As to the cloud. I posted this at the webs. Ninja, this one is such a wacky concept, watch it curl, website, ninja fire, all right? All I'm doing is I'm fetching down the source code of that web page. All right, when I fetch down the source code of that web page, observe what happens. Okay, that can get a lot nuttier. That exploit is what I call log injection. I can just put into my URL an escape characters, then go to Jpmorgan.com slash escape characters. Here, anybody who's viewing I can corrupt their, activate them and make little fireworks go off and whatever and things like that, making their lives not as any. Here's a little, feel free to come on by, have some pizza and participate. You guys are awesome. Okay. If I'm wearing this hat means there was no time for a shower, that means that my notes were like I took too much time writing the notes, which is cool. It means that it is in a flow state of some kind or whatever. I added something special to the notes here, that special linked. I'm going to take a bit and just teach you the crypto of the web as fast as I can because I like talking crypto and whatever. I hear myself talk about crypto. Here's the story of web crypto, all right? When you go to this site, if I want that lock to be signed, meaning that my interactions with that server are well encrypted, that's what that lock means. I'm going to fetch a certificate from webs dot prof dot ninja. I'm going to validate that. I'm going to use the public credentials in that to start what I'm going to call a key exchange. Which allows me and that server to now have a shared secret that nobody in the world knows, just me and the server. Then I'm going to use that shared key to generate random bytes in two places on Earth at the same time. All right, now that's a wacky sentence. Produce random bytes in two places at the same time should make your head explode if you accept what random means. So obviously it's not actually two sets of the same random bytes in two places on Earth at the same time, it's something else. Okay, fine. And then we're going to use or which is the most beautiful thing in the world and that rand those random bytes to encrypt and decrypt the actual message. Okay, now I'm going to tell the story in reverse order, the x or up, but I wanted you to know the context before I started telling you about this thing. You all as web developers or whatever, you're going to have to issue the validate the certs. You're going to have conversations with people about which certificate authorities are like government agencies under sheep's clothing or whatever and all that kind of stuff. Make decisions about that kind of thing, and think about what the future of public stuff means in the circle of trust and all those. But it starts with just these two things, which is what I'm going to try to get at today. All right? If I get my vibe right, which I'm definitely like this vibe shirt, I will get you to recognize that crypto art without being random, method acting is the art of being Jim Carey without actually being Jim Carey. Right. This is about trickery and randomness. And see random without seeing contrived. We all do that all the time, right? Like somebody is like, oh, I'm so random, whatever you're not, you're full of shit, whatever. I know you. That's the art of crypto. Okay. Very human or in the one time pad, I frigg in love. Anybody who's like been hanging around with me for a while has heard me say or like 100 times. Yeah. Yeah, he's heard it. Will heard if you're over there in the CTFs or whatever, CTF or those are like my favorite three letter words. Most of the reason why is because I have the scrabble background in me. Like I like wordplay or rock is a palindrome and I just find that very charming because I get to say or rock. I just want to talk about or I lived in France for a while. My favorite restaurant in France was one where every day the menu is whatever the chef was in the mood for. It was always, that's a little how this class is. I will always be in the mood to talk. I could be in a bad mood. You're like, hey, you want to talk like, yes, younger, let's go. I'm in a better mood now. It's largely just because it's a palindrome. Another charming palindrome that is going to be in your life from now on, as you think about it. Del. All right. You're welcome. You're welcome. Okay. All right. Just just adding a little bit of whimsy to the beauty of life. All right. So crypto, very serious business, okay. Again, I'm kind of in this mood to like tell you like the big story. And then we'll dive into like the kind of how, right? So that you have the context of where everything is going to go. One, generally, if I talk about symmetric key crypto. Symmetric key crypto is the opposite of public key crypto. Public key crypto is like having an e mail address. You know my e mail address. You can send me an e mail but you can't read my mail. Symmetric key crypto is like a shared password to my Netflix account or whatever. Like here's my Netflix password and we