[mmcc]

Hi everyone,

I've released a new cipher called Crystalline on CodePlex. So far, the cipher seem incredibly strong but I feel that it needs to go up against people with experience of breaking ciphers.

The reference implementation (in C#) can be found at the link below. If anyone has any questions, comments or suggestions, please feel free to reply.

crystalline (dot) codeplex (dot) com

[crazyycast13]

I'll check out the code later today.

[mmcc]

I'll check out the code later today.

Thanks very much. I added a little on the theory of operation to the documentation section at Codeplex, so you may want to check it out.

If you want any deeper insights or explanations, just ask. I'll be more than happy to help. I'm still refining the algorithm around the area calculating rounds, at present I just return a hard coded value. This seems to effect the randomness of the output which is critical to its strength. I need to find a robust way of calculating this.

[mmcc]

What makes this a "REAL ADVANCED" crypter?
Who coded it?

I coded it and designed the algorithm and I'm quite good at data analysis. As far as I can tell at this point, there is no mathematical approach to retrieving the key or plaintext.

I've used a different approach with this cipher, in that, it shifts the location of bytes and bits. This erases information about the plaintext, replacing it information about the random sources that perform the relocation.

So, the cipher is based upon information loss, rather than hard to solve mathematics. That why I say there is no mathematical approach to breaking it.

I hope I have explained that well enough, as it is an advanced concept.

[crazyycast13]

I coded it and designed the algorithm and I'm quite good at data analysis. As far as I can tell at this point, there is no mathematical approach to retrieving the key or plaintext.

I've used a different approach with this cipher, in that, it shifts the location of bytes and bits. This erases information about the plaintext, replacing it information about the random sources that perform the relocation.

So, the cipher is based upon information loss, rather than hard to solve mathematics. That why I say there is no mathematical approach to breaking it.

I hope I have explained that well enough, as it is an advanced concept.

He's spamming this section, ignore him.

[DangerZone90]

lots of infected .exe's

HUGE GIF, sorry for that🤐
Spoiler (Click to View)[img]http://media.giphy.com/media/3o85xCCvAEEHN7BZ4I/giphy.gif[/img]

[mmcc]

lots of infected .exe's

HUGE GIF, sorry for that🤐

For a second there, I thought you meant Crystalline cipher download. Phew! :)

The only .exe's in that package are builds of the cipher, which you can put through dotPeek to confirm. That's the beauty of C#, you don't need to wonder what code is lurking in the executables.

---

crazycast13, did you manage to checkout the code?

---

I'll check out the code later today.

How didyou get on? Any issues?

[crazyycast13]

How didyou get on? Any issues?

First of all, most people in this section never even do legit ciphers with good keys, and bastardize them, so automatic props to you.

I'm looking at your writeup and it looks pretty good, I don't see any strong bruteforce attacks from a couple of passovers but give me a little bit more time.

BTW HxD ftw

As far as the rounds go, well you can't make that random. Well you could, and then present the user with x amount outputs and let them decide, but that's just screwy. I tried that with one algo I did but ehhh it doesnt increase randomness by that much and instead just makes the user have more problems.

Sorry it took so long for me to respond I had to fix my computer before I could take a look.

[Demoralise]

I'll be willing to test this for you OP.

[mmcc]

First of all, most people in this section never even do legit ciphers with good keys, and bastardize them, so automatic props to you.

I'm looking at your writeup and it looks pretty good, I don't see any strong bruteforce attacks from a couple of passovers but give me a little bit more time.

BTW HxD ftw

As far as the rounds go, well you can't make that random. Well you could, and then present the user with x amount outputs and let them decide, but that's just screwy. I tried that with one algo I did but ehhh it doesnt increase randomness by that much and instead just makes the user have more problems.

Sorry it took so long for me to respond I had to fix my computer before I could take a look.

No worries on the late reply, I've been working around the clock myself so I wouldn't have had much time to reply. I don't like short keys, computed keys or passphrases either, I like to have a good margin of safety built in.

Its great to hear that you have found no obvious weaknesses from the tests you have run. That's a good sign at this early stage of the analysis. I was thinking of making the rounds a function of the key and salt within a defined range just to make it that little bit harder. The reason why I didn't do that was because I noticed that chi-squared tests were picking up order on different values and I need to explore the root of that. I didn't want to brush it under the carpet. I don't think it is anything serious, it just may be picking up the oscillation in the TRNG. I am writing R scripts at the minute that will explore this.

I'm having another conversation with Karl-Uwe-Frank over at DevShed and we've been discussing methods of testing this cipher. Whilst randomness test are useful, I want to hit it with some serious machine learning techniques. I described a few of them here:

forums[dot]devshed[dot]com/security-cryptography/969138-crystalline-cipher-testers-required-post2956397.html#post2956397

Its basically a death of a thousand cuts and it will reveal exactly how strong this cipher is. I suspect, given the methodology, that this will be an on-going assessment as new techniques are added. It might be an interesting exercise to make this in such a fashion that it can attack any cipher and pool the capabilites of everyone involved in cryptanalysis into some form of open-source/SaaS project that anyone can use. I don't know how popular that will be, but we'll see in time.

