What do you know about control strings?

[IS-92]

Control strings can be considered as an alternative to asymmetric encryption.

Unlike solutions that use public and private secret keys, here, session cryptographic protocols are exchanged implicitly.

In practice, a control string allows both parties (sender and recipient) to independently generate a symmetric set of cryptographic primitives (encryption algorithm, encryption mechanism, hash function, MDF, KDF, filter byte, IV, etc.). Тhis information can be transmitted over an open channel (such as the internet) without in any way jeopardizing the confidentiality of critical data.

Another characteristic feature of control strings is that the length of the delta secret session keys generated by them (in practice, there is more than one) is always greater than or equal to the length of the encrypted sequence of bytes (regardless of whether it is files, text, or streaming data). This means that in this case, Claude Shannon's theorem will always be fulfilled.

Control strings successfully combine methods from combinatorics with algorithms that have proven their effectiveness in practice.

Currently, the software solutions using control strings are only available for Windows. These solutions include specialized email clients, systems for encrypting large file arrays, specialized database protection solutions, and hybrid solutions for protecting multimedia information, among others.

I would be grateful if anyone could share their experience with using control strings to protect critical data, as the information available is currently limited.

Thanks in advance for your help.

[Salem]

Control strings can be considered as an alternative to asymmetric encryption.

Do you have any references?

[IS-92]

Мy colleagues introduced me to a software product that uses this solution. It uses two options for generating control strings:

Through digital images (as explained in the report). The application uses "decks". This is an alias for a set of digital images that are used.

The problem for me was that at first I thought this was a form of steganography, but it turned out I was wrong.
This approach has nothing to do with steganography. The principle is different. There is no "hidden" information here. In fact, the information itself is used as a component for generating session cryptographic protocols.

Through a randomly selected web resource (they demonstrate with the official National Security Agency website). In this case, they demonstrate how this site is utilized as a reliable source for generating control strings, without violating the law or compromising the site's functionality in any way.

You can see this if you look at the images at the following address:

apps.microsoft.com/detail/9PM7VN21SK42

[IS-92]

Example:

Control string generated from a web resource (https://www.nsa.gov/):

F2 F4 33 A2 57 57 56 F6 F6 F6 86 86 87 D7 D7 D3 63 63 67 E7 E7 E2 F2 F2 F2 12 12 12 42 42 44 E4 E4 E2 F2 F2 F2 92 92 92 52 52 52 D2 D2 D2 E3 02 D8 08 08 08 07 97 57 A7 26 B7 E7 57 07 B7 47 15 67 27

Result crypto protocol:

Cipher: Twofish (symmetric key block cipher)
Mode: CTS (Ciphertext stealing)
Hash function: Tiger
Key derivation: KDF2
Transfer encoding: HEX

Delta Key: 51 15 72 23 B4 16 42 62 A6 D6 04 07 27 84 25 87 72 D6 F4 73 E2 B5 05 75 D4 06 94 D3 14 92 85 83
Delta Cipher IV: 29 95 97 35 A7 12 35 D3 F2 62 72 15 D3 62 E3 93
Seed: 68 83 83 95 C2 66 47 85 77 33 23 72 E7 82 23 53 52 F2 42 52 23 03 23 54 C6 33 B5 82 E5 C3 A6 02 82 86 03 D3 55 52 66 E3 72 74 E4 F3 17 E4 A2 A4 A7 13 E5 53 94 C5 82 E2 12 16 84 82 93 D3 F7 E7
Filter byte: 255
Password: r9S'gA:R}64%TD{R6gHQQv39$mb*6X

DELTA RESISTANCE:

Hd ... 4,230756
Nd ... 135,384196
Ld ... 32

PASSWORD RESISTANCE:

Hp ... 3,990238
Np ... 127,687615
Lp ... 32

Both parties (Alice and Bob) effectively have a "locksmith" (session crypto machine, SCM) who "unlocks" the message (in this case, the protected files). Тhere is no need for two keys, and in one session, we can have N number of secret keys and even algorithms. There is no limit.

Unfortunately, most of the articles on the subject are in Bulgarian, and some of them are classified. I will try to translate some, but there is one key one, which is from 2010.

