topbanner_forum
  *

avatar image

Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
  • October 20, 2019, 03:29 AM
  • Proudly celebrating 13 years online.
  • Donate now to become a lifetime supporting member of the site and get a non-expiring license key for all of our programs.
  • donate

Author Topic: FrogTea  (Read 5493 times)

berry

  • Supporting Member
  • Joined in 2011
  • **
  • Posts: 51
    • View Profile
    • Read more about this member.
    • Donate to Member
FrogTea
« on: October 06, 2012, 11:16 PM »
What is FrogTea? FrogTea is a free, Windows based, encryption utility which allows you to create a secure*, stand alone, self-decrypting HTML archive which may contain either html or plain text content. These self-decrypting archives may be decrypted on any device which has a javascript capable browser.

For more information visit http://frogtea.com/index.html
cheers,
berry
NoteFrog developer
"NoteFrog - use it, don't lose it"
10/07/2012

* <a href="http://en.wikipedia....her_security_summary">http://en.wikipedia....her_security_summary</a> No demonstrated attack. Theoretical attack 2<sup>59</sup> chosen plaintexts - that's 576460752303423488 or half the size of all the printed material in the world.</p>
Note: FrogTea is a free utility from HTConsulting, the authors or NoteFrog.
« Last Edit: October 14, 2012, 05:05 PM by berry, Reason: edited domain name »

IainB

  • Supporting Member
  • Joined in 2008
  • **
  • Posts: 7,451
  • Slartibartfarst
    • View Profile
    • Read more about this member.
    • Donate to Member
Re: FrogTea
« Reply #1 on: October 07, 2012, 05:31 AM »
@Berry: When I read about this on the NoteFrog blog the other day, I thought it looked very interesting.
Thanks.

IainB

  • Supporting Member
  • Joined in 2008
  • **
  • Posts: 7,451
  • Slartibartfarst
    • View Profile
    • Read more about this member.
    • Donate to Member
I resurrected this old thread from @berry (of HTConsulting, author of the Notefrog clipboard information manager), because of the issues being discussed in this discussion thread: File Encryption - now effectively outlawed in the US?

FrogTea is a portable GUI built around the text encryption algorithm/tool xTea.
There were 4 releases of FrogTea by HTConsulting, available from the Frog Tea webpage - the original link to which seems to be defunct: http://frogtea.com/index.html

However, that page is still in Wayback, and the latest captured is here: https://web.archive.org/web/20150508165332/http://frogtea.com/index.html
That page has a link to the latest downloadable version of FrogTea.

Bear in mind that only the interface was changed in the 4 different versions, and the xTea component was apparently unaltered.

NB: It may be that use of FrogTea (xTea) is illegal in some countries.

(The text of the FrogTea webpage is copied below sans embedded hyperlinks/images. Any emphasised or reorganised text or added images are my changes.)
FrogTea?
04_300x242_BB6C25D1.png

Frog Tea
A Proper Cup of Tea by Peter Merich

What is FrogTea? FrogTea is a free, Windows based, encryption utility which allows you to create a secure*, stand alone, self-decrypting HTML archive which may contain either html or plain text content. These self-decrypting archives may be decrypted on any device which has a javascript capable browser. see Wikipedia: xxTea

While it will be a feature of the next release of NoteFrog Professional, we're also offering a stand alone utility which enables you to create secure* "FrogTea" archives of any text/html content you wish.

The encryption and decryption is done on your computer or mobile device. None of your data is ever sent over the internet.

Since it's secure* you may share the encrypted file with others - only those who have the password will be able to access the data content. You may load your encrypted html file on any device having a web browser which supports javascript, and decrypt it anytime you wish by opening the HTML file in the browser and decrypting it - right there in the browser - no internet access is necessary - no data is ever transmitted over the internet.
(Note: Since the self-decrypting file is totally self-contained, any references to external files or data must be fully qualified. If your decrypted content contains links to external web-based locations, clicking on those links WILL attempt to access the internet, but the only data transmitted from your device will be the URL request. If your decrypted output fails to access links or external data, look for non-qualified references in your original input file.)

