Polyalphabetic encryption for Passwords

[Jeremy Deuel]

Just an Idea:
In PHP, passwords for different purposes often are stored plaintext in
the source. I often wondered, how this could be prevented.

So if you have a web-project, that is access-restricted, try the
following workaround:

include this snippet into your web-project:

function polyalph_encryp t($original, $key = FALSE) {
if (!$key) $key = $_SESSION["passphrase "]; // The access-key
//Make the key longer, if needed
$i = round( strlen($origina l)/strlen($key) );
for ($j=0;$j<$i;$j+ +)
$key .= $key;
$result = "";
for ($i = 0; $i < strlen($origina l); $i++) {
$sigma = 94 + ord( $original{$i} ) + ord( $key{$i} ) - 64;
$result .= chr ( fmod ( $sigma, 94 ) + 32 );
}
return $result;
}

function polyalph_decryp t($secret, $key = FALSE) {
if (!$key) $key = $_SESSION["passphrase "]; // The access-key
//Make the key longer if needed
$i = round( strlen($secret)/strlen($key) );
for ($j=0;$j<$i;$j+ +)
$key .= $key;
$result = "";
for ($i = 0; $i < strlen($secret; $i++) {
$sigma = 94 + ord( $secret{$i} ) - ord ( $key{$i} );
$result .= chr ( fmod ( $sigma, 94 ) + 32 );
}
return $result;
}

Of course, this will only function with ascii-passwords, but for most of
us, this should be enough. So with this trick, the encrypted passwords
can only be successfully decrypted, if the user enters the right
master-password (= Access-password).

Well, it is a little tricky and not 100% safe (as everything is):
- It wouldn't be a good idea to check the validity of the
access-password in plaintext. Instead try the following:
if ($_POST["user"] == "YOURUSERNA ME" && sha1($_POST["password"]) ==
"YOUR SHA1-HASHED PASSWORD")
$_SESSION["passphrase "] = $_POST["password"]
- of course this is only half-way safe if you have all more or less
"random" passwords.
- And in the end it can only prevent foolish webmasters from spying out
your database-passwords. But of course, the master-password is stored in
plaintext in the $_SESSION variable and this means it is also avaible in
plaintext somewhere on the computer.

jeremy

[Sjoerd]

Re: Polyalphabetic encryption for Passwords

Jeremy Deuel wrote:[color=blue]
> Just an Idea:
> In PHP, passwords for different purposes often are stored plaintext in
> the source. I often wondered, how this could be prevented.[/color]

Nice functions, and not that simple to decrypt.

People already thought about this, and came up with the following:
XOR "encryption ": A bitwise XOR (exclusive or, ^ operator) is done for
every character of the string. The key is repeated, as in your example.
The advantage is that encryption and decryption uses the same function:
Doing a XOR on a string twice will result in the original string.
ROT-13: Rotate the alphabet with 13 positions: A becomes N, B becomes
O, etc. Because there are 26 letters in the alphabet, doing a ROT-13
twice will result in the original string.

Also take a look at str_repeat(), which can repeat the key so that it
is long enough. You can use the % operator instead of fmod().

[Jeremy Deuel]

Re: Polyalphabetic encryption for Passwords

In article <1140181912.627 470.148460@g43g 2000cwa.googleg roups.com>,
"Sjoerd" <sjoerder@gmail .com> wrote:
[color=blue]
> Jeremy Deuel wrote:[color=green]
> > Just an Idea:
> > In PHP, passwords for different purposes often are stored plaintext in
> > the source. I often wondered, how this could be prevented.[/color]
>
> Nice functions, and not that simple to decrypt.
>
> People already thought about this, and came up with the following:
> XOR "encryption ": A bitwise XOR (exclusive or, ^ operator) is done for
> every character of the string. The key is repeated, as in your example.
> The advantage is that encryption and decryption uses the same function:
> Doing a XOR on a string twice will result in the original string.
> ROT-13: Rotate the alphabet with 13 positions: A becomes N, B becomes
> O, etc. Because there are 26 letters in the alphabet, doing a ROT-13
> twice will result in the original string.
>
> Also take a look at str_repeat(), which can repeat the key so that it
> is long enough. You can use the % operator instead of fmod().[/color]

Thanks for str_repeat and the % operator. I didn't know them yet..

ROT-13 is not thaaaaaat safe... ;)
XOR would be very interesting, like this one could implement the
vernam-algorithm. How do I implement bitwise operations in PHP?

[Colin McKinnon]

Re: Polyalphabetic encryption for Passwords

Jeremy Deuel wrote:
[color=blue]
> Just an Idea:
> In PHP, passwords for different purposes often are stored plaintext in
> the source. I often wondered, how this could be prevented.
>
> So if you have a web-project, that is access-restricted, try the
> following workaround:
>[/color]
<snip>

So:
ResourcePasswor ds = f(publicdata, MasterPassword)
publicdata = f'(ResourcePass words, MasterPassword)
[color=blue]
> Of course, this will only function with ascii-passwords, but for most of
> us, this should be enough. So with this trick, the encrypted passwords
> can only be successfully decrypted, if the user enters the right
> master-password (= Access-password).
>[/color]

Having a single password shared by multiple users is not exactly great
security on a multi-user system. While this system could be used on a
per-UserPassword basis to encrypt a single MasterPassword (which itself
encrypts multiple ResourcePasswor ds),

MasterPassword = f(publicdata[user], UserPassword[user])
publicdata[user] = f'(MasterPasswo rd , UserPassword[user])

subsequently changing the MasterPassword would be virtually impossible
without access to the unencrypted/hashed UserPasswords - another security
flaw.

But if you could use assymetric encryption to distribute the MasterPasswords
with the UserPasswords acting as passphrases to the UserPrivateKey, you
could leave the user key pair lying around on the server disk and you'd
then have a *secure* and *manageable* solution.

publicdata[user] = g'(MasterPasswo rd, UserPublicKey[user])
MasterPassword = g(publicdata[user], UserPrivateKey[user],
UserPassword[user])

C.