all log in with that same passwords. All of the freeloaders in my life have moved into my house. Doesn't matter, but that's our CTF team operates. Right. We just get one log in and share it with everyone. All right, that's symmetric key crypto as we all have the same exact password. Okay, here that is in three abstract functions that exist in all symmetric key crypto schemes, function one key, how do you generate a key? Okay, That's all you have to know is that anybody who's designing a crypto scheme has to think about how the key is generated. Step two, encrypt function will take in some plain text and that key and spit out some cypher text. All right, and then a decryption, we'll take in the ciphertext, the same key, and spit back out the plain text. Okay, that's the framework of symmetric key crypto. Not a big deal. Barely need to say that out loud. Yeah. Sometimes I'm going to regret not having said that. Okay. I encrypt with this key. I decrypt with the same key with me on the set up. Okay? All right. Those of you who have had crypto outside of this class are either in the crypto class or in some networks, class networks, classes love talking about crypto. Here's why. Crypto is actually only used on the Internet, right? Like we care about crypto because the Internet and that's because I take my packets, translate them into like a radio frequency. I send them to that radio listener which turns it into electrical signals through their Ethernet cable, send it off to a ISP box, which then translates it into lasers. Sends it across the Atlantic Ocean or whatever with laser proof shark wires which then receive it, do some processing and send it back as lasers, then back as electrical signals, and back as radio. All right? And that process is happening all the time with my face. That means that 20 grubby little servers are touching my data in transit from here to there. Okay. So the reason crypto matters is because, you know, we aren't actually that well connected. We've got 100 little intermediaries with all their little shark roof laser wires sending our on my data, right? So the goal is that those grubby little people handling my grubby little packets can't do weird stuff with it. All right. Now what are the weird stuff that they were going to want to do? One, just eavesdrop, right? So can I get my packet and read it? Okay. That's something like if you've ever, have you guys watched the imitation game with Pengling, Cumber Blatch in that World War Two era style code breaking or whatever. We're listening in on all the German radio signals. Right? And the German radio signals are going pep peep, we're like translating that in or whatever. It's radio, everybody hears it. The Internet is a buzzy wire that we're all holding. We shock each other. That's the Internet. All right. We're all receiving all the messages. This wi right, like we're all getting all those packets. And the very beginning of the packet is saying only for Andy's computer. And the rest of you are nice enough to disregard it, but you don't have to be just listening. Okay. Fine. Why am I talking about German World War two and Benedict Cumberland? Um, you guys got a funny name. Because when we invented computers, it was to crack German radio signals. The way that we did it was with this process which is to predict that those stinky, we're going to start every thing with Hitler since they had to have Hitler at the beginning of every message. We can see like this is probably the part that said Hitler. Then can I use that prediction about the il Hitler part and then maybe other common German phrases that might be in there use that known part to the plain text to read the rest. Right. And if you invent a crazy thinking machine that can do thousands of operations per second, then yes we would do that, but we did, all right, fine. Because lives are on the line. Okay. The grubby little paws are going to know parts of your messages, right? Like my messages have HTTP 1.0 or 2.1 or whatever and all that. And they've got like HTML, ducky head, whatever, you can predict a shit ton of the packet data that I'm sending, right? So being able to predict some of it shouldn't be able to help you predict any of the rest of it. That makes sense. All right, so like plain text is really known. All these people know part of your message and they shouldn't be able to figure out anything else just from guessing. All right, like lesson number two. Never send the same crap twice. So imagine I'm listening to the buzzy wire and they're trying to encrypt it and I hear BP beep, and then later on I hear P beep the exact same way. Again, I might not know what was in that perfectly well encrypted message, but I know it was the same message. And if the first time they started bombing Dresden, then the second time they're probably going to bomb Dresden all now, all of a sudden they became the British or whatever. Yeah, yeah, we did that, yeah, that we did that to the Japanese, where we pretended like we were out of water at certain islands