ROT13 algorithm in C

Question

I am trying to learn C and I came across the ROT13 scrambling system used to store some passwords.

Assuming the user types everything in correctly (uses 1 argument, uses a string not an int, etc.) would this be correct/safe to use? Or is there anything at all that I am doing wrong you can point out to me (techniques, indentation, anything at all)?

#include <stdio.h>
#include <string.h>

int main(int argc, char** argv)
{
    char* word = argv[1];
    int key = 13;

    // all the letters in the first argument 
    for (int n = 0, len = strlen(word); n < len; n++)
    {
        int currentLetter = word[n];

        char cipher = currentLetter + key;

        // make sure the next letter isn't over 26 or it isn't a ascii letter
        // if it is, do %26
        if ((currentLetter - 'a') + key > 26)
        {
            key = (currentLetter - 'a') + key) % 26;
            cipher = 'a' + key;
        }

        printf("%c", cipher);
        // reset the key and do the next letter
        key = 13;
        }
    }
    printf("\n");
    return 0;
}

Answer 1

Test your program with a variety of inputs. Include "abcdefghijklmnopqrstuvwxyz".

Have a look what happens for 'n'. Always try to make sure you test low values, high values and edge cases. 'Wrapping round' is a classic edge case.

Then look at this line:

if ((currentLetter - 'a') + key > 26)

This program only works for lower case 'passwords'.

You might look at the functions in #include <ctype.h> such as tolower(.) or islower(.) to extend to mixing upper and lower case.

NB Obviously ROT13 has no real cryptographic value of any kind. I mention that because I have seen it (and things not better) used in applications. You're doing this as a learning exercise. Right?

Answer 2

ROT13 scrambling system used to store some passwords

If you find someone using it to store passwords, please tell them to stop, and to actually hash the passwords instead. ROT13 does not provide any security.

Beware of code like this:

 currentLetter - 'a'

The results are platform-dependent (or rather, character-set dependent). Not all character codings have the 26 alphabetical letters as consecutive elements - EBCDIC being the most common exception.

For a coding-independent approach, I would recommend a simple lookup table:

char translate[UCHAR_MAX+1];
/* first make all characters translate to themselves */
for (size_t i = 0;  i < sizeof translate;  ++i) {
    translate[i] = (char)i;
}
char *letters_am = "abcdefghijklm";
char *letters_nz = "nopqrstuvwxyz";
for (size_t i = 0;  letters_am[i];  ++i) {
     /* two corresponding lower-case chars */
     unsigned char c1 = letters_am[i];
     unsigned char c2 = letters_nz[i];
     translate[c1] = c2;
     translate[c2] = c1;
     /* same for their uppercase equivalents */
     c1 = toupper(c1);
     c2 = toupper(c2);
     translate[c1] = c2;
     translate[c2] = c1;
}

Once this table is initialised, we can then transform input very simply:

int c;
while ((c = getchar()) != EOF) {
    putchar(translate[c]);
}

Answer 3

I think that the best way to decode ROT13 is with an algorithm like this:

    j = 0;
        while (buf[i] != '\0')
        {
                if ((buf[i] >= 'a' && buf[i] <= 'm') || (buf[i] >= 'A' && buf[i] <= 'M'))
                        buf[i] += 13;
                else if ((buf[i] >= 'n' && buf[i] <= 'z') || (buf[i] >= 'N' && buf[i] <= 'Z'))
                        buf[i] -= 13;
                decoded[j++] = buf[i];
                i++;
        }
        decoded[j+1] = '\0';