Schneier on Security

Clive Robinson • February 12, 2010 6:13 PM

Hmm,

The story is reminisant of the “Dimond Safe” story Bruce covered a while ago…

I won’t say it came from the other end of the horse but the mouth I think not.

With regards book codes there are almost as many ways to use books for ciphers as there are books in the world.

You can even use them for “grills” with fixed pitch fonts.

One thing that should be noted is the simple addative cipher that can be used with a One Time Pad can also be used with a book.

If you just add one line of chars (mod26 or whatever) then it is not that difficult to break even without the book.

However the more lines you add the closer it aproximates the OTP.

Back in the 1980’s it was said that four additive lines where sufficient to be effectivly unbreakable me I’m not so sure 😉

With the likes of project Gutenburg or as noted by Carlo Graziani Google getting “online book text” in several languages is not going to be that difficult.

However one book system that did amuse me is one that uses two pages of text as cordinates to another page of text.

You use a “message indicator” to pick three start points (pageA, sentanceA, pageB lineB, char inB, pageC, lineC, char inC). You then convert the sentance at the first (A) start point into a “frequency flatening matrix”

That is you take the first eight letters in “a sin to er” or “eat on irish lid” or other usefull phrase to remember the most frequently used letters in the laguage of the book. You assign these the single digits 0-7 the remaining letters of the alphabet get asigned the double digit numbers 80-99 (oh and two special chars such as ‘.’ and ‘,’ or figure/letter “shift” etc).

You then use this frequency flatening matrix to convert the text from the second (B) start point into numbers.

These numbers you use as a count to get the next char from the third (C) start point. This forms your faux OTP.

As simple as it sounds it is very error prone when done by a human but works well enough on a computer. And as many will note the faux OTP is not statisticaly flat (though that can be quite easily corrected 😉

There are any number of such systems that people have thought up and some people think them up for fun to make puzzels from to encipher a well known saying etc.

Clive Robinson • February 15, 2010 4:17 PM

@ JRR,

“are you talking about finding the packages AFTER they decoded the coordinates and had dug that big hole, or are you talking about running ground-penetrating radar over an entire state park?”

After they decoded the coordinates and either just before or just after they dug the big hole.

GPR is quick over a small area (say 100 x 100 meteres or yards 😉

Soil resestivity tests are reasonably quick over larger areas of open ground (say 500 x 500 meters)

And there are various other air bourn tests that work over much bigger areas.

The problem is how virgin the ground is and how big the hole dug to bury the object.

GPR will pick up a small post hole, soil restivity possably not.

Something the size required to bury a body will be detectable from an air bourn system in flat open ground even a hundred years after the burial and despite the fact that the field has been top ploughed in more recent times.

But if this guy was burying hundreds of documents we are talking about quite a big hole, it is unlikly it was dug in an optimal way thus it may easily have been four or more foot or so in diameter. He did however show some good sense in some respects in that he did it in an aborial area. GPR will detect soil disturbance in such an area with only minor problems not so soil resistivity (tree roots are like poor conductors and go in various directions) and obviously trees mask the ground from many airbourn systems.

However they did know on thing that might well have aided their search even if they did not have anything other than an aproximate area. They knew that he had banged a buch of nails into a marker tree at each site.

How many trees can you check with a metal detector a day?

A single person could easily sweep a tree in 15 seconds with a standard security wand metal detector and walk to the next in another in less than 15 seconds. With a second person acting as trail finder / marker off you could be doing 1000 trees per two person team per day.

In open mature woodland (I don’t know the actual terain we are talking about here so take this with a large pinch of salt) trees tend to be 50 feet diameter or so apart.

So as a poor aproximation you are looking at doing a standing avenue of trees 50,000 ft by 50 ft or 2,500,000 square foot a day. Which is aproximatly 500 * 500 meters area so four teams of two people could concevably do 1Km by 1Km area per day in the summer.

All considerably less risky than draging a GPR or soil geophysics package around. If people do ask then be honest and say you are looking for nails banged into trees. If people ask why say “do you know what a copper nail does to a tree?” and if they say no say “it kills it over about five years”. If they then ask “but who would do that” say people setting up tempory hides for hunting/nature watching etc etc. You immediatly come across as a good guy and have the side effect you might actually stop some people banking nails into trees (three wins 😉