The DMZ

forest

00:09

Didn't North Korea write their own cipher? Or some heavily-modified version of AES?

lmao, I just did a web search for "North Korea cipher" and I'm getting ads:

> 5 Best VPNs for North Korea in 2022 for Streaming & Security

Ah, this is it

--- a/rijndael.cpp
+++ b/jipsam1.cpp

-static uint8_t SubByte(const uint8_t x0) {
+static uint8_t SubByte(const jipsam1_ctx * ctx, size_t r, const uint8_t x0) {
+  const uint8_t   k = ((ctx->k[r+0] ^ ctx->k[r+3]) & (ctx->k[r+17] ^ ctx->k[r+15])) ^
+                 (ctx->k[r+7] & 0x0F) ^ (ctx->k[r+11] & 0xF0);
   const uint8_t  x1 = multiply( x0,  x0); // x^2
   const uint8_t  x2 = multiply( x1,  x0); // x^3
   const uint8_t  x3 = multiply( x2,  x2); // x^6
@@ -49,7 +51,7 @@ static inline uint8_t SubByte(const uint8_t x0) {

From kryptoslogic.com/blog/2018/07/…

forest

01:20

(I started getting curious about this cipher, so I just posted a question on Crypto.SE)

0

Q: Security analysis of North Korean block cipher Jipsam1

The cipher is a modification to AES and is described on this website: The only difference between Jipsam1 and AES-256 is the S-box. Whereas in AES the S-box is public and constant, namely $$ \begin{pmatrix} 1&0&0&0&1&1&1&1\\ 1&1&0&0&0&1&1&1\\ 1&1&1&0&0&0&1&1\\ 1&1&1&1&0&0&0&1\\ 1&1&1&1&1&0&0&0\\ 0&

Journeyman Geek

02:22

@forest If you try to crack it Kim Ill Sung's ghost will personally spray VX on your face?

ThoriumBR

10:38

@nobody just found out you have access to all my systems!

5

Q: metadata from linux file system in uploaded photos

Before uploading a photo or image to a forum, I may typically strip the metadata to remove identifying material with exiftool. The thing is, the linux file system itself seems to leave some metadata on a file: cardamom@pluto ~ $ ls -la insgesamt 1156736 drwx------ 145 cardamom cardamom 20480...

linux file-system

nobody

17:09

@ThoriumBR yup, I've even had access to forest's systems for a long time. But I never learned anything about linux privilege escalation, so I haven't yet been able to make any use of that access.

@forest Why did they do that though? Is it meant to strengthen the cipher or weaken it?

ThoriumBR

17:38

@nobody maybe thwart newbies decrypting with out of the shelf libs?

for example, if you change the s-box from something, the result won't make sense

nobody

17:51

Yeah, that's possible too. But if that's all they wanted, couldn't they have done something simpler, like use the round keys in the opposite order (since I'm guessing that wouldn't affect the security properties of the cipher unlike what they currently did)?

belkarx

Maybe they have other motivation (like backdooring the "security")

ThoriumBR

probably they wanted to affect the security

nobody

Well if they want to affect the security positively (i.e. strengthen the cipher) then that would imply they know of some weakness in AES that we don't. If they want to backdoor or weaken it, then that would imply they know of a technique to weaken ciphers that we haven't figured out yet. Both of these sound slightly scary to me.

belkarx

They are. So let's hope that they just changed it as an attempt at security through obscurity

forest

20:46

They probably wanted to strengthen it and just didn't trust "western cryptography"

nobody

21:05

That seems reasonable.

ThoriumBR

or say "this was changed by us so it's stronger"

Fire Quacker

21:31

It has been blessed by the imperious leader, it must be stronger

forest

21:42

There's another cipher they made, Pilsung, which is based on AES but makes many changes.

It's essentially its own cipher, whereas Jipsam1 is just a modified version of AES:

I note that an equivalent way of looking at Jipsam1 is that it is essentially standard AES, except that after each sbox (in the encrypt direction), all bytes are xor'ed with a key-dependent constant ($\text{0x63} \oplus c_r$). This would suggest that, absent an unexpected interaction between that constant xor and the add-round-key in the next round, it is likely to have security similar to AES. — poncho 19 hours ago

From the website:

> This construction seems reasonably secure, considering the additions are largely done on top of a solid AES base. However, there are some concerning details:

- The permutations are not quite random, given the biases described above;
- The randomness is not very independent, as S-boxes and permutations all derived from the same key bits;
- Given that the S-box randomness is only partial, the Baignères-Vaudenay security result does not quite apply here;
- The random ShiftRows operation is unnecessary, and looks more like a liability than an asset. It can make weak classes of keys p…

@nobody I don't usually speak in such absolutes, but I will say this: There is no way they know of a weakness in AES that we don't.

nobody

Why so?

(I mean why the absolute, I already know why it is unlikely)

forest

Because it would necessarily imply that North Korea has better cryptographic capabilities than even the NSA.

And the NSA we know from leaks (among other things) does not have any serious cryptographic break in AES (although I'm sure they know of plenty of neat side-channel attacks against many implementations). It's an a fortiori argument.

(And I don't think that "new tau cryptanalysis" thing in the leaks matters)

nobody

Does the NSA still hire all the top mathematical talent?

forest

No. They haven't since probably the 90s.

Universities and the private sector now compete heavily with them.

That's not to say that they don't have tremendous capability, but it does mean they are no longer 20 years ahead of the public. With that said, their goals may differ from those of other cryptographers. For example, while everyone else is trying to figure out how secure some stream cipher is, the NSA is trying to reduce the cost of developing a device that can perform multi-target attacks against 128-bit block ciphers, or factor 1024-bit integers/calculate 1024-bit discrete logs.

In other words, public cryptographic research is largely about increasing the maximum security of a cryptographic design, whereas the NSA's cryptographic research may focus on making attacks which are just barely possible, practical. So while we're all busy laughing at SHA-1, the NSA is probably trying to find an attack that can reduce a chosen-prefix collision down to a more practical level than 2^63 (or whatever it is now). It's something we all knew was possible, but they want it practical.

nobody

22:00

Interesting. Does the academic crypto community still focus on cryptanalysis? I have a feeling there a lot of research on cryptanalysis in earlier years but now cryptographers just focus more on building new constructions or finding novel applications instead of trying to break existing constructions.

forest

For sure. The academic community is heavily invested in cryptanalysis. It's the fundamental core of cryptography.

You can't build a new construction or find a novel application if you don't know where the weaknesses lie.

I will say though that the new constructions are just more popular among non-cryptographers. Everyone likes to talk about the new applications of sponge functions and zero-knowledge proofs, but it's a bit boring to gossip about the latest impossible differential attack in some intentionally-tweaked cipher, or some new linear property of some high-level construction.

nobody

Ah that would explain it. Although to me its the cryptanalytic attacks that seem more interesting, but maybe that's because I'm a wannabe hacker and enjoy breaking stuff more than building it.

forest

It's important to remember that a "full" and practical attack is very hard to come by. The vast majority of research is just about slightly improving an existing attack, or coming up with a totally impractical but theoretically possible and interesting attack.

So you won't hear about someone improving an attack complexity from 2^200 to 2^195 at the expense of increasing memory requirement from 2^80 to 2^150 (which would obviously be a totally pointless attack in the real world), but you will hear about someone making SHA-1 broken in practice, and that kind of thing is rare. It's easy to confuse that rarity with dwindling interest in cryptanalysis.

The mere existence of impossible differential cryptanalysis is testament to that. Impossible differential cryptanalysis is a differential attack where the differential characteristics have a probability of 0 of appearing and thus have no impact whatsoever on the security of a cryptographic function, but it does tell you something about the security properties of the function, which can be useful.

forest

22:19

@nobody Here's a great example: sci-hub.hkvisa.net/10.1080/0161-110391891964

> Impossible differential cryptanalysis of Mini-AES

This is an attack which was published but that you probably never heard of. It's an attack that physically cannot work because it requires an intermediate state in the cipher which has a probability of 0 of existing, and it's against an intentionally modified version of AES that no one ever uses. This is how cryptanalysis often works.

Also, another example involving the cipher Twofish:

> In 1999, Niels Ferguson published an impossible differential attack that breaks six rounds out of 16 of the 256-bit key version using 2^256 steps.

hehe

An attack that is literally impossible, is slower than brute force anyway, and only breaks less than half of the cipher's rounds!

But... all these "pointless" attacks are very important and are the very backbone of cryptographic research.

(I think I talk too much lol)

nobody

22:45

@forest Nah, the things you say are always interesting. Plus you keep this room alive

ThoriumBR

23:31

sure! keep going!

it's sad when I hop here in the morning and:
> "13 hours later…"

3

forest

heh

I know that feel.

Transcript for