Hacker News Reader

Comment by terom | Hacker News Reader

  >>> cb = bytes.fromhex('6968766f606e776c2d2d21262138475c5b5a475b545e475c6b6a776b646e776c6b6a772b646e776c6b6a776b646e776c6b6a776bbadf04036b6a776c616a846f')
  >>> pb = b'\x02\x02\x01\x04\x04\x00\x00\x00FGVMEV0000000000\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00...'
  >>> print(''.join(chr(c ^ k) for c, k in zip(cb, pb)))
 
 kjwkdnwlkjwkdnwlkjwkdnwlkjwkdnwlkjwkdnwlkjYEJ

EDIT: The repeating XOR key is pretty obvious. Just ignore the junk at the end from the `...` in the given plaintext.

View on HN

Key looks more like they just bashed the home row with a few extensions of the longer fingers.

Apparently, running "uuidgen" is too difficult for them. Which, shouldn't be a surprise for someone who already decided to use XOR "encryption".

Wouldn’t a random sequence using a seed as the secret be a better choice?

Yes. If you can build a cryptographically-secure random number generator, which can output a long stream of random bytes from a seed, congrats, you just invented a stream cipher. Just XOR your plaintext and random bytes, and you are good to go.

That's called a "stream cipher". ;-)

XOR encryption is unbreakable with an one-time pad that matches the message length (that's basically AES CTR). It's one of the most secure cryptography primitives we have.

The problem is deciding to use home-grown encryption.

This isn't a one-time pad. It's reused for every message.

It's reused every 8 bytes...

That too.

AES CTR isn't a one-time pad. It's as strong as AES, not theoretically unbreakable.

"Basically" is the key word there.

I usually say that encryption is the easy part. Just use XOR and you are good. All the complicated bits are related to key management.

Interesting, kjwkdnwl hasn't been seen before in Have I Been Pwned.

Reply on news.ycombinator.com