There's not been much news recently. I've had someone contribute code for implementing Rijndael, but I've been too busy with other things to get that going. However, I happened to stop by the local magazine store the other day and picked up Dr. Dobb's Journal, which interestingly enough, contains an algorithm that I'm sure everyone's heard about by now: Helix. I'm going to be incorporating this with the next version of ActionCrypt. As well as Rijndael. If anybody is interested in helping me out with optimizing the library with Flasm, I'd be much obliged. Additionally, I am going to rework the internal API for faster function calls and lookups -- Flash (even in version 7) processes longer variable names more slowly. Hopefully stuff in MX 2004 is faster. If you'd like to help, please email me at dodell .at. sitetronics .dot. com. Thanks.

After admitting to myself that I'm neither a cryptographer nor cryptanalyst, nor do I participate in any cryptography-related conventions, nor do I have any reason to consider myself informed about security standards in general, I decided it was time to take a trip to the NIST (National Institute of Standards and Technology) website. There is a wealth of information there; several sites made it to my bookmarks (something I've not used for years).

I must say that this looks like one government organization that has its shit together (pardon my French). After reading specification SP-800-38A, I realized that I didn't actually know very much about what's going on with cryptography and the standards world. They keep their webpage standard and nice looking and actually respond to emails.

Yes, that's right. I emailed regarding the security of modes and algorithms for classified information. To my (previous) understanding, Rijndael (or AES, Advanced Encryption Standard) was designated for the encryption of all data, classified or "just sensitive". It turns out that AES is only designated for sensitive data; the NIST couldn't give me a whole lot of information about the encryption of classified data because that's ouside their scope. I was given a telephone number for the NSA INFOSEC (which I'm unable to call, being in the Netherlands) and told that if I was unable to call that number due to my location, they would try to help me find an email contact. This email didn't come the next week or the next month after I contacted them -- it came a matter of 16 hours later.

When was the last time you got that kind of help from the U.S. Government? With all seriousness, though, I am greatly appreciative for the help provided by the NIST, and know now a bit more about what kind of stuff to recommend to you to use for your security. I do however know for a fact that there is so much information about how to keep things really secure.

Things that I'd like to do soon include adding Rijndael to AC, discussing cryptographic modes and providing information regarding key management.

Although this is a somewhat silly library (who encrypts stuff in Flash?), I want to use it as a security portal as well. Here are some sites that made it to my bookmarks yesterday:
C S R C - Modes of Operation
SP-800-38A (2001 Edition): Recommendation for Block Cipher Modes of Operation Methods and Techniques (Morris Dworkin)
C S R C - Cryptographic Toolkit (Key Management)
Cryptographic Standards and Validation Programs at NIST

Welcome to the ActionCrypt Website. ActionCrypt is a modular class library for usage with Flash applications. It can be used to encode text using any encoding algorithm for which a module is provided. At this moment, only Blowfish under ECB mode is supported (note that this is not terribly secure). More encryption modes and algorithms will be following soon.

This webpage provides documentation about the ActionCrypt website and provides links to similar libraries, code, and services using and/or dealing with the ActionCrypt library.

Getting the Library

ActionCrypt is open source software and is licensed under the GNU LGPL (GNU Lesser General Public License). It is available for download in several formats:

  • Flash ActionScript source code format (.as),
  • Optimized flasm Flash assembler format (.flasm - this will eventually be made available for all available combinations of block modes and algorithms)
  • Optimized Flash bytecode binary format (.swf - binaries will also be provided for all available combinations of block modes and algorithms when possible)

We've not yet released all our files (or even committed them to CVS). You can download our first release of ActionCrypt at our SourceForge project page here.

Services implementing secure key transmission, key servers, and other necessities for keeping this secure library secure are provided in the links section.

Using the Library

ActionCrypt is very easy to use because of its modular design. By simply including the main library file, a file providing an implementation for the block mode, and a file implementing the algorithm, you can encrypt pretty much any information you'd like.

Here is an example implementation of the library (please note: DO NOT EVER implement this library in the following manner. This implementation is very insecure as the generated SWF will contain the key, which is readable by anybody able to disassemble your SWF file. See the DISCLAIMER file in any of the distributions for your security and our lack of responsibility for your security, or the lack thereof):

#include "actioncrypt.as" /* Main library functions */
#include "ecb.as" /* ECB block mode, quite insecure */
#include "blowfish.as" /* Blowfish algorithm */

ACObj = new ActionCrypt();
ACObj.actioncrypt_module_open("Blowfish", "ECB");
ACObj.actioncrypt_generic_init("v3r33 5tr0nG K3Y h33r!", 22);
ACObj.actioncrypt_generic("very long text!!", 16);
var CipherText = new String(ACObj.plain.join(""));

ACObj.actioncrypt_generic_end(); /* Clean up! */

delete ACObj; /* Getting rid of the obj is also a secure/good idea. */

ACObj = new ActionCrypt();
ACObj.actioncrypt_module_open("Blowfish", "ECB");
ACObj.actioncrypt_generic_init("v3r33 5tr0nG K3Y h33r!", 22);
ACObj.actiondecrypt_generic(CipherText, CipherText.Length);

var PlainText = ACObj.plain.join("");

ACObj.actioncrypt_generic_end(); /* Clean up! */

delete ACObj; /* Get rid of the obj again */

If you've ever worked with libmcrypt before, you probably see the similarities between the usage of ActionCrypt and libmcrypt.

In reality, ActionCrypt should only be used in one of several ways. You should use ActionCrypt to:

  • Allow your users to encrypt data and send the now secure information over an insecure channel for storage, providing a key to the player themselves. This is useful for storing passwords server-side. Hashed passwords are more vulnerable to attack than are heavily encrypted "self encoded" passwords.
  • Allow your users to decrypt encrypted data retrieved from a server.
  • Use third party tools to securely connect to a key server and retrieve a key. You should use key servers who are "AC Approved." That is to say, we recommend choosing a provider who has let us test their services fully and whom we trust with your data. (NOTE: any transmission of data over the Internet is susceptible to attack or eavesdrop. We do not recommend the use of the Internet to transmit keys.)

Speed of the Library

Flash was truly not meant to do such heavy calculations as are required by ActionCrypt. On slower machines, some of the calculations used to encrypt data are so strenuous that the user may be prompted to cancel the script. You should therefore always let the user know when data is being encrypted. We've attempted to optimize the library as much as possible by disassembling the exported SWF bytecode for the various mode/algorithm combinations and optimizing the Flash assembler as much as possible before exporting it back into SWF format. It is recommended that the optimized versions are used.

An unoptimized version using Blowfish in ECB mode to encrypt 32k of text with a 56 bit key takes approximately 19.5 seconds on a 700 MHz Pentium 3 processor (under very stressed circumstances). In comparison, the same optimized binary version takes % that time (only # seconds).

Links

We have provided links here to relevant sites.

http://www.sitetronics.com - SiteTronics will be providing several services utilizing ActionCrypt.

http://flasm.sourceforge.net - the flasm project provides a Flash bytecode assembler and disassembler, especially useful for optimizing math-intensive loops. This is used to create our optimized binaries and is necessary to recompile the Flash assembler source code of our libraries.

SourceForge.net Logo