[Salem]

I'm still none the wiser as to how this works.

At best, it seems like your "control string" is a buzzword for nothing more than either an initialisation vector or a salt.

Your worked example is nonsense without context. Anyone can post a bunch of random data and claim anything.

Your "app" seems like just yet another run of the mill file system encryption tool, except it reads like https://en.wikipedia.org/wiki/Snake_oil_(cryptography)

[rproffitt]

Over on other discussions, the premise that control strings can be considered an alternative to asymmetric encryption is false.

Was this a presumption or the beginning of some thesis?

[IS-92]

If you allow me some small clarifications.

Let's start with the fact that in asymmetric encryption, you have two keys, and it uses trusted certificates. We also exchange secret keys using the same cryptographic algorithm. Not to mention that the same secret key is used multiple times.
In contrast to this approach, with control strings we have an exchange of a control string, which allows the generation of a set of secret keys, as well as the generation of a session cryptographic protocol, which includes an encryption algorithm, a hash function, an encryption mechanism, etc.
In practice, the two approaches have no commonalities. The principle is diametrically different.
With asymmetric encryption, you have an "exchange". With control strings, there is practically no exchange, but we have a "generation" at the end client.
I became personally acquainted with control strings during a scientific conference organized by a military school in 2018.
However, I disagree that this is simply generating random IVs and salts.
Also, this approach is not just used for files. It's used for messages and more. It's also used for databases. And the example I gave just shows one solution that I use. But it's not the only one.
Just because there is no information on the internet about this topic doesn't mean it's not a topic we should discuss.
Control strings are an absolute analogue of Raymond Queneau's "Cent mille milliards de poèmes", but in this case, they are used for encryption.

[Salem]

Again, you're providing nothing but speculation and circumstance.

So Alice sends Bob a "control string" and they both derive some secret "session" key. How do they do that based on the publicly transmitted information. What stops Eve performing the same derivation?

[IS-92]

Hello, Salem,

Your question is very relevant and was the first question I asked.
Widely used cryptographic solutions are based on encryption algorithms that use integer factorization or discrete logarithms.
In this case we are referring to combinatorics and modern mathematical theories (À la Poursuite des Champs, Shabbat polynomial, random digital objects isomorphism etc.). This suggests a different approach to the same problem.
The idea is not new and is currently widely used in various fields, especially in the management of critical processes.
With control strings there is no process of transmission (exchange) of control strings, unless someone decides to do so, but even then it is not a problem for it to be intercepted by anyone. As I already mentioned, the principle is different and it is based on "generation" (extraction). In this case, the level of protection is reduced to the minimum number of possible combinations, which is a task from the field of combinatorics.
The generation itself is based on a randomly selected object (digital, analog, material or virtual).
In this case, the unauthorized user should at least know who the random object is (and in the real case objects), which their parameters are used, under what boundary conditions, etc. Without this information, cryptanalysis by an unauthorized user is not possible.
I think it is appropriate to first see how control strings function at a basic level, because I understand that this is not exactly understood at the moment.

Quote:

"The work you are holding in your hands represents, itself alone, a quantity of text far greater than everything man has written since the invention of writing, including popular novels, business letters, diplomatic correspondence, private mail, rough drafts thrown into the wastebasket, and graffiti."

François Le Lionnais, postface to Cent Mille Milliards de poèmes
Société mathématique de France (SMF).

Example:

Due to the sonnet form: aBaB aBaB ccD eeD - 61 42 61 42 61 42 61 42 63 63 44 65 65 44 (14 Bytes);
Result: 100 000 000 000 000 sonnets.

