The Daily WTF: Curious Perversions in Information Technology

2011-07-25 Reply Admin

germaican:
I think there are really very few names which originate in the US, the nation, that has no laws to prevent parents from giving stupid names to kids. You could name your kids "Doorknob" and "toilette paper". I don't think there is any other Nation so FREE in this regard.

Really? I'm sure that there are some nations that have laws about what you can call your kids. But I'd guess (admittedly, without any hard facts at my fingertips) that there are more that don't.

2011-07-25 Reply Admin

hoodaticus:
Those who live in glass houses...:
boog:
Those who live in glass houses...:
boog:
C-Octothorpe:
boog:
C-Octothorpe:
Encryption is NOT Encoding
You've got that backwards. Your link even says so in the first section:
Strictly speaking, encryption is an encoding operation...
I realized that after I posted. I was simply saying that in the context of IT security, they *should* be treated as completely different things, even though there is some overlap between the two.
What? And miss out on all the entertainment of people confusing the two terms?
Gah! What confusion? Does the word "synonym" mean anything to you?!?!
You're funny, but the people who really do think that encrypt and encode are mutual synonyms are way funnier.
I wish all you ivory tower wannabes would get off your high horses. Base-64 is encryption! Do you even know what encryption means? It means "to put in a code". Base-64 is a code. Now STFU.
No, that's what encoding means. En-cod[e]-ing. En-crypt-ing means to make cryptic.

http://www.merriam-webster.com/dictionary/code

Most applicable definition in this case is "a system of symbols (as letters or numbers) used to represent assigned and often secret meanings" I assume all of you are native English speakers? Possibly not, I suppose.

2011-07-25 Reply Admin

[quote user="C-Octothorpe]I get that, but I think if he meant one-way encrypt, he would've used the word hash...

At least that's how I read his post.[/quote]

Ahh, I see your point.

EvanED · 2011-07-25 Reply Admin

mah bonez:
The [lack of] quality of an encryption scheme does not determine whether or not it is an encryption scheme;

My problem with this is if you bring intent into the picture, if you want to be pedantic (and who doesn't!) I would argue that there's no such thing as an "encryption scheme" -- only an encoding scheme that, at the moment, happens to be being used for encryption.

2011-07-25 Reply Admin

EvanED:
Anon:
EvanED:
I agree in the sense that there is a very different connotation to each. I disagree in the sense that I think it would be quite hard to come up with a definition that draws a sharp line between the two (or separating out a subset of encodings as "not encryption")

No, it's very easy to come up with a sharp line. If some data is transformed into some other form with the purpose of hiding it, then it's encryption. If data is transformed for the purpose of transporting or storing it, it's encoding. Whether or not an encryption is strong or not is beside the point. Sometimes you might do both to the same set of data.

XML, ASCII, Unicode are encodings. They are designed for ease and efficiency of storage and transmission of information.

RSA is encryption, regardless of whether or not it's breakable. Nobody would use RSA just for transporting or storing data unless they also intended to hide it from prying eyes.
I don't think I agree. I, for one, always encrypt data with the goal of being able to view it later.

What's that got to do with anything. I didn't say anything about not viewing data. Stop making strawmen.

2011-07-25 Reply Admin

EvanED:
My problem with this is if you bring intent into the picture, if you want to be pedantic (and who doesn't!) I would argue that there's no such thing as an "encryption scheme" -- only an encoding scheme that, at the moment, happens to be being used for encryption.

Agreed, but that is the crux of distinction between the two when you get at it.

2011-07-25 Reply Admin

EvanED:
The first reason is that it removes the property of "being encryption" from the actual algorithm, and places it on the person doing the encoding. Is base64 encryption or mere encoding? In some cases it's definitely the latter, because you want to transfer some binary information over a channel that doesn't support it. But now if someone else comes along and says "oh, base64 is hard to understand" (they're bad at crypto) and code data in it because they think it'll keep it out of prying eyes, suddenly base64 is encryption?

No. You are looking at the wrong person for intent. The intent is with the person who designed the algorithm, not the person using it. ASCII, XML and base64 are designed to be encodings. RSA is design to encyption.

If a particular user uses it wrong, that doesn't change the status of the tool, anymore than somebody using a shoe to drive in a nail suddenly makes the shoe a hammer.

2011-07-25 Reply Admin

Mason Wheeler:
The true requirement for cryptography is that a person possessing the algorithm but not the key cannot read the message.
There is no key in Base64 encoding, only an algorithm, so it does not qualify as encryption, oversimplified definitions in some dictionary notwithstanding.

I would argue that Base64 qualifies as having a key, albeit a widely known one. If you don't have the index table, Base64 is unreadable. If someone changes the table (without changing the algorithm), the message is unreadable.

As for code vs cypher, the explanation I was told growing up is that codes work with concepts, cyphers work with letters.

EvanED · 2011-07-25 Reply Admin

EvanED:
I don't think I agree. I, for one, always encrypt data with the goal of being able to view it later.

I just noticed this, but to whomever posted this: you, sir (or ma'am), are kind of a dick.

(It wasn't me. Take a look back; the poster shows up as "EvanED (unregistered)".)

2011-07-25 Reply Admin

Tarmil:
Well, if a Base64 implementation is worth $64k, you should definitely buy my Base128 implementation. Guess the price.

US$3?

2011-07-25 Reply Admin

Because no one name Thijs would ever immigrate to the US or come here to work on a visa?? Or be born here of foreign parents [perhaps he is Thijs Jr.]?? he asked??

