Okay, so ShadowCrypto is dead now, in the same grave as the RICE# series. And no more custom encryption by me.
dankrause brought up a good point: I don't have nearly enough entropy in the keys to encrypt data securely. I'm sorry, but that's a fact that's real, and that no one has control of except actual cryptographers. So I'm done with custom cryptography, and sticking with projects I can actually do without causing major harm to other's security.
So ShadowCrypto should be removed from chat soon (once Random gets around to it) and the download page for ShadowCrypto will be deleted soon. This thread can be closed.
could you post the SB code here?
Have you heard of the first rule of crypto?
I believe ShadowCrypto has some extremely obvious security issues. I also believe that I can decrypt any message encrypted by ShadowCrypto without the password with little effort. I'll be happy to demonstrate for anyone interested. Just post an encrypted message.
Also, can you recover passwords?
EDIT: PM me the flaws and possible solutions please. Bad idea to post it here.
It's brute-forcable. Your math has the side effect of reducing total effective entropy in the key to around 8 bits. One out of every set of 200ish random strings are equivalent for the purposes of decryption. I can't recover the key you used, because it's the same as an infinite number of other keys. I can give you an arbitrary number of keys that work just like yours though.
What you did wrong: you ignored the first rule of cryptography, which is actually "Leave cryptography to the experts." Note that the second rule is "You are not an expert."
I'm also not a cryptography expert, so I couldn't give you a good fix that would guarantee using all of the available entropy in your key. Your modulus 256 is not the cause of your problems, however.
So I don't ultimately want to discourage anyone from attempting to write cryptographic functions. I definitely DO want to discourage them from ever actually USING them for anything. Novel cryptographic algorithms are vetted and discussed in a community of experts, who apply years of experience testing and improving them before ever using them anywhere. They had to start somewhere, however. Keep writing code.
No. There are cryptography experts. You are not one. If you were, you would understand why it's a bad idea to make your own cryptography algorithm and also understand why the existing ones work. If you are trying to make your own crypto, you are not an expert.
Please read what people actually say instead of making unclever assumptions.