so that they would, in a way that we knew that they would read it and then they were encrypting the message, oh, the Americans are out of water at these islands and then we could like use that to figure out how they encrypted that message. Right? Yeah, that kind of like chosen plain text business, but this same message twice ever. I'm thinking more like algorithmic traders. If you're one of the little way quants on Wall Street who are trying to be as a few milliseconds away from the NYSE as possible, then Goldman Sachs is making all these little micro transactions with their Elgos. If I can see a message perfectly well encrypted, that said by 100 and then I see the same message later. I'm going to presume that it was by 100 because historically I knew what they did the first time. Right? Like I might not have to be able to crack the message. I could just be able to say like, well, the first time it did this, then I got the same message. Again, what this is saying is not only do I have to do the art of looking random, I have to do it over and over and over again. And never repeat the same thing twice while having somebody else on the other side of the planet be able to create the same stream of randomness. All right. All right, that's a hard task. Um, okay, here's your networks defense class or whatever. In 10 minutes, not 10 minutes. I won't take that long on this. If anybody with their grubby little packets, with their grubby little hands are holding my packet, they can just make a copy of it, and then later on maybe they can just send it again. It's perfectly well encrypted. They have no idea what's in my packet, but they replay it later over and over and over again. Does that keep transferring money from my funds? Like All right, this one's going to like transfer 100 bucks. Know what? Transfer? 2000 3,000 4,000 5,000 Right. Because like any one of them could take any of my packets and send them over and over and over again. So that's a replay attack. All right, so it's just saying, all right, the secret message to somebody else without my permission is just going to keep sending. Or they can reflect it back to me. They can take my own message or somebody else's message or whatever and then send it back. Or they can like intercept the message on this side and this side swap them around. Whatever dot people with their grubby little hands on your packets are going to be able to like replay them, send them back, whatever things like that. And they can also try to tamper with them. Maybe I don't know what's exactly in your packet, but I know that it's like Word which I'm going to show you which it is. This part said transfer $1,000 but I'm like smart and I know that these are the four bytes that would be 1,000 I'm going to tweak the encrypt encrypted bytes so that whenever you decrypt it, I don't know how you're going to decrypt it. You're going to decrypt it. Now it says 9,999 bytes. That is because it's really easy to do. I'll show you. All right. Taking those packets and without actually being able to crack decryption, just tamper with them in ways that make predictable outcomes when they get decrypt. All right, those are the context of this whole thing. All right, that's all Preface. Now let's get to, or rocks my favorite little sentence to say. All right. I've tried these notes on exactly once. I found myself bouncing around in the wrong order. I like this summary of what the hell or is and why it matters or whatever, but I want to bounce down and bounce back up and things like that, et cetera. Here's X or the way you learned it in discrete math, or if you're redstone coder or something like that, you have two redstone signals are coming in. If one of them is you want to lamp, both of them are you want to lamp, you want to lampf or is exclusive takes in two binary inputs that are either on or off. If they're both on, you're off. If they're both off, you're off. But if one is or the other is on, then you're on. Okay. That's the truth table here. This is on, on, on. That one's false, that one's false, that one's true, That one's true. Okay, With me on how X or works, Okay? Now when I'm actually doing crypto x or I never ever get back down to that level of granularity, like I never actually care about bits again, which is the weird thing, right? That's the part, that's the truth table version of it. Let's do this. My wacky vernacular a is going to be a variable. A is going to either be zero or one. Okay? Based on these rules. If I give you a variable that I don't know ahead of time, it's either going to be zero or one to copy that variable over. And it's going to be 01. And then I or both of those variables together. Variable one, variable one again, and I or them together, what will I get out always zero because if they're both of then I'm off. If they're both on, then I'm a variable x ord with itself gives me zero. All right? And then a variable x ord with zero will give you the variable back. If I put a zero in a mix with zero, get a zero back. If we put a one in a