2011-07-25 Reply Admin

C-Octothorpe:
Hortical:
C-Octothorpe:
Most likely during development they realized that truly encrypting the config section(s) wreaked havoc with the rest of the app, or caused some bad performance issues and at the last minute they decided to simply encode it (they would have to anyway for it to live happily in XML)...

Couldn't they just base64 the encrypted xml?

Double plus fun.
Then hash it... I'd like to see them brute force that. Of course this could affect application performance, but I'm willing to take that hit.

Yah...one-way processes are great ways to encrypt stuff...

2011-07-25 Reply Admin

C-Octothorpe:
hoodaticus:
If their config files are so important to keep away from the client, then why didn't they do that, replacing the file load with a webservice call?
Because that just obscures it. If they're determined enough, they can simply sniff the connection and intercept it... If you really want to lock the user out, I think the best approach would be to perform some sort of checksum or hash and have it call home on startup to verify (send back a public key encrypted response so they can't intercept and modify). No encryption needed, just check the integrity of the data, and bomb out badly when they try to make their own changes.

Uhm. Maybe you not be 'xplaining urself so good....

2011-07-25 Reply Admin

C-Octothorpe:
Those who live in glass houses...:
Some Dude:
Base64 is encoding not encryption. Do you even know what Base64 is?

GIYF: http://www.merriam-webster.com/dictionary/encrypt def 2: ENCODE

How does your foot taste?
Wow, to see this level of misguided and uninformed pedantry is just, um, impressive... And the guy he was replying to isn't much better.

Here is a hint: encoding != encrypting

Or if you want to continue being loud and ignorant, let me put it this way: how secure would you feel while doing some online banking that the connection between your browser and the banks servers was simply encoded (because it's the same thing, dontcha know)...

I agree. Putting petrol in the bonfire is so helpful at extinguishing it.

2011-07-25 Reply Admin

Mason Wheeler:
Those who live in glass houses...:
I wish all you ivory tower wannabes would get off your high horses. Base-64 is encryption! Do you even know what encryption means? It means to put in a code. Base-64 is a code. Now STFU.

From Wikipedia:

In cryptography, encryption is the process of transforming information (referred to as plaintext) using an algorithm (called cipher) to make it unreadable to anyone except those possessing special knowledge, usually referred to as a key.

See also Kerckhoffs's Principle, which explains that the key is the essential part of a cryptosystem. The true requirement for cryptography is that a person possessing the algorithm but not the key cannot read the message.

There is no key in Base64 encoding, only an algorithm, so it does not qualify as encryption, oversimplified definitions in some dictionary notwithstanding.

You could argue the algorithm involves a key. While I tend to agree that we're talking encoding not encryption, I think it's a very fine line. How, for example, does base64 encoding differ to base 32 encoding? Is the algorithm any different, or just some values (keys) within the algorithm?

Incidentally, I suspect Zuenis may have contributed to the Base64 page on wikipedia...

wikipedia:
Input ends with: any carnal pleasure. Output ends with: YW55IGNhcm5hbCBwbGVhc3VyZS4= Input ends with: any carnal pleasure Output ends with: YW55IGNhcm5hbCBwbGVhc3VyZQ== Input ends with: any carnal pleasur Output ends with: YW55IGNhcm5hbCBwbGVhc3Vy Input ends with: any carnal pleasu Output ends with: YW55IGNhcm5hbCBwbGVhc3U= Input ends with: any carnal pleas Output ends with: YW55IGNhcm5hbCBwbGVhcw==

2011-07-25 Reply Admin

ac:
Mason Wheeler:
Those who live in glass houses...:
I wish all you ivory tower wannabes would get off your high horses. Base-64 is encryption! Do you even know what encryption means? It means to put in a code. Base-64 is a code. Now STFU.

From Wikipedia:

In cryptography, encryption is the process of transforming information (referred to as plaintext) using an algorithm (called cipher) to make it unreadable to anyone except those possessing special knowledge, usually referred to as a key.

See also Kerckhoffs's Principle, which explains that the key is the essential part of a cryptosystem. The true requirement for cryptography is that a person possessing the algorithm but not the key cannot read the message.

There is no key in Base64 encoding, only an algorithm, so it does not qualify as encryption, oversimplified definitions in some dictionary notwithstanding.

Also from Wikipedia (http://en.wikipedia.org/wiki/Caesar_cipher):

In cryptography, a Caesar cipher, also known as a Caesar's cipher, the shift cipher, Caesar's code or Caesar shift, is one of the simplest and most widely known encryption techniques. It is a type of substitution cipher ...

and (http://en.wikipedia.org/wiki/Substitution_cipher):

In cryptography, a substitution cipher is a method of encryption by which ... ROT13 is an example of the Caesar cipher, developed in ancient Rome.

ROT13 is clearly only an algorithm by your definition, since it only uses a key. Yet, by the same reference you cited, it is also called "encryption".

Maybe in those days, since nobody knew about this technique, knowing the algorithm was the key. This might still apply with Base64 for the average computer user.

Rot13 is a modified Caeser Cipher with a key of 13... Base64 encoding also has a key - in fact, it is difficult to encode anything without a key - we would simply be making arbitrary changes. The notion that the presence of a key (vs an algorithm) distinguishes between a cipher and a code is flawed, in that the algorithm defines the method to uncover the code. That is, the algorithm IS the key.

Many moons ago, when I studied a course in "Coding and Cryptology", I was taught (and I'm not claiming this is entirely true either) that the difference was that the aim of Coding was to decrease probability of error in data transmission, while the aim of encryption was to hide data. Based on this definition, and Wikipedia's thoughts on Base64:

wikipedia:
...to ensure that the data remains intact without modification during transport...