Keep attacking it from every angle you can think of and let me know if you spot anything. Even little things, like a pattern in the output, that you notice could be very important.

Hopefully, everyone will get to benefit from a cipher that we know with a very high confidence that no one can break.

Woud you mind if I linked to this thread from the CodePlex homepage for Crystalline so that people can come and discuss attacking the cipher and/or read more?

I'll be willing to test this for you OP.

Please do. Any help you can provide will be much appreciated. If you have questions, comments or suggestions just post them and I will discuss it with you.

[crazyycast13]

No worries on the late reply, I've been working around the clock myself so I wouldn't have had much time to reply. I don't like short keys, computed keys or passphrases either, I like to have a good margin of safety built in.

Its great to hear that you have found no obvious weaknesses from the tests you have run. That's a good sign at this early stage of the analysis. I was thinking of making the rounds a function of the key and salt within a defined range just to make it that little bit harder. The reason why I didn't do that was because I noticed that chi-squared tests were picking up order on different values and I need to explore the root of that. I didn't want to brush it under the carpet. I don't think it is anything serious, it just may be picking up the oscillation in the TRNG. I am writing R scripts at the minute that will explore this.

I'm having another conversation with Karl-Uwe-Frank over at DevShed and we've been discussing methods of testing this cipher. Whilst randomness test are useful, I want to hit it with some serious machine learning techniques. I described a few of them here:

forums[dot]devshed[dot]com/security-cryptography/969138-crystalline-cipher-testers-required-post2956397.html#post2956397

Its basically a death of a thousand cuts and it will reveal exactly how strong this cipher is. I suspect, given the methodology, that this will be an on-going assessment as new techniques are added. It might be an interesting exercise to make this in such a fashion that it can attack any cipher and pool the capabilites of everyone involved in cryptanalysis into some form of open-source/SaaS project that anyone can use. I don't know how popular that will be, but we'll see in time.

Keep attacking it from every angle you can think of and let me know if you spot anything. Even little things, like a pattern in the output, that you notice could be very important.

Hopefully, everyone will get to benefit from a cipher that we know with a very high confidence that no one can break.

Woud you mind if I linked to this thread from the CodePlex homepage for Crystalline so that people can come and discuss attacking the cipher and/or read more?

Please do. Any help you can provide will be much appreciated. If you have questions, comments or suggestions just post them and I will discuss it with you.

You have to realize, the amount of people in this forum who can do legit crypto is a handful, if that. Are you doing this for a university project or are you doing this just because?

Serious props either way. Serious props.

BTW http://crypto.stackexchange.com/ is a great place with a lot of smart people who could answer some questions better than I could, same goes for
http://www.reddit.com/r/crypto

[mmcc]

You have to realize, the amount of people in this forum who can do legit crypto is a handful, if that. Are you doing this for a university project or are you doing this just because?

Serious props either way. Serious props.

BTW crypto stackexchange com is a great place with a lot of smart people who could answer some questions better than I could, same goes for
www reddit com/r/crypto

I understand that the majority of users here will have an interest but not necessarily the skillset to support that interest. I think they will find this fascinating as I will share the techniques behind how we analyse the cipher and various cutting-edge approaches to breaking them. I will use R and R Studio, which everyone can download for free, for most of this and I'll share the scripts. Hopefully, some users will pick it up as I go along. I'll start simple enough so that they can pick up the language, how to use RStudio, etc., then introduce more complex analysis into the mix. I come from a Matlab background, so I'll be using this as a way to broaden my skillset.

No, its not for University. I already hold an honours degree in Computer Science. This emerged from a very simple question I had over 5 years ago, why do most ciphers preserve the order of the plaintext in the ciphertext? I saw this as a form of leakage that provided a reference point from which cryptanalysis could begin. My only reason for doing this is because I find it interesting and that it provides good subject matter for further experimentation with machine learning and statistical tools. Crosswords and Suduko just don't hold the same appeal I suppose.

I have been to Stack Exchange, however, they are seeking focused questions that its user base can provide definitive answers for. I asked 'How secure is the Crystalline Cipher?' which is a very broad question, too broad to be answered in such a format. They placed the question on hold and requested that I reword it to narrow the focus. I will probably do that now and ask about something related to information loss. Hopefully I will be able to use the responses in the analysis in some way.

I didn't know Reddit had a crypto section. I will take a look and see what form of topics they will accept. Thanks.