mix with a zero, I get a one back. That's algebra now, right? A plus A is zero and a plus zero is A. Okay. By the way, if you want to know the mathematical analogy for x or it's literally just addition mod two, all right? Addition mod two. Even odds take in two evens, you get an even, take in two odds, you get an even odd and even you get an odd. All right? So that is any number plus an even will have the same parity as the original number. Okay, So now we'll go back to my wacky rules. Now x is my variable, all right, so here's my wacky variable, 01 plus zero is variable zero or one? We just established that variable plus itself is zero. Okay? Cool. All right. Now let me ask you this. You and your mind are going to pick an even or odd number, all right? I don't know. In fact, you should be broken as you pick it. Let's say you all pick even, all right? Because you're all just like a hive mind. It's a hive mind. Like I'm going to pick even, but I ask you a pick. Random even or odd number you pick. Now, I'm going to flip a genuine coin, fair coin. If the coin comes up heads, add one to your number, and if the coin comes up tails, I'm going to add zero to your number. Okay? I flip my coin. For each one of you flip a coin, you all picked even how many of you are going to be even after the coin flip? About half. Even though you were all not random. If I genuinely add a random zero or one to you, the output is randomly, even or odd that is structured. Plus random looks random. Yeah, those words sound like word soup to me in this context. Maybe it's basian or something, I don't know. I'm saying something that doesn't have a uniform distribution plus something with a uniform distribution. Gets a uniform distribution that is completely structured, very predictable. Unpredictable. Must be unpredictable. All right? Yeah, yeah, yeah. As an ECE professor, I don't know that side of the house. They all do signal processing. I get it. I did coding theory, but I haven't been through that course work order. Those aren't words that are sensible. Okay, finally, here's the story of X, or your data is structured data. I generate a key that is a coin flip at every single bit, I mix my key into your structured data and what's going to come out is now completely coin flip looking mother. All right, structured coin flip. Coin flip, okay. Then here's the magic part. I take my random bytes and the output will look random. So in this case, the goal of crypto is to look like static, white noise. Like I say static, but I mean, just like unpredictable radio static, this thing will do that, provided that the key was random. Now suppose that I add my random number. It's random zeros and ones, and then I add the same random number mod two. Well this is two of those, which means that they disappear. Which means I get my number back in this world, encrypt with the same key and I actually decrypt. Encryption is decryption in the land. It's also very hardware and mathematically so key. The key is the yeah, I guess the lock addition, I just take my keys, just random zeros and ones and now I'm just adding 01 to every single bit with no carry. The output will look like random bits everywhere zero. But then I just add those same random bits and I get back to structure. All right, see with me on that, this is why X is super cool to cryptography. Now, this isn't some weird historical thing. This is literally what my site and all sites that you've been to today, do you guys have been doing this all day, every day in your little pockets as the NSA is or whatever. As people are just taking your data, here's my proof. Just go to inspect the Dev tools you guys have been doing this to debug things and stuff. Click Security. Okay. Here is the cryptographic protocols used in locking down this website. All right. Cls, that's the assert system. Dhe here is the Diffy Helman key exchange. So that's how we're going to establish the same shared secret using elliptic curve number P 384 or whatever. So this lack of thing is going to be how we're going to do our key exchange. Fine. And then this is the advanced encryption mode, six P using Gala counter mode. Okay, fine. I'm going to show you how gala counter mode looks on Wikipedia real quick. Gc M wiki, GCM Wiki gala counter moode. Okay, observe right here. So there's a lot of stuff going on out here. But the Cpr text is made by the plaintext with like the result of a result of. What that's doing is generating random look, invites and oring in plain tests throughout the length of your planet. This is the box I'm describing, that's the plain text, That's your cyte is what all of your packets are doing all day. Every day. 99% of all day description in the world is on the X. Okay. That's my proof that even your prostate ninja site visit was ored with random bites. Okay. By the way, the rest of the junk on here is to make an off tag which is trying to prevent tampering, because tampering is a big deal too. So this is just or with some random bites and the rest is like try to prove