Base64 is encoding, not encryption.

I still maintain, however, that there is a key...

2011-07-25 Reply Admin

Because he's an idiot. "==" at the end says "base64" loud and clear.

2011-07-25 Reply Admin

C-Octothorpe:
Anon:
C-Octothorpe:
EvanED:
Anon:
Then I *really* don't want to sign up to any highish profile websites that you designed the authentication mechanism for. Passwords are meant to be encrypted 1-way.
Now this I rather disagree with: encryption is basically by definition intended to be two-way.
I think he was making a joke that you encrypt once, and decrypt once...

Not at all, if you can do that you are violating CWE-257: http://cwe.mitre.org/data/definitions/257.html

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
Potential Mitigations Use strong, non-reversible encryption to protect stored passwords.

Other Notes The use of recoverable passwords significantly increases the chance that passwords will be used maliciously. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plain-text passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders.

I get that, but I think if he meant one-way encrypt, he would've used the word hash...
At least that's how I read his post.

i like hash. crab hash, that's the best. corned beef is good but more greasy.

i know that is pretty lame, albeit delicious, but sometimes you just hash to say it.

CAPTCHA TEST - haero: haero to all my friends in Tokyo !

There, that proves I'm not a robot. My wife has been wondering for some time.

2011-07-25 Reply Admin

Hortical:
C-Octothorpe:
Encryption is NOT Encoding[/url] Mariam Websters perhaps defines them as interchangeable terms, however in the context of computer science and cryptography specifically (which is what we're talking about, so get over it), they are wholly different things.

I'd put it this way:

Encryption might be considered a form of Encoding

...If we consider Encoding to mean moving data from one representation to another. Encryption in particular is then a way of encoding data such that it will be sufficiently difficult to decode. Decoding may be greatly facilitated by a key, it might even absolutely require it to make sure the data has been properly decoded.

A given Encoding is not necessarily a form of Encryption

Because encoding is just changing how we represent data. When I convert from Unicode to ASCII, is that encryption? What about when I make a ZIP archive? Or convert from one lossless image/audio format to another? Encryption? Really?

You could argue, if you wish, that the use of base64 here is encryption, just a really poor one. That discussion would end up mirroring "(Art/Not Art) vs (Good Art/Bad Art)".

Ladies and Gentlemen, I think we have a winner!

Encoding is about representation. Encryption is about Secrecy. There is some overlap, Encryption is a form of Encoding, but Encoding is NOT encryption.

The definitions are unrelated. The problem is when people start insisting that things are one or the other, that is, that we can never be both.

Let's assert that apples are a food. Does this mean that apples are not fruit? I always thought apples were fruit. Does the assertion that they are in fact food have any influence on my original supposition that they were fruit? Does this mean all food is fruit? No, a fruit is a (reasonably specific) type of food.

Let's assert that cryptograms are codes. Does this mean that cryptograms are not ciphers? I always thought cryptograms were ciphers. Does the assertion that they are in fact codes have any bearing on my original supposition that they were ciphers? Does this mean all codes are cipher? No, a cipher is a (fairly specific) form of code.

ingenium: It requried his full ingenium to come up with an analogy like that

2011-07-25 Reply Admin

History Lesson:
The Pope:
Galileo:
The Earth doth circle the Sun, and not t'other way 'round.
I was right about the level of pedantry today... :)
FTFY

Thanks for the laughs there, chief!

dohpaz42 · 2011-07-25 Reply Admin

EvanED:
C-Octothorpe:
Mariam Websters perhaps defines them as interchangeable terms, however in the context of computer science and cryptography specifically (which is what we're talking about, so get over it), they are wholly different things.
I sort of agree and sort of disagree. I agree in the sense that there is a very different connotation to each. I disagree in the sense that I think it would be quite hard to come up with a definition that draws a sharp line between the two (or separating out a subset of encodings as "not encryption").
This goes doubly so if you want to make the classification of something invariant with time. I think it's pretty clear that RSA would be encryption now. Does it become a mere encoding if quantum computers become commonplace and inverting RSA keys becomes trivial?

Encryption is a way to transform data, while ensuring confidentiality, integrity, and availability (CIA Triad). Encrypted data is confidential because only the parties that have the appropriate key can read the data. You can also use the key to verify the integrity of the data; in lamen's terms: if the data was altered during transmission, the data could not be decrypted back into the original plaintext. For the intended parties to be able to decrypt the data, all parts (the encrypted data and the key) must be available to only the parties that require it.

Encoding is a way to transform data, but does not guarantee the CIA triad. ROT13 and Base64 are two ways to encode data; these algorithms are not encryption because anybody can decode the data without having to have a special key to do so. Therefore, the data could be altered between the source and the destination, and the decoding party would have no viable means of knowing.

Come on people, this is all utterly basic CS 101 stuff here. I'm disgusted by this community's lack of understanding of two basic concepts.

