256bit Keys For Strong Encryption

Techniques for identifying keys that resist brute-force and dictionary attacks. Includes Delphi source for analyzing keys, converting passphrases to keys and permuting keys.

[256bit Keys For Strong Encryption]

// source code at bottom

The security of any good cryptosystem relies on the key. No matter how large a key, there will be an imposing decrease in security if it is poorly used by the software. Keys should be measured according to the bits of entropy contained within them, and simple keys should be disallowed. They should contain many different characters, and have no discernable patterns. Only when these conditions are met will a key withstand dictionary and brute force attacks.

A key's entropy measures the amount of unpredictable bits.

Considering users will usually only use alpha-numeric characters, you should only use the minimum number of bits possible to represent that key. Using 8 bits per character means there are 256 different characters available. An attacker knows the user will only use alpha-numeric characters (62 characters, 6 bits), and will not bother testing for the 194 other characters. A practical technique is to convert each character (1 byte) into a 6bit number, and concatenating then next to each other. You could allow only lower case letters and a few numbers and reduce each character to 5bits (32 characters). It is important to demand the user to use passwords that are larger to achieve the same key size. With this said, an 8 character key should not be considered to be 64bits, but in fact 48bits (6bits x 8 characters). Keys with low entropy pose a security threat no matter how well designed the rest of the system is designed.

Short, one-word keys should not be tolerated within a cryptosystem. Even if you optimize entropy, there simply isn't enough key data in a 5 character key to withstand a brute force attack. A 30bit key (6bits x 5 characters) only allows a possibility of a few billion keys, which only takes a few hours to exhaust on a powerful computer. A key of at least 128bits should be required for sesitive data; this ensures a span of a few years before the need arises for a new and longer key. At 6bits per character this means the key should be 22 or more characters long. This may seem large, but nothing stops you from using phrases. As an example lets look at the phrase "ThE ElevatoR WaS GoinG UP", it is 25 characters long. The key is 150 bits long, but still easy to remember. All keys should be dealt with in this manner. There is no excuse for allowing a user to use an 8 character key and compromising the entire cryptosystem.

A key provides better resistance against algorithmic searches when it contains many different characters. If the key is 22 characters long, but only contains 4 different characters, then it is severely weak. To keep things simple, at least half the characters in a key should be different (22 character key should have at least 11 different characters). More different characters in a key make it harder to statistically predict the next character. Although such an attack is unlikely, there is no room for error. Preventing all known types of attacks and anticipating breaches before-hand is of utter-most importance no matter how insignificant a risk may seem. A risk is always a risk. It is important to encourage users to have the most different characters they can remember in each key to make algorithmic searches yield no results.

Attackers love patterns, they make key searches and his life much easier. Users seem to think that keys like: "bingobingo" are more secure than those like: "bingo", but the fact is they are only slightly better. Smart attackers know all the tricks users devise to make their keys harder to guess. Using a word twice should be strongly discouraged. Oftentimes users add numbers at the end of the key, to make it less predictable. Unfortunately 80% of the time the number is 123, and the other 20% is 321. For an attacker to test these additional keys, he must also test with 123 added to each key, as well as 321. This means he has to search 3 times as many keys; this only represents a 1.5 bit increase instead of the 18bits 3 characters should offer. Testing keys for patterns can be a very complex obstacle, and will not be discussed in this paper. After obvious patterns have been disallowed it is wise to pass the key through a one-way hash function such as SHA or HAVAL. These functions take an input of data and create an out which has no solvable relationship to the input; for every possible input there is only one output. The output of these hash functions is seemingly random and will effectively disguise any discrete patterns.

Eliminating patterns makes it very difficult for an attacker to

search for weak keys.

//***** NOTES:

The source bellow is part of a library in progress cummulating 3 years of research. It's meant to be an example, but if you want to use it in a program, a little bit of credit would be nice.

These key routines have been optimized and re-written a dozen times, I've tried to comment as best I could. The procedure structures may seem odd because I originaly wrote them in C++. The pseudo random number generator comes from an unknown source, and this implementation of haval is a [severe] modification of David Barton's haval.pas found in the DCPcrypt 1.3 component suite. I used context encapsulation so that the procedures wouldn't have to be instantiated in a multi-threaded environment (server maybe?).



Transforms a key into another by expanding and compressing. No previous keys can be determined by the current key, but all the succeeding keys can be. This is usefull for adding entropy to a key (so that there are no shortcuts to brute searches) or for sessions which may need to use multiple session-keys.


Converts a string with 64 possible characters: 'a'-'z', 'A'-'Z', '0'-'9', '_' and '.' into a 256bit by leaving out 2 bits from every character (64 chars only need 6bits to represent each, instead of 8bits for 256 chars), and then uses MutateKey to add entropy.


