/* Byte-at-a-time ECB decryption * Create a modified oracle function that decrypts an unknown string encrypted * under ECB-mode with a consistent, but unknown key. * AES-128-ECB(known-string || unknown-string, key) */ func c12() (actual, expected Result) { expected = "Rollin' in my 5.0\nWith my rag-top down so my hair can blow\nThe girlies on standby waving just to say hi\nDid you stop? No, I just drove by\n\x01" if crypto.GlobalAesKey == nil { crypto.GlobalAesKey = crypto.NewAesKey() } key := crypto.GlobalAesKey blocksize := crypto.DetectBlocksize(key) secretBlocks := len(crypto.AppendSecretEncryptEcb([]byte(""), key, false)) / blocksize var secret []byte createDict := func(plaintext []byte, block int) map[int][]byte { dict := make(map[int][]byte) for b := 0; b <= 255; b++ { extra := []byte{byte(b)} plaintext := append(plaintext, extra[0]) ciphertext := crypto.AppendSecretEncryptEcb(plaintext, key, false) dict[b] = ciphertext[block*blocksize : blocksize*(block+1)] } return dict } for n := 0; n < secretBlocks; n++ { for i := 0; i < blocksize; i++ { short := stdBytes.Repeat([]byte("A"), blocksize-(i+1)) plaintext := append(short, secret...) dict := createDict(plaintext, n) secretCiphertext := crypto.AppendSecretEncryptEcb(short, key, false) for char, lookup := range dict { if string(secretCiphertext[n*blocksize:blocksize*(n+1)]) == string(lookup) { char := []byte{byte(char)} secret = append(secret, char...) } } } } return string(secret), expected }
/* Byte-at-a-time ECB decryption * Same goal as #12, but prepend a random # of random bytes to input. * AES-128-ECB(random-#-bytes || input, key) */ func c14() (actual, expected Result) { expected = "Rollin' in my 5.0\nWith my rag-top down so my hair can blow\nThe girlies on standby waving just to say hi\nDid you stop? No, I just drove by\n\x01" if len(crypto.GlobalAesKey) == 0 { crypto.GlobalAesKey = crypto.NewAesKey() } key := crypto.GlobalAesKey blocksize := crypto.DetectBlocksize(key) createDict := func(plaintext []byte, prefixLength, block int) map[int][]byte { dict := make(map[int][]byte) for b := 0; b <= 255; b++ { extra := []byte{byte(b)} plaintext := append(plaintext, extra[0]) ciphertext := crypto.AppendSecretEncryptEcb(plaintext, key, true) dict[b] = ciphertext[(block*blocksize)+prefixLength : (blocksize*(block+1))+prefixLength] } return dict } findPrefixLength := func(blocksize int, key []byte) int { // If we send 2-3 blocks of repeating bytes, we will see a repeating block for i := blocksize * 2; i <= blocksize*3; i++ { encrypted := crypto.AppendSecretEncryptEcb(stdBytes.Repeat([]byte("A"), i), key, true) numBlocks := len(encrypted) / blocksize // Loop through blocks to find a repeat for j := 0; j < numBlocks-1; j++ { firstBlock := encrypted[j*blocksize : (j+1)*blocksize] secondBlock := encrypted[(j+1)*blocksize : (j+2)*blocksize] // Repeating block indicates we added enough bytes to make an even block if string(firstBlock) == string(secondBlock) { return (j+2)*blocksize - i } } } return 0 } // Knowing the length of the random prefix bytes, pad input to make a full block var secretBlocks int prefix := findPrefixLength(blocksize, key) // TODO: There must be a better way to account for prefix/16 rounding down and // giving 1 too few blocks if prefix%blocksize <= 5 { secretBlocks += 1 } pad := blocksize - (prefix % blocksize) // prefix + pad = full block prefix += pad // Figure out how many blocks to solve totalBlocks := len(crypto.AppendSecretEncryptEcb([]byte(""), key, true)) / blocksize secretBlocks += totalBlocks - (prefix / 16) var secret []byte for n := 0; n < secretBlocks; n++ { for i := 0; i < blocksize; i++ { // Send A*pad to pad the prefix to a full block, + A*blocksize-1, // blocksize-2, ... until that block of the secret is solved short := stdBytes.Repeat([]byte("A"), pad+blocksize-(i+1)) plaintext := append(short, secret...) // Create a dictionary of ciphertexts for every character dict := createDict(plaintext, prefix, n) secretCiphertext := crypto.AppendSecretEncryptEcb(short, key, true) for char, lookup := range dict { targetBlock := secretCiphertext[prefix+(n*blocksize) : prefix+(blocksize*(n+1))] if string(targetBlock) == string(lookup) { char := []byte{byte(char)} secret = append(secret, char...) } } } } return string(secret), expected }