LlXorBase64/ja - Revision history

Misaki Vanilla at 22:05, 22 November 2023

2023-11-22T22:05:57Z

← Older revision		Revision as of 15:05, 22 November 2023
Line 84:		Line 84:
	\|also_articles=		\|also_articles=
	\|notes=		\|notes=
	===~~Implementation~~===		===実装===
	~~The~~ XOR ~~is performed by converting each~~ Base64 ~~strings~~ {{LSLP\|str1}} ~~and~~ {{LSLP\|str2}} ~~into a byte arrays and then XORing the two byte arrays. Finally converting the resulting byte array back into~~ Base64 ~~and returning it to the user.~~		XOR は、各 Base64 文字列 {{LSLP\|str1}} および {{LSLP\|str2}} をバイト配列に変換し、それらの二つのバイト配列を XOR して行います。最後に、結果のバイト配列を再び Base64 に変換し、ユーザーに返します。

	~~However during the conversion to byte arrays the last~~ (bitcount % 8) ~~are discard. LSL treats~~ Base64 ~~strings as~~ 8~~-bit byte arrays, not arrays of 6-bit bytes.~~		ただし、バイト配列への変換時には最後の (bitcount % 8) が破棄されます。LSL では Base64 文字列を 8 ビットのバイト配列として扱います。6 ビットのバイトの配列ではありません。

	===~~Cryptography~~===		===暗号学===

	While the information provided in this section is by no means exhaustive, it should give the reader enough information that they can ask the right questions and guide their future reading. Writing cryptographic algorithms should not be attempted without an understanding of cryptography as the results may otherwise be disastrous.		このセクションで提供されている情報は決して網羅的ではありませんが、読者には十分な情報が提供され、正しい質問をすることや将来の読書をガイドすることができるでしょう。暗号アルゴリズムの作成は、暗号学の理解なしに試みてはならないことであり、そうでないと結果は壊滅的となる可能性があります。

	In cryptography, a ''secret'' is a bit of input information that is used to transform the cryptographic algorithm. The ''secret'' is not mutated with subsequent runs of the algorithm. A ''seed'' is also used to transform the algorithm but unlike the ''secret'' it does mutate; the method of mutation is part of the algorithm.		暗号学では、「秘密」は暗号アルゴリズムを変換するために使用される入力情報のビットです。この「秘密」は、アルゴリズムの後続の実行で変化しません。また、「シード」もアルゴリズムを変換するために使用されますが、「秘密」とは異なり変異します。変異の方法はアルゴリズムの一部です。

	~~To effectively use a secret and a seed you need to keep secret at-least two of the following:~~ '''1)''' ~~the algorithm,~~ '''2)''' ~~the seed, or~~ '''3)''' ~~the secret.~~		秘密とシードを効果的に使用するには、次のいずれかを少なくとも2つ秘密にしておく必要があります：'''1)''' アルゴリズム、 '''2)''' シード、または '''3)''' 秘密。

	Believe it (or not) that keeping your algorithm secret will not protect you. The attack vectors that can be used against XOR algorithms require little or no knowledge of the algorithm. The best protection is a strong algorithm that uses multiple secrets/seeds. In this way you can still satisfy the prior precondition by interpreting the numbered items as categories. Keep in mind how the secrets and seeds are used, an attacker need not determine the secrets, only intermediate static values and the relationship between intermediate values for the algorithm to be broken. Do not give the attacker secrets and seeds that render blocks of living code, static. The more information provide to the attacker, the simpler your algorithm becomes.		信じてもらえるかもしれませんが、アルゴリズムを秘密にしても保護されません。XOR アルゴリズムに対して使用できる攻撃ベクトルは、アルゴリズムに対するほとんどまたは全く知識が必要ないものです。最良の保護は、複数の秘密/シードを使用する強力なアルゴリズムです。これにより、前提条件を解釈することによって前提条件を満たすことができます。攻撃者に静的なコードのブロックを提供しないでください。攻撃者に提供する情報が多いほど、アルゴリズムは単純になります。