Examines a key's entropy by searching for patterns, counting the bits needed per character, evaluation 0/1 (binary) distribution, and derives a summative rating of the key measured in bit-length.

(a complete example of this can be found at http://www.geocities.com/drmungkee/software/codebase.html)

//******************* UNIT BEGINS HERE ****************************************

unit keyfunc;



   key256=array[0..7]of longword;


      r:array[1..97]of real;







      hash:array[0..7]of longword;

      hashbuffer:array[0..127]of byte;














procedure MutateKey(var key:key256);

function PasswordToKey(pass:string):key256;

function AnalyzePassword(pass:string):KeyStatistics;


const BIT_MASK:array[0..7]of byte = (1,2,4,8,16,32,64,128);












// Haval


// Derived from David Barton's haval.pas (DCPcrypt 1.3 component suite)



procedure HavalCompress(ctx:THaval_CTX);

   function rr32(x:longword;c:longint):longword;register;assembler;


      mov ecx,edx

      ror eax,cl


   procedure r1(var x7,x6,x5,x4,x3,x2,x1,x0:longword;const w:longword);

   var t:longword;





   procedure r2(var x7,x6,x5,x4,x3,x2,x1,x0:longword;const w,c:longword);

   var t:longword;


      t:=(x3 and(x4 and(not x0)xor x1 and x2 xor x6 xor x5)xor x1 and(x4 xor x2)

         xor x0 and x2 xor x5);



   procedure r3(var x7,x6,x5,x4,x3,x2,x1,x0:longword;const w,c:longword);

   var t:longword;






   procedure r4(var x7,x6,x5,x4,x3,x2,x1,x0:longword;const w,c:longword);

   var t:longword;


      t:=(x3 and(x5 and(not x0)xor x2 and(not x1)xor x4 xor x1 xor x6)xor x2

         and(x4 and x0 xor x5 xor x1)xor x0 and x1 xor x6);



   procedure r5(var x7,x6,x5,x4,x3,x2,x1,x0:longword;const w,c:longword);

   var t:longword;


      t:=(x1 and(x3 and x4 and x6 xor(not x5))xor x3 and x0 xor x4 and x5

         xor x6 and x2);



var t7,t6,t5,t4,t3,t2,t1,t0:longword;

    w:array[0..31] of longword;











   r1(t7,t6,t5,t4,t3,t2,t1,t0,w[ 0]);

   r1(t6,t5,t4,t3,t2,t1,t0,t7,w[ 1]);

   r1(t5,t4,t3,t2,t1,t0,t7,t6,w[ 2]);

   r1(t4,t3,t2,t1,t0,t7,t6,t5,w[ 3]);

   r1(t3,t2,t1,t0,t7,t6,t5,t4,w[ 4]);

   r1(t2,t1,t0,t7,t6,t5,t4,t3,w[ 5]);

   r1(t1,t0,t7,t6,t5,t4,t3,t2,w[ 6]);

   r1(t0,t7,t6,t5,t4,t3,t2,t1,w[ 7]);

   r1(t7,t6,t5,t4,t3,t2,t1,t0,w[ 8]);

   r1(t6,t5,t4,t3,t2,t1,t0,t7,w[ 9]);























   r2(t7,t6,t5,t4,t3,t2,t1,t0,w[ 5],$452821E6);






   r2(t1,t0,t7,t6,t5,t4,t3,t2,w[ 7],$3F84D5B5);


   r2(t7,t6,t5,t4,t3,t2,t1,t0,w[ 0],$9216D5D9);




   r2(t3,t2,t1,t0,t7,t6,t5,t4,w[ 1],$2FFD72DB);


   r2(t1,t0,t7,t6,t5,t4,t3,t2,w[ 4],$B8E1AFED);

   r2(t0,t7,t6,t5,t4,t3,t2,t1,w[ 8],$6A267E96);


   r2(t6,t5,t4,t3,t2,t1,t0,t7,w[ 3],$F12C7F99);


   r2(t4,t3,t2,t1,t0,t7,t6,t5,w[ 9],$B3916CF7);




   r2(t0,t7,t6,t5,t4,t3,t2,t1,w[ 6],$71574E69);





   r2(t3,t2,t1,t0,t7,t6,t5,t4,w[ 2],$718BCD58);





   r3(t6,t5,t4,t3,t2,t1,t0,t7,w[ 9],$2AF26013);

   r3(t5,t4,t3,t2,t1,t0,t7,t6,w[ 4],$C5D1B023);




   r3(t1,t0,t7,t6,t5,t4,t3,t2,w[ 8],$8E79DCB0);












