Hacker News new | ask | show | jobs
by vermilingua 1567 days ago
Which would slow down inspection by a factor of 25 if it were to check the whole keyspace.
2 comments

There is no special limit of 25 possible keys.

The keyspace is essentially infinite, because of 2 things:

1 you don't have to worry about control bytes (aka "binary")

2 unicode

rot13 using 1/2 of the 26 letter English a-z alphabet is just an arbitrary limit for visual appearance and limitation of the channel in bbs/newsgroup posts.

Things like rot18 and rot47 already widen the alphabet significantly up from 26 to include numbers, punctuation, and more of the "printable" ascii from 0-127, while still avoiding control bytes like null etc.

But this example is using rot13 in a channel passing binary data already, so there is no point avoiding the control bytes like null etc.

So without going to unicode the limit would already be 255.

But the alphabet, and thus the key space, is practically infinite with unicode. Merely your bandwidth goes down when you get to say, 16 encoded bytes per plaintext byte.

In fact, you don't even need to bother 'rotating' anything, you can just pick a random number anywhere from 1 to the zillions, and simply add that number to the plaintext values and subtract from the ciphertext. Rather than rotating, it's just transposing, but that's all rotating is anyway.

You don't even need to install any package like bsdgames either. You can do the encode/decode directly in bash, not even very many lines.

Where does the keyspace come from? rot13 has no keys.

Of course you could do rot2 - rot24 and all the other combinations. Is that were the factor 25 comes from?

The deep inspection needs to look only at the first couple of bytes of each new a TCP connection. So it's not that disrupting. After 2 bytes you can already skip for a vast fraction of other traffic.

You'r right, the rot13 command is a shell wrapper around: ` exec /usr/bin/caesar 13 "$@" ` Forcing the key to be 13. You can obviously invoke /usr/bin/caesar with any of the 25 keys.
The underlying tool (caesar) will infer the key if you forget to pass it in. It does so without brute forcing.

Applying this to DPI wouldn't be too bad.