#3 Cyclic Password Weakness

[Hooman Valibeigi]

Cyclic pass phrases, could be used to decrypt files which have been encrypted by any number of cycles of the same phrase.

For example, a file encrypted with "aaaaaaaaaaaaaa" as the key, can also be decrypted using any number of 'a's, like "aaaaaaaa" or "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", etc

It suffers from any cyclic phrase like "123123123", "abbbabbb", etc

[Russ Williams]

I see this bug too. But to be more precise, not with ANY number of a's: there must be at least 8 in both the encryption and the decryption passwords, it seems.

But e.g. encrypting with aaaaaaaa (8 a's) lets you decrypt with aaaaaaaaa (9 a's), and encrypting with aaaaaaaaa (9 a's) lets you decrypt with aaaaaaaa (8 a's).

Similarly encrypting with 1234567812345678 lets you decrypt with 12345678, and encrypting with 12345678 lets you decrypt with 1234567812345678, and encrypting with 12341234 lets you decrypt with 123412341234, and encrypting with 1234512345 lets you decrypt with 123451234512345 (i.e. it's indeed not restricted to powers of 2 or anything like that, for what it's worth).