   r3(t5,t4,t3,t2,t1,t0,t7,t6,w[ 7],$55CA396A);

   r3(t4,t3,t2,t1,t0,t7,t6,t5,w[ 3],$2AAB10B6);

   r3(t3,t2,t1,t0,t7,t6,t5,t4,w[ 1],$B4CC5C34);

   r3(t2,t1,t0,t7,t6,t5,t4,t3,w[ 0],$1141E8CE);




   r3(t6,t5,t4,t3,t2,t1,t0,t7,w[ 6],$636FBC2A);





   r3(t1,t0,t7,t6,t5,t4,t3,t2,w[ 5],$AFD6BA33);

   r3(t0,t7,t6,t5,t4,t3,t2,t1,w[ 2],$6C24CF5C);


   r4(t6,t5,t4,t3,t2,t1,t0,t7,w[ 4],$28958677);

   r4(t5,t4,t3,t2,t1,t0,t7,t6,w[ 0],$3B8F4898);


   r4(t3,t2,t1,t0,t7,t6,t5,t4,w[ 2],$C4BFE81B);

   r4(t2,t1,t0,t7,t6,t5,t4,t3,w[ 7],$66282193);




   r4(t6,t5,t4,t3,t2,t1,t0,t7,w[ 6],$5DEC8032);






   r4(t0,t7,t6,t5,t4,t3,t2,t1,w[ 3],$D396ACC5);





   r4(t3,t2,t1,t0,t7,t6,t5,t4,w[ 8],$69C8F04A);



   r4(t0,t7,t6,t5,t4,t3,t2,t1,w[ 9],$F6E96C9A);

   r4(t7,t6,t5,t4,t3,t2,t1,t0,w[ 1],$670C9C61);


   r4(t5,t4,t3,t2,t1,t0,t7,t6,w[ 5],$6A51A0D2);







   r5(t6,t5,t4,t3,t2,t1,t0,t7,w[ 3],$7EFB2A98);








   r5(t6,t5,t4,t3,t2,t1,t0,t7,w[ 0],$3B8B5EBE);


   r5(t4,t3,t2,t1,t0,t7,t6,t5,w[ 7],$85C12073);


   r5(t2,t1,t0,t7,t6,t5,t4,t3,w[ 8],$56C16AA6);



   r5(t7,t6,t5,t4,t3,t2,t1,t0,w[ 5],$1BFEDF72);

   r5(t6,t5,t4,t3,t2,t1,t0,t7,w[ 9],$429B023D);




   r5(t2,t1,t0,t7,t6,t5,t4,t3,w[ 6],$49F1C09B);



   r5(t7,t6,t5,t4,t3,t2,t1,t0,w[ 2],$25D479D8);




   r5(t3,t2,t1,t0,t7,t6,t5,t4,w[ 4],$976CE0BD);

   r5(t2,t1,t0,t7,t6,t5,t4,t3,w[ 1],$04C006BA);















procedure HavalUpdateLen(ctx:THaval_CTX;len:longword);


   inc(ctx.lenlo,(len shl 3));

   if ctx.lenlo<(len shl 3)then inc(ctx.lenhi);

   inc(ctx.lenhi,len shr 29);


procedure HavalFlush(ctx:THaval_CTX);








procedure HavalInit(ctx:THaval_CTX);












procedure HavalUpdate(ctx:THaval_CTX;const Buffer; Size: longint);

var p:^byte;



   p:[email protected];

   while size>0 do








      end else








procedure HavalFinal(ctx:THaval_CTX;var digest);



   if ctx.index>118 then HavalCompress(ctx);

   ctx.hashbuffer[118]:=((HASH_SIZE and 3)shl 6)or(5 shl 3)or 1;

   ctx.hashbuffer[119]:=(HASH_SIZE shr 2)and $FF;




   move(ctx.hash,digest,HASH_SIZE div 8);






procedure PrngInit(ctx:TPrng_CTX;seed:longword);

var i:byte;


   ctx.x1:=(seed+PrngC1)mod PrngM1;

   ctx.x1:=(ctx.x1*PrngI1+PrngC1)mod PrngM1;

   ctx.x2:=ctx.x1 mod PrngM2;

   ctx.x1:=(ctx.x1*PrngI1+PrngC1)mod PrngM1;

   ctx.x3:=ctx.x1 mod PrngM3;

   for i:=1 to 97 do


      ctx.x1:=(ctx.x1*PrngI1+PrngC1)mod PrngM1;

      ctx.x2:=(ctx.x2*PrngI2+PrngC2)mod PrngM2;




function Prng(ctx:TPrng_CTX):longword;

var i:longword;


   ctx.x1:=(ctx.x1*PrngI1+PrngC1)mod PrngM1;

   ctx.x2:=(ctx.x2*PrngI2+PrngC2)mod PrngM2;

   ctx.x3:=(ctx.x3*PrngI3+PrngC3)mod PrngM3;

   i:=1+(97*ctx.x3)div PrngM3;




procedure PrngFlush(ctx:TPrng_CTX);

var i:byte;





   for i:=1 to 97 do ctx.r[i]:=0;