To see it in action select this self decrypting file and decrypt it using the key "A Proper Cup of Tea" - try other keys if you wish.
FrogTea User Guide
  • Start FrogTea, if it's not already running.
  • You may obtain the completely stand alone utility here FrogTea beta. There is no installation. No system changes of any sort. Just download to a folder and run. (It's beta only in the sense of the user interface. The encryption is tried and proven (corrected) "Block Tea" - see Block TEA Tiny Encryption Algorithm. )
  • tea window
  • You may either select an html or text file to encrypt or use the current text contents of the clipboard. If you are using the clipboard content, you may elect to have line feeds/ new lines replaced with an html linefeed, otherwise your text may appear as one long line.
  • Once you've selected an input option, click on the "Lock".
  • If you've chosen to select a file, you'll be asked to select an input file. We're going to use a NoteFrog self-publishing stack export.
  • Now assign a key. A key of at least 8 characters is recommended. Remember your key. It is not stored anywhere or available from the encrypted content.
  • Re-enter the key for verification.
  • You may enter an optional password "Hint", which will appear on the output HTML page.
  • Now, select an output filename and location.
  • The self-decrypting output file is created in the location specified. It is also opened in a browser window for verification.
  • You may enter the key and verify the resulting output.
    ______________________________

*How secure is xTea?
  • The published criticism is theoretical: http://eprint.iacr.org/2010/254.pdf - In fact, xTea has not been broken in practice. (The underlying data may be accessable if the user employed poor password technique, in which case ANY data encryption is vulnerable. Guessing a password is not breaking an encryption method. You should employ good password selection for all sensitive data.)

  • http://en.wikipedia....her_security_summary No demonstrated attack. Theoretical attack with 259 chosen plaintexts - that's 576,460,752,303,423,488 or half the size of all the printed material in the world.

  • Simon Shepherd, Professor of Computational Mathematics Director of the Cryptography and Computer Security Laboratory, Bradford University, England. and http://www.tayloredg...matics/TEA-XTEA.pdf- How secure is TEA? Very. There have been no known successful cryptanalyses of TEA. It's believed to be as secure as the IDEA algorithm, designed by Massey and Xuejia Lai. It uses the same mixed algebraic groups technique as IDEA, but it's very much simpler, hence faster. Also it's public domain, whereas IDEA is patented by Ascom-Tech AG in Switzerland. IBM's Don Coppersmith and Massey independently showed that mixing operations from orthogonal algebraic groups performs the diffusion and confusion functions that a traditional block cipher would implement with P- and S-boxes. As a simple plug-in encryption routine, it's great. The code is lightweight and portable enough to be used just about anywhere.

  • http://www.safemess.com/faq.php - How secure is the encryption? The encryption is secure enough for personal usage unless you have a government agency breathing down your neck.

  • http://derekwilliams...8-TEA-Encryption.pdf - In a practical sense, modified TEA (XTEA) with proper keys and adequate rounds is quite strong as an encryption algorithm. In an academic sense, as noted above, unmodified TEA has a published related key weakness that reduces the effective key length from 2128 to 2126 and could result in a partial attack with 234 chosen plaintexts. Unfortunately, this often gets misrepresented that TEA is inherently weak and should not be used.

  • My important passwords are stored online in an xTea encrypted archive at My xTea passwords - click the "random" button.

  • ¬© htconsulting 2012

« Last Edit: April 03, 2017, 09:02 PM by IainB »

f0dder

  • Charter Honorary Member
  • Joined in 2005
  • ***
  • Posts: 9,146
  • [Well, THAT escalated quickly!]
    • View Profile
    • f0dder's place
    • Read more about this member.
    • Donate to Member
Re: FrogTea
« Reply #3 on: April 03, 2017, 10:43 PM »
Don't use.

