Write Your Own Encryption Algorithm For Fun And Laughs

Writing an industrial strength encryption algorithm is hard. However that doesn't mean it isn't a fun little exercise to try to understand some of the problems, challenges and pitfalls.

Background videos:

00:00 - Intro
02:53 - Stream vs Block Ciphers
04:32 - XOR
05:40 - Random numbers
07:17 - LFSR
17:41 - Oceantoo's LFSRs
21:19 - Seed
26:13 - Source Code
28:20 - Outro




#garyexplains

[stephenscorzo]

I really have to hand it to you. You explain the concept of cryptography brilliantly.

[EUPThatsMe]

Back in the day ('90s) I modified RC4 by changing how the S-box was initialized - normally a 256 byte array filled with bytes 0..255 - mine was seeded starting with the low byte of the CRC of the key and wrapping around e.g. 42..255, 0..41. This mod changed only the initial state and didn't affect the "randomization" and encryption portions. This provided the known security of RC4 (not much by today's standards but good enough back then) while being incompatible with standard RC4 decryption programs.

[Lampe]

I implemented a kind of random rolling XOR cipher recently, so it takes 128 bits (16 bytes) of the plaintext, generates a random 8-bit number (with Python3's built-in random.randint() function), uses the first bit of that for the direction and the other seven for the distance of the shift, applies this shift to the plaintext bits (most of the time making the data already not look like a string anymore because the bit that was at the beginning of a plaintext byte can now be for example the third one of a shifted byte) and then XORs the shifted plaintext with a 16-byte chunk of the key supplied. To be able to decrypt it it includes the 8-bit random number as a header to the cipher package. I know that the last step there makes it much easier to crack but at least it is MUCH easier to implement the decryption and a Python3-encryptor-encrypted cipher text could also be decrypted in JS. And the shifting happens before the XOR so you have to first decrypt it and can shift it to see if you decrypted it right, if you shift the encrypted data you basically unshift the plaintext but at the same time shift the key, which will not help you much in getting the original plaintext.
One thing that is more secure about this encryption is that it's harder to get the key if you know the plaintext and one corresponding cipher because the same plaintext/key combination can generate exponentially to the plaintext's length many different ciphertexts.

[wherami]

One of my fav subjects. Been thinking of this for years

[lactobacillusprime]

Actually today I woke up and had the exact same thoughts about possibly doing my own encryption algorithm. Decided against it but your video is just super freakishly coincidental.

[mSparks]

encrypt the rgb of an image and write it back out to get an idea how "random" it looks

[SanchitSnehashish]

Love it! Sharing your knowledge to others is such a nice thing to do. Keep it up, Gary 👍🏻

[mytechnotalent]

Fantastic Gary you really are a brilliant teacher.

[that_it.]

the output formula of xor gate is

[MarkKeller]

*GARY!!!*
*Good afternoon Professor!*
*Good afternoon fellow classmates!*
*Stay safe out there everyone!*

[moRaaOTAKU]

I'm early Hello Gary <3 as always amazing content.

[superslayerguy]

Gary: "Please...let me explain"
Me: "please do Gary, please do..."

[BM-jycb]

I'm going to use Base 64 to "encrypt" our data, as was confidently suggested by a manager after being told this was sufficient by a contractor.

[The.Doctor.Venkman]

We need another Voynich Manuscript - That's put the spanner in the works for centuries lol!

[SchalaArchivesish]

I think the most pathetically easy "encryption" algorithm I've seen was from some 1997-2001 software called Hotline Connect. Password "encryption" simply XOR'd each character with 255 (0xFF). Actually, there's some almost as equally old communication software that's floating around in IP purgatory that I disassembled recently, and... it has about a handful of encryption algorithms that made my head spin.

[alexandrubotan]

I have actually done it myself in order to secure my digital journal, and have a physical password stored somewhere so I don’t forget. The only problem is you can’t decrypt it as far as I know 😅.

[Chris-wflr]

that was cool and interesting but Xor is reversible, is it? I don't know much about it! but I would guess that it would be less crackable to have randomization done based on a portion of the unique hash. I mean, if you had an algorithm that repeatably randomized based on some of the digits of the hash then a computer software couldn't guess that you used Xor and reverse anything. i am not good at understanding technical language and you might have explained this already. is it the case though, that based on a hash, that you can do pretty much whatever you want with the data you are encrypting? you could for example use it to know where fake data has been inserted and how it has been randomized? I know that you said Xor is powerful but it isn't related to the unique hash at all? i don't get why it's good for this but maybe you already said and I just didn't understand. I guess i am assuming that Xor could be reversed easily if they guess you might have used Xor. oh, i get it now. that's why you do it multiple times but how do you reverse it? if it's not related to the hash? i mean... nvm. Sorry.

edit. I should just watch it again really but if, for example, a custom Xor function returned "random numbers" based on the unique hash and not just 1 or 0, then i could maybe understand it more easily but i think maybe that a lot of things in the video are just over my head. I did try to understand. Good video though. I only just learnt what Xor was a few days ago and I think it's neat and very cool.

edit. Oh and actually i found this video VERY interesting. Using a hash is a great idea! because it's always the same and cant be reversed to get the password (even if they somehow got it with some kind of exploit). Really really cool. Thanks.

edit. I can see why authentication apps need to stay in sync. They make it so someone could use your password 2 seconds after you on a different system but it wouldn't work because the unique key and the time are used to generate a unique hash like number. is it? So everytime you log in it's different or rather they have to align perfect;ly based on time and using the code in the app. They have to use time to keep the app and servers in sync i think because the code is in the app is always sending a unique hash or whatever they use to verify it's you (when you log in). meaning that if someone intercpt the unquie hash somehow bwteen you and the servers, it doesn't matter because they dont know the code in the app on the device? and it's changing all the time. But for the code to be able to be verified correctly at the other end the app and server need to be in sync is it? and it means that a man in the middle attack thing where you logged into someone else's wifi by accident while in starbucks or w/e won't let them use that information but it will you let you log in even so... cuz the time is different from when the hash/code/verification thing was created in the app. but.. actually. maybe a man in the middle attack wasnt a good example because the app and server might not be in sync on a millisecond/ultra fast level (and the codes not changing that fast) and so really they maybe could log-in if they did it very very quickly after they got the information but if your password leaked or something like that, then others wouldn't be able to use it because too much time would have passed but they could easily make it so someone can't log in twice or make it so you cant log in again until enough time has passed for the apps verification code to have changed? i guess that software could, as soon as it detects the info it thinks it wants, cut your internet in a man in the middle attack, and in theory they could then log-in themselves instead. since your input would be going through their pc first. idk.

i might try to make my own encryption thing but tbh i find javascript (the only language i know) kind of a hassle and it would be for fun cuz i'm not good at maths. But I like the idea of getting a hash (from the pass) and using that hash to inject stuff and to randomise it maybe and, but actually it sounds like a total hassle, to reduce the length of the output as much as possible so that there's less to work with for the person trying to break it and ofc it become more mysterious cuz they dunno how it has been strunk down necessarily. think on it, you can do whatever crazy sh*t you want to shrink it... shrink it and randomise... maybe after it's been randomised. but i think it's also too much hassle. Maybe it's that i am not good at javascript, i haven't been programming for long. As long as everything it does can be reversed you then you could add "random numbers" to the entire output based on the hash after having done everything else. Or use secret charatchers and mean 4 zeros. or w/e. or if you put the code in blocks (blocks of binary) and you can detect patterns, you could use symbols to represent certain patterns and then randomise them and if the "sybmols" are in number actually and not special charatchers (like a secret number code) then you could add the random numbers based on a hash to them at the end as well. based on the hash know what "pattern codes" are fake/inserted. oh and give the codes for patterns different codes based on the hash.

00100101
10010010
00110011
10001000

68 could mean 1010 if you look at it from bottom to top, going from left to right. 7 could mean :
0
0
0
0

ie. the gaps are other numbers but it tells you those ones. the order could be in by block number. 68, 7, 98, 34, 24, 5, 128- could be a block and their order could be randomized to. the block would be linear binary but viewed and treated as a square block for the sake of making the patterns code. but the secret.. could be... not telling anyone how it works in the first place. and making it weird. cuz the weirder u can make it and no one knows how it work, maybe the better. so, i would maybe, wven though it's probably sh*t, get the hash, slice up the code and reorder it based on the hash, created patterns code numbers based on the hash, but it in blocks and randomise their order based on the hash. just for fun because you and i know that maths people and professionals in this field can;t realistically be outdone by you or me messing around when we arent really willing to do all the statistics and also i am a bit of an idiot. maybe randomize the size of the blocks that the patterns are foiund in based on the hash as well, the blocks dont need to be 8 in length for that or any particular depth afaik. so long as they just go left to right, new line, left to right. or could random that, sometimes they could go right to left. or... other ways. it just needs to be understood which way from the hash isnt it? i think so. but, i am quite stupid. i mean a hash is always the same length right? so the last 2 digital could dictate whether the first half of blocks (rounded down) are reversed or whether it's alternating or whatever and idk what a hash gives you but if you want a chose "yay" or "nay" for something then you could decide by whether a certain number is odd or even to make that kind of choice i guess, or whatever., by whatever system you can come up with isnt it? maybe the patterns idea isnt the best but if they were pattern dictated by the hash and theirs njumber codes also (indepently) then.. idk. i really dont know if that's a terrible idea or not. if they were always tghe same length you could have a nicer output like 6701078028 rather than needing and breaks like ", " or "-". and if their length was decided by the hash then the output could be one long number and length of each "block" : unknown. some blocks in reverser 001 instead of 100, inserted blocks, the block that are out of order, maybe the code intially as well. all going by certain numbers in the hash. or maybe that's just the same as randomizing it? maybe all these things are the same as just using one good way to randomize it and maybe that's eactly what you did. but i just dont undertand how you did it with Xor since it's not related to the hash? or is it in your implementation? what i mean is... do you need the hash to reverse your Xor'ing when you decrypt it? i guess so. i just didnt get it.

[DAVIDGREGORYKERR]

Double hashing using SHA512(unsigned long long int *inblock, unsigned long long int *outblock);

[myentertainment]

Wrote my own encription algorithm for fun and laughts😊
Got immediatly hacked😅

[albinjt]

YT sucks, why didn't I get this video notified ?