Spaces:

CoruNethron
/

openssl-for-restless-souls

Running

App Files Files Community

CoruNethron commited on Jul 23

Commit

aa7e62e

verified ·

1 Parent(s): 4972b93

Please fix only the part "4. How to Detect Real Success". Instead of visual inspection with `file` add an example with hexdump. Remove "Checksum Verification" and "Structure Validation" blocks. Replace them with another advice - to train and use LLM model to answer YES/NO question about decryption results. - Initial Deployment

Browse files

Files changed (2) hide show

README.md +6 -4
index.html +304 -19

README.md CHANGED Viewed

@@ -1,10 +1,12 @@
 ---
-title: Openssl For Restless Souls
-emoji: 🏆
-colorFrom: red
 colorTo: green
 sdk: static
 pinned: false
 ---
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference

 ---
+title: openssl-for-restless-souls
+emoji: 🐳
+colorFrom: gray
 colorTo: green
 sdk: static
 pinned: false
+tags:
+  - deepsite
 ---
+Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference

index.html CHANGED Viewed

@@ -1,19 +1,304 @@
-<!doctype html>
-<html>
-	<head>
-		<meta charset="utf-8" />
-		<meta name="viewport" content="width=device-width" />
-		<title>My static Space</title>
-		<link rel="stylesheet" href="style.css" />
-	</head>
-	<body>
-		<div class="card">
-			<h1>Welcome to your static Space!</h1>
-			<p>You can modify this app directly by editing <i>index.html</i> in the Files and versions tab.</p>
-			<p>
-				Also don't forget to check the
-				<a href="https://huggingface.co/docs/hub/spaces" target="_blank">Spaces documentation</a>.
-			</p>
-		</div>
-	</body>
-</html>

+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>OpenSSL for Restless Souls</title>
+    <script src="https://cdn.tailwindcss.com"></script>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.7.0/styles/atom-one-dark.min.css">
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.7.0/highlight.min.js"></script>
+    <script>hljs.highlightAll();</script>
+    <style>
+        .code-block {
+            border-radius: 0.5rem;
+            font-size: 0.9rem;
+        }
+        .hero-gradient {
+            background: linear-gradient(135deg, #1e3a8a 0%, #0ea5e9 100%);
+        }
+        .section-divider {
+            border-bottom: 2px dashed #e2e8f0;
+        }
+        .info-card {
+            transition: transform 0.3s ease, box-shadow 0.3s ease;
+        }
+        .info-card:hover {
+            transform: translateY(-5px);
+            box-shadow: 0 10px 15px -3px rgba(0, 0, 0, 0.1);
+        }
+    </style>
+</head>
+<body class="bg-gray-50 font-sans antialiased">
+    <!-- Header -->
+    <header class="hero-gradient text-white">
+        <div class="container mx-auto px-4 py-16">
+            <div class="max-w-3xl mx-auto text-center">
+                <h1 class="text-4xl md:text-5xl font-bold mb-6">OpenSSL for Restless Souls</h1>
+                <p class="text-xl opacity-90">When your password seems to work, but it's actually wrong</p>
+            </div>
+        </div>
+    </header>
+    <!-- Introduction -->
+    <section class="py-12 px-4">
+        <div class="container mx-auto max-w-4xl">
+            <div class="bg-white rounded-xl shadow-md p-6 md:p-8">
+                <h2 class="text-2xl font-bold text-gray-800 mb-4">The Mystery of False Positives</h2>
+                <p class="text-gray-700 mb-4">
+                    Imagine you're trying to unlock a door with a key. You try your key and the door opens - success! But wait...
+                    when you step inside, you realize this isn't your house at all. That's essentially what can happen with OpenSSL decryption.
+                </p>
+                <p class="text-gray-700">
+                    OpenSSL, the popular cryptographic tool, sometimes tells you a password worked when it actually didn't.
+                    This tutorial will explain why this happens and how to deal with it.
+                </p>
+            </div>
+        </div>
+    </section>
+    <!-- Correct Password Example -->
+    <section class="py-12 px-4 bg-gray-100">
+        <div class="container mx-auto max-w-4xl">
+            <h2 class="text-3xl font-bold text-gray-800 mb-8 text-center">1. The Correct Way</h2>
+            <div class="mb-8">
+                <h3 class="text-xl font-semibold text-gray-800 mb-3">Encrypting a File</h3>
+                <p class="text-gray-700 mb-4">
+                    First, let's see how to properly encrypt and decrypt a file with OpenSSL using AES-256-CBC encryption:
+                </p>
+                <pre class="code-block"><code class="language-bash"># Create a file with our secret message
+$ echo -n "hello world" > ./toencrypt.txt
+# Encrypt it using AES-256-CBC with a password
+$ openssl enc -aes-256-cbc -a -in ./toencrypt.txt \
+  -pass pass:`echo -n "correctpass" | shasum -a 256 - | sed -E 's/  -//'` \
+  > ./encres.txt</code></pre>
+            </div>
+            <div>
+                <h3 class="text-xl font-semibold text-gray-800 mb-3">Decrypting Successfully</h3>
+                <p class="text-gray-700 mb-4">
+                    Now let's decrypt it with the correct password:
+                </p>
+                <pre class="code-block"><code class="language-bash">$ openssl enc -aes-256-cbc -d -a -in ./encres.txt \
+  -pass pass:`echo -n "correctpass" | shasum -a 256 - | sed -E 's/  -//'`
+hello world</code></pre>
+                <p class="text-gray-700 mt-4">
+                    This works exactly as expected - we get back our original "hello world" message.
+                </p>
+            </div>
+        </div>
+    </section>
+    <!-- The Problem Section -->
+    <section class="py-12 px-4">
+        <div class="container mx-auto max-w-4xl">
+            <h2 class="text-3xl font-bold text-gray-800 mb-8 text-center">2. The Surprising Behavior</h2>
+            <div class="bg-white rounded-xl shadow-md p-6 md:p-8 mb-8">
+                <h3 class="text-xl font-semibold text-gray-800 mb-3">Testing Wrong Passwords</h3>
+                <p class="text-gray-700 mb-4">
+                    Now let's try something interesting. We'll write a script to test many wrong passwords and see what happens:
+                </p>
+                <pre class="code-block"><code class="language-bash">#!/bin/bash
+# Encrypted file from our example
+enc_file="./encres.txt"
+# Loop through 0001 to 9999
+for i in {1..9999}; do
+    # Format password as wrongpassXXXX
+    pass="wrongpass$(printf "%04d" $i)"
+    # Generate SHA256 hash of password
+    pass_hash=$(echo -n "$pass" | shasum -a 256 | sed -E 's/[[:space:]]+-//')
+    # Attempt decryption, suppress error messages
+    result=$(openssl enc -aes-256-cbc -d -a -in "$enc_file" -pass pass:"$pass_hash" 2>/dev/null)
+    exit_code=$?
+    # Check if OpenSSL reported successful decryption
+    if [ $exit_code -eq 0 ]; then
+        echo "========================================================"
+        echo "False positive found with password: $pass"
+        echo "Hexdump of decrypted output:"
+        echo -n "$result" | hexdump -C
+        echo "========================================================"
+        echo
+    fi
+done</code></pre>
+            </div>
+            <div class="bg-yellow-50 border-l-4 border-yellow-400 p-4 mb-8">
+                <div class="flex">
+                    <div class="ml-3">
+                        <h3 class="text-lg font-medium text-yellow-800">Unexpected Results</h3>
+                        <p class="text-yellow-700 mt-2">
+                            When running this script, you might see output like this:
+                        </p>
+                        <pre class="code-block mt-2"><code class="language-text">========================================================
+False positive found with password: wrongpass0030
+Hexdump of decrypted output:
+00000000  17 c6 30 30 02 9d 94 d1  7d af 12 a7 35 07 71     |..00....}...5.q|
+0000000f
+========================================================
+========================================================
+False positive found with password: wrongpass1194
+Hexdump of decrypted output:
+00000000  5b d9 d7 5b ea b9 2b d8  a5 cb e8 b9 f7 a9 e7     |[..[..+........|
+0000000f
+========================================================</code></pre>
+                    </div>
+                </div>
+            </div>
+            <p class="text-gray-700">
+                These are <span class="font-semibold">false positives</span> - OpenSSL reports success with wrong passwords!
+                The decrypted output is garbage, but OpenSSL had no way to know it wasn't what we originally encrypted.
+            </p>
+        </div>
+    </section>
+    <!-- Explanation Section -->
+    <section class="py-12 px-4 bg-gray-100">
+        <div class="container mx-auto max-w-4xl">
+            <h2 class="text-3xl font-bold text-gray-800 mb-8 text-center">3. Why This Happens</h2>
+            <div class="grid md:grid-cols-2 gap-6 mb-8">
+                <div class="info-card bg-white rounded-xl shadow-md p-6">
+                    <h3 class="text-xl font-semibold text-gray-800 mb-3">Padding Oracle Mystery</h3>
+                    <p class="text-gray-700">
+                        OpenSSL uses <span class="font-semibold">PKCS#7 padding</span> for block ciphers like AES. When decrypting, it checks if the padding is valid, not if the data makes sense.
+                    </p>
+                    <p class="text-gray-700 mt-2">
+                        With a wrong password but correct padding, OpenSSL happily decrypts the data, resulting in garbage output.
+                    </p>
+                </div>
+                <div class="info-card bg-white rounded-xl shadow-md p-6">
+                    <h3 class="text-xl font-semibold text-gray-800 mb-3">Probability of False Positives</h3>
+                    <p class="text-gray-700">
+                        For AES (block size 16 bytes), the chance of random padding being valid is about 1/256. With our 9999 attempts, we'd expect around 39 false positives (9999/256 ≈ 39).
+                    </p>
+                    <p class="text-gray-700 mt-2">
+                        In our test, we found 4 - within expected statistical variation.
+                    </p>
+                </div>
+            </div>
+            <div class="bg-white rounded-xl shadow-md p-6 md:p-8">
+                <h3 class="text-xl font-semibold text-gray-800 mb-3">The Math Behind It</h3>
+                <p class="text-gray-700 mb-4">
+                    When OpenSSL decrypts, it looks at the last byte to determine padding. Valid padding values are 1 to 16, each with probability 1/256.
+                </p>
+                <p class="text-gray-700">
+                    The probability that a random decryption appears valid is:
+                    <br>
+                    <span class="font-mono bg-gray-200 px-2 py-1 rounded">P(valid padding) ≈ 1/256 ≈ 0.39%</span>
+                </p>
+            </div>
+        </div>
+    </section>
+    <!-- Detection Section -->
+    <section class="py-12 px-4">
+        <div class="container mx-auto max-w-4xl">
+            <h2 class="text-3xl font-bold text-gray-800 mb-8 text-center">4. How to Detect Real Success</h2>
+            <div class="bg-white rounded-xl shadow-md p-6 md:p-8 mb-8">
+                <h3 class="text-xl font-semibold text-gray-800 mb-3">Hexdump Analysis</h3>
+                <p class="text-gray-700 mb-4">
+                    Examine the raw bytes of decrypted output. Legitimate text will show readable ASCII characters on the right side:
+                </p>
+                <pre class="code-block"><code class="language-bash"># Compare good vs bad decryption
+$ openssl enc -aes-256-cbc -d -a -in encres.txt -pass pass:correctpass | hexdump -C
+00000000  68 65 6c 6c 6f 20 77 6f  72 6c 64                 |hello world|
+0000000b
+$ openssl enc -aes-256-cbc -d -a -in encres.txt -pass pass:wrongpass | hexdump -C
+00000000  17 c6 30 30 02 9d 94 d1  7d af 12 a7 35 07 71     |..00....}...5.q|
+0000000f</code></pre>
+            </div>
+            <div class="info-card bg-white rounded-xl shadow-md p-6 mb-8">
+                <h3 class="text-xl font-semibold text-gray-800 mb-3">AI Verification (draft)</h3>
+                <p class="text-gray-700 mb-4">
+                    Train a small LLM model to analyze decrypted content and answer "Does this look like valid decryption?":
+                </p>
+                <pre class="code-block"><code class="language-python">import transformers
+# Load a pre-trained model
+model = transformers.AutoModelForSequenceClassification.from_pretrained("distilbert-base-uncased")
+tokenizer = transformers.AutoTokenizer.from_pretrained("distilbert-base-uncased")
+def is_valid_decryption(text):
+    inputs = tokenizer(text, return_tensors="pt", truncation=True, max_length=512)
+    outputs = model(**inputs)
+    prediction = outputs.logits.argmax().item()
+    return bool(prediction)  # True for valid, False for invalid</code></pre>
+                <p class="text-gray-700 mt-4">
+                    Fine-tune the model on examples of valid vs invalid decryptions to improve accuracy.
+                </p>
+            </div>
+            <div class="mt-8 bg-blue-50 border-l-4 border-blue-400 p-4">
+                <div class="flex">
+                    <div class="ml-3">
+                        <h3 class="text-lg font-medium text-blue-800">Best Practice</h3>
+                        <p class="text-blue-700 mt-2">
+                            Combine hexdump analysis with AI verification for most reliable results. The human eye can spot patterns while AI handles bulk verification.
+                        </p>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </section>
+    <!-- Conclusion -->
+    <section class="py-12 px-4 bg-gray-900 text-white">
+        <div class="container mx-auto max-w-4xl text-center">
+            <h2 class="text-3xl font-bold mb-6">Key Takeaways</h2>
+            <div class="grid md:grid-cols-3 gap-6 mb-8">
+                <div class="bg-gray-800 p-4 rounded-lg">
+                    <svg xmlns="http://www.w3.org/2000/svg" class="h-10 w-10 mx-auto mb-3 text-blue-400" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z" />
+                    </svg>
+                    <h3 class="font-semibold text-lg mb-2">False Positives Happen</h3>
+                    <p>OpenSSL can report success with wrong passwords due to valid padding</p>
+                </div>
+                <div class="bg-gray-800 p-4 rounded-lg">
+                    <svg xmlns="http://www.w3.org/2000/svg" class="h-10 w-10 mx-auto mb-3 text-green-400" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z" />
+                    </svg>
+                    <h3 class="font-semibold text-lg mb-2">Verify Output</h3>
+                    <p>Always check decrypted content matches expected format</p>
+                </div>
+                <div class="bg-gray-800 p-4 rounded-lg">
+                    <svg xmlns="http://www.w3.org/2000/svg" class="h-10 w-10 mx-auto mb-3 text-yellow-400" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 10V3L4 14h7v7l9-11h-7z" />
+                    </svg>
+                    <h3 class="font-semibold text-lg mb-2">Statistics Matter</h3>
+                    <p>Expect about 1 false positive per 256 wrong password attempts</p>
+                </div>
+            </div>
+            <p class="text-gray-300">
+                OpenSSL is a powerful tool, but like all tools, it's important to understand its quirks. Happy (and careful) encrypting!
+            </p>
+        </div>
+    </section>
+    <!-- Footer -->
+    <footer class="bg-gray-800 text-gray-400 py-8 px-4">
+        <div class="container mx-auto max-w-4xl text-center">
+            <p>CC BY-SA, CoruNethron, 2025: Tutorial for Restless Souls</p>
+            <p class="mt-2 text-sm">Note: This tutorial demonstrates basic cryptographic concepts and isn't intended as security advice.</p>
+        </div>
+    </footer>
+<p style="border-radius: 8px; text-align: center; font-size: 12px; color: #fff; margin-top: 16px;position: fixed; left: 8px; bottom: 8px; z-index: 10; background: rgba(0, 0, 0, 0.8); padding: 4px 8px;">Made with <img src="https://enzostvs-deepsite.hf.space/logo.svg" alt="DeepSite Logo" style="width: 16px; height: 16px; vertical-align: middle;display:inline-block;margin-right:3px;filter:brightness(0) invert(1);"><a href="https://enzostvs-deepsite.hf.space" style="color: #fff;text-decoration: underline;" target="_blank" >DeepSite</a> - 🧬 <a href="https://enzostvs-deepsite.hf.space?remix=CoruNethron/openssl-for-restless-souls" style="color: #fff;text-decoration: underline;" target="_blank" >Remix</a></p></body>
+</html>