	====~~Best Practices~~====		====ベストプラクティス====

	~~As a cryptographic technique,~~ XOR is weak and there are several attacks that can be leveraged to determine the XOR inputs. Depending upon how the secrets are used cracking a single message could expose the input secrets, resulting in the derived algorithm being broken.		XOR は暗号技術としては弱いものであり、XOR 入力を決定するために利用できる攻撃がいくつかあります。秘密がどのように使用されているかによって、単一のメッセージを解読することが秘密を明らかにし、導かれたアルゴリズムが破られる可能性があります。

	~~Keep your secrets secret. Use a seeded trap door function to shake up the bits of the secret before using with the XOR and change the seed often.~~		秘密を秘密にしておくこと。XOR と使用する前に、ビットを振るうためにシードされたトラップドア関数を使用し、シードを頻繁に変更します。

	Do not XOR a value by two differing length values without knowing the implications. It may seem like a good idea but what it actually does is link the fields. While it will give you a longer key value (the {{Wikipedia\|Least Common Multiple\|w=n}} ~~in length), the fields will be linked such that there are really only as many fields as the~~ {{Wikipedia\|Greatest Common Divisor\|w=n}}~~. The number of unique fields determines the theoretical maximum number of keys an attacker has to try.~~		異なる長さの2つの値でXOR演算を行う場合、その影響を知っておくことなく実行しないでください。良いアイデアのように思えるかもしれませんが、実際にはフィールドをリンクさせることになります。これにより、より長いキー値（長さの {{Wikipedia\|Least Common Multiple\|w=n}}）が得られますが、フィールドは {{Wikipedia\|Greatest Common Divisor\|w=n}} だけ存在することになります。ユニークなフィールドの数は、攻撃者が試す必要がある理論上の最大キー数を決定します。

	Unique_Key_Fields = Greatest_Common_Divisor(lengths_of_keys) * number_of_keys		Unique_Key_Fields = Greatest_Common_Divisor(lengths_of_keys) * number_of_keys

	====~~Attack Vectors~~====		====攻撃ベクトル====
	~~First thing you need to know is that XOR is limited poly-alphabetic cipher. The attack vectors that work for poly-alphabetic ciphers work for XOR.~~		最初に知っておくべきことは、XOR は制限された多項式暗号です。ポリアルファベティック暗号に対して機能する攻撃ベクトルは、XOR に対しても機能します。
	* '''~~Probability~~''': In English, letters have different probabilities of occurring because of grammar and spelling rules. XOR does not hide the letter probabilities. This attack only works when the keys are many times smaller than the message.		* '''確率''': 英語では、文字は文法や綴りのルールにより発生する確率が異なります。XOR は文字の確率を隠さない。この攻撃は、キーがメッセージよりもはるかに小さい場合にのみ機能します。
	* '''UTF-8 ~~Rules~~''': ~~When you convert a string to~~ Base64, UTF-8 ~~encoding is used first. If you assume the inputs are valid~~ UTF-8 ~~encodes some bits can be determined purely upon examination. This is most useful in determining the length of the key.~~		* '''UTF-8 ルール''': 文字列を Base64 に変換するとき、まず UTF-8 エンコードが使用されます。入力が有効な UTF-8 エンコードであると仮定すれば、ビットのいくつかは観察だけで決定できます。これは主にキーの長さを決定するのに役立ちます。
	* '''~~Plain Text~~''': ~~The user captures outputs for known inputs can expose weaknesses in the key.~~		* '''プレーンテキスト''': ユーザーは既知の入力に対する出力をキャプチャすることで、キーの脆弱性を明らかにすることができます。
	* '''~~Brute force~~''': ~~Attacking the key, secret and~~/~~or seed~~		* '''総当たり攻撃''': キー、秘密、および/またはシードへの攻撃