It's unmaintained software, the source is not available, TEA should be considered broken, and the page doesn't mention whether the algorithm is being used in EBC or a chained mode, nor whether any key stretching is being used for the input passphrase.
- carpe noctem

IainB

  • Supporting Member
  • Joined in 2008
  • **
  • Posts: 7,451
  • Slartibartfarst
    • View Profile
    • Read more about this member.
    • Donate to Member
Re: FrogTea
« Reply #4 on: April 03, 2017, 11:09 PM »
Oh, so its apparently not of much use then? I had not known that.

IainB

  • Supporting Member
  • Joined in 2008
  • **
  • Posts: 7,451
  • Slartibartfarst
    • View Profile
    • Read more about this member.
    • Donate to Member
Re: FrogTea
« Reply #5 on: April 04, 2017, 03:10 AM »
Somewhat concerned after @fodder's comments above, that I might have inadvertently missed something about the functionality and security of FrogTea, I reread all the links that I had given above.
As far as I can see from the literature and references, xTEA (where TEA stands for "Tiny Encryption Algorithm") is the preferred foundation for FrogTea and is one of three TEA algorithms:
  • TEA
  • xTEA
  • xxTEA

At http://m8e.com/, it says:
(Text copied below sans embedded hyperlinks/images.)
Text encryption
  • This is a base64 enhanced version of the original encryption routine, found here. TEA
  • The strong encryption with JavaScript implementation of David Wheeler & Roger Needham's Block TEA (Tiny Encryption Algorithm) by Chris Veness is done only on the client computer browser with JavaScript. Information is not sent or stored anywhere during encryption or decryption.
  • The Tiny Encryption Algorithm is strong encryption. It is one of the fastest and most efficient cryptographic algorithm in existence. It's public domain. The code is lightweight and compact, which makes it practical for JavaScript implementation.
  • The JavaScript source code of this program can be easily viewed as the source code of this HTML page. Security specialists do not recommend using encryption for which source code is not available for analysis.
  • If the password is lost or forgotten, there is no practical way to recover the unencrypted text from the encrypted text.
  • Check the laws of your country to determine if you can use strong encryption legally.
  • This site is for illustrative purposes only and is not intended to be a TEA encryption service. There is NO warranty, expressed or implied as to the suitability for any purpose.

Furthermore, there is apparently no known/documented "best" attack for xTEA - refer Wikipedia - Cipher security summary

Well, that all looks pretty good, but some of the references here could be mistaken or out of date, I suppose. (I wouldn't know.) For those who are interested, there seems to be quite a lot of heavy academic documentation about it too, on the Internet.

Perhaps the potentially weakest link is the GUI provided by FrogTea.exe, and one would need to be able to verify the code for that too, I presume (in addition to verifying the Javascript for xTEA). I gather that the FrogTea.exe code is sourced by and copyright of HTConsulting.com.

If one wanted to explore this further, it could be interesting to know how xTEA has been broken, or something, and where that is documented, and how easy that might be to replicate for the average laptop/smartphone thief.

However, for the purposes of securely encrypting the typical user's portable bits of personal/private/confidential HTML and text-based data - e.g., to protect against (say) the event where the device holding the data is lost/stolen - with the ability to sync/share it across several devices (all having java and browsers), and between specific trusted people, it seems that FrogTea could potentially be rather useful. It could also protect against all but the most determined attacks from those pesky Ruskie, GCHQ and the NSA agents. That is, for those as might feel more secure with, and gain some "peace of mind" from such protection.

Come to think of it, I reckon that one of my neighbours might be a Ruskie - well, he calls himself "Dmitry" and walks around wearing a Russian Ushanka hat anyway, and sometimes sits in a deckchair in his garden drinking Vladivar and repeatedly pointing a revolver to his head and then spinning the cylinder around. He's a bit odd.
Hmm, maybe I should think of using FrogTea, just in case, like. Can't be too careful these days...
« Last Edit: April 04, 2017, 03:19 AM by IainB »

f0dder

  • Charter Honorary Member
  • Joined in 2005
  • ***
  • Posts: 9,146
  • [Well, THAT escalated quickly!]
    • View Profile
    • f0dder's place
    • Read more about this member.
    • Donate to Member
Re: FrogTea
« Reply #6 on: April 04, 2017, 10:37 AM »
Well, that all looks pretty good, but some of the references here could be mistaken or out of date, I suppose. (I wouldn't know.) For those who are interested, there seems to be quite a lot of heavy academic documentation about it too, on the Internet.
(...)
If one wanted to explore this further, it could be interesting to know how xTEA has been broken, or something, and where that is documented, and how easy that might be to replicate for the average laptop/smartphone thief.
I haven't scoured the net, but I assume the notes on wikipedia are correct with regards to TEA attacks. A 2^59 chosen plaintexts is "not excatly trivial", but the attack is six years old by now - and XXTEA probably isn't getting a lot of (public) attention since it's not a sexy thing to break. It's not one of the normally used ciphers, so why bother throwing a lot of resources at it?

For academia, that is. Our friendly three-letter agencies haven't got the same resource constraints, nor a drive for public glory.

However, for the purposes of securely encrypting the typical user's portable bits of personal/private/confidential HTML and text-based data (...)
If you have a hard requirement of no other requirements than a browser (e.g. no executables), perhaps - but I'd still look for other solutions. And it wouldn't be hard to cook up something with a proper encryption algorithm that still decrypts from html+js.

Other than that: threat modeling.
- carpe noctem

IainB

  • Supporting Member
  • Joined in 2008
  • **
  • Posts: 7,451
  • Slartibartfarst
    • View Profile
    • Read more about this member.
    • Donate to Member
Re: FrogTea
« Reply #7 on: April 04, 2017, 03:58 PM »
@fodder:
This seems to be talking at cross-purposes. I am not positioning myself as an advocate or supporter of FrogTea, about which I am relatively ignorant - don't even use it - but merely as a supporter of the innovative idea of the usefulness of something like FrogTea and which I had always considered a novel approach, though not one that I would necessarily advocate using under all circumstances.
In doing this, I am thus attempting to contribute something positive, constructive and potentially useful to DC Forum members, by extending and building on a discussion based on someone else's (@berry's) proposal regarding an encryption tool.

Sure, I can see some potential weaknesses in the use of FrogTea, but what puzzled me in your initial response was what seemed to be your outright damning of the whole thing in this thread - for no compelling, apparent, verifiable and substantive reason - as though it could not possibly be any kind of useful encryption tool. That would seem to be absurd.
In the other thread, you went further and even asked what use/purpose it had and were seemingly mistakenly implying/thinking that I was putting FrogTea forward as some kind of a proposed technological solution to address the issues/problems in that other thread (which I decidedly wasn't doing and which would have been an absurd thing to do in any case).

So you apparently couldn't see the purpose of FrogTea, and yet you effectively damned it as being entirely not fit for purpose, which would seem to be contradictory.
That all rather seemed to me as though you might be having an irrational outburst of some kind, as though you simply just didn't like the thing, nor any part of it, ignoring its potential - although it had what seemed to be a valid and clear set of some strong pros and fewer cons as an encryption tool filling a niche (QED).

You could be (say) largely correct in what you write above, but where you write:
...For academia, that is. Our friendly three-letter agencies haven't got the same resource constraints, nor a drive for public glory. ...
_____________________
- it seems to be based on requirements from your perspective that might be somewhat purist/stringent and thus a tad over-the-top for the kind of domestic situation that I postulated for the average Joe:
However, for the purposes of securely encrypting the typical user's portable bits of personal/private/confidential HTML and text-based data - e.g., to protect against (say) the event where the device holding the data is lost/stolen - with the ability to sync/share it across several devices (all having java and browsers), and between specific trusted people, it seems that FrogTea could potentially be rather useful.
_______________________
Indeed, it still does seem true that "...FrogTea  could potentially be rather useful" - in that niche.
I could be wrong, of course, but I don't see where HTConsulting were suggesting that the requirement was to lock out potential attacks from the likes of the NSA, or suggesting that it was even desirable to have such a high standard of security that one could lock out the likes of the NSA. Maybe if @berry was a habitué of the DC Forum, he would be able to enlighten us both on this matter, but meanwhile we shall just have to suppose.

That's why I made the joke about the unlikely extreme perspective - in the shape of my neighbour Dmitry - and pointed out the more likely relevance of a typical use case:
...If one wanted to explore this further, it could be interesting to know how xTEA has been broken, or something, and where that is documented, and how easy that might be to replicate for the average laptop/smartphone thief.
____________________
- because that is arguably likely to be the typical use case that could be most relevant/applicable for the average Joe. However, it would be incorrect to interpret that - as you seemed to do - as meaning that the requirement was necessarily a "...hard requirement of no other requirements than a browser (e.g. no executables)".
I was not touching on what the requirements really were or should be.
On the contrary, all I was attempting was to retrofit the features to suggest that FrogTea seemed to have the potential to be quite handy if one felt one could make use of such-and-such FrogTea features as it possessed.
This is always remembering that features are not the same thing as requirements, and vice versa.

If we were concerned with the objective of locking out the SS (Secret Services) of this world for ordinary domestic IT users like myself, then I would suggest that this objective is already infeasible and would be "p#ss#ing in the wind", self-defeating and a huge waste of effort.
The SS have already amply demonstrated their power and that they are unstoppable, and if they are blocked from covertly entering through the back door, then they will simply overtly break down the front door and enter that way, and then subject the user to methodical and excessively disproportionate violence (e.g., Kim Dotcom raid) and subsequent public and harmful, punitive treatment using an expensive and compliant state-controlled police and judiciary across nations. This makes extraordinary public examples of those who fail to obey, to dissuade others from disobeying in  future.
If I had thought that FrogTea was potentially that good, then I probably would not recommend its use. It would probably only provoke the SS. So "threat modelling" would be excessive and going over the top again - for most domestic security purposes.

f0dder

  • Charter Honorary Member
  • Joined in 2005
  • ***
  • Posts: 9,146
  • [Well, THAT escalated quickly!]
    • View Profile
    • f0dder's place
    • Read more about this member.
    • Donate to Member
Re: FrogTea
« Reply #8 on: April 05, 2017, 11:19 AM »
Sure, I can see some potential weaknesses in the use of FrogTea, but what puzzled me in your initial response was what seemed to be your outright damning of the whole thing in this thread - for no compelling, apparent, verifiable and substantive reason - as though it could not possibly be any kind of useful encryption tool. That would seem to be absurd.
Not really.

The reasons I listed against using FrogTea are pretty sound. If anything is absurd, it's that insistance that there's some merit in using an unmaintained, closed-source program with problematic encryption - while not philosophically untrue, it's about as ridiculous as insisting that it's better to wear a pajamas in a blizzard than being naked.

In the other thread, you went further and even asked what use/purpose it had and were seemingly mistakenly implying/thinking that I was putting FrogTea forward as some kind of a proposed technological solution to address the issues/problems in that other thread (which I decidedly wasn't doing and which would have been an absurd thing to do in any case).
You seem intent on muddling things up. I tried keeping this thread about FrogTea in and by itself (which can be kept fairly technical), whereas the other thread is political, and it's in that context I struggle to see how tech is supposed to be a solution for a political problem.
- carpe noctem

IainB

  • Supporting Member
  • Joined in 2008
  • **
  • Posts: 7,451
  • Slartibartfarst
    • View Profile
    • Read more about this member.
    • Donate to Member
Re: FrogTea
« Reply #9 on: April 06, 2017, 01:45 AM »
^^
@f0dder: Ah. I see. You must be right.