One of the billions of possible control string structures:

3F F3 F3 F7 57 57 56 F6 F6 F6 86 86 87 D7 D7 D3 63 63 67 E7 E7 E2 F2 F2 F2 12 12 12 42 42 44 E4 E4 E2 F2 F2 F2 92 92 92 52 52 52 D2 D2 D2 E3 02 D8 08 08 08 07 97 57 A7 26 B7 E7 57 07 B7 47 15 67 27

Part I - 3F F3 F3 F7 57 57 56 F6 (16 Bytes) - Cipher algorithms Id list records (min value: 30, max value: 1465341686);
Part II - F6 F6 86 86 87 D7 D7 D3 16 Bytes) - Encryption mode Id list records (min value: 9, max value: 2015897645);
Part III - 63 63 67 E7 E7 E2 F2 F2 16 BYtes) - Hash functions Id list records (min value: 26, max value: 404557070);
Part IV - 12 12 12 42 42 44 E4 E4 16 Bytes) - Key derivation Id list records (min value: 7, max value: 1111811300);
Part V - E2 F2 F2 F2 92 92 92 52 (16 Bytes) - Transfer encoding Id list records (min value: 9, max value: 1835888046);
Part VI - 52 D2 D2 D2 (8 Bytes) - CSR control Id list records (min value: 4, max value: 1389548242);
Part VII - E3 02 D8 08 (8 Bytes) - Password generation mode Id list records (min value: 4, max value: 486352888);
Part VIII - 08 08 07 97 57 A7 26 B7 (16 Bytes) - Control mechanism identifier (there are more than one);
Part IX - E7 57 07 B7 47 15 67 27 (16 Bytes) - Code of the mechanism for managing the life cycle of secret keys (there are many more than two).

Combination formula:

C(n,r)=n!/(r!x(n-r)!)

Substituting the Minimum Values:
(Only for the first seven components of the cryptographic protocol)

n = 30+9+26+7+9+4+4 = 89
r = 7

C(89,7)=89!/(7!x(89-7)!) = 89!/(7!x82!)

You can calculate the possible number of combinations yourself, and this is just the beginning.

Now let's think about what is the probability in this case that an unauthorized person, even with unlimited resources, will be able to determine the correct combination for one session?

Note: In this case, the standard duration of one session is about 36 milliseconds.

Combinatorics is one of the oldest branches of mathematics.

The National Cryptologic Museum (NCM) has many interesting exhibits, some of which deserve special attention.
It is also worth carefully studying Esquisse d'un Programme. There is much to be learned there about modern cryptography.

There is also a lot of useful information in the seminars regularly held by the Quantum Computing Institute.

[IS-92]

Please note that in the previous example I did not mention a secret key, hash, seed (here we use "seeds" and "quantization" of the input data, not "salting the hash"), etc.

Thank you for your opinion. It is very important to me.

[IS-92]

Let us pay tribute to أَبُو اَلْعِزِ بْنُ إسْماعِيلِ بْنُ الرزَّاز الجزري.
We owe the idea of control strings to him.
For more than a thousand years, what he created has been working, and to this day, no supercomputer or quantum computer has been able to unlock the chest.
I remind you that in this case, mechanical elements are used, which in modern solutions are simply replaced with digital (virtual) ones.
As you can see, this is not something new.
A long time ago, all this was described in "Тhe book of knowledge about witty mechanical devices".
Let us give Al-Jazari his due, because he was a great scientist to whom we owe a lot today, including in the field of the theory of mechanisms and machines, theoretical mechanics, and more.

In the picture you will see the first mechanical computer that used control strings.

[https://i.pinimg.com/originals/3c/e4/8c/3ce48c9fef412a0a4d02a91bb8eac085.jpg]

[Salem]

I have nothing else to add without seeing either some peer reviewed research papers explaining how it works, or some open source proof of concept code I can download, examine and try.

[IS-92]

Thank you for your interest.

As I mentioned, there are articles, but in English there is only one publication in 2010 and it is from a conference, and the materials there were published only as a paper book (they were not published on the internet).
I will translate some articles on the topic, and I will provide you with access to them. If you use a language other than English, you can share.

What I would like to clarify is that we are currently working on a specific project related to the pharmaceutical industry and my desire is to discuss the topic with a person who has practical experience related to the use of control strings in the management of industrial processes.

I assume that you are aware that in such solutions things like "open source" are absolutely unacceptable.

Industrial controllers are critical devices and established protocols are followed there.

Not to mention that operating systems that work in real time are not like the ones used on a mass. There are quite serious differences that also need to be known in detail.

If you have experience in programming systems that use parallel data processing, if you know in detail PPL, and future objects (future objects are objects that implement the IFuture interface, which defines a mechanism to access the result of a function asynchronously) etc., you would be useful.