2011-07-25 Reply Admin

Anon:
VGhpcyB0ZXh0IElTIE5PVCBFTkNSWVBURUQuICBJZiBpdCB3ZXJlLCB5b3Ug d291bGQgYmUgdW5hYmxlIHRvIGRlY2lwaGVyIGl0IHdpdGhvdXQgJ3NwZWNp YWwga25vd2xlZGdlJyAobGlrZSBhIGtleSkgYXMgZGVmaW5lZCBoZXJlOiAg aHR0cDovL2VuLndpa2lwZWRpYS5vcmcvd2lraS9FbmNyeXB0aW9uICBJZiB5 b3UgdGFrZSB0aGUga25vd2xlZGdlIG9mIGRlY3J5cHRpbmcgYmFzZTY0IGFz IHRoaXMgJ3NwZWNpYWwga25vd2xlZGdlJywgdGhlbiBieSB0aGF0IGxvZ2lj IHRoZSBlbmdsaXNoIGxhbmd1YWdlIGl0c2VsZiBpcyBhbiBlbmNyeXB0aW9u IGJlY2F1c2Ugb25seSBwZW9wbGUgd2l0aCAnc3BlY2lhbCBrbm93bGVkZ2Un ICh0aG9zZSB3aG8gdW5kZXJzdGFuZCBlbmdsaXNoIGNoYXJhY3RlciBnbHlw aHMsIHRoZWlyIG1lYW5pbmdzLCBhbmQgdGhlIGFiaWxpdHkgdG8gZm9ybSB0 aG91Z2h0cyBhbmQgaWRlYXMgdXNpbmcgdGhlIGVuZ2xpc2ggZW5jcnlwdGlv biBhbGdvcml0aG0pIGNhbiB1c2UgaXQgb3IgZGVjaXBoZXIgaXQu

RGVjaXBoZXIgaXQgdG8gd2hhdD8=

2011-07-25 Reply Admin

boog:
C-Octothorpe:
Anon:
VGhpcyB0ZXh0IElTIE5PVCBFTkNSWVBURUQuICBJZiBpdCB3ZXJlLCB5b3Ug d291bGQgYmUgdW5hYmxlIHRvIGRlY2lwaGVyIGl0IHdpdGhvdXQgJ3NwZWNp YWwga25vd2xlZGdlJyAobGlrZSBhIGtleSkgYXMgZGVmaW5lZCBoZXJlOiAg aHR0cDovL2VuLndpa2lwZWRpYS5vcmcvd2lraS9FbmNyeXB0aW9uICBJZiB5 b3UgdGFrZSB0aGUga25vd2xlZGdlIG9mIGRlY3J5cHRpbmcgYmFzZTY0IGFz IHRoaXMgJ3NwZWNpYWwga25vd2xlZGdlJywgdGhlbiBieSB0aGF0IGxvZ2lj IHRoZSBlbmdsaXNoIGxhbmd1YWdlIGl0c2VsZiBpcyBhbiBlbmNyeXB0aW9u IGJlY2F1c2Ugb25seSBwZW9wbGUgd2l0aCAnc3BlY2lhbCBrbm93bGVkZ2Un ICh0aG9zZSB3aG8gdW5kZXJzdGFuZCBlbmdsaXNoIGNoYXJhY3RlciBnbHlw aHMsIHRoZWlyIG1lYW5pbmdzLCBhbmQgdGhlIGFiaWxpdHkgdG8gZm9ybSB0 aG91Z2h0cyBhbmQgaWRlYXMgdXNpbmcgdGhlIGVuZ2xpc2ggZW5jcnlwdGlv biBhbGdvcml0aG0pIGNhbiB1c2UgaXQgb3IgZGVjaXBoZXIgaXQu
T3IsIGZvciB0aGF0IG1hdHRlciwgdXNpbmcgYSBkb29yLi4uICBXaXRob 3V0IGtub3dpbmcgaG93IHRvIHR1cm4gYSBkb29yIGtub2IsIHRoZSBkb2 9yIGlzIGVmZmVjdGl2ZWx5IGxvY2tlZC4=
T2YgY291cnNlLCBkb29ycyBhcmUgYmFkIGFuYWxvZ2llcyBmb3Igc2VjdXJpdHkuICBXaGV0aGVy IHRoZSBkb29yIGlzIGxvY2tlZCwgb3IgSSBkb24ndCBrbm93IGhvdyB0byBvcGVuIGl0LCB3aXRo IHRoZSByaWdodCB0b29scyBJIGNhbiBhbHdheXMgYnJ1dGUgZm9yY2UgbXkgd2F5IHRocm91Z2gu Cg==

Perhaps that's the exact point. Cryptography can be the same. Whether something is encrypted, or you don't know how to decrypt it with the right tools you can often brute force through (and I think 'always' for doors would apply as much as it would here....The doors to some safes might pose more problems than a door on a house, equally, the RSA algorithm might cause you a few more headaches than a simple vignere cipher. Of course, a one-time pad would be impossible without the key....)

2011-07-25 Reply Admin

Brent:
Anon:
VGhpcyB0ZXh0IElTIE5PVCBFTkNSWVBURUQuICBJZiBpdCB3ZXJlLCB5b3Ug d291bGQgYmUgdW5hYmxlIHRvIGRlY2lwaGVyIGl0IHdpdGhvdXQgJ3NwZWNp YWwga25vd2xlZGdlJyAobGlrZSBhIGtleSkgYXMgZGVmaW5lZCBoZXJlOiAg aHR0cDovL2VuLndpa2lwZWRpYS5vcmcvd2lraS9FbmNyeXB0aW9uICBJZiB5 b3UgdGFrZSB0aGUga25vd2xlZGdlIG9mIGRlY3J5cHRpbmcgYmFzZTY0IGFz IHRoaXMgJ3NwZWNpYWwga25vd2xlZGdlJywgdGhlbiBieSB0aGF0IGxvZ2lj IHRoZSBlbmdsaXNoIGxhbmd1YWdlIGl0c2VsZiBpcyBhbiBlbmNyeXB0aW9u IGJlY2F1c2Ugb25seSBwZW9wbGUgd2l0aCAnc3BlY2lhbCBrbm93bGVkZ2Un ICh0aG9zZSB3aG8gdW5kZXJzdGFuZCBlbmdsaXNoIGNoYXJhY3RlciBnbHlw aHMsIHRoZWlyIG1lYW5pbmdzLCBhbmQgdGhlIGFiaWxpdHkgdG8gZm9ybSB0 aG91Z2h0cyBhbmQgaWRlYXMgdXNpbmcgdGhlIGVuZ2xpc2ggZW5jcnlwdGlv biBhbGdvcml0aG0pIGNhbiB1c2UgaXQgb3IgZGVjaXBoZXIgaXQu

