News for hackers. Stuff that matters.

A comment on A JPEG that becomes a PNG after AES encryption and a PDF after 3DES decryption. Parent comment

Re:A JPEG that becomes a PNG after AES encryption and a PDF ... by gizmo686 on Thursday September 11, 2014 @10:58PM (#8306399)
I didn't check this demo in particular, but I have seen this trick before. The first observation needed is that you can insert an arbitrary block of data into the picture without changing how it renders. The second observation is that AES is a symmetric algorithm, meaning decryption is the same operation as encryption. Using this, you can encrypt the PNG, and embed the result in the unencrypted JPEG. Then, when you encrypt the JPEG, you encrypt the embedded PNG.

There are a couple of complications to this. The major one is that both formats require correct data near the begging of the file. The size of this region is small enough that it is feasible to brute force passwords until you find one that works.

[ Parent | on HN ]
Re:A JPEG that becomes a PNG after AES encryption and a PDF ... by mehrdada on Friday September 12, 2014 @01:00AM (#8306657)
You get the definition of "symmetric" wrong. Symmetric encryption refers to using the same key for encryption and decryption, as opposed to asymmetric, aka public-key encryption. By no means AESEncrypt and AESDecrypt are the same functions.

That said, some encryption modes employing AES, like AES in CTR mode, are based on generating a pseudo-random keystream and XORing it with cleartext to get the ciphertext. The inverse of that operation is itself, but that has nothing to do with the term "symmetric encryption". This particular case uses AES in CBC mode, which is not symmetric in that sense.

[ Parent | on HN ]
Re:A JPEG that becomes a PNG after AES encryption and a PDF ... by cbsmith on Friday September 12, 2014 @01:50AM (#8306744)
There is a difference between "symmetric key encryption" and "symmetric encryption".
[ Parent | on HN ]
Re:A JPEG that becomes a PNG after AES encryption and a PDF ... by dlitz on Friday September 12, 2014 @04:25AM (#8307084)
Is there? The usual term for what you're describing is a "stream cipher" or a "streaming-mode cipher".
[ Parent | on HN ]
Re:A JPEG that becomes a PNG after AES encryption and a PDF ... by zamalek on Friday September 12, 2014 @05:02AM (#8307183)
I think the objection here comes from not stating that it's AES in CTR mode.

AES is not a symmetric algorithm, AES in CTR mode is.

[ Parent | on HN ]
Re:A JPEG that becomes a PNG after AES encryption and a PDF ... by cbsmith on Friday September 12, 2014 @06:24AM (#8307352)
The other poster was talking about a stream cipher...

However, I'd point out that DES is a block cipher (thought it can be turned in to streaming cipher much like AES), and its decryption is encryption is with the keys in reverse order. This is how triple-DES can work as it does.

[ Parent | on HN ]
Re:A JPEG that becomes a PNG after AES encryption and a PDF ... by nightcracker on Thursday September 11, 2014 @11:03PM (#8306407)
AES encryption is not the same as decryption.
[ Parent | on HN ]