Add mink, version 20170614, to othersrc. From the README:
This is a small library and utility program which transforms input
data into output data, concealing and revealing along the way. Rather
than just do one round of encryption, this can do multiple rounds on
the same data. All kinds of bit and byte rotation, mirroring around a
diagonal, Xor, and AES are provided, including raw AES, and CBC, CTR,
EAX and GCM modes.
Small awk-like scripts are written to transform the data; the same
script is used in each direction.
Keys, IVs and AADs are specified in the script, or can be read from
the terminal, working from a prompt. This is true for strings used
to xor data.
Thus, to extract the original from a file that has already been
transformed, you need to know not only the keys/IVs/AADs being used,
you need to know all the arguments used for bitwise rotations,
repetitions of AES encryption, and order of transformations specified
in the script. To discourage timing attacks, random data is encrypted
a random number of times after each transformation in the script.
It may be best to describe this in a worked example:
% echo 'Input data' | mink -e 'bswap 32' > scrambled
% hexdump -C scrambled
00000000 75 70 6e 49 61 64 20 74 00 0a 61 74 00 00 00 00 |upnIad t..at....|
00000010
% mink -c 11 'bswap 32' scrambled
Input data
%
But mink is designed to work with multiple encryption transformations:
% echo 'Input data' | mink -e 'bitrotr 3; bswap 32' > encrypted
% hexdump -C encrypted
00000000 ab 83 73 4a 0b 23 01 a3 00 50 0b a3 00 00 00 00 |..sJ.#...P......|
00000010
% mink -c 11 'bitrotr 3; bswap 32' encrypted
Input data
%
And the instructions are usually entered into a file, for ease of use of
decryption:
% cat 1.mink
bitrotr 3
bswap 32
% echo 'Input data' | mink -e -f 1.mink > encrypted
% mink -f 1.mink -c 11 encrypted
Input data
%
However, the main way that mink shines is when using more advanced methods
of (symmetric) encryption. And, for these, we need keys and IVs:
% sed 15q < /usr/share/dict/words > in
% wc in
15 15 92 in
% cat 2.mink
setkey 0 "key number one"
setkey 1 "IV?"?
bitrotr 3
aes128-ctr 0 1 2367
%
After the first 2 commands, we have a 92byte file to work with. We
also have introduced 128 bit AES in CTR mode, using 2 keys, and
running for 2367 repetitions. The "setkey" lines set up the strings
to be used for keys and IVs. Hex escapes (\xAB) can be used to
express 8bit entities. If a setkey string is followed by a question
mark, the string is taken to be a prompt, and the user is asked to
enter the string. getpass(3) is used for this. Strings are assigned
to numeric slots, which do not need to be contiguous or sequential,
but are easier to remember that way. The invocation of aes128-ctr
above means "use string in slot 0 as the key", use the string input by
the user as an IV, and repeat the ctr encryption 2367 times.
% mink -e -f 2.mink -o encrypted in
IV?
% hexdump -C encrypted
00000000 c2 16 39 77 9c 98 fd 4d 52 d0 27 17 35 03 e4 f0 |..9w...MR.'.5...|
00000010 15 5c a0 78 ad 19 77 21 c4 f0 f9 e3 ee a5 b4 1c |.\.x..w!........|
00000020 bd 37 06 ad a4 d6 53 f8 ed de 12 8c 05 95 cc 55 |.7....S........U|
00000030 c4 08 fd cb 8c 1f b5 af 7c 00 50 75 04 d1 2e 3b |........|.Pu...;|
00000040 63 70 53 5e ba 8b 41 42 2f 3e aa 81 fe 48 5c e7 |cpS^..AB/>...H\.|
00000050 a9 7c 8a 33 13 d4 d9 af fe 6a d4 be 3e c5 7d 9f |.|.3.....j..>.}.|
00000060
% mink -f 2.mink -c 92 encrypted
IV?
A
a
aa
aal
aalii
aam
Aani
aardvark
aardwolf
Aaron
Aaronic
Aaronical
Aaronite
Aaronitic
Aaru
% # the user entered the wrong IV in the next invocation of mink
% mink -f 2.mink -c 92 encrypted | hexdump -C
IV?
