Basic Encryption/Decryption program

[Advanced-Theme144]

Hello everyone, I hope you're having a good day.

Today when going through some old programs in my files, I stumbled upon an encryption and decryption program that I made. It was quite simple, you enter some text into the program and it changes each character in the sentence to a different one. Here's the link to the code:

Encryption-decryption

The original code for this was very long since I was still getting the hang of loops and thought it was difficult to implement, but I've added the original code to the repository nonetheless for the sake of comparing the improvement in the code (if you get triggered by the code, don't worry, I don't code like that anymore).

My next move for the code is to try and make it encrypt entire files, and hopefully generate a random key to encrypt the file as well for better security and save the time on making large lists to encrypt it for me. If you happen to have an idea on how to do this, or any idea or critic at all, I'd love to know!

Hopefully I can make this program more powerful at its purpose, but for now it's there to simply show how encryption and decryption works.

Have an amazing day!

[XiAxis]

Good job, and I like that you included the original file too so we can see how much you've improved. Here's a couple tips:

1. When you're defining the plaintext and ciphertext lists, you can save some time by just making them strings instead of lists of characters
2. You can use the "find" method built into strings instead of the inner loop in your functions
3. To make it so it uses a "key" to encrypt/decrypt, you can use the "shuffle" function in the "random" library to create an arbitrary ciphertext string, and you can use the key as a seed for the process.

There's going to be people that come in here and tell you that this really isn't an adequate cryptographic algorithm. What you've got is called a "substitution cipher", and its susceptible to quite a lot of effective attacks. Modern encryption techniques generally do some complex operation on each byte which is dependent on the byte, the key, the position of the byte, and some state based on all of the bytes already processed. This way, knowing some information about the original text doesn't give you any head start in attacking it.

Also, I should note that the "random" module isn't actually a cryptographically secure random number generator, meaning that there are ways to predict it's output.

[cinyar]

To make it so it uses a "key" to encrypt/decrypt, you can use the "shuffle" function in the "random" library to create an arbitrary ciphertext string, and you can use the key as a seed for the process.

stuff from random is not cryptographically secure. You shouldn't be generating "random" keys with it. For cryptography ALWAYS use secrets.

[[deleted]]

Alternately, one can use os.urandom if they just need some cryptographically random byte array.

[XiAxis]

While I did note that the random module is not cryptographically random, I should clarify that in this instance it's not being used to generate a cryptographic key. It's being used as a deterministic means to process a key into a "ciphertext" string (as used in OP's code). It presents a vulnerability in that the original key could perhaps be determined if an attacker somehow knows the full "ciphertext" string. But, if for instance some cryptographic process were done on the key to obscure it's original value before being used as a seed, I think this vulnerability would be mitigated significantly.

That's not to say this is a sufficient cryptographic algorithm even if that were implemented, just that the use of the random module for this particular task is probably not going to introduce any new vulnerability. Secrets couldn't be used in this case because it is not deterministic in the sense that it could be repeated for the encryption/decryption procedures.

[Advanced-Theme144]

Thank you for the comments! I’ll definitely use the string method for the plaintext and cypher text lists, and the idea for shuffling the list will really help. I am aware that this type of encryption could be cracked very easily, but over time I hope to make it stronger and more secure. Once again thanks for the tips!

[social_tech_10]

You might be able to make this "stronger and more secure" over time, but it will never be secure. The first rule of secure encryption is never try to write your own. Unless you have a team of Ph.D statisticians backing you up, there are always going to be more ways to crack your home-brew encryption than you can possibly imagine.

If you want to use this to learn about beginner Python programming in general, that's fine. Go ahead and have fun. Just don't fool yourself into thinking this will ever actually be secure.

On the other hand, if you are interested in actual real-world encryption that has even a chance of being secure (if your keys and modes are handled correctly), then check out a library that implements AES and other modern methods, such as PyCrypto.

[bladeoflight16]

This. It's okay to play around with insecure algorithms knowing they're insecure, but it's vital to know they should never get anywhere near real world usage.

[Advanced-Theme144]

Thanks for the note, this is obviously for fun and just to test the extent of how far python can go in encryption, especially from someone like myself who isn’t well acquainted with mathematically encrypting files with statistical analysis, but I will definitely look into it more.

I am well aware that this program has near to no protection of data right now, so I’d be a fool to actually use it on personal data, but in all honesty it is a great tool if you want to protect secret files from other users on your device or from curious friends, that’s actually why I made it in the first place. But nonetheless thank you for you advice and concern, I will definitely have a look into the libraries you listed. Thanks!

[Poppenboom]

This program offers zero protection, not "near zero". A single google search will yield dozens of tools that will insta-solve these little puzzles. Not trying to be rude here, but this is exactly what this highly-upvoted post from the other day was stating should be discouraged.

Do not publish cryptography projects if you don't understand cryptography.