The purpose of the topic is not to discuss how effective these types of solutions are (they have been proven and have been used for years), but to try to solve two specific cases with joint efforts.

This requires serious knowledge, including in specific sections of mathematics, one of which is extreme graph theory.

If you could help, I would be grateful. If the topic is unfamiliar to you, you can simply follow the discussion here and if you have any questions, I or one of my colleagues will answer you.

Thank you once again for the shared opinion, because as I mentioned, it is of great importance to me and my colleagues. Your posts helped us make extremely important conclusions that will be of great use in future presentations.

Sincerely

P.S. My personal advice is to familiarize yourself with the Diffie-Hellman key exchange protocol (DH).
This will help you understand control strings. It is also a good idea to follow the development of NIST CRYSTALS-Kyber, BIKE, Classic McEliece, HQC and SIKE, which use technology known to us from Google's Kyber-768 (it is good to read more about X25519 before that). Тhese are quite popular topics and there is a lot of information about them on the Internet.

[rproffitt]

A simple google with "experience related to the use of "control strings" in the management of industrial processes." finds prior works and much later than 2010.

1. Sadly it seems this is the classic XY Problem discussion. Read https://en.wikipedia.org/wiki/XY_problem
2. Some of what you write sounds like the genesis of a paper for school. Which is fine but don't leave out that or the reason you are exploring this topic. Again, the XY problem rears its head.
3. It's clear there is plenty of papers to be had but back to the XY problem. I don't see why I would use control strings here as the problem X (the user's problem) isn't clear and the Y/WHY? or root problem isn't clearly told.

[IS-92]

I completely agree with you that the XY problem is crucial when a decision needs to be made. But agree that even though Eric Steven Raymond is a programmer, this is more of a communication issue.

Control strings are a technological solution based on current standards NIST, FIPS, ISO, and GOST. The standards are proven engineering practices.

But since you raised the question of choice, I will give you just one elementary example of the advantages of control strings over all other solutions.

I assume you are familiar with the DIANA cryptographic system used by the National Security Agency (NSA).
Control strings can be considered a branch of this system for civilian use, with the difference that even if you use TEMPEST interception, you will not gain unauthorized access.

If you would allow me, could you please point me to the articles you found that relate to the use of control strings?

I would be obliged.

Thanks in advance

[jkon]

Hello IS-92,

I am very happy that you reply to posts , and this is refreshing. However, please also address the topic being presented rather than your own. Call me what you want, but reading your posts, I didn't understand: What problem are you trying to solve? How does your proposed method solve it better? Can you provide an example in any programming language that I can test?

I won't speculate about your intentions since you're part of this community and we're discussing it openly. However, please clearly present what you're proposing with code and tests that demonstrate it.

[IS-92]

Thank you for your willingness to help.

The first issue that is of critical importance when working with control strings on large data sets is the issue of accurate time interval measurement.
In this case, it is necessary to work with microsecond accuracy in parallel processing mode.
I am attaching a sample code.
Programming language Object Pascal (Delphi).
Development environment RAD Studio

You need to add System.Threading.
The application is a standard multi-platform (one code for Windows, Linux, iOS, and Android).

procedure TTimeControl.TaskTimeControl(Sender: TObject);
var
   Task : ITask;
   Float: Single;
   Time : Integer;

begin

   // We are creating a task...
   Task:= TTask.Create(procedure ()
      begin

         // For example,
         // we generate a random floating point number...
         Float:= Random;

         // Determining the task execution time in microseconds...
         TaskTime:= .......;

      end);

   // We start the task ...
   Task.Start;

end;

Can you suggest a solution for the precise determination of the time interval?

I repeat that it should be accurate to 1 microsecond, not 1 millisecond. Moreover, periodic calibration should not be required.

Thank you for your interest.

[Salem]

The first issue that is of critical importance when working with control strings on large data sets is the issue of accurate time interval measurement.

Why?

The only use of time I'm aware of is in Timed One-Time Passcodes, but these operate at minute intervals, not microseconds.

Sure, speed is important if you're encrypting a lot of data, but the actual ticks are not inputs to the algorithm.