00000000 21 82 48 b5 93 dd c9 c9 47 56 10 ee 98 43 ab 91 |!.H.....GV...C..|
00000010 53 96 b3 3d 61 9a fc 87 5a 8f 06 d9 0b 40 47 1d |S..=a...Z....@G.|
00000020 8f 00 95 89 ef 79 7a ed c5 fa 5b 01 0c 8f 58 8c |.....yz...[...X.|
00000030 f8 11 52 fe d9 86 4b fa 71 a8 8b 6b 6f d6 59 31 |..R...K.q..ko.Y1|
00000040 ad 29 60 64 ba 27 e0 d2 3c 4c f2 6d 39 11 cd f4 |.)`d.'..<L.m9...|
00000050 8c b3 dc d3 b8 5e d0 48 6e ee 99 61 |.....^.Hn..a|
0000005c
%
Please also note that the number of repetitions for operations is important:
% mink -v 0=zero -v1=two -e 'aes256-ctr 0 1 1330' Makefile | hexdump -C
00000000 31 3b 82 97 22 e4 ef 26 a7 f3 61 66 02 81 94 4c |1;.."..&..af...L|
00000010 12 9f a5 63 cf 95 68 ab 00 46 c3 cd b7 c3 35 f4 |...c..h..F....5.|
00000020 0d 99 cb 11 c8 0c df ff 88 85 54 7a e9 4c 66 7b |..........Tz.Lf{|
00000030 cd b5 7d 27 c0 45 70 d8 cd 85 dc 2c 11 e7 df 07 |..}'.Ep....,....|
00000040 aa e2 06 d1 85 a8 96 8d 4f d6 f4 8d ab 22 4a b4 |........O...."J.|
00000050 12 60 30 31 43 63 5c 73 36 1e d6 77 21 6d ff 9e |.`01Cc\s6..w!m..|
00000060 7c 6e 52 65 7e 4c 6b d3 4d 8c 5d 2f e3 6c 87 b9 ||nRe~Lk.M.]/.l..|
00000070 87 d6 f6 ad 84 f9 22 72 d3 46 80 7c ce fb 87 2b |......"r.F.|...+|
00000080 b0 7f 89 13 73 5a 3e 75 b3 37 60 cf e7 a0 65 4e |....sZ>u.7`...eN|
00000090
% mink -v 0=zero -v1=two -e 'aes256-ctr 0 1 1331' Makefile | hexdump -C
00000000 c3 0e b6 08 d1 56 0b 18 c5 2a 80 97 d2 64 85 b2 |.....V...*...d..|
00000010 d1 42 b8 92 33 00 fd c5 ae ae a8 c5 8f 50 ce 3f |.B..3........P.?|
00000020 18 64 ea fc f8 06 17 ae 62 9e c2 eb 1d d3 4d 84 |.d......b.....M.|
00000030 15 bb b4 da 6a 0c b4 3b fe 4e 55 41 4e 43 75 64 |....j..;.NUANCud|
00000040 62 70 ad 45 fd 06 5a 87 dc 0d 62 71 9b 0d ab d7 |bp.E..Z...bq....|
00000050 0f ba ab 64 28 10 f5 fb fd 05 60 9e 89 38 f2 e9 |...d(.....`..8..|
00000060 e6 fd 78 76 24 f3 da 82 f3 22 94 bb 8b 30 92 d7 |..xv$...."...0..|
00000070 5f 38 94 16 f4 d9 02 2b 89 37 49 e6 f3 93 23 be |_8.....+.7I...#.|
00000080 34 f7 43 c2 c3 69 ec 93 76 62 f0 ba c1 2c 96 00 |4.C..i..vb...,..|
00000090
%
After the data has been encrypted by mink, anyone wanting to read the
original data needs to know ALL of:
1. the exact statements of the transformation script, i.e. the bitrotr, bswap,
aes128/256 commands
2. the order of these commands - for example, AES encryption before
using a bit rotation will produce a different result to that where the
same bitwise rotation is done before AES:
% echo 'Input data' | mink -e 'setkey 0 "key"; setkey 1 "iv" ; aes128 0 1 3; bitrotr 4' | hexdump -C
00000000 ef b3 4e 04 a1 13 47 01 3b 16 d9 66 ef 3a da 00 |..N...G.;..f.:..|
00000010
% echo 'Input data' | mink -e 'bitrotr 4; setkey 0 "key"; setkey 1 "iv" ; aes128 0 1 3' | hexdump -C
00000000 89 36 80 e8 32 4d 74 62 2c 9a 02 ea 28 a9 74 6b |.6..2Mtb,...(.tk|
00000010
3. The keys and IVs used for any AES operations, and any AAD used in
AEAD transformations such as EAX or GCM, or strings used in XOR
transformations
4. The number of repetitions of AES encryption to perform
Arbitrarily complex scripts can be used, which would help if proof of work
is to be a part of the data transformation.
The list of transformation methods is as follows:
aes(128|256)-cbc key iv reps
aes(128|256)-ctr key iv reps
aes(128|256)-eax key iv aad reps
aes(128|256)-gcm key iv aad reps
aes(128|256) key
bitrotl nbits
bitrotr nbits
byteswap nbits
diagonal number
reverse
rol nbytes
ror nbytes
xor string
In addition, these transformations can be further specified to apply
to a range of input data - the offset and length can be appended to
each of the instructions above, using the form off:n len:m, where n
and m are both decimal integers.
After every instruction is executed, a random number of iterations of
AES encrypting random data are performed. This is intended to
minimise the effect of timing attacks.
Alistair Crooks
Wed Jun 14 18:08:15 PDT 2017
UnifiedSplitRaw
