I am trying to encrypt a password for my school project. Here is the process:

  • Let's assume that I have a string p (n characters long) which contains the password.
  • The program reverses the string and stores it in string r.
  • It takes each character of p and r, applies the XOR operator and stores it in string e.
  • Next time the user wants to access the file, she will be asked to enter the password. The entered password will go through the process explained above and will be compared to string e.
  • If both are not equal, access will be denied.

How many combinations it will take a computer to brute force it, in order to show if it is effective?

The assignment prevents me from using any third-party libraries such as bcrypt.

  • 2
    First things first, passwords should not be encrypted, but hashed. The hashing process is similar to what you are doing right now, though. Second thing, are you required to use your own algorithm for passwords? – Revenant Oct 11 '16 at 8:43
  • This is for my school project I don't know anything about including hashing in my project. I'm using my own algorithm for passwords because the other algorithm will be hard to include and might require third party applications to do so. – Dr.Paradox Oct 11 '16 at 8:50
  • Most languages have some sort of crypto implementation, whether it be built-in or in third-party libraries. What language are you using? – Revenant Oct 11 '16 at 9:07
  • 2
    For 8-bit ASCII passwords the maximum number would be 256^n so the password (or text) length would be relevant (). Most users won't use anything but letters and maybe numbers. Assuming the attacker would already know it's XOR and has some idea of password length. Not to mention other methods to which XOR cypher would be highly vulnerable. So for short texts it can be brute forced easily for long text it leaves too many clues (like repeating certain patterns, especially when pasword is shorter than the text) that allow other methods to be used. (Also reversing the password is good for nothing) – thorsten müller Oct 11 '16 at 10:31
  • 1
    @Revenant It's very likely this is a toy assignment for school, meaning no crypto functions may be used, either built-in or external. The purpose is probably to teach the student the complexity and weaknesses of a naive implementation. – Andres F. Oct 12 '16 at 0:53

No brute forcing is needed. Given the "encrypted" string e, I can produce a fake password p_ which your system will accept, very quickly.

The algorithm to do this is:

  • Let p_first_half be the first n/2 characters of e (where / indicates integer division, rounded down).
  • Let p_ be p_first_half with n - n/2 zero-bytes appended.

If you run p_ through your "encryption" algorithm, the result will be e, so your system will accept my fake password.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.