Schneier on Security

Clive Robinson • March 31, 2011 8:03 AM

Sometimes you need to know the “entity” when trying to work out how a system is constructed.

From what has been said,

“McCormick was a high school dropout, but was able to read and write and was said to be “street smart.” According to members of his family, McCormick had used such encrypted notes since he was young, but apparently no one in his family knows how to decipher the codes”

and,

“The FBI says that officers in St. Louis, Missour discovered the body of 41 year-old Ricky McCormick on June 30, 1999 in a field and the clues regarding the homicide were two encrypted notes found in the victim’s pants pockets.”

So Ricky was born around 1958, and the various forms of high functioning Autism such as dyslexia were not realy recognised / diagnosed / treated untill the mid 1980’s so well past the time he would have “dropped out” (possibly of shame).

One asspect of the various Autistic Spectrum Disorders (ASD) is a “savant” ability whereby they can memorise large amounts of data and do “mentaly mechanical” tasks way beyond that of other mortals.

What has not been said is what is known about Ricky around the time of his death or what the FBI’s interest in the matter is (I was under the impression they did not deal with local jurisdiction type crimes).

What did he do for a living for instance where and what sort of place did he live in. All can be clues to his mental makeup.

If he was “street smart” but a “high school drop out” I would but a small bet on his being ASD without further evidence.

Keeping encrypted notes from prior to adolescense is another significant indicator (ie they cannot accademicaly show how smart they are but can prove it by doing things others his own age or considerably older cannot do (and the inability of others to recognise this gives rise to a real sense of shame and resentment).

If he worked at the fringes of crime I would actually increase the size of the bet, esspecialy if he was a “bookies runner” or other “numbers person” (by and large criminals don’t care what your academic ability is but they do realy care if you have a rare useful skill they can use profitably).

This is because in several studies of first offenders who had educational problems above junior level, many were found to have high intellect but poor academic ability. In some extended studies after receiving appropriate “schooling” something like 80% of these “offenders” did not re-offend and over a period of years worked their way up to above average income for the areas they lived.

If Ricky had these problems (ie was high functioning ASD) the chances are he could do multiple encipherment fuctions in his head without having to use pencil and paper.

Thus we could be looking at a polyalphabetic cipher or stream cipher using some kind of feed back or feed forward generator.

For instance for my sins (and no I’m by no means of “savant” level) I have in the past been able to do a simple additive generator with a five charecter lag in my head.

There is also an additional mental trick where you can do a running average by keeping the running total of the five numbers in your head and subtracting the fifth char back whilst adding the new char.

So some of those bracketed items may be “message indicators” or keys.

So it is entirely possible Ricky’s system is polyalphabetic with a running key based on a simple generator. And if that is the case we don’t have sufficient information to find the system except by luck.

One avenue would be “probable plain text” for both messages and try to “zig zag” (or “saw tooth” for those in the US) them out.

Clive Robinson • March 31, 2011 10:26 AM

@ Wumpus,

‘Oddly enough, some people enter these things called the “NIST cryptographic hash Algorithm Competition’

Could that “oddly” be because they don’t trust Federal employees enough to get it right (I know I don’t based on past performance)?

Afterall the majority of the serious entrants don’t even pay US Tax…

So in a way it shows just how little the rest of the world trusts “Federal Employees” and their employer.

Or maybe their daft enough to think there may be fame and fortune in it somewhere 😉

Clive Robinson • March 31, 2011 4:25 PM

@ M,

“I highly doubt that this is crypto though; otherwise it would have been cracked by now.”

Possibly not, there are many civil war ciphers still waiting to be decoded where the key is not one of the standard set or have minor errors in coding etc.

Likewise there are still a great deal of “agents codes” from the second world war and later just sitting there undecoded and some may still be of importance over and above their historical value.

It’s usually a question of “resources” such as thinking time when a cipher structure is unknown.

Looking at the two images both pages appear to be written in a rational way and a quick visual scan for frequency count sugests they are not “randomly selected by human”. However the flow of the lines does suggest that they were written continuously not on a charecter by charecter basis which would be evidence for your proposal as “gibberish”.

That said if I had to make a guess my first thought due to the structure and various line lengths is it is a character based substitution cipher. That was written out in a fluid way (either by being copied from a rough working sheet or because the writer could code in their head).

If it is actually a cipher or code the question then arises as to if it is mono or polyalphabetic?

Although there are short stretches that appear to be monoalphabetic I’m thinking that it’s probably polyalphabetic in some way.

The question then is are the alphabets related or independent of each other and how many are there and what cause the shift to the next alphabet.

It might also be a chained monoalphabet, but the ciphertext does not look right for that (I’d need to do a charecter distance graph to check that by eye).

The question then arises about the other symbols etc that are interspaced with the text, they may or may not have meaning as “control charecters” in changing the alphabet etc.

In truth the number of possabilities is probably more abundant than the number of letters, and there is insufficient ciphertext to take a reliable stab at finding any real structure.