Decrypted Secrets
Classic conventional cryptography
CS349 Cryptography
Department of Computer Science
Wellesley College
Everyone keeps secrets
o
The disk of Phaistos, a
Cretan-Minoan clay disk
from the 17th century BC.
o
A decryption that is
generally accepted does
not seem to exist.
Classic cryptology
2-2
1
Substitution techniques
Julius Caesar used a system that cyclically
mapped letters to the third letter in the
alphabet.
plain: meet me after the toga party
CIPHER: PHHW PH DIWHU WKH WRJD SDUMB
Classic cryptology
2-3
Classic cryptology
2-4
Brute-force cryptanalysis
o
Here we guessed that the
encryption was a CAESAR
cipher*,
o
And we used the fact that
the language of the
plaintext was easily
recognizable.
*”The enemy knows the system being used.”
Claude Shannon
2
Knowledge of the plaintext language is
helpful, but not absolutely necessary
Frequency profile, English language
Frequency profile, German language
Classic cryptology
2-5
Cipher text frequency profiles
Frequency profile, German language
Frequency profile, ciphertext
Classic cryptology
2-6
3
Large key size
complicates exhaustive search
Classic cryptology
2-7
So let’s completely mix the letters*
*Or even invent our own -- the resulting encryptions are known as
monoalphabetic ciphers.
Classic cryptology
2-8
4
26! keys is a challenge to brute-force
o
But monoalphabetic
substitution is still
vulnerable to pattern
matching and statistical
attack.
o
Probable word attacks can
be particularly
devastating.
Classic cryptology
2-9
Maxim No. 1: One should never
underrate the adversary
Classic cryptology
2-10
5
Maxim No. 1’. One should never
overrate one’s allies
o
While not secure,
CAESAR ciphers are easy
to learn and to use.
o
Simplicity is essential for
cryptosystems used by
many, often in difficult
circumstances.
Classic cryptology
2-11
Classic cryptology
2-12
Vigenère tableau
o
The confederate cipher
disk is functionally
equivalent to the ‘tabula
recta’ of Trithemius.
6
A polyalphabetic cipher in action
key:
deceptivedeceptivedeceptive
plaintext: wearediscoveredsaveyourself
Ciphertext:ZICVTWQNGRZGVTWAVZHCQYGLMGJ
Classic cryptology
2-13
Classic cryptology
2-14
Alberti cipher disks
o
Leon Battista Alberti
described a mechanical
tool in 1466 for general
substitution with shifted
mixed alphabets.
7
Jefferson cylinder
o
Thomas Jefferson took
the idea one step further
by completely mixing all
the alphabets.
o
The U.S. cipher device M94 was widely used for
lower-level military
communications until 1942.
Classic cryptology
2-15
Classic cryptology
2-16
The De Viaris attack
o
Etienne Bazeries
rediscovered cylinder
multiplex encryptions and
thought them
unbreakable.
o
Even if the device should
fall into the hands of
empty, the number of
permutations of wheel
alignments should exclude
trivial exhaustion.
8
De Viaris decryption
Given a axis military message
FSAMC RDNFE YHLOE RTXVZ
LRMQU UXRGZ NBOML NDNPV
RTMUK HRDOX LAXOD CREEH
VREXZ GUGLA BSEST VFNGH
De Viaris starts with the probable word attack, in
this case the word /division/.
Classic cryptology
Sliding attack
d i v i s
F S A M C
i o n
R D N F E
Y H L O E
R T X V Z
d i v i
F S A M C
s i o n
R D N F E
Y H L O E
R T X V Z
d i v
F S A M C
i s i o n
R D N F E
Y H L O E
R T X V Z
d i
F S A M C
v i s i o
R D N F E
n
Y H L O E
R T X V Z
and so forth …
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
d
E
F
F
C
C
C
P
T
E
I
B
G
N
F
F
K
F
I
F
G
i
J
O
0
H
Q
E
J
E
J
E
T
C
R
B
N
M
E
U
J
J
v
X
X
X
U
T
T
B
D
X
X
I
Y
Y
X
X
X
X
X
L
X
i
J
O
0
H
Q
E
J
E
J
E
T
C
R
B
N
M
E
U
J
J
s
T
T
T
R
R
R
E
P
L
V
C
A
A
V
T
V
O
T
U
T
i
J
O
O
H
Q
E
J
E
J
E
T
C
R
B
N
M
E
U
J
J
o
P
U
J
N
I
I
N
Y
P
T
U
R
I
N
P
G
N
M
N
U
2-17
n
O
P
P
M
M
M
S
H
O
C
D
P
S
E
S
F
A
Q
T
O
1st generatrix encryptions
of /division/
Classic cryptology
2-18
9
Eureka!
