/* Byte-at-a-time ECB decryption
* Create a modified oracle function that decrypts an unknown string encrypted
* under ECB-mode with a consistent, but unknown key.
* AES-128-ECB(known-string || unknown-string, key)
*/
func c12() (actual, expected Result) {
expected = "Rollin' in my 5.0\nWith my rag-top down so my hair can blow\nThe girlies on standby waving just to say hi\nDid you stop? No, I just drove by\n\x01"
if crypto.GlobalAesKey == nil {
crypto.GlobalAesKey = crypto.NewAesKey()
}
key := crypto.GlobalAesKey
blocksize := crypto.DetectBlocksize(key)
secretBlocks := len(crypto.AppendSecretEncryptEcb([]byte(""), key, false)) / blocksize
var secret []byte
createDict := func(plaintext []byte, block int) map[int][]byte {
dict := make(map[int][]byte)
for b := 0; b <= 255; b++ {
extra := []byte{byte(b)}
plaintext := append(plaintext, extra[0])
ciphertext := crypto.AppendSecretEncryptEcb(plaintext, key, false)
dict[b] = ciphertext[block*blocksize : blocksize*(block+1)]
}
return dict
}
for n := 0; n < secretBlocks; n++ {
for i := 0; i < blocksize; i++ {
short := stdBytes.Repeat([]byte("A"), blocksize-(i+1))
plaintext := append(short, secret...)
dict := createDict(plaintext, n)
secretCiphertext := crypto.AppendSecretEncryptEcb(short, key, false)
for char, lookup := range dict {
if string(secretCiphertext[n*blocksize:blocksize*(n+1)]) == string(lookup) {
char := []byte{byte(char)}
secret = append(secret, char...)
}
}
}
}
return string(secret), expected
}
/* Byte-at-a-time ECB decryption
* Same goal as #12, but prepend a random # of random bytes to input.
* AES-128-ECB(random-#-bytes || input, key)
*/
func c14() (actual, expected Result) {
expected = "Rollin' in my 5.0\nWith my rag-top down so my hair can blow\nThe girlies on standby waving just to say hi\nDid you stop? No, I just drove by\n\x01"
if len(crypto.GlobalAesKey) == 0 {
crypto.GlobalAesKey = crypto.NewAesKey()
}
key := crypto.GlobalAesKey
blocksize := crypto.DetectBlocksize(key)
createDict := func(plaintext []byte, prefixLength, block int) map[int][]byte {
dict := make(map[int][]byte)
for b := 0; b <= 255; b++ {
extra := []byte{byte(b)}
plaintext := append(plaintext, extra[0])
ciphertext := crypto.AppendSecretEncryptEcb(plaintext, key, true)
dict[b] = ciphertext[(block*blocksize)+prefixLength : (blocksize*(block+1))+prefixLength]
}
return dict
}
findPrefixLength := func(blocksize int, key []byte) int {
// If we send 2-3 blocks of repeating bytes, we will see a repeating block
for i := blocksize * 2; i <= blocksize*3; i++ {
encrypted := crypto.AppendSecretEncryptEcb(stdBytes.Repeat([]byte("A"), i), key, true)
numBlocks := len(encrypted) / blocksize
// Loop through blocks to find a repeat
for j := 0; j < numBlocks-1; j++ {
firstBlock := encrypted[j*blocksize : (j+1)*blocksize]
secondBlock := encrypted[(j+1)*blocksize : (j+2)*blocksize]
// Repeating block indicates we added enough bytes to make an even block
if string(firstBlock) == string(secondBlock) {
return (j+2)*blocksize - i
}
}
}
return 0
}
// Knowing the length of the random prefix bytes, pad input to make a full block
var secretBlocks int
prefix := findPrefixLength(blocksize, key)
// TODO: There must be a better way to account for prefix/16 rounding down and
// giving 1 too few blocks
if prefix%blocksize <= 5 {
secretBlocks += 1
}
pad := blocksize - (prefix % blocksize) // prefix + pad = full block
prefix += pad
// Figure out how many blocks to solve
totalBlocks := len(crypto.AppendSecretEncryptEcb([]byte(""), key, true)) / blocksize
secretBlocks += totalBlocks - (prefix / 16)
var secret []byte
for n := 0; n < secretBlocks; n++ {
for i := 0; i < blocksize; i++ {
// Send A*pad to pad the prefix to a full block, + A*blocksize-1,
// blocksize-2, ... until that block of the secret is solved
short := stdBytes.Repeat([]byte("A"), pad+blocksize-(i+1))
plaintext := append(short, secret...)
// Create a dictionary of ciphertexts for every character
dict := createDict(plaintext, prefix, n)
secretCiphertext := crypto.AppendSecretEncryptEcb(short, key, true)
for char, lookup := range dict {
targetBlock := secretCiphertext[prefix+(n*blocksize) : prefix+(blocksize*(n+1))]
if string(targetBlock) == string(lookup) {
char := []byte{byte(char)}
secret = append(secret, char...)
}
}
}
}
return string(secret), expected
}