[Salem]

Oh, and Chatgpt is similarly in the dark as the rest of use as to what you mean.

What can you tell me about "Control strings can be considered as an alternative to asymmetric encryption."

The statement "Control strings can be considered as an alternative to asymmetric encryption" is not a widely accepted or standard concept in cryptography. To evaluate this statement accurately, we need to break down and clarify two things:

1. What are "control strings"?

In general computer science or software contexts, control strings usually refer to:

Strings that contain special characters or commands used to control output formatting (e.g., \n, \t, or printf-style format strings).

Input that influences the flow or control of a program (e.g., configuration strings, command sequences).

In some custom protocols or niche systems, control strings may be user-defined values that influence secure access or behavior.

However, "control strings" are not a standard cryptographic primitive. There’s no well-known or formally defined cryptographic mechanism called "control strings" in the same sense as asymmetric encryption (like RSA, ECC).

So, unless the term is being used in a highly specific or proprietary context, it's not an accepted alternative in cryptography.

1. What is asymmetric encryption?

Asymmetric encryption uses public-private key pairs:

The public key is shared openly.

The private key is kept secret.

It allows secure communication (e.g., anyone can encrypt using your public key, but only you can decrypt it with your private key).

Common algorithms: RSA, Elliptic Curve Cryptography (ECC), ElGamal.

It solves key distribution problems and is foundational to modern security protocols like SSL/TLS, PGP, and blockchain systems.

Why "Control Strings" Are Not a Real Alternative

Unless we're talking about a very specific custom system, control strings do not provide:

Encryption (confidentiality),

Key distribution,

Authentication, or

Non-repudiation,

which are the core features of asymmetric encryption.

Possibilities Where the Statement Might Make Sense

There are a few niche or hypothetical scenarios where someone might suggest something like this:

Control strings used in challenge-response systems:

E.g., A fixed "control string" acts like a password or challenge.

But this is more like symmetric authentication, not a true alternative to asymmetric encryption.

In constrained systems:

Someone might argue that instead of using expensive asymmetric crypto, predefined “control strings” can be used to control access or trigger actions.

But again, this would lack the security guarantees provided by public-key cryptography.

Obfuscation or access control mechanisms:

Control strings might act like "keys" to unlock features or access, but this is not encryption in a cryptographic sense.

Final Assessment

The statement "Control strings can be considered as an alternative to asymmetric encryption" is:

❌ Misleading or incorrect in general cryptographic terms.

⚠️ Potentially valid only in very narrow, custom, or non-cryptographic contexts (like proprietary access control mechanisms).

✅ Would require clear definition of what "control strings" means in the specific context to assess any equivalence or substitution.

If you have a specific paper, system, or context where you saw this claim, feel free to share it — I can then give a more precise and contextualized evaluation.

[Reverend Jim]

the XY PROBLEM

Is that where you look at your ex and wonder why?

[IS-92]

When working with databases and processing queries that retrieve information from encrypted databases, you have to work in very small time intervals. Keep in mind that in this case the maximum allowable transaction processing time is 32 milliseconds. For reference, for banking transactions it is in the order of 300 milliseconds.

[IS-92]

Salem, control strings are not a "cryptographic primitive", just as "asymmetric encryption" is not a cryptographic primitive.
The cryptographic primitives that form the basis of cryptographic protocols include encryption algorithms, hash functions, and encryption mechanisms, among others. All of them are subject to standardization.
The claim that control strings are, quote: "predefined" is not true.
Where exactly did you read that they are "predefined"?
Elliptic Curve Cryptography (Elliptic Curve Cryptography, ECC) is a set of algorithms based on the Residue Number System (RNS). Currently, they are used in TLS, PGP, and SSH, and no one has questioned this. Previously, RSA, DSA, and DH were used.
It is a completely different matter if we have two varieties of this approach, as follows: elliptic curves over real numbers and elliptic curves over finite fields, which brings us back to the discrete logarithm problem.
From what you wrote, I understand that you don't distinguish between "encryption", "cipher algorithm", "cipher mechanism", and "access control".