that nothing got tampered with. Okay? All right, so in this sense our goal is to generate a random number or my plain text message with random number, send that across the internet, Give them the same random keys, somehow magically, and then have them or that random key with my thing to get the thing. Okay, you're with me on the story, easy enough. All right. I got a code sample here just showing the basics in Python. I'm going to make this little Er so I can point out it with my finger. All right, so I don't ember or 101 bit or long strips of text. Right? And so the question is how do I turn long strips of text into this like or operation bit by bit by bit? And the answer is that every single character you've ever sat on the Internet is stored as 0.1 How most of the time it's a encoded even T's one of these as is just just this table up here. Um, this is Ask. This has the 127 principle. 128 principle characters in ask. Not all principle, but you can see that the alphabet is just like 96 plus how deep in the alphabet for the capital alphabet is 64 or plus the alphabet. Okay. And was the number 65? Now obviously the number 65 isn't what your computer chip does. Your computer chip reads it in binary. In order for me to see the binary of 65 quickly. I actually look at the hex digest. This is like a nice intermediate, almost like assembly or something where it's like I can see the binary in 41 better than I can see the binary in 65. I'll show you how in just a second. Well, I'll show you how Right here. The 16 numbers in hexidesmal, do you know? Hexadesimal. It's base 16. I just start counting, 012-345-6789, and then I run out of digits. I can't say ten with one because I have a different base now I say a, and then, and then, and then D, and then, and then, and now I stop. Okay. Is 15 in binary? 15 is eight plus four plus two plus one. All right. So 11111. Okay. So what that means is that zero through 15 in binary looks like 0 0 0 0 0 0 1 0 0 1 0 0 0 1 1, et cetera. All the way up to 11 Rumble. Okay, cool. What that means is that when I start taking characters that are longer, capital A is 41. I can see that four as a four digit binary thing pretty quickly. 4.4 digit binary is zero for the eight place, one for the four place zero for the 20, for the 10100, and then one is 0001. If I have 65 in decimal 41 in hex, in binary, I see that four as this and the one as this. I can use that quickie reference here that felt intuitive enough to me to quickly see all eight of that bite. Okay. All right, cool. Here's how Andy, or this random crap is going to look in Python or whatever capital A is, 65 in binary. It's this. I did a little bit of predification, some ugly code, in order to make a nice clean eight bit version of capital A with me on that. Now the first bite of my key in this is a single bite, that's an unprintable bite. All right. This unprintable bite is six in hex, in binary is 11116, is four plus two. And now I'm going to or these in the way the X Or works is it just goes bit by bit oring each one an even plus an odd is an odd, odd plus an odd is an even, even plus an odd is an odd, et cetera. All right. So this is the X or of capital A and the bite that would be six all bytes go from 00 up to F 255 is the largest bite. Okay. All right. Here is like a Pythonic or more at my scale of or just take strings and ing with strings and stuff like that and I'm just going to go bite by bite. This is or on integers, this operator, this carrot operator. That's how you do Xor with any two integers. And it's going to do it whatever they are in binary or whatever they are in binary. Okay? This thing is just going through bite by bite in both the message and the key. And creating a bite out of that and returning that at the end. Okay. The or of this thing, capital and, and that thing comes out as this. All right. All right, fine. Now you can even see the B. That's a B here. That's eight plus two plus 18.2. Is ten plus one is 11. 11 is okay. Cool. I can see it. All right. Obviously that's seven. Or maybe not obviously, four plus plus one is seven. And that's the second bite, second nibble, by the way, that's a really cute thing. In hexidecimal, each character of a hexodescimal version of your string is called nibble because it's half a bite. Just lots of charm here in this space. All right. We can now go nibble by nibble and see the ors pretty quickly. That shit is fast in a computer right. At the chip level, I could code it myself just in a bread board or something, right? So you can imagine that gets baked in those transistors are going light speed. Okay, cool. All right, now here's the cool part. I think I can take that text or it back with my key and the output is. And now guess what else? What happens if I or that crazy text with the string and right here, what will I get? I will get the key. A wacky little truth in here is that I'll just write this in the discord. A plus equals, all right, fine. That doesn't say anything interesting. That's just saying two random things together make another random thing. All right? Fine. But plus A plus B is A. Those three are now in a forever love triangle. A and B must combine to give me, and C and B must combine to give me A and C and must combine to give me. It's faded. Those three just live together. Show you that in real life I made this or playground. All right. A A, Yeah. Yeah. Yeah. So if I have lower case A and capital A, I got 21. Okay. Let's do this. Let's take a message over here, students and here. I'll take a message over here and say DCT. Okay? I get this nonsense. All right. That's my that's the cipher text or whatever. I took high students here and UDCTFooow, I'm going to refresh. I'll put in just that nonsense. On the left hand side. On the right hand side, I'm going to start typing in U DTF. Okay? The output is high students here. Likewise, I can take that thing and I can put in this and I get woo, UDCTF. It's looping because they're about the sam length. Because I didn't like carefully plot out those numbers. And I've always wanted to establish some, a party trick where I can a wonderland tail of two cities and make some nonsense looking gobbledygook. And I trick you into oring that gobbledygook with tail of two cities somehow and you get Alice in Wonderland back out. It's like here's this entropy. But the entropy actually has inside of it, Alice in Wonderland and the other thing, and it's just like it's the marriage of those two. It's like my kids sometimes reflect my wife's personality and sometimes they reflect mine. We're both in there somewhere. Okay. So, that's that's a wacky little thing. There is no random, there's just a, B, and C plus a plus is A. If you can pull out half, you get the other half and yeah, this is the encryption that you all use all day. Every day. All right, so now go back to my Hitler example. You know that I've got Hyle Hitler in my message. What does that mean? That means you can read the key. Right? You predict that part. You're reading bytes of the key. Does knowledge of the key help you decrypt anything else? Need depends on how well it's set up or whatever. But that's the game we play. Now suppose you're going to do malware analysis. All right, one of the things that makes malware tricky is that they don't just have their op codes in there for you to look at. They just have a big gobbledygook of entropy and another random entropy at run time. Once they've decided they're not inside of a virtual machine with restricted Ram, they'll or those two things together to make their new op codes and that's what they'll run. Now you put the malware in a signature program, They did a hash of that binary and they're like, fuck you, I'm just going to change my random bytes. It's the same code but now it or is a completely different hash. Your signaturing doesn't work. Like change that whenever they want this kind of on the fly, updated op codes or whatever down at the cuts, it just looks like random entropy. But it's not random entropy, right? I love or is really wacky. It's like it looks random but it's not random. And how do I know if somebody is being authentic or they're just Jim Carey playing Andy Kaufman? Was that really Andy Kaufman? No, but how do I know? All right. Is Andy Kaufman dead made? Okay. All right, so the one time pad, here we go. You know that we had a World War era between the United States and the Soviet Union. Just to prevent the world from annihilating itself, we installed a red phone between the White House and the Kremlin. Just so that if anything goes really crazy, the two world powers could talk to each other and say, hey, let's not destroy the world, okay, We got close a couple of times. That phone was encrypted with the one time pad, just like all of your traffic is today. But back in the day they didn't have public crypto yet. Dudes would take suit full of zeros and ones between the sites and they'd re use their keys because it's hard to get a dude with a suitcase full of things from one country to the other and deliver it without being intercepted. All right. We would send our randomness physically so that that phone call could be encrypted with the one time pad. All right, Wacky, This is a perfect crypto scheme if I can do the following three things correctly. Make unpredictable, random looking keys that are reproducible on two locations on the planet at the same time. The keys are as long as the message I want to encrypt. If I can do that, then this system is Chef's kiss. Perfect. Now, that's hard to do. Like I said, cold War era suitcases full of stuff, the keys aren't long enough, so they start repeating them. You can even see in my playground, I repeated the key because the key wasn't long enough. And what the hell is the point if I can get you random bytes across the Internet to the other side of the globe that are just as long as the message I want to send. Like I now could just send the message like if I can get you keys where nobody else knows the key, why not just send you the message with that message system or whatever? Right? Like