	===~~How to decode with php~~===		===PHPでのデコード方法===
	PHP ~~script can be found in~~ [http://lslwiki.net/lslwiki/wakka.php?wakka=llXorBase64StringsCorrect LSL Wiki].		PHP スクリプトは [http://lslwiki.net/lslwiki/wakka.php?wakka=llXorBase64StringsCorrect LSL Wiki] にあります。
	~~An older version of the code can be found here:~~ [[User:SignpostMarv_Martin/LSL2/llXorBase64StringsCorrect\|llXorBase64StringsCorrect ~~in PHP~~]].		コードの以前のバージョンはこちらにあります：[[User:SignpostMarv_Martin/LSL2/llXorBase64StringsCorrect\|PHP での llXorBase64StringsCorrect]]。
			SignpostMarv のデコーダの PHP による実装。
	~~Implementation of~~ SignpostMarv~~'s decoder in~~ PHP.
	<source lang="php">		<source lang="php">
	<?php		<?php
Line 148:		Line 147:
	</source>		</source>

	===~~How to decode with java~~===		=== Java でのデコード方法 ===
	~~Remember to URLEncode your~~ BASE64 ~~hash if you transfer it vie~~ GET~~...~~		BASE64 ハッシュを GET 経由で転送する場合は、必ず URLEncode を行ってください。


	<source lang="java">		<source lang="java">
Line 194:		Line 194:
	</source>		</source>
	<div style="display:none;"><source lang="lsl2"> </source></div>		<div style="display:none;"><source lang="lsl2"> </source></div>
	~~\|history=~~*~~Added to LSL to fix the problems with~~ [[llXorBase64StringsCorrect/ja]] ~~(which was supposed to fix the bugs in~~ [[llXorBase64Strings]]~~), as reported in~~ {{Jira\|SCR-35}}.		* [[llXorBase64StringsCorrect/ja]]（[[llXorBase64Strings/ja]]のバグを修正するために追加されたもので、そのバグを修正するためのものでした）の問題を修正するためにLSLに追加されました。({{Jira\|SCR-35}})
	\|negative_index		\|negative_index
	\|cat1=Base64		\|cat1=Base64

Misaki Vanilla at 22:03, 22 November 2023

2023-11-22T22:03:20Z

← Older revision		Revision as of 15:03, 22 November 2023
Line 5:		Line 5:
	\|func=llXorBase64\|sort=XorBase64		\|func=llXorBase64\|sort=XorBase64
	\|return_type=string		\|return_type=string
	\|p1_type=string\|p1_name=str1\|p1_desc=Base64 ~~string~~		\|p1_type=string\|p1_name=str1\|p1_desc=Base64 文字列
	\|p2_type=string\|p2_name=str2\|p2_desc=Base64 ~~string~~		\|p2_type=string\|p2_name=str2\|p2_desc=Base64 文字列
	\|func_footnote={{LSLP\|str2}} ~~repeats if it is shorter than~~ {{LSLP\|str1}}~~. If the inputs are not~~ Base64 ~~strings the result will be erratic.~~<br/> ~~Be sure to read the~~ [[#Cryptography\|Cryptography]] ~~section before designing a cryptographic algorithm.~~		\|func_footnote={{LSLP\|str2}} は、{{LSLP\|str1}} よりも短い場合は繰り返されます。もし入力が Base64 文字列でない場合、結果は不規則になります。<br/> 暗号アルゴリズムを設計する前に [[#Cryptography\|Cryptography]] セクションを確認してください。
	\|func_desc=~~Correctly performs an exclusive or on two~~ {{LSLGC\|Base64}} ~~strings.~~		\|func_desc=正確には、二つの {{LSLGC\|Base64}} 文字列に対して排他的論理和 (XOR) を実行します。
	\|return_text=~~that is a Base64 XOR of~~ {{LSLP\|str1}} ~~and~~ {{LSLP\|str2}}.		\|return_text={{LSLP\|str1}} と {{LSLP\|str2}} の Base64 XOR です。
	\|spec		\|spec
	\|caveats=		\|caveats=
	* ~~During the conversion to a byte array the last <code>(bitcount % 8)</code> are discarded from both~~ {{LSLP\|str1}} ~~and~~ {{LSLP\|str2}}~~. See~~ [[#Implementation\|Implementation]] ~~for details.~~		* バイト配列への変換時に、{{LSLP\|str1}} と {{LSLP\|str2}} から最後の <code>(bitcount % 8)</code> が破棄されます。詳細については [[#Implementation\|Implementation]] を参照してください。
	\|constants		\|constants
	\|examples=<source lang="lsl2">default		\|examples=<source lang="lsl2">default

