🚀 go-pugleaf

 My thanks to those who remind me that each byte has eight bits.
 The values should be 95^1024 keys, controlling 2^8192 possible
 cipherings.  But I'm not sure it matters much.

 Now that I think about it, Mass Encryption is odd in that the
 User Key is so closely connected to the internal key.  Of course,
 any cipher can be insecure with a short key, but the difference
 here is that the User Key is so directly related to the ciphering
 process itself.  Whereas a short key in other ciphers may select
 in a well-distributed fashion from a small number of choices
 hidden among all the possible cipherings (and even this is weak),
 in this cipher a short key means that only a small portion of the
 cipher is really unique.  The rest of the cipher is functionally
 derived from the unique portion which is exposed to attack.

 Whereas in other ciphers a User Key selects a particular
 ciphering as a unit, in this cipher *each character* in the User
 Key *independently* selects a portion of the cipher, a known
 particular byte.  This means that individual characters of the
 User Key can be isolated and attacked separately.  This is unusual
 and very weak.

 Indeed, each User Key character may control *several* particular
 bytes, due to the key expansion formulas; such bytes could be
 anagrammed in an attempt to find a single solution for the
 associated key character, independent of the rest of the key.

 When selections are poorly distributed, the number of possible
 cipherings tells the wrong story.  For example, Simple Substitution
 on 26 letters should select from 26! (that's about 2^88) possible
 cipherings.  Nevertheless, people somehow manage to solve these
 ciphers virtually by examination.  Trial-and-error occurs, but it
 is not a *random* sort of trial-and-error; it is instead directed
 by probable words and probable adjacent characters.  For solution
 purposes, each letter of the substitution key can be worked on
 separately, most of the time.

 Evaluating the number of possible cipherings is useful only to the
 extent that other attacks have been eliminated, and brute force
 remains as the only available attack.  But that is not the case in
 Simple Substitution, and that is not the case in Mass Encryption
 either.

 ---
 Terry Ritter   ritter@cactus.org