

# outputs: f9mzpWBW4w==
revc = ENCRYPTION(mykey).encrypt("shining days")

# outputs: u\xd2\x913\x83dk =or= (u?3dk) when you print
revv = ENCRYPTION(yourkey).decrypt(revc)

# outputs: f9mzpWBW4w==
reve = ENCRYPTION(yourkey).encrypt(revv)

# outputs: shining days
revf = ENCRYPTION(mykey).decrypt(reve)
print(revf)

I decrypt the text then I send to the recipient.
The recipient will decrypt it with different/wrong key.
The decrypted text will be encrypted using his key.
His encrypted message will resend to me.

(since I don't have his key to decrypt his message, I will use mine)

I decrypted his encrypted message using MY KEY.
And that message was also my message to him.

I think the issue was started in line: 25

reve = ENCRYPTION(yourkey).encrypt(revv)
@cittyinthecloud
Copy link

This is perfectly normal, if you decrypt the message the message you get garbage, which when re-encrypted gets you the original encrypted message. That's called symmetric encryption.

@dancvrcek
Copy link

CTR more is a simple exor of data blocks and “encrypted key” so you can easily change order of encrypt and decrypt operations above and you always get the plaintext at the end. ;)

@ricmoo
Copy link
Owner

ricmoo commented Jun 3, 2019

Please keep in mind that AES and the common modes of operation are cryptographic primitives. They are very low level. You should not use them directly if you do not understand what they are designed for and have not researched how to correctly use them. There are many cases of improperly using them that have resulted in leaking information via side-channel attacks. At a minimum, please read the Wikipedia entries on block ciphers and the common modes of operation.

@ricmoo ricmoo changed the title Pyaes Encrypt/Decrypt Bug (Crackable?) What should I read to learn more about AES? Jun 3, 2019
@Legorooj
Copy link

Legorooj commented Jul 9, 2019

https://www.youtube.com/watch?v=NHuibtoL_qk is a great video explaining the maths behind AES.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

5 participants