Question

So today I was doing what I sometimes do which is just program stuff for fun, and I decided to make my own encryption method. I think it’s a basic stream cipher. The thing is I know next to nothing about cryptography, so I don’t know how secure it is.

Here is the method (implemented in PHP)

public function encrypt($data)
{
    $keylen = sizeof($this->key);
    $i=0;
    $current = 0; //Current offset for the cipher
    $ascii = utf8_decode($data);
    $output = "";
    for ($i=0;$i<strlen($ascii);$i++)
    {
        //Moves the cipher offset based on the key and the value of what is being
        //encrypted
        $current += ord($ascii[$i]) + $this->key[$i % $keylen];
        $current = $current % 256;
        $output .= chr($this->cipher[$current]);
        //Moves the cipher offset to the value of the subsequent cipher key
        $current = $this->cipher[($current+1)%256];
    }
    return $output;
}

Explanations

$this->cipher a preshuffled array of all integer values from 0-255, each only showing once. (Effectively a one to one function, without any kind of pattern)

$this->key a 512 byte random key (Unlike the cipher array may contain repeated values)

The cipher and key used for decryption must be the same as the one used for encryption obviously to retrieve the plaintext.

Decrypt method

public function decrypt($data)
{
    $keylen = sizeof($this->key);
    $i=0;
    $offset = 0;
    $output = "";
    for ($i=0;$i<strlen($data);$i++)
    {
        $current = $this->r_cipher[ord($data[$i])];
        //Calculates the offset for the next iteration
        $next = $this->cipher[($current+1)%256];
        //Subtracts the calculated offset and key value
        $current -= $offset + $this->key[$i % $keylen];
        //Makes sure value is between 0 and 255
        $current = ($current+512)%256; 
        $output .= chr($current);
        $offset = $next;
    }
    return utf8_encode($output);
}

r_cipher is just the inverse function to the cipher function

http://pastebin.com/KbvHZnD1 Examples of the algorithm in use, gives the sample key and cipher as well as several examples

Answer 1

Since it’s a streamy cypher, key reuse is probably very problematic.

---

$output .= chr($this->cipher[$current]);
$current = $this->cipher[($current+1)%256];

This implies that the state of current after this character is simply a permutation of the output byte.

So whenever one looks at two values that are a multiple of 512 bytes apart, have the same preceding output, and the input at that position is the same the output will be the same. That’s a clear deviation from ideal cypher properties.

---

If you encode all 256 get the content of cypher apart from an offset on the index. After this you’re reduced to a 512 byte caesar cypher.

Combining these two weaknesses you get a full key recovery on a known plain-text of a few hundred kB.