// Key Routines


procedure MutateKey(var key:key256);

var i:byte;

    exp_key:array[0..1,0..7]of longword;





// *** [1]feed key as 8 seeds into PRNG to generate 16 longs

   for i:=0 to 7 do


      PrngInit(@ran_ctx,key[i]); //use key as seed data

      exp_key[0,i]:=Prng(@ran_ctx); //expand key

      exp_key[1,i]:=not Prng(@ran_ctx); //negate to reduce PRNG relationship


// *** [2]feed [1] as 64 bytes into SHA256

   for i:=0 to 7 do temp_key[i]:=key[i];


   HavalUpdate(@hash_ctx,exp_key[0][0],64); //feed expanded key as data


// *** [3]xor(^) [2] and [1] to produce the final key

   for i:=0 to 7 do key[i]:=key[i]xor temp_key[i]; //reduce HASH relationship


function PasswordToKey(pass:string):key256;

var i,j:integer;

    temp_chars:array[0..42]of byte;


    temp_key:array[0..31]of byte;




// *** [1]convert 8bit Chars to 6bit bytes

   for i:=1 to length(pass)do

      case byte(pass[i]) of

         97..122:temp_chars[i]:=byte(pass[i])-97; //if a..z assign 0-25

         65..90 :temp_chars[i]:=byte(pass[i])-39; //if A..Z assign 26-51

         48..57 :temp_chars[i]:=byte(pass[i])+4; //if 0..9 assign 52-61

       byte('.'):temp_chars[i]:=62; //if . assign 62

       byte('_'):temp_chars[i]:=63; //if _ assign 63


   key_size:=(length(pass)*6)div 8; //keysize with 6bit chars

// *** [2]append 6bit Chars to each other

   temp_pos:=0; //temp buffer position

   bit_pos:=0; //bit position

   for i:=0 to key_size-1 do //concatonate 6bit chars together



      for j:=0 to 7 do



            ((temp_chars[temp_pos] and BIT_MASK[bit_pos]) shr bit_pos) shl j);


         if bit_pos=6 then







// *** [3]make full 256bit key

   if key_size<44 then



      for i:=key_size to 43 do //fill in empty bytes


         temp_key[i]:=temp_key[j]xor i;




// *** [4]eliminate english language redundancy




function AnalyzePassword(pass:string):KeyStatistics;

var i,j:longword;

    key:array[0..1023]of byte;

    chars:array[0..255] of byte;





// *** [1]count keylenght


// *** [2]copy key to buffer

   for i:=0 to stat.KeyLength-1 do key[i]:=byte(pass[i]);

// *** [3]count char repetition

   for i:=0 to 255 do chars[i]:=0;

   for i:=0 to stat.KeyLength-1 do inc(chars[key[i]],1);

// *** [4]count different characters


   for i:=0 to 255 do if chars[i]<>0 then inc(stat.CharCount,1);

// *** [5]count charbits


   for i:=0 to 7 do if stat.CharCount > BIT_MASK[i] then inc(stat.CharBits,1);

// *** [6]count patterns






         if (key[i]=key[pat_pos])and(i<>pat_pos)then //if match is found


            inc(pat_len,1); //increment pattern size

            inc(i,1); //move to next char

            inc(pat_pos,1); //next char in pattern

         until (key[i]<>key[pat_pos])or(i=stat.KeyLength); //until pattern ends


      until (i>stat.KeyLength-1); //until finished searching for this pattern

      inc(pat_pos,1); //start new pattern with the next char

   until pat_pos>stat.KeyLength; //until all patterns have been searched

   if pat_len=0 then stat.Patterns:=0

      else stat.Patterns:=(pat_len*100)div stat.KeyLength;

// *** [7]count bit-differential



   for i:=0 to stat.KeyLength-1 do

      for j:=0 to 7 do

         if (key[i] and BIT_MASK[j])=0 then inc(zeros,1) else inc(ones,1);


// *** [8]count brutelength


// *** [9]count keysize


// *** [10]count rating := BL - ((((pat+dif) /2) /100) *BL)


      ((((stat.Patterns+stat.Differential)div 2)*stat.BruteLength)div 100);




(C)Copyright DrMungkee, 2001 (www.drmungkee.com, [email protected])


Share this article!

Follow us!

Find more helpful articles: