Advertisement
Guest User

Untitled

a guest
Feb 9th, 2016
150
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.58 KB | None | 0 0
  1. =============
  2. Documentation
  3. =============
  4.  
  5. Algorithm calculates a hash string that can serve as a random key for generating CSRF tokens.
  6. This key's length can range from (57-64) characters (including hyphens), and the algorithm is broken up into 8 different
  7. semi-functions (semis) that calculate a different section of the key. In order to remove predictability
  8. of different components of the key, some of the components will never have a fixed length. However, some
  9. of the separate component lengths are dependent on that of another component, as well as those values. In addition,
  10. in order to ensure that some components cannot be differentiated, the hyphens in the key can be removed. Other components
  11. (such as the fixed-length symbol component), will always be obvious due to their reoccurrence. This documentation will explain
  12. each of the 8 functions that calculate the different key components.
  13.  
  14.  
  15. # Segment Headers
  16. To calculate the value of each component in the key, the algorithm consults "segment headers", or just a library
  17. of characters that can be inserted into a key component to determine the value. The algorithm contains 3 segment headers
  18. that contain a variety of different characters that can be selected for each different component. The three segment headers
  19. are as follows: the ASH, the NSH, and the SSH. These are the Alpha Segment Headers, the Numeric Segment Headers, and the
  20. Symbolic Segment Headers. In the original code, they are organized into three referencable strings with the following values:
  21.  
  22. ASH: abcdefghijklmnopqrstuvwxyz
  23. NSH: 0123456789
  24. SSH: @#$%!^&*()=+/
  25.  
  26. # Component 1
  27. Component 1 has an unfixed length. It's length can range from 3 to 5 characters, also with the off chance that the length
  28. is 2 characters. The chance of a 2-length first component is 1/1000 and a 1/100 chance of a 3-length first component, as values from the NSH range from 0-9, and every '0'
  29. character from the NSH is omitted (you will never find a '0' in a hash). To calculate the first component, a single random
  30. character from the NSH is appended to the key. Like explained, if this NSH character happens to be a '0', it must be omitted
  31. resulting in an alphabetic first character of the key. Next, the algorithm exectues a commited loop in which 4 characters are
  32. appended to the key. During this loop, the current iteration is calculated as i. On even iterations of i (including 0), a character
  33. from the ASH is appended to the key. On odd iterations, a character from the NSH are appended to the key (again with a 1/10 chance of this
  34. character getting omitted). Ideally, the pattern of the first component will read NANAN, with the 1/10 chance of ANAN, the 1/100 chance
  35. of AAN, and the 1/1000 chance of AA.
  36.  
  37. Examples: 3u3f3 4r8d8 s6l6 j4y
  38.  
  39. # Component 2
  40. Component 2 not only has an unfixed length, it's value and therefore length are inheritantly dependent upon that of component 1.
  41. First of all, it's length range can be determined initially with the first logical operation that helps to determine the algorithm
  42. used to calculate the component's value. Therefore, the pattern of component 2 is unpredictable. To determine the function, the algorithm
  43. uses a single check to identify whether the length of the first component is 4 (as opposed to 2, 3, or 5). If this is the case, then an algorithm
  44. similar to the first algorithm is executed. The same loop of 4 iterations is used in which even iterations append ASH characters, and odd iterations
  45. yield NSH characters. The difference here, is that even or odd iterations are treated as different cases, while in component 1, the even case
  46. is checked, then the odd case is run (unless the even case runs, in which case a new iteration is started). Therefore, effectively the component
  47. functions are the exact same in result.
  48.  
  49. If the length of the first component is NOT 4, the value of component 1 is used to determine the value of component 2. In this case, the algorithm goes
  50. as such: First, a single NSH character is appended to the componenet. Then, the algorithm computes the characters of component 1 in order and stores this as
  51. s. Then, the characters of s are reversed and appended to the second component.
  52.  
  53. Examples (including first component): 3sp5-t8y1 i2y4-y3s4 5x6l8-3l6x5 8k7m8-6m7k8 m4y-74m 6o4d-xe
  54.  
  55. # Component 3 and 4
  56. Component 3 has unfixed length (1/100000000 (one in one-hundred-million) chance of 0-length component)
  57. Component 4 has fixed length of 7
  58. Next, a component of 8 NSH characters is calculated, followed by a 7 ASH character component. These are both stored.
  59. The 8-character component (component 3), calculates 8 NSH characters (again with '0' characters omitted).
  60. The 7-character component (component 4), calculates 7 ASH characters (with no omits)
  61.  
  62. # Component 5
  63. Component 5 also has an unfixed length. However, the value of component 5 can always be predicted using the values
  64. of component 3 and 4. Fortunately, it is a little harder to recognize the pattern of component 5. Initially, the first
  65. character of component 4 is appended as the first character of component 5. Next, the second character of C3 is appended.
  66. Next, the third character of C4 is appended. This pattern is continued then the value is reversed and appended to the end.
  67.  
  68. This algorithm can also be calculated as so: A loop of 7 iterations is issued, with iteration number (i). Starting with the ith (0) index
  69. of component 3, every other character is appended to the 5th component, alternating from taking the ith character from componennts 3 and 4.
  70. This string is then reversed and used as the 5th component.
  71.  
  72. # Component 6
  73. Component 6 has an unfixed length, but will always range from 8 to 9 characters in length. The component is calculated as such:
  74. A loop of 4 iterations is issued. On each iteration, first an SSH character is appended, followed by an ASH character. Afterwards,
  75. an NSH character is appended (with a '0' character omitted).
  76.  
  77. # Component 7
  78. Component 7 is calculated by reversing component 3. Literally, the reversed value of component 3 is the value of component 7.
  79.  
  80. # Component 8
  81. The final component has an unfixed length. A loop of 8 iterations is issued, beginning with appending a single ASH character, then every other
  82. character alternates between an NSH and ASH character (with all '0' characters omitted).
  83.  
  84. THE END
  85.  
  86. # Notes
  87. This algorithm will crash with most programming languages unless you use some logic to work around these crashes (due to unfixed lengths).
  88. Typically, these crashes are going to be ArrayIndexOutOfBoundsExceptions, which is why the original algorithm was implemented in JavaScript.
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement