Schneier on Security

Clive Robinson • November 28, 2008 9:20 AM

It is interesting to note the paper strips.

First off they are numbered at the top (1-18 as far as I can see). But also they are (oddly) of differing alphabet length, sugesting there is a previous stage that was not recorded.

The two first stages both appear to be 18 columns wide

I’m not sure what the intermediate step is (the one that looks like filling under the bell curve)

Then there is the odd maths at the top right of the squared page (whish I could read all the digits).

My gut feeling on the paper strips is that the person is anagraming a transposition cipher of (possibly) 18 chars wide (or 3/6/9/12/18) possibly found from a simple letter pair spacing test.

But the odd lengths sugests there is some previous stage, unfortunatly I can not read the letters well enough to tell how the stages relate to each other 8(

Clive Robinson • November 28, 2008 11:26 AM

@ jim,

Well done.

I suspect as you can read the middle lines you are unlike me not using a mobile phone with an 1.25 x 2 inch screen.

With regard to the pyramid hat or extra chars (as I cannot read them) I’m guessing that they are a cyclic offset backwards and forwards in the original cipher text. And that the plain text you see is where the correct offset jybes.

@ Andy,

“A transposition (anagram encryption)cypher can be detected because it’s letter frequencies are the same as the native language.”

It is fairly easy to avoid or fake with a simple post cipher encoding stage.

If you remember either,

“a sin to err” or “eat on irish”

They give you the most frequently used letters in written English. If you assign the first seven to the numbers 1-7 and the other letters of the alphabet to 80-99 (selecting one for figure/punctuation shift) then you have effectivly flattened the frequency charecteristics of the plain text.

If you use an number OTP to encrypt and then use the above to post code the numbers back to letters it looks very much like a transposition cipher (and reduces the amount of morse etc required).

Likewise if you use a transposition cipher and post code to numbers it looks like you have used an OTP.

Obviously you would make it a little bit more difficult by using something like a pass phrase (from a book etc) to jumble the letter to number mappings.

Either method adds considerable effort to Eve and friends workload when analysing the cipher text.

There are other similar tricks using nulls etc to make life hard, but one of the simplest is “Russian Coupling” where you split the message in two at a known point and send the second half first.

Clive Robinson • December 4, 2008 8:34 PM

@ Graham,

“Check out the SECOM cipher, it’s a little complex but VERY secure.”

There are a couple of things wrong with it that will make it both stronger in use and easier to send correctly.

The first part of it turning the letters into numbers and flatening the frequency is very much as I described further up this blog page.

However when building the letter to number “checkerboard” it should be from a key phrase.

The seven letters should be selected from a larger set in,

“Eat On Irish L” = aehilnorst

And used in the order they are found in the key phrase.

The last three unique letters in this key phrase should be used to pick the gaps.

So the pass phrase of,

“The time of man is but four score years and ten,
For women it is a greater lot of plus ten years”

Gives,

theioan and ars = 189 which gives a top row of,

_theioa__n

The other non “Eat On Irish L” chars in the passphrase shold be pulled as they are,

mfbucydwgp

The remaining non used “Eat on irish l” letters should be put in reverse alphabetical order (srl), followed by the special charecter (*) and then any unused non “eat on irish l” letters (jkqvxz).

srl*jkqvxz

This string is pre appended to the used non “eat on isrish l” letters and split into the two lots of ten,

srl*jkqvxz
mfbucydwgp

The numbers should be scrambled by asigning 12…90 to the first ten unique letters that are not in the “eat on irish l” set.

Then reading back wards from the end of the pass phrase the numbers are selected uniquly in revers order.

So with the passphrase,

“The time of man is but four score years and ten,
For women it is a greater lot of plus ten years”

The numbers are,

6402918753

Giving the first encoding checkerboard as,

x _theioa__n
1 srl*jkqvxz
8 ucydwgpmfb
9 0291875364

A second checkerboard needs to be made up from a different passphrase, which is used after the transpositions to convert the numbers back into alpha charecters. The special charecter gets converted to any random single digit number that is not easily confused with a letter (23456789).

Although the system might be known to the enamy the use of different checkerboards and passphrases renders it virtualy impossible to break without knowing the three pass phrases in use.

And just to make it more difficult, whilst still in the number form, split the message at some passphrase derived point and swap the two parts over.

Surprisingly with a little practice and squared paper it is actually not a difficult system to use.

You can also add “hidden” security/”turned” checks fairly easily as well.

Just remember what ever method you use for your key phrases they should only be used once and not from a recognised source like a news paper etc otherwise the system can be broken…