Here's the key I used to "decrypt" this: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/

Yes, that's a pretty insecure key because it's stupid simple and the MIME default, but it is still technically a key... the algorithm involved is actually used with many other keys, often it's just a change to the last two characters (eg base64 for filenames and URLs would be complicated by '/'), but using the ASCII characters, in order, from 32-95 used to be the previous default (aka uuencode).

Which isn't to say that I think that base64 is encryption... but there is a matter of intent. Normally base64 is intended to encode binary data as printable plain text, but if you have intent to obscure the data, it may be said to be "encryption" of a sort in that particular case.

I'd take it a step further, and say the key here is (6,8)...

2011-07-25 Reply Admin

C-Octothorpe:
EvanED:
Anon:
Then I *really* don't want to sign up to any highish profile websites that you designed the authentication mechanism for. Passwords are meant to be encrypted 1-way.
Now this I rather disagree with: encryption is basically by definition intended to be two-way.
I think he was making a joke that you encrypt once, and decrypt once...

Passwords can be salted and hashed (yum). Why do we need to encrypt them?

2011-07-25 Reply Admin

M.Funkibut:
Because no one name Thijs would ever immigrate to the US or come here to work on a visa?? Or be born here of foreign parents [perhaps he is Thijs Jr.]?? he asked??

Whatever - he needs to change his name. Through the article (and now the comments) I keep reading "This"

2011-07-25 Reply Admin

The table used in base64 is part of the algorithm, therefore it's not encryption. Could you write an algorithm based on base64 which used any combination of 64 characters, making it encryption? Sure. But that wouldn't be base64, just something based on it.

2011-07-25 Reply Admin

dohpaz42:
EvanED:
C-Octothorpe:
Mariam Websters perhaps defines them as interchangeable terms, however in the context of computer science and cryptography specifically (which is what we're talking about, so get over it), they are wholly different things.
I sort of agree and sort of disagree. I agree in the sense that there is a very different connotation to each. I disagree in the sense that I think it would be quite hard to come up with a definition that draws a sharp line between the two (or separating out a subset of encodings as "not encryption").
This goes doubly so if you want to make the classification of something invariant with time. I think it's pretty clear that RSA would be encryption now. Does it become a mere encoding if quantum computers become commonplace and inverting RSA keys becomes trivial?

Encryption is a way to transform data, while ensuring confidentiality, integrity, and availability (CIA Triad). Encrypted data is confidential because only the parties that have the appropriate key can read the data. You can also use the key to verify the integrity of the data; in lamen's terms: if the data was altered during transmission, the data could not be decrypted back into the original plaintext. For the intended parties to be able to decrypt the data, all parts (the encrypted data and the key) must be available to only the parties that require it.

Encoding is a way to transform data, but does not guarantee the CIA triad. ROT13 and Base64 are two ways to encode data; these algorithms are not encryption because anybody can decode the data without having to have a special key to do so. Therefore, the data could be altered between the source and the destination, and the decoding party would have no viable means of knowing.

Come on people, this is all utterly basic CS 101 stuff here. I'm disgusted by this community's lack of understanding of two basic concepts.

Rot13 has a special key: 13 - it just happens to be well known (some have argued similar for Base64 encoding, but I'm on the fence with that one).

The bit people don't seem to be able to grasp is that encryption and encoding are not mutually exclusive, in fact, all encryption is a form of code. I think you could even argue that the concepts are very different. That coding refers very much to the technical effort, and encryption refers more to the intent. If the intent is to hide data, then we have to consider it encryption.

Mary, Queen of Scots encrypted messages she sent to her supporters. These messages were intercepted and decrypted. These messages used a Substitution Cipher (a variation on the Caeser Cipher from which ROT13 derives - instead of a shifting a certain gap, each letter maps to another predefined letter). (See also: Mary Queen of Scots; Babbington Plot).

Question for the wise:

This cipher was trivially broken. Does this mean it's not encryption?
This cipher is well known these days. Does this mean it's no longer in the realms cryptography?
ROT13, the Caeser Cipher are simplifications of this form while the Vignere Cipher (and inddeed, the one-time pad) are extensions of this Cipher. Which of these could be considered encryption?
If for any of these examples you said it's not encryption, when did it cease to be?

2011-07-25 Reply Admin

AP²:
The table used in base64 is *part of the algorithm*, therefore it's not encryption. Could you write an algorithm based on base64 which used any combination of 64 characters, making it encryption? Sure. But that wouldn't be base64, just something based on it.

And the method has us chopping 8 bit strings into 6 bit strings. What if we chopped 8 bit strings into strings of length 5 or 6? What if we chopped 10 bit strings into 8? Can you see how these magic numbers 8 and 6 are a bit like having a key?