that's a wacky little existential dilemma, which I'll answer Monday. But for today, we're going to be in the Cold War era. One time pad. All right. Now this is called the one time pad. For a reason. The padding is just adding all the zeros and ones or whatever, fine. The one time, if ever I do it twice, the whole scheme is. So now here's the one time pad done twice and it stays flag. And this is where my love for this problem came from. It's because at the guts of computer science was word play. At the guts of the first task we had to do was crossword solvers. That's who Bletchley Park brought in little I played, I wanted to go to the Scrabble nationals. I trained with all these like hardcore Scrabble players and stuff, or whatever, and I was like doing good and I qualified for this tier of scrabble play. I thought, you know what, I'm going to do, I'm going to go down a tier, I'm just going to kick the shit out of them. I went down a ti what I found ladies who are really good at crosswords and they kick the shit out of me and it's like, wait, how's this happening? Why are they down here and not here? Why aren't the ladies better then? Well, because they had like a really defensive puzzly form of play, and I had to adapt. It took me a day to adapt. I was training against these high flyers up here. I throw down my bingos, and there's no room for any bingos against those gray hairs. Anyway, maybe it took me a day to adjust. I got better. Okay. This is where this gets beautiful to me. Plain text one or totally random key. You get something that looks totally random. Plain text two with a totally random key, and you get something that looks totally random. However, it's the same key. All right, here this is, I made a mess and a message that has a flag in it, and I sort them both with completely unpredictable 1,000 bytes of unpredictable randomness. And here it is for you, this is my messages encrypted with 1,000 bytes of randomness. All right, cool. Now it's your job to read my message because I screwed up. How did I screw up? I screwed up by hitting the back. Okay, here's what happens. The eavesdropper gets both cipher texts, just like you right here, or them together. What do I get? No, I get this plus this, Okay, mod two. Well, that's not readable exactly, but the key disappears. Key plus key is zero and anything plus zero is anything. If I add these to each other, what I get is plain text one. Or plain text two, is where my heart starts getting excited. That's the place where I really love thinking because that's where the scrabble lives. Why is that where the scrabble lives? Let's try. Yeah, They're on top of each other. They both begin at the same place. This is Allison Wonderland, Tale of Two Cities. And take a look at these numbers. Do these numbers look random to you? Yes. If you said no, it's because I socially engineered you too. But the look, really, I'm going to exore them with each other on my playground. It's like way too many bytes. So this is going to be wacky to mess with, but okay, fine, lots of bytes. Now take a look at this one. Does that look more random or less random than the inputs did? No, it looks way less random. Way less random. Why Just look at every other digit? Look how many zeros there are in a row. 0000f maybe. I don't know what they are is plain text or plain text. Let's now do my coin flip experiments. Again, you pick a random even or odd. You all picked even. Okay, fine. You all pick seven. All pick odd. Have each of you flip a coin. And if the coin is one, you add one coin tails, you add zero to your number, and then you tell me whether or not it is even or odd. But I rig the coin, now the coin always comes up heads. A double sided coin. What that means is that all of you are going to have the same result if you all pick seven. Because humans just always pick seven and you all do it with my fake coin, it doesn't look random anymore. This whole thing rested on structured or random looks random, but structured or structured is not random. That is, ask or ask ask X or ask the top half. The first nibble of every bite of ask is like small. It's always 432 or one ask stops at 01:27 The top bit is never a one, right? What that means is that I've got small or small every time for every other nibble here, look at that. 1004 is a little big, maybe. But it ain't. I will never see an F in one of the even numbered spots here. I'll never see an E or a D or, or I'll never say anything past eight. Best I'll ever see is a seven and that'll be rare most of the time. I'm going to see 01. That's 0134, maybe. All right. That ain't random anymore. That means that 34 of those possible nibbles are thrown out. Every other nibble, it's a little bit of a neural net thing. We're like, oh shit, that is no longer sensible. Okay, well now let's do something. Okay, I'm going to take this output, this is 1,000 bytes of structured or structured. I'm going to put it into Python. This is where I started to really love this thing from Pone import or cypher text