[TheDubWubCub]

Very interesting work mmcc! 😁

It's unfortunate that I lack the skills and knowledge to be able to fully comprehend and properly assist with your project, but I appreciate it immensely and wish you the best of luck towards the extensive evaluation of Crystalline. 😵👍

From what I can tell, Crystalline already seems to do a good job at stumping people with basic crypto skills/knowledge (depending on incentives).
Seeing how you're striving for more though, "Crystalline hopes to set a new standard in security", then I suggest you keep on doing what you're doing and openly share it with the world. 🤗

Do you have a primary purpose for Crystalline or was it just designed with the intent for universal purposes?

Also, how are you able to incorporate 'randomness' within a cipher/encryption system? I would think that would affect its ability to decode/decrypt properly unless you're somehow storing the 'random info' within the ciphertext or something.😧

Lastly, why'd you name it 'Crystalline'?😁

[mmcc]

Very interesting work mmcc! 😁

It's unfortunate that I lack the skills and knowledge to be able to fully comprehend and properly assist with your project, but I appreciate it immensely and wish you the best of luck towards the extensive evaluation of Crystalline. 😵👍

Thanks. I'm actually taking the analysis step-by-step over a Devshed if you want to learn or just watch how it is done. Karl identified an issue in the random output of the cipher but beyond output from randomness testing tools he didn't have anything concrete to demonstrate the source of the issue. I was in the process of creating code in R that could produce output suitable for machine learning when I obtained a really clear image of the repeating structure that Karl's tests were finding. Right now, that appears to be a harmonic, most likely a bias introduced by the plaintext as the frequency distribution would be off a little. So, I don't think it is anything to worry about.

Have a read:
forums devshed com/security-cryptography-17/crystalline-cipher-testers-required-969138.html

From what I can tell, Crystalline already seems to do a good job at stumping people with basic crypto skills/knowledge (depending on incentives).

Yes, so far, no one has reported break or even provided a general methodology as to how one may be achieved other than brute force. That's a very promising sign and after I have dug a little deeper, it will be ready for analysis by some seasoned professionals and academics.

Seeing how you're striving for more though, "Crystalline hopes to set a new standard in security", then I suggest you keep on doing what you're doing and openly share it with the world. 🤗

That's the general idea. If a strong cipher emerges, fantastic. I'm sure people will use it. If not, everyone involved in the analysis will have added to a body of knowledge around assessing the strength of ciphers. So, there is no downside to this.

Do you have a primary purpose for Crystalline or was it just designed with the intent for universal purposes?

There is no primary purpose for the cipher. It is for general usage where security is paramount.

Also, how are you able to incorporate 'randomness' within a cipher/encryption system? I would think that would affect its ability to decode/decrypt properly unless you're somehow storing the 'random info' within the ciphertext or something.😧

Its because the cipher does not encrypt data in a conventional manner. It scrambles the locations of bits and bytes using random input in a way that can be reversed. That input being the key and salt. I can reverse the process because it is performed as one long chain of bit/byte swaps.

Lastly, why'd you name it 'Crystalline'?😁

In a word, structure. Because the cipher changes the locations of bits/bytes in a chain, it reminded me of crystals growing. Snowflakes, quartz, the phase change between ice and water, etc. The name seemed apt.

[TheDubWubCub]

Thanks. I'm actually taking the analysis step-by-step over a Devshed if you want to learn or just watch how it is done. Karl identified an issue in the random output of the cipher but beyond output from randomness testing tools he didn't have anything concrete to demonstrate the source of the issue. I was in the process of creating code in R that could produce output suitable for machine learning when I obtained a really clear image of the repeating structure that Karl's tests were finding. Right now, that appears to be a harmonic, most likely a bias introduced by the plaintext as the frequency distribution would be off a little. So, I don't think it is anything to worry about.

Have a read:
forums devshed com/security-cryptography-17/crystalline-cipher-testers-required-969138.html

Oh I see, I'll have a look! Thanks. :]

Yes, so far, no one has reported break or even provided a general methodology as to how one may be achieved other than brute force. That's a very promising sign and after I have dug a little deeper, it will be ready for analysis by some seasoned professionals and academics.

I shall try one thing and see if I get anywhere with it, (doubt it haha), but yea that'll be awesome if you can get it reviewed from them!

That's the general idea. If a strong cipher emerges, fantastic. I'm sure people will use it. If not, everyone involved in the analysis will have added to a body of knowledge around assessing the strength of ciphers. So, there is no downside to this.

Very true! :]

There is no primary purpose for the cipher. It is for general usage where security is paramount.

Even better haha good luck!

Its because the cipher does not encrypt data in a conventional manner. It scrambles the locations of bits and bytes using random input in a way that can be reversed. That input being the key and salt. I can reverse the process because it is performed as one long chain of bit/byte swaps.

Okay gotcha, never mind then. :)

In a word, structure. Because the cipher changes the locations of bits/bytes in a chain, it reminded me of crystals growing. Snowflakes, quartz, the phase change between ice and water, etc. The name seemed apt.

haha awesome, and have you made other crypto systems before? and for what purpose? (little or small? for fun or work?)