All operations

Bitwise operation

Apply XOR, AND, OR, NOT or a shift to every byte against a repeating key.

What is loaded above

That hex string is set 1, challenge 3 of the Cryptopals crypto challenges: a line of English XOR’d against one repeated byte. The pipeline decodes the hex to raw bytes and XORs each of them against 0x58, which gives Cooking MC's like a pound of bacon. The challenge hands you no key. You recover it by trying all 256 and scoring each result on how much it looks like English.

How the key is applied

The key is typed as hex and cycles across the input. ff applies one byte to every byte of the message; deadbeef repeats over four. Each input byte meets one key byte and the selected operation runs on that pair.

XOR undoes itself, so running the same key over the output returns the original. NOT inverts every bit and ignores the key field. The shift distance is the key byte modulo 8, so a multi-byte key shifts different positions by different amounts.

Why it breaks

A one-byte key has 256 possibilities. Trying all of them takes under a millisecond, and the right one announces itself by producing plausible letter frequencies.

Lengthening the key buys less than people expect. Chop the ciphertext into columns by key length and each column is a single-byte XOR again. The length itself leaks: repeated plaintext under a repeated key yields repeated ciphertext at multiples of the period. Kasiski published that attack against Vigenere in 1863 and it carries over to bytes unmodified.

XOR resists analysis only when the key is random, as long as the message, and never reused. That is the one-time pad, and reuse destroys it. XOR two ciphertexts made under the same pad and the pad cancels, leaving the plaintexts laid over each other.

The operations that cannot be undone

AND, OR and the shifts throw bits away. AND against 0f zeroes the top half of every byte and nothing recovers it. Select one and the direction buttons vanish from the stage, because there is no way back to offer. Forward they earn their place, masking a field out of a packed byte or forcing a single bit high.

Why malware likes it

Malware hides strings this way constantly. URLs, registry paths and command-and-control addresses get a one-byte XOR so that strings returns nothing and a static signature misses. It costs the author a loop, and it defeats the laziest scanning.

Hexadecimal is the first stage of the pipeline above, and the format the key is written in. RC4 XORs against a generated keystream instead of a repeating one, which is what a stream cipher does properly.