equals this thing. Oh, okay. Cyphertext equals C, decode hex. All right, so here's like the first hundred bytes of that. Okay, Not readable. Not readable, but not random either. Okay, so this has a flag in it and this has two plain text messages predict something that I might have typed in my messages to you. Go ahead and give me a prediction. What is something that you might think that I would have said inside of my messages to you? Yeah. Ninja with a little brace, you know. All right. Oh, what I've said, and ninja for sure, because there's definitely a flag, right? Maybe the word flag. Maybe U D, maybe U, DCTF. Okay. All right. So I'm making a prediction of some text. Now. Remember this is the Heil Hitler situation now. Right, I can predict something. Now, when this was done, well, what did you read? You read random bytes from the key. When this is done poorly, what do you read? You read not random bytes, actual plain text bytes from the second message. That might give you more words to start guessing. And you can start using sentence structure and GPT kind like things in order to predict more and more and more of this sentence. To read the other sentence. Yeah, line. Maybe. Yeah, but this one is uniquely wordplay. I'm like looking for sensible sentences. I'm making a guess about the human nature of the person sending the message. I'm in the heart of like math Phd crypto making guesses about what's in the soul of my adversary. That's what I find so charming about it. All right, let's try this out. I'm going to do what we call crib is where I take real quick. I'm going to just make a little function called printable. It'll just take in like anything and just decide is that thing printable or does it have like ugly characters in it? I want no ugly characters just like in anything. If not in string printable, return false. Return true. Okay, right there's is printable. All right. I'm going to just cribdrag for I in range 1,000 plus the length of my prediction. I don't know my source or something. And then I'm going to try me will equal the Xor of that source and my prediction if is printable. I try me. Okay. Okay. So we're looking for something. Oh, I see. Udctfline 9421000 is probably too long. So we're going to go back to the beginning. Okay, Take a look at that one at spot 12. I see space study. All right, let's make a bigger prediction now. Nine, maybe this is going to show up in another place. Actually, let's take a look at the next one. That's like sensible. So 12 is sensible. Yeah, I wouldn't put it, I don't know, Maybe that 74, okay. Now. Yeah, exactly. Annual U D CTF for sure with spaces. And look how far apart they are. All right, so now take a look, I'm dragging, right, these things are repeating. I went 12-74 so what's 74 -12 62. 74 plus 602136. I'm jumping to 136 and seeing if I get something good again. Boom. Okay. All right. I can keep going, add 62 every time, but I'm going to read another little part of one of the two messages because the thing is looping because it wasn't long enough, like the red telephone Kremlin between the White House. All right, and each one of those is going to give me better and better guesses. Let's make a better guess now. Prediction equals what was one of our predictions, annual, UDCTF. All right. A little bit less. It's good. Oh, okay. All right. Was the next one somewhere in the one '30s or something? Oh, my gosh. Oh my gosh. 216. I am broken. Okay. All right. I'm reading flag, baby. I'm reading flag. And space is space ninja. What would you guess is before blank space is ninja. If I'm writing a message to you and is ninja? No, no, I'm not that arrogant. The flag is ninja. All right. Prediction equals the flag is ninja. Good morning study, our third annual. How far apart were those? 62. Let's go to like 124, right? Any problems? Okay, and you see why I find this so charming. It's like human, right? Right. In the guts of big random Cp. And all of your internet traffic is encrypted this way. All of your internet traffic is stuff or random. If ever they use the same key twice. And I'm aware that they might have used the same key twice. I can or together. And I'll get stuff or stuff not yet readable. Way more predictable. Okay? All right. I invite you to solve the rest of the flag. I'll give you my little. I'll just save this like solver one through 13 or something. I'll just kind of like share what we did together here. Okay. Cool. Cool. Cool. Oh, I'm a minute past time. There we go. Yeah. All right. All right. That is my introduction to the Or one time back? Yeah, I'll answer Monday. That's the realm of public key cryptography which is also a whole shit show. Rummy Cube.
XOR ROX and the One Time Pad
From Andrew Novocin October 27, 2023
4 plays
4
0 comments
0
You unliked the media.
Zoom Recording ID: 4159319948
UUID: N3659PNBT/6be8lJ8q++dg==
Meeting Time: 2023-10-27 01:08:07pmGMT
…Read more
Less…
- Tags
- Department Name
- ECE
- Department Division
- Date Established
- October 27, 2023
- Appears In
Link to Media Page
Loading