🚀 go-pugleaf

A week or so ago I posted code for turning any one-way hash function into a CFB
encryption algorithm.  I've looked at it a bit more, and made a few
improvements (as well as fixing a bug in the original code).  To recap, the
cipher used MD5 as its one-way function, with the resulting algorithm being
called MDC.  The output of MDC was made key-dependant by replacing the
predefined Mysterious Values with ones derived from a user-supplied key.

I believe that using a one-way hash function in this manner makes more sense
than using a true cipher since, when used in CFB mode, the cipher is simply
acting as a hash function anyway.

The transformation is in fact somewhat more complex than this, since MD5 uses
both the 'input' and 'output' data in its transformation, and reduces 64 bytes
of input to 16 bytes of output.  It works as follows:

      in[ 64 ] + out[ 16 ] -> out'[ 16 ]
	data    previous MD   current MD

This problem is resolved by initially setting out[ 16 ] to the IV, and in[ 64 ]
to zeroes.  Then, once the MDC constants have been set, we set in[ 64 ] to
values derived from the key.  This means that even chosen plaintext attacks can
only resolve 16 of 80 bytes of input.  Thus the best attack possible is a
20%-chosen plaintext attack (128 bits known, 512 bits unknown).  What we are
doing is as follows (for a chosen-plaintext attack):

       [ 16 bytes ]  +  [ -------- 64 bytes -------- ]

	16 bytes -         64 bytes - derived from
	 chosen           encryption key and unknown
      
			|       |
		    +---------------+
		    |               |
		    |      MDC      |   Unknown one-way transformation
		    |               |
		    +---------------+
			|       |
			\       /
			  \   /
			    v

		      [ 16 bytes ]
		 
		       16 bytes -
			 known

We are transforming a 640-bit input value of which 128 bits are known, to a
128-bit output value via the MDC tranformation, a one-way hash function which
is controlled by a user-supplied key.

In fact, this can be refined even further by using in[ 64 ] as the key, and
repeatedly transforming out[ 16 ] to out'[ 16 ] with it (with the initial
setting of out[ 16 ] being the IV value).

Thus we have two possibilities (with chosen-ciphertext attack shown below):

    in[ 64 ] + out[ 16 ] --MDC--> out'[ 16 ]
    unknown     chosen   unknown    known

and

    in[ 64 ] + out[ 16 ] --MD5--> out'[ 16 ]
    unknown     chosen    known     known

Question:  Is the use of the unknown-transformation MDC necessary?  In other
words, do the 64 unknown bytes used with the known-transformation MD5 give
enough security?  If they do, this has interesting possibilities, since MD5 is
a MAC system and therefore not covered by the ITAR restrictions....

Comments, flames, etc to pgut1@cs.aukuni.ac.nz.