2011-07-25 Reply Admin

Those who live in glass houses...:
hoodaticus:
Those who live in glass houses...:
boog:
Those who live in glass houses...:
boog:
C-Octothorpe:
boog:
C-Octothorpe:
Encryption is NOT Encoding
You've got that backwards. Your link even says so in the first section:
Strictly speaking, encryption is an encoding operation...
I realized that after I posted. I was simply saying that in the context of IT security, they *should* be treated as completely different things, even though there is some overlap between the two.
What? And miss out on all the entertainment of people confusing the two terms?
Gah! What confusion? Does the word "synonym" mean anything to you?!?!
You're funny, but the people who really do think that encrypt and encode are mutual synonyms are way funnier.
I wish all you ivory tower wannabes would get off your high horses. Base-64 is encryption! Do you even know what encryption means? It means "to put in a code". Base-64 is a code. Now STFU.
No, that's what encoding means. En-cod[e]-ing. En-crypt-ing means to make cryptic.
http://www.merriam-webster.com/dictionary/code
Most applicable definition in this case is "a system of symbols (as letters or numbers) used to represent assigned and often secret meanings" I assume all of you are native English speakers? Possibly not, I suppose.

[image]

excession · 2011-07-25 Reply Admin

Back in the BBS/Fidonet days, our illustrious 'sysop' attempted to gloat about the in-built "super secure" sysop-only communications available in the BBS software he had acquired.

A few minutes with the encrypted message he included, showed that it was simple ROT15. :rolleyes:. (not ROT13, that would have been just too easy). He also wrote threats of 'suing' me for releasing private internals of software ... the same guy tried to disbar me from the BBS for telling him to 'go stick your head in a pig'.

True Confessions: I've coded a C++ Base64 implementation that's -still- in production use :/ Please don't ask "why?".

2011-07-25 Reply Admin

dohpaz42:
Come on people, this is all utterly basic CS 101 stuff here. I'm disgusted by this community's lack of understanding of two basic concepts.

I think people understand that RSA != base64, it's just a question of drawing the line between [Not Encryption] and [Poor Encryption].

hoodaticus · 2011-07-25 Reply Admin

Those who live in glass houses...:
hoodaticus:
Those who live in glass houses...:
boog:
Those who live in glass houses...:
boog:
C-Octothorpe:
boog:
C-Octothorpe:
Encryption is NOT Encoding
You've got that backwards. Your link even says so in the first section:
Strictly speaking, encryption is an encoding operation...
I realized that after I posted. I was simply saying that in the context of IT security, they *should* be treated as completely different things, even though there is some overlap between the two.
What? And miss out on all the entertainment of people confusing the two terms?
Gah! What confusion? Does the word "synonym" mean anything to you?!?!
You're funny, but the people who really do think that encrypt and encode are mutual synonyms are way funnier.
I wish all you ivory tower wannabes would get off your high horses. Base-64 is encryption! Do you even know what encryption means? It means "to put in a code". Base-64 is a code. Now STFU.
No, that's what encoding means. En-cod[e]-ing. En-crypt-ing means to make cryptic.
http://www.merriam-webster.com/dictionary/code
Most applicable definition in this case is "a system of symbols (as letters or numbers) used to represent assigned and often secret meanings" I assume all of you are native English speakers? Possibly not, I suppose.

Yes, and I speak other languages as well. You might even say I understand the foreign roots of the word that give it its subtle shade of meaning. Encryption is for obfuscation. Encoding is for the exact opposite. No amount of stupidity or appeals to the authority of - of all dictionaries - Webster's (which uses the muddled definitions of the peasant class), will change that.

Addendum (2011-07-25 22:17): The origin of crypt - which is the payload in the word "encryption":

1375–1425 for sense “grotto”; 1555–65 for current senses; late Middle English cripte < Latin crypta < Greek kryptḗ hidden place, noun use of feminine of kryptós hidden, verbid of krýptein to hide; replacing earlier crypta < Latin, as above

And here's the origin for "code" - which is the payload in the word "encoding":

1575–85; < Latin cōdex, caudex tree-trunk, book (formed orig. from wooden tablets);

This makes it pretty clear that encryption == encoding + intent to obfuscate

2011-07-25 Reply Admin

VHJ1ZTsgIGJ1dCBldmVuIGEgcHJvZ3JhbW1pbmcgdHlybyBhcyBtZSB3YXMgYWJsZSB0byBmaWd1cmUgb3V0IGhvdyB0byBhZGQgaXQhIA==

hoodaticus · 2011-07-25 Reply Admin

Ken Mitchell:
VHJ1ZTsgIGJ1dCBldmVuIGEgcHJvZ3JhbW1pbmcgdHlybyBhcyBtZSB3YXMgYWJsZSB0byBmaWd1cmUgb3V0IGhvdyB0byBhZGQgaXQhIA==

VGhlIG5leHQgcGVyc29uIHdobyBwb3N0cyBpbiBiYXNlNjQgd2lsbCBiZSBmZWQgdG8gQ29kZXRo dWxodSwgam9pbmluZyBpdHMgZW5kbGVzcyBjeWNsZSBvZiBjb21waWxhdGlvbiBhbmQgZGVjb21w aWxhdGlvbi4gIEF0IHdoaWNoIHBvaW50IEkgc3VwcG9zZSB0aGV5IHdvdWxkIGJlIGFibGUgdG8g ZW1haWwgdXMgdG8gZXhwbGFpbiB0aGUgZGlmZmVyZW5jZXMgYmV0d2VlbiBlbmNvZGluZyBhbmQg ZW5jcnlwdGlvbiB0aGF0IHRoZXkgbGVhcm5lZCBmcm9tIGEgdW5pcXVlbHkgZmlyc3QtcGVyc29u IHBlcnNwZWN0aXZlLg==

2011-07-25 Reply Admin

Because Thijs is not that smart?

2011-07-25 Reply Admin

boog:
Funny, I didn't say anything about copyright in my answer.
It may be that I wasn't talking about the DMCA at all.

If you weren't referring to the anti-reverse-engineering clauses in the DMCA (which are moot here anyways, there are explicit exceptions for this sort of RE), then what WERE you referring to? Reverse engineering, by itself, isn't illegal or civilly actionable anywhere I'm familiar with.

2011-07-26 Reply Admin

sparr:
boog:
Funny, I didn't say anything about copyright in my answer.
It may be that I wasn't talking about the DMCA at all.

If you weren't referring to the anti-reverse-engineering clauses in the DMCA (which are moot here anyways, there are explicit exceptions for this sort of RE), then what WERE you referring to? Reverse engineering, by itself, isn't illegal or civilly actionable anywhere I'm familiar with.

Reverse Enginering is a Copyright Exemption in US law. This is a fairly unusual exemption: most countries do not have a specific exemption like this.

Even without the specific exemption, many countries do not consider Reverse Engineering to be a copyright violation.

However some, including Malaysia and Australia, do consider Reverse Engineering to be a copyright infringement. Copyright infringements are illegal in AUS, so the police could come knocking on your door at midnight, but in practice it is the product of reverse engineering, not the act itself, which leads to prosecution.

2011-07-26 Reply Admin

trtrwtf:
From the vendor's perspective, this actually makes sense. Okay, now they have a config tool, and they want to make sure everyone uses it, but somebody along the way says "that cost us money to make it, you can't just give it away". Well, you can and you should, but tell that to the bean counter - so they come up with a way to make people want the tool: they obfuscate the XML.

That's just the list price: nobody is gonna pay that for it... It's the free bonus $100K product the sales force can throw in to make the sale, or you pay $1K per day for the "consultant" to make the changes to your configuration.

2011-07-26 Reply Admin

Coders arguing semantics is always depressing to read. Even more depressing is the fact that it took several dozen posts before someone pointed out the fact that in ROT13 13 is the key just as in Caesar's cipher 3 is the key. This should have been painfully obvious to any programmer.

2011-07-26 Reply Admin

Felt more like 100s of posts to me.

2011-07-26 Reply Admin

dohpaz42:
Encryption is a way to transform data, while ensuring confidentiality, integrity, and availability (CIA Triad). Encrypted data is confidential because only the parties that have the appropriate key can read the data. You can also use the key to verify the integrity of the data; in lamen's terms: if the data was altered during transmission, the data could not be decrypted back into the original plaintext. For the intended parties to be able to decrypt the data, all parts (the encrypted data and the key) must be available to only the parties that require it.
Encoding is a way to transform data, but does not guarantee the CIA triad. ROT13 and Base64 are two ways to encode data; these algorithms are not encryption because anybody can decode the data without having to have a special key to do so. Therefore, the data could be altered between the source and the destination, and the decoding party would have no viable means of knowing.

Come on people, this is all utterly basic CS 101 stuff here. I'm disgusted by this community's lack of understanding of two basic concepts.

Except, ROT-13 is encryption; it's just fairly trivial to decrypt. And.. your first paragraph is utterly failing. First, you can replace all instances of the word "encryption" (after the first sentence) with "encoding" or "base64" or any of a myriad example encodings and everything stated pretty well still holds true; the last sentence in that paragraph though is logically failing as both the data and the key can be known by unintended parties.

In regards to the second paragraph, please demonstrate how encryption ensures confidentially and availability in a way that encoding does not, and for that matter, how encryption ensures integrity any different than encoding. Encoding (at least the forms thus far presented) is a form of encryption where the decryption has been reduced to near triviality.

Let's be clear. I don't use the words "encoding" and "encryption" interchangeably (nor do I use ROT-13 or base-64 to encrypt data that needs to be secured). I use them in the context of the intent (as mentioned, encoding to transform information into a form that can be better managed and encryption to transform information into an obfuscated form that [hopefully] cannot be easily decrypted by others.

2011-07-26 Reply Admin

Peter:
germaican:
I think there are really very few names which originate in the US, the nation, that has no laws to prevent parents from giving stupid names to kids. You could name your kids "Doorknob" and "toilette paper". I don't think there is any other Nation so FREE in this regard.
Really? I'm sure that there are some nations that have laws about what you can call your kids. But I'd guess (admittedly, without any hard facts at my fingertips) that there are more that don't.

Spain is one where there are such laws. David Beckham got into trouble when he was living there for calling his sn Cruz, which is a girl's name. OTOH he had no trouble at all calling another son "Brooklyn" (presumably in retaliation at a certain US prez calling his daughter Chelsea).

There are no such laws in the UK. But generally speaking, unless you're an airhead celebrity and can get away with giving your children stupid names like Fifi Trixibelle or Peaches etc., people in the UK tend to consider the excesses of some of the names in the US a reason for ridicule. For the really stupid names we watch reruns of the Maury Povich show.

dkf · 2011-07-26 Reply Admin

mah bonez:
Except, ROT-13 *is* encryption; it's just fairly trivial to decrypt.

Encoding is just the process of putting a message in some kind of code. Even writing a message down is encoding of a sort (using glyphs). Encryption is a(n ontological) subclass of encoding where the message is hidden in some sense.

Practical and useful encryption ensures confidentiality through the fact that only a party who knows the relevant secret can decrypt the message, and it is typically combined with algorithms that ensure integrity and authenticity through techniques such as public key cryptography (where keys are partitioned into pairs, one part public and the other private) and digital signatures. Another major advance was the use of compression; that makes it significantly harder to use cryptanalysis due to the reduction in the amount of redundant information. (SSL is a wonderful thing. It makes all of this so easy.)

While ROT13 is an edge case from the border — it used to be considered encryption, but nobody serious has used anything that weak for hundreds of years — it's really just a simple encryption algorithm pre-bound to a key (and which happens to be a self-inverse) and should these days be considered to be just an encoding. Heck, I used to be able to read it without decoding it (but I reallocated those brain cells).

2011-07-26 Reply Admin

MadJo (professional software tester):
boog:
You left out the part where Thijs B's company gets sued to oblivion for "bypassing security" and "reverse engineering" the software.

Thijs is clearly not a US-name, and therefor the DMCA doesn't apply, thanks for playing, we have some lovely consolation prices for you backstage.

So what? Licence terms are licence terms, wherever you are. I bet eleventeen space donuts that theirs prohibited reverse-engineering the code, and that this counts. Whether they want to make this amount of noise and draw attention to the gouging of their customers is another matter, though

2011-07-26 Reply Admin

mah bonez:
dohpaz42:
Encryption is a way to transform data, while ensuring confidentiality, integrity, and availability (CIA Triad). Encrypted data is confidential because only the parties that have the appropriate key can read the data. ...
Encoding is a way to transform data, but does not guarantee the CIA triad. ROT13 and Base64 are two ways to encode data; these algorithms are not encryption because anybody can decode the data without having to have a special key to do so. Therefore, the data could be altered between the source and the destination, and the decoding party would have no viable means of knowing.

...

Except, ROT-13 is encryption; it's just fairly trivial to decrypt.

I would say that ROT-13 is the odd-one-out here, because it's an encryption algorithm (ROT-x) plus a well-known key (13) rolled into one. Because it has a key I'd also call it encryption.

And.. your first paragraph is utterly failing. First, you can replace all instances of the word "encryption" (after the first sentence) with "encoding" or "base64" or any of a myriad example encodings and everything stated pretty well still holds true;

No you can't because there is no key/secret required to decode base64, so it does not offer privacy.

encoding = algorithm that transforms data (without a key) encryption = algorithm that transforms data and requires a (secret) key to do so

which also means encryption is a form of encoding, but not vice versa.

GFK · 2011-07-26 Reply Admin

QJo:
Peter:
germaican:
I think there are really very few names which originate in the US, the nation, that has no laws to prevent parents from giving stupid names to kids. You could name your kids "Doorknob" and "toilette paper". I don't think there is any other Nation so FREE in this regard.
Really? I'm sure that there are some nations that have laws about what you can call your kids. But I'd guess (admittedly, without any hard facts at my fingertips) that there are more that don't.

Spain is one where there are such laws. David Beckham got into trouble when he was living there for calling his sn Cruz, which is a girl's name. OTOH he had no trouble at all calling another son "Brooklyn" (presumably in retaliation at a certain US prez calling his daughter Chelsea).

There are no such laws in the UK. But generally speaking, unless you're an airhead celebrity and can get away with giving your children stupid names like Fifi Trixibelle or Peaches etc., people in the UK tend to consider the excesses of some of the names in the US a reason for ridicule. For the really stupid names we watch reruns of the Maury Povich show.

I think MOST of the countries have SOME restrictions, although for most of these cases the restrictions must no be large.

France has this kind of laws. From the revolution until 1966, any Christian-born parents had to call their children by a name present on the Christian calendar (or some other Christan-related calendar, like the roman one).

Now things are different, but judges can still forbid a name if they think it can be a problem for the child. For example, "Renaud" is a very common last name, and is a homophone for Renault, which is the biggest car seller in France. Mégane is a common first name, and also the name of a Renault model. Some time ago, the case of parents wanting to call their daughter Megane Renaud was forbidden by a judge; the parents eventually won the right to give their daughter this name, but the case had to go up to the equivalent of the Supreme Court to be ruled.

Also most of countries where there are ethnical conflicts have these kind of laws. In Spain, Franco's regime forbid catalan names, which got in trouble Yohann Cruyff, famous football player and FC Barcelona superstar, when he named his son Jordi (catalan traduction for George, St Patron of the city of Barcelona), legally since his son was also Dutch by nationality.

Turkey also forbids Kurdish names, and AFAIK a lot of religious countries depend on what the religion allows. I'm sure naming your kid Satan or Allah must be a legal issue in most countries.

2011-07-26 Reply Admin

I was thinking "that looks like base64" after 2 seconds.

2011-07-26 Reply Admin

GFK:
[In France] judges can still forbid a name if they think it can be a problem for the child. For example, "Renaud" is a very common last name, and is a homophone for Renault, which is the biggest car seller in France. Mégane is a common first name, and also the name of a Renault model. Some time ago, the case of parents wanting to call their daughter Megane Renaud was forbidden by a judge; the parents eventually won the right to give their daughter this name, but the case had to go up to the equivalent of the Supreme Court to be ruled.

Just as well that Ford Prefect didn't land in France, then!

2011-07-26 Reply Admin

EvanED:
EvanED:
I don't think I agree. I, for one, always encrypt data with the goal of being able to view it later.
I just noticed this, but to whomever posted this: you, sir (or ma'am), are kind of a dick.
(It wasn't me. Take a look back; the poster shows up as "EvanED (unregistered)".)

What kind of private detective am I?

Encrypted XML

Leave a comment on “Encrypted XML”