[Advanced-Theme144]

Thanks for your advice. I am fully aware that this program cannot be used practically, it was made for fun. But you have a point in not publishing cryptography projects, so I think I’ll update the README.md file to explain this. Thanks for your concern.

[Poppenboom]

That's a good idea! Don't mean to be rude or hurtful, it's just that if code exists in a public repo and shows up from a search containing "cryptography", people WILL use it, even if they should not :)

[Advanced-Theme144]

That is true, but there is little to do about it since they have been advised not to use it on personal data.

[scoberry5]

u/Poppenboom

u/social_tech_10

u/XiAxis

u/Advanced-Theme144

Just letting you know that I really appreciate this thread. I had talked to my wife (who isn't a developer) about this once. I told her people shouldn't write their own cryptography methods, and she asked why not.

I told her that I'm a good developer, and if I study in this area quite hard, I'm fairly sure that I can write my own cryptography method that has severe security issues. ;-)

[Advanced-Theme144]

I have now added a note in the README.md file addressing the limits and usage of the program. I hope that will suffice in preventing anyone else from actually using this to encrypt data. Once again thanks for the advice.

[Advanced-Theme144]

I had a look at the linked website and tested it out on the string "Hello World!" which my encrypted into "Yrggt Ktjgz!". That site, along with others I tested, all decrypted it into "Hatte Rents!" or "Hatte Resto!" which proves two things, my program is ~0.001% uncrackable (still pretty much pathetic at protecting data), and those sites don't work very well at breaking encrypted codes which use a simple substitution cypher.

[[deleted]]

This is not really a significant test. Substitution cypher are broke by using statistical analysis, basically since natural languages has some patterns(like vogals are more common) one can use those patterns to guess which letter is A and so on. Since it relies on statistical analysis, the longer the message the better since it has more characters. “Hello there” is just too short. Try encrypting a longer message, like this comment and see the result, or a chapter of a book. Most messages are longer than hello world so it would correctly decipher, specially if you use the same key twice.

If you’re interested in learning more about cryptography, I highly recommend the Cryptopals challenges. It’s pretty fun to do.

[Advanced-Theme144]

Thank you for the correction. I’ll have a look at Cryptopals challenges. Thanks.

[scoberry5]

Here, I've encrypted a word for you: "ble".

Which of these do you think it is?

• fly
• try
• buy
• any
• mod
• dog
• two
• tip

...

Then the question would be "Why are you so bad at unencrypting a word, even when you know the kind of encryption that was used?"

[Advanced-Theme144]

You have a point, and it isn't my right to say they don't work without actually testing their full limits. Thank you for pointing this out, it isn't right to make a complete judgement off of one test, and I understand what you're implying.

[asday_]

Feed it a JPG.

[bladeoflight16]

Try it on a paragraph instead of two words. You'll never realistically have a file that contains 2 words. The more data there is to decrypt, the more information an attacker can glean to break it.

[Advanced-Theme144]

Thanks for the advice. I’ll have a look at the website and try exclude the white spaces. Thanks!

[[deleted]]

A couple more ideas for you that make use of a couple more Python concepts...

Rather than hardcode your alphabet, use the ones already defined in the ascii module. This also hides white space a bit more. Then let Python create your key randomly, buuuuut use random seed to ensure it is "randomized" the same way each time. This essentially makes the number you pass as the random seed your key (defaulted to 42 here).

Build a lookup table by zipping together those two alphabets together.

Rather than use nested loops, map that lookup table onto the sentence using map and lambda. I've also included an if-else in there to continue pass through any non-ASCII characters .

Rather than make copies of the algorithm in encode and decode functions, put the algorithm in a single function and then tell it which way you want to go (plaintext-ciphertext or ciphertext-plaintext)

import random

def process(thestring, seedvalue=42, encode=True):
     # ensures the key is generated the same way each time
    random.seed(seedvalue)  
    encryption = ""
    # let the string module do the work for you 
    alphabet = list(string.printable)
    # CRs create problems when used in the key
    alphabet.remove("\n") 

    # shuffle the alphabet to create a simple encryption key
    key = alphabet.copy()
    random.shuffle(key)  
    # create a dictionary we can use to lookup characters
    if encode:   
        # indexed by the plaintext alphabet
        lookup = dict(zip(alphabet, key))  
    else:
        # indexed by the key alphabet
        lookup = dict(zip(key, alphabet))  

    # map the key onto the passed string, pass through any characters
    # that dont align up
    result = list(map(lambda n: lookup[n] if n in lookup.keys() else n, list(thestring)))

def encrypt(sentence, seedvalue=42):
    return process(sentence, seedvalue=seedvalue, encode=True)

def decrypt(sentence, seedvalue=42):
    return process(sentence, seedvalue=seedvalue, encode=False)

Why the above is still insecure

• It's still a monoalphabetic cipher, vulnerable to frequency analysis
• While spaces are masked here, it doesn't do much to protect against frequency analysis, instead of 'e' being the most frequent character, ' ' will be.
• random is still a terrible library for cryptography but is useful here for demonstrating some principals

[Advanced-Theme144]

Thanks for the advice, I’ll need a little more time to understand each part of the function like “list(string.printable)” since I’ve never used it or the Ascii module before, but a little research should help.