Misaki Vanilla at 20:15, 2 November 2023

2023-11-02T20:15:35Z

← Older revision		Revision as of 13:15, 2 November 2023
Line 1:		Line 1:
	{{LSL_Function		{{LSL_Function/ja
	\|inject-2={{Issues/SVC-289}}{{Issues/SCR-35}}		\|inject-2={{Issues/SVC-289}}{{Issues/SCR-35}}
	\|inject-3={{Issues/BUG-3763}}		\|inject-3={{Issues/BUG-3763}}
Line 194:		Line 194:
	</source>		</source>
	<div style="display:none;"><source lang="lsl2"> </source></div>		<div style="display:none;"><source lang="lsl2"> </source></div>
	\|history=*Added to LSL to fix the problems with [[llXorBase64StringsCorrect]] (which was supposed to fix the bugs in [[llXorBase64Strings]]), as reported in {{Jira\|SCR-35}}.		\|history=*Added to LSL to fix the problems with [[llXorBase64StringsCorrect/ja]] (which was supposed to fix the bugs in [[llXorBase64Strings]]), as reported in {{Jira\|SCR-35}}.
	\|negative_index		\|negative_index
	\|cat1=Base64		\|cat1=Base64

Misaki Vanilla: copy from english(Todo: need translate to japanese)

2023-10-08T05:38:46Z

copy from english(Todo: need translate to japanese)

New page

{{LSL_Function
|inject-2={{Issues/SVC-289}}{{Issues/SCR-35}}
|inject-3={{Issues/BUG-3763}}
|func_id|func_sleep=0.0|func_energy=10.0
|func=llXorBase64|sort=XorBase64
|return_type=string
|p1_type=string|p1_name=str1|p1_desc=Base64 string
|p2_type=string|p2_name=str2|p2_desc=Base64 string
|func_footnote={{LSLP|str2}} repeats if it is shorter than {{LSLP|str1}}. If the inputs are not Base64 strings the result will be erratic.<br/> Be sure to read the [[#Cryptography|Cryptography]] section before designing a cryptographic algorithm.
|func_desc=Correctly performs an exclusive or on two {{LSLGC|Base64}} strings.
|return_text=that is a Base64 XOR of {{LSLP|str1}} and {{LSLP|str2}}.
|spec
|caveats=
* During the conversion to a byte array the last <code>(bitcount % 8)</code> are discarded from both {{LSLP|str1}} and {{LSLP|str2}}. See [[#Implementation|Implementation]] for details.
|constants
|examples=<source lang="lsl2">default
{
state_entry(){

// Use a HARD password ! with caps nocaps numbers and symbols !
string pass = "P4s5Wo_rD";

string data = "I am some ver important data.";

// Enccrypting the data:
string crypt = llXorBase64(llStringToBase64(data), llStringToBase64(pass));

// Say the mess you made to Owner
llOwnerSay(crypt);

// DeCrypting the data and say back to owner:
llOwnerSay(llBase64ToString(llXorBase64(crypt, llStringToBase64(pass))));

}

}</source>
<source lang="lsl2">
// Stronger encryption - generates a random encrypted string.
//safe character set
string ASCII = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";

//convert integer to characters
string chr(integer i)
{
return llGetSubString(ASCII, i, i);
}

//for generating a random string.
string salt(integer amount) {
string salt = "";
integer i;
//for length of salt , generate characters
for(i = 0; i < amount; i++) {
salt += chr((integer)llFrand(llStringLength(ASCII)));
}
return salt;
}

default
{
touch_start(integer n) {
//generates a random salt to add to the string.
//put salt on the end so that even if the data is corrupted by SVC-6362, it is unimportant data
string data = "I am some very important data." + salt((integer)llFrand(5)+ 5);

string pass = "password";

// Encrypting the data:
string crypt = llXorBase64(llStringToBase64(data), llStringToBase64(pass));

// Say the mess you made to Owner
llOwnerSay(crypt);

// DeCrypting the data and say back to owner: Remember to remove the salt when needed ;)
llOwnerSay(llBase64ToString(llXorBase64(crypt, llStringToBase64(pass))));

}
}
</source>
|helpers
|also_functions
|also_events
|also_tests
|also_articles=
|notes=
===Implementation===
The XOR is performed by converting each Base64 strings {{LSLP|str1}} and {{LSLP|str2}} into a byte arrays and then XORing the two byte arrays. Finally converting the resulting byte array back into Base64 and returning it to the user.

However during the conversion to byte arrays the last (bitcount % 8) are discard. LSL treats Base64 strings as 8-bit byte arrays, not arrays of 6-bit bytes.

===Cryptography===

While the information provided in this section is by no means exhaustive, it should give the reader enough information that they can ask the right questions and guide their future reading. Writing cryptographic algorithms should not be attempted without an understanding of cryptography as the results may otherwise be disastrous.

In cryptography, a ''secret'' is a bit of input information that is used to transform the cryptographic algorithm. The ''secret'' is not mutated with subsequent runs of the algorithm. A ''seed'' is also used to transform the algorithm but unlike the ''secret'' it does mutate; the method of mutation is part of the algorithm.

To effectively use a secret and a seed you need to keep secret at-least two of the following: '''1)''' the algorithm, '''2)''' the seed, or '''3)''' the secret.

Believe it (or not) that keeping your algorithm secret will not protect you. The attack vectors that can be used against XOR algorithms require little or no knowledge of the algorithm. The best protection is a strong algorithm that uses multiple secrets/seeds. In this way you can still satisfy the prior precondition by interpreting the numbered items as categories. Keep in mind how the secrets and seeds are used, an attacker need not determine the secrets, only intermediate static values and the relationship between intermediate values for the algorithm to be broken. Do not give the attacker secrets and seeds that render blocks of living code, static. The more information provide to the attacker, the simpler your algorithm becomes.

====Best Practices====

As a cryptographic technique, XOR is weak and there are several attacks that can be leveraged to determine the XOR inputs. Depending upon how the secrets are used cracking a single message could expose the input secrets, resulting in the derived algorithm being broken.

Keep your secrets secret. Use a seeded trap door function to shake up the bits of the secret before using with the XOR and change the seed often.

Do not XOR a value by two differing length values without knowing the implications. It may seem like a good idea but what it actually does is link the fields. While it will give you a longer key value (the {{Wikipedia|Least Common Multiple|w=n}} in length), the fields will be linked such that there are really only as many fields as the {{Wikipedia|Greatest Common Divisor|w=n}}. The number of unique fields determines the theoretical maximum number of keys an attacker has to try.