[IS-92]

In addition, we also have one-time password (OTP), time-based one-time password (TOTP), HMAC-based one-time password (HOTP) algorithm, which has been adopted as a basic standard by the Internet Engineering Task Force (IETF). All of them can be considered as control strings, with limited functionality.
This is very well described in RFC 6238.
If you use a credit or debit card, you have probably used these solutions.

[IS-92]

Reverend Jim, the comparison with the former is very accurate. This is the most accurate description of XY, the decision-making model. :-)

[Salem]

I smell a troll - I'm out.

[IS-92]

Salem, just say that you are not familiar with the topic and that you cannot help.
Please excuse me, but when elementary competence is lacking, one moves on to personal attacks.
So far, I have not read a single serious argument from you. I also did not notice that you had read and understood a single line of what was written. I am glad that you are leaving, because in reality, opinions like yours are of no use.

Sincerely

[IS-92]

The answer to the question was given by a colleague in another forum.
I will allow myself to publish her answer, because it can serve as an example of how a discussion is conducted.
The answer that the colleague gave can also be used in other tasks related to real-time processes, and not only.
I would also pay special attention to the method she proposed for generating session passwords (or secret keys), because it is really quite an interesting solution.

"... I had a similar problem to yours. To solve it, I used System.Diagnostics.TStopwatch, and the result completely satisfies me.
In my case, I used this to generate random session passwords, but if you use KDF, you can also use it to generate delta keys.
The time delay is insignificant and does not affect the overall process.
This is my code:

procedure TTimeControl.TaskTimeControl(Sender: TObject);
var

   Timer: TStopWatch;   // This is my solution, but I'm looking for other options.

   Task : ITask;
   Float: Single;
   Time : Integer;


   OTP: String; // Time-based One-Time Password


begin

   // We are creating a task...
   Task:= TTask.Create(procedure ()
      begin

         // For example,
         // we generate a random floating point number...


     // Start time control
     Timer:= TStopWatch.StartNew;

         Float:= Random;

     //Wnd time control
     Timer.Stop;


     // Determining the task execution time 
     TaskTime:= Timer.Elapsed.FromTicks;

     // Create Time-based One-Time Password (OTP)
     OTP:= FormatFloat('0.000000', TaskTime);
     OTP:= CreateMGF1(OTR, 32);  // 32 bytes password
     OTP:= StringToASCII(OTR);

      end);

   // We start the task ...
   Task.Start;

end;

I hope I was helpful to you. "

Thank you to my colleague for the suggestion.
I share it as an example that shows how communication should be done.

[IS-92]

A second practical problem related to the use of control strings.

Unlike digital certificates, control strings do not require storage in files or BLOB fields; however, another issue arises that deserves separate attention.

As mentioned, the main difference between asymmetric encryption and encryption using control strings is that while the former only exchanges secret keys, and a limited number of them (public and private), with control strings, we have symmetric generation of cryptographic protocols and an unlimited number of secret keys.

There are no problems with the management of secret keys and their subsequent destruction; however, the formation of the protocols has its own specific requirements.
Each protocol necessarily has a cipher algorithm, cipher mode, hash function, MDF/KDF function, and encoding. Groups of bytes contained in the control strings are used to form them.

Each protocol necessarily has a cipher algorithm, cipher mode, hash function, MDF/KDF function, and encoding. Groups of bytes contained in the control strings are used to form them.

For example:

CS Delta: ... 01111100 00111011 00101100 01011000 01011011 ...

| 01111100 | 00111011 | 00101100 | 01011000 | 01011011 |

Cipher Id - 01111100
Mode Id - 00111011
Hash Id - 00101100
MDF/KDF Id - 01011000
Encoding - 01011011

Cipher: IDEA, PGP - 01111100
Mode: OFB - 00111011
Hash: SHA 512 - 00101100
KDF: MDF1 - 0101; KDFx - 1011
Encode: HEX - 01011011

It is obvious that in this case we have an information surplus. The reason for this is that each byte consists of two tetrads, and these are eight bits. At the same time, the number of standardized cryptographic primitives is limited. In the case of KDF, it doesn't even exceed 10.

The question is:

Do you have any suggestions or ideas on what could be done to minimize the information overload?

Thanks in advance for any answers to this question.

[Ritikadas]

wow