gabemai314
Blue Jay
Joined: 12 Feb 2017
Age: 25
Gender: Male
Posts: 76
Location: Loveland, Colorado, USA, Earth, Solar System, Gould Belt, Orion Arm, Milky Way Galaxy, Local Group, Virgo Supercluster, Laniakea Supercluster, Universe
01 Aug 2017, 8:44 am
I have designed and implemented a version of the Rijndael cipher (Advanced Encryption Standard) that uses a 3 dimensional 8x8x8 state (temporary buffer) instead of a 2 dimensional 4x4 state. This means the cipher will have a key size of 4096 bits. It uses 64 rounds for encryption and decryption. The cipher also includes new transformations called ShiftSlices and MixSlices that add additional diffusion into the cipher. These transformations are analogous to ShiftRows and MixColumns. I have a working implementation of the cipher that I wrote in C. I have also implemented various modes of operation such as ECB, PCBC, and XEX. Seeing that quantum computers will only halve the bit-strength of an algorithm, reducing the key size to 2048 bits, the three-letter agencies are surely going to have a field day with this one. Try brute-forcing the keys before the universe reaches heat death! 
Ichinin
Veteran
Joined: 3 Apr 2009
Gender: Male
Posts: 3,653
Location: A cold place with lots of blondes.
05 Aug 2017, 7:25 am
Redesigning a cipher after it has been made "to improve it" is like making the bradley again (see pentagon wars).
8^3 means an a state of 512, not 4096. Key distribution is a factor you should think of. Like Schneier said: "Cryptography does not exist in a vaccum".
64 rounds, compared to the specified 10-14 will make it extremely slow. Have you done any performance testing? People don't want to die of old age when encrypting data, even if it is more secure.
Please stop using C, its an insecure language that should have been shot and burried by now. C++ and other languages exists and are free, usually comes included in Linux and the free .NET environment (VS express) can be downloaded from Microsoft.
Noone bruteforce - ever. 3 letter agencies cheat by rigging PRNGs and hacking services that use the crypto amongst other things. Did you miss the Shadowbrokers leak? That
is on you.
gabemai314
Blue Jay
Joined: 12 Feb 2017
Age: 25
Gender: Male
Posts: 76
Location: Loveland, Colorado, USA, Earth, Solar System, Gould Belt, Orion Arm, Milky Way Galaxy, Local Group, Virgo Supercluster, Laniakea Supercluster, Universe
07 Aug 2017, 8:10 am
Ichinin
Veteran
Joined: 3 Apr 2009
Gender: Male
Posts: 3,653
Location: A cold place with lots of blondes.
08 Aug 2017, 5:00 am
09 Aug 2017, 1:41 pm
if you try to brute-force traditional AES-256, it will take even the most powerful bitcoin mine there is billions of years. Hackers are like horror movie villains, and will take advantage of the careless behaviour of the victim to achieve their goal (eg. their password being "qwerty1234" or "Volvo240"). The police here in Scandinavia has unsuccessfully tried to brute-force Countermail passwords several times.
Keep in mind that something isn't safe per se if it hasn't been thoroughly tested. Microsoft will pay hackers to test their stuff extensively; as will Google. NSA, Microsoft or anyone else aren't going to pay billions to reinvent the wheel. 
C still has plenty of stuff going for it. It's much easier to make a compiler for C, and secure PRNGs, ciphers, hash functions and so on need to run of low-end hardware as well (bank tokens, access cards, etc.). If an algorithm's security rests solely on being tough on the hardware, it can be used to mount a DDoS attack (as has been the case with scrypt or bcrypt if not used correctly).
Ichinin
Veteran
Joined: 3 Apr 2009
Gender: Male
Posts: 3,653
Location: A cold place with lots of blondes.
10 Aug 2017, 5:46 am
We're getting off topic but:
If they did that, the are even bigger idiots than i thought. Normally you'd throw a list of hashed passwords against it. People do not walk around with >128 bit keys in their heads.
Anyone who care about security will pay for vulnerabilities, but more money can be made on darknets selling the same exploits for bitcoins. No questions asked, exclusive rights to the buyer. (Guess the clientele: well funded, organised, has use for 0-days, don't care about the law/is above the law).
Nothing is going for C - it is s**t, it has no bounds checking (which means buffer overflows), it has no type safety, and more (see link below) etc which means much of the stuff you write will be full of unpatched vulnerabilities unless you know what you are doing, there is plenty more that ISN'T going for C since people have already moved away from it - C is dead ancient knowledge, please stop resuscitating it and drop that piece of crap and move on to something that can put food on your table - the amount of organisations that are willing to pay someone to code in C are extremely low.
Even this guide how to code securely in C will be over 15 years old in a month:
https://www.sans.org/reading-room/whitepapers/securecode/securely-programming-388
10 Aug 2017, 12:18 pm
Ichinin
Veteran
Joined: 3 Apr 2009
Gender: Male
Posts: 3,653
Location: A cold place with lots of blondes.
10 Aug 2017, 5:06 pm
Perhaps i was unclear: we're about organised crime and the intelligence community. Rules go out the window. There is a reason why some security researchers follow digital currency like Bitcoin and Etherum.
You shouldn't handle memory as a developer, same argument why construction workers shouldn't handle explosives - it needs expertise - or a remotely controlled robot (analogy for automated memory handling). And you do not write missile guidance systems and access card systems in Javascript, CSS, and whatever. People still do that in C and it need to stop.
That does not make the language secure and that people should continue to use it. I have moved on from C, C++, VB, Java to newer languages that are safer and more simple to develop in, granted there are limitations when developing operating system features at that level, but there has to be alternatives.
No, some language have more resiliency against some attacks because they are not what C is. I could use the same arguments for Brainfuck, ERLANG or QBasic.
(and if you reply, please don't screw up the quotes again, was rather painful to sort out
)
gabemai314
Blue Jay
Joined: 12 Feb 2017
Age: 25
Gender: Male
Posts: 76
Location: Loveland, Colorado, USA, Earth, Solar System, Gould Belt, Orion Arm, Milky Way Galaxy, Local Group, Virgo Supercluster, Laniakea Supercluster, Universe
17 Aug 2017, 8:39 pm
