(archive 'newLISPer)

March 4, 2007

Out of the crypt

Filed under: newLISP — newlisper @ 23:39
Tags:

I enjoyed reading Ax0n’s article on encryption over at HIR Information Report. He used newLISP to demonstrate how to use newLISP’s encrypt command.

I don’t know much about encryption and security, so I usually rely on the built-in tools that are provided by the operating system – on the Mac that means the Keychain and encrypted disk images, which have always worked well for me – but then, I’m not a spy or a terrorist, and I’ve never had my computer stolen or confiscated by the Government.

I often think, though, that it would useful to have some simple encryption tools for use in more casual situations. I’m not fanatical about keeping secrets, but there’s definitely room for some tools that would stop the casual snooper or occasional visitor being able to get access to some of my more personal stuff, such as passwords and payment information. I doubt whether anything too simple and easy would deter a skilful and determined hacker or a Government agency. But you could always lose your computer, or have it stolen, and I suspect that a typical thief wouldn’t necessarily be a skilled code-breaker. So how about using newLISP to do a bit of on-the-fly encoding, to keep out the less-skilled nosy parker?

On the bottom of this web page you can see the text:

If you want to contact me, run the following through newLISP to see my email address:

(encrypt "TH^VDZJmD[N07YBD" ":-)")

This is basically all there is to using the encrypt command – you supply the string to be encrypted or decrypted, and a key. Since I’ve provided the key here, you can decrypt this easily by evaluating this expression in newLISP.

This function uses the XOR method, which is described in “Cryptography for Dummies” (I got it from the library this week) as a toy rather than a useful encryption tool. However, I can’t see that it’s particularly easy to crack – if you’ve just picked up someone’s laptop, you’re not going to be able to read a message encoded like this, at least, not immediately.

I thought it would be cool to write MacOS system services to encrypt and decrypt selected text (I’ve been writing about them recently. Here’s the encryption service:

#!/usr/bin/newlisp
(set 'raw-crypt-key (exec {osascript -e "tell application \"Finder\"
  activate
  set p to (display dialog \"Enter your key\" default answer \"\" giving up after 10 with hidden answer)
  if button returned of p is \"OK\" then
    text returned of p
  end if
end tell"})
)
(unless (string? (set 'crypt-key (first raw-crypt-key)))
    (exit))
(while (read-line)
  (println (base64-enc (encrypt (current-line) crypt-key))))
(exit)

The bulk of this script is just some AppleScript to get the key. The ‘with hidden answer’ option for display dialog does that “bullets instead of characters” thing, to give the illusion of secrecy.

The decryption service is almost identical, of course, although we want to apply base64 decoding first, before running encrypt:

(println (encrypt (base64-dec (current-line)) crypt-key))

These services can be easily used in any application, such as a diary or notebook: just select some text, type the key when prompted (and remember it!) and just the selection is encrypted or decrypted. Let’s try it on the next paragraph:

cw1NX05AXkhNGllGGlhaXw0DWExaXxsdF0hHWQcJW14JTUhFVg1LX05IT15MGgdMVE5bQ11dEA1KW0MJXUhHX19ITkgJSVlbW0NOXw0=
WUVISExKTkhbSQEJW0NNGllBX15MGkBAXUVdGlhZSUhdGllBXw1ISl1FU05ITkRGVA1QVVgOSEgJTUJbUURHXQ1AVAM=

Yes – that looks sufficiently cryptic to scare off the less determined snoopers, and the key is easy to remember :-) Of course, by using short keys that you can remember (and enter) easily, you’re compromising security. And doing each line separately is probably a big weakness, too. But then, if you’re paranoid about keeping secrets, you’ll be using some proper heavy-duty encryption tools instead. I figure that this level of encryption is enough to baffle the typical unwelcome visitor to your secret files!

Advertisements

Leave a Comment »

No comments yet.

RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Blog at WordPress.com.

%d bloggers like this: