Comment by luma | Hacker News Reader

Comment by luma | Hacker News Reader

Parent Full thread

It's not bad crypto, it's an encoding scheme. It's even in the name! Citrix uses this to pass around credentials between disparate systems which might not be part of the same ActiveDirectory forest preventing the use of OS provided ticketing systems. The traffic carrying these credentials are encrypted with SSL, so you shouldn't be able to pull this in cleartext off the wire. It's obviously not a great system, but it does what it's designed to do. Details on abusing this system are available here[1], but they still require getting access to the unencrypted stream which once again will be passed around the network inside an HTTPS connection.

While I'm sure it was an interesting exercise, the author could have saved himself some time and simply Googled the name, there are published scripts and COM objects to deal with this encoding stream such as[2].

[1] http://www.securityfocus.com/archive/1/520869

[2] http://www.remkoweijnen.nl/blog/2013/03/19/scriptable-citrix...

From your second link: "Please note that for security reasons I have chosen to only allow Encoding via the scripting interface."

It also seems a little odd that it's doing XOR with the sum of all previous characters if there is no attempt to obfuscate.

Good point. What, more specifically, is the purpose of the Citrix encoding system? Is it to map an arbitrary byte string onto a limited range of bytes (ASCII A to P)? If so, any reason base 64 was unsuitable for these applications?

Base64 can maybe result in strings unsuitable for pasting as-is into bad HTTP servers' URLs (the default character set include '/' and '+').

Using only the uppercase letters lets them worry less about whether the string got mangled because some systems interpreted it as Unicode and some didn't etc.

Something like Bitcoin and Flickr's base58 would have also worked, but the encoder and decoder would have been more complicated. They got away with only division by 16.

They get a little bit of integrity checking too.

Basically, this is base16 with a poor man's integrity checking baked in. Pretty interesting.

Ah, so the design of this encoding is specifically targeting URLs? That makes a lot more sense. Thanks!

Knowing that, it does in fact seem like a sensible encoding for certain applications. Encoding, not encryption, mind you. I assume (or at least hope) the designers intended it as the former only, and never as the latter.

Reply on news.ycombinator.com