Unique_Key_Fields = Greatest_Common_Divisor(lengths_of_keys) * number_of_keys

====Attack Vectors====
First thing you need to know is that XOR is limited poly-alphabetic cipher. The attack vectors that work for poly-alphabetic ciphers work for XOR.
* '''Probability''': In English, letters have different probabilities of occurring because of grammar and spelling rules. XOR does not hide the letter probabilities. This attack only works when the keys are many times smaller than the message.
* '''UTF-8 Rules''': When you convert a string to Base64, UTF-8 encoding is used first. If you assume the inputs are valid UTF-8 encodes some bits can be determined purely upon examination. This is most useful in determining the length of the key.
* '''Plain Text''': The user captures outputs for known inputs can expose weaknesses in the key.
* '''Brute force''': Attacking the key, secret and/or seed

===How to decode with php===
PHP script can be found in [http://lslwiki.net/lslwiki/wakka.php?wakka=llXorBase64StringsCorrect LSL Wiki].
An older version of the code can be found here: [[User:SignpostMarv_Martin/LSL2/llXorBase64StringsCorrect|llXorBase64StringsCorrect in PHP]].

Implementation of SignpostMarv's decoder in PHP.
<source lang="php">
<?php
/*
* Description: Implementation of SignpostMarv's php base64 decoder.
* Author: Kopilo Hallard
* License: http://creativecommons.org/licenses/by-sa/2.5/
*/

/* Cipher (s1 data, s2 key) */
function llXorBase64($s1, $s2) {
$s1 = base64_decode($s1); $l1 = strlen($s1);
$s2 = base64_decode($s2);
if($l1 > strlen($s2)) $s2 = str_pad($s2, $l1, $s2, STR_PAD_RIGHT);
return base64_encode($s1 ^ $s2);
}

$Skey = "password";
$para1 = $_POST["para1"];

$result = llXorBase64($para1, base64_encode($Skey));

echo "Encrypted Data: ".$para1.PHP_EOL;
echo "Unencrypted ".base64_decode($result);

?>
</source>

===How to decode with java===
Remember to URLEncode your BASE64 hash if you transfer it vie GET...

<source lang="java">
String BASE64datahash = "error";
String passhash = "error";

try {
//URLDecode the URL encoded encrypted data
BASE64datahash = java.net.URLDecoder.decode("KhoFRRYaAUMbEVU%3D", "UTF-8"); //KhoFRRYaAUMbEVU%3D
System.out.println("BASE64datahash: " + BASE64datahash); //KhoFRRYaAUMbEVU=

//create an array of BASE64 data
char[] BASE64data = BASE64datahash.toCharArray();
char[] dataUB = new String(new BASE64Decoder().decodeBuffer(new String(BASE64data))).toCharArray(); //BASE64 decode the data
System.out.println("encrypted data (but base64 decoded) [dataUB]: " + new String(dataUB));

//Encode the secred key/password to BASE64 (Just to show how to use BASE64Encoder)
//String BASE64password = new String(new BASE64Encoder().encodeBuffer("supersecretpassword".getBytes()));
//System.out.println("BASE64password: " + new String(BASE64password));

//create array of BASE64 key/password
//char[] key = BASE64password.toCharArray();
//char[] keyUB = new String(new BASE64Decoder().decodeBuffer(new String(key))).toCharArray();
char[] keyUB = "supersecretpassword".toCharArray();
System.out.println("plaintext key/password [keyUB]: " + new String(keyUB));

//XOR data array chars with corresponding key/password array chars
int k=0;
for (int i = 0; i < dataUB.length; i++) {
dataUB[i] = (char) (dataUB[i] ^ keyUB[k]);
k++;

//Loop to start of the key if the key is too short
if (k == keyUB.length)
k=0;
}

System.out.println("Decoded data [dataUB]: " + new String(dataUB));

} catch (Exception ex) {
System.out.println("Oops!");
}
</source>
<div style="display:none;"><source lang="lsl2"> </source></div>
|history=*Added to LSL to fix the problems with [[llXorBase64StringsCorrect]] (which was supposed to fix the bugs in [[llXorBase64Strings]]), as reported in {{Jira|SCR-35}}.
|negative_index
|cat1=Base64
|cat2=Encoding
|cat3
|cat4
}}