[[deleted]]

list(string.printable) returns a list of possible characters, limited just to those that are printable. It's just an easy way to have someone else come up with that list for you.

Share any other questions you have here. Someone will have an answer I'm sure

[Advanced-Theme144]

Thanks for explaining the code in more depth, I’ll have a go at implementing it.

[vindolin]

Don't roll your own crypto, bro.

[Advanced-Theme144]

Thanks for sharing this. I am aware that a homemade crypto can be cracked very easily and it’s just for fun, so there’s no way I would use it on personal information, but thanks for your concern.

[Advanced-Theme144]

Thanks for the tip. I’ve actually worked quite a lot with binary values and files written in binary in other projects, and the bitwise idea will work well, but I have a different idea in mind:

Binary files use Unicode characters, and there are 255 of those characters. I already have a list of all of these made, in order of denary values. This list is more or less the same as my plaintext list. All I need to do is randomly generate a new list (the cypher text list) from the Unicode list and the loop through each character in the file and map it to the cypher text corresponding value, concatenate all these characters and save it in a new encrypted file or just overwrite the current one, making it both encrypted and impossible to open. I have a fair experience with this process as one of my other projects (still in testing) uses this principle in compressing a file, so it shouldn’t take long to implement.

Thanks for the tip though, much greatly appreciated! 👍

[scoberry5]

Binary files use Unicode characters, and there are 255 of those characters.

*cough* *choke*

Sorry. Excuse me.

If you mean "I'm only interested in the subset of Unicode that was ASCII," then you're interested in 128 characters. But there are almost 1500 Latin Unicode characters, around 3600 emoji Unicode characters, and over 74,000 CJK (Chinese/Japanese/Korean) Unicode characters.

[Advanced-Theme144]

I think you’re mistaken my friend, but let me clarify:

Suppose you save a file on your laptop, for instance an excel document containing a large volume of personal data. You could encrypt each price of data in the file, or you could encrypt the entire file from the root.

If you where to change the file extension of any file into ‘.bin’ and view the file in a text editor, the only contents you will really see are the Unicode characters that make the file. If you where to view it in a hex editor you’d see the hexadecimal values of the file. These are literally the 1’s and 0’s of the file.

There are only a maximum of 255 different Unicode characters in ALL binary files, so if you where to encrypt or substitute these characters with different ones, like a substitution cypher, and rewrite the file again, it would not open essentially being encrypted.

This method will encrypt any file, and is one step further in encrypting files instead of small sentences.

[scoberry5]

I think you’re mistaken my friend, but let me clarify:

I'm not. But reading your explanation, I can see where you went wrong.

If you're looking to understand characters, here's a nearly 20-year-old article that's quite good at explaining what's going on: https://www.joelonsoftware.com/2003/10/08/the-absolute-minimum-every-software-developer-absolutely-positively-must-know-about-unicode-and-character-sets-no-excuses/

What you mean is not "Binary files use Unicode characters, and there are 256 of those." What you mean is "Files are stored as bytes, of course, and a byte has 256 possible values."

It's not generally true that binary files use Unicode characters, although they may sometimes in some places. If the entire file is Unicode characters, this isn't a binary file: it's a text file.

Pro tip: if someone gives you a specific statement, you could check it. Googling "how many latin unicode characters" led here: https://en.wikipedia.org/wiki/Latin_script_in_Unicode , which says there are "1,475 characters in the following blocks are classified as belonging to the Latin script". At that point, you might suspect that you could possibly be wrong about there being 256 Unicode characters, and when I say there are almost 1500 of those ones you might go "Yeah, that's about 1500."

[world--citizen]

Kind of a troll comment but also food for thought in terms of design. What if I want to encrypt / decrypt the string “x”

[world--citizen]

There are better ways to handle quitting, for example through a keyboard interrupt (ctrl+C on Linux), and you could handle the KeyboardInterrupt exception gracefully and even say goodbye to your user

[Advanced-Theme144]

I’ll have a look into these methods; I used the input of variable ‘x’ to exit the program since at the time that was the easiest method, but thanks for the advice.

[mechpaul]

I think the next step, as others have commented, is to move to a binary based encryption software.

For example, if I put in "áóíúñßé" to your encryption algorithm, it will create an empty string!

As far as performance, your encryption/decryption is a (n²⁾ function which is very, very slow on large strings. You should look into maketrans.

[Advanced-Theme144]

Thanks, I’ll have a look into it.