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
Not much happens until the fourth
generatrix, when we get a hit for the twelfth
position with the cipher text fragment
HLOERTXVZ:
F S A M C
R D N F E
d i v i
Y H L O E
s i o n
R T X V Z
All eight letters are found among the
available ones and seven of them occur just
once. There is a choice of alphabets for H.*
d
H
J
I
Z
U
U
J
M
L
P
H
K
U
K
K
S
J
B
J
J
i
M
B
L
E
M
X
V
U
N
R
S
B
T
F
R
O
O
C
Q
P
v
A
E
E
R
O
Q
K
J
H
D
L
R
L
H
N
J
Y
L
F
N
i
M
B
L
E
M
X
V
U
N
R
S
B
T
F
R
O
O
C
Q
P
s
X
Z
Z
O
Q
N
D
D
I
Z
R
U
B
Z
E
Z
B
U
M
A
i
A
B
L
E
M
X
V
U
N
R
S
B
T
F
R
O
O
C
Q
P
o
S
E
M
K
N
Z
F
F
V
A
N
Z
M
R
X
R
C
R
Z
E
n
R
S
Q
J
E
J
T
X
U
J
G
V
X
T
U
H
D
Y
A
T
4th generatrix encryptions
of /division/
*However, the the eleventh alphabet can be
excluded. Why?
Classic cryptology
2-19
Reality check
at distances 20 and 40 characters
L R M Q U
R T M U K
U X R G Z
H R D O X
N B O M L N D N P V
z h p n r m y k
a i n m a t i n
B O M L N D N P
c j l k d n s q
d k k j b s t t
L A
A
b
c
d
e
1
X
X
z
a
e
b
O
O
I
q
p
n
D
D
c
b
a
z
C
C
o
u
r
a
R
R
e
m
t
d
E
E
z
l
a
j
E H
E
z
l
s
a
3
5
4
11
13 15 12
24.
0.
1.
2.
3.
22.
23.
24.
0.
1.
Classic cryptology
2-20
10
New probable word:
/departaseptheures/*
p t h e u
V R E X Z
16
14
20 7 18
6 17
r e s
G U G L A
10
2
8
9 +
+
B S E S T
+
1 3
5
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
V F N G H
4 11 13
*Direct hit! We determine 13 of the eighteen
cylinders. The rest is a piece of cake.
15 12 +
p
S
S
Q
M
L
L
J
D
V
T
Y
V
Y
B
X
V
U
T
S
V
t
X
Z
Z
Q
O
Q
R
M
F
A
S
F
S
I
E
B
X
U
A
A
h
K
L
J
E
D
D
Q
X
Y
M
M
N
P
E
O
C
P
E
B
K
e
H
U
D
B
H
X
D
U
L
R
T
S
D
T
A
G
O
S
C
C
u
Y
C
R
R
V
E
B
L
Z
O
N
D
C
P
L
D
Z
C
M
E
r
U
V
V
O
Q
N
U
S
D
G
D
Z
T
A
Z
U
L
D
X
Y
e
H
U
D
B
H
X
D
U
L
R
T
S
D
T
A
G
O
S
C
C
s
V
X
X
P
I
P
T
V
G
Y
U
C
X
Y
U
Y
A
I
Y
L
3rd generatrix encryptions
/ptheures/
Classic cryptology
2-21
Classic cryptology
2-22
Arno Schmidt’s Erinnerungen
11
Zig-Zag exhaustion
of probable word position
o
It is dangerous to use a
meaningful keytext in a
common language.
o
For example, consider the
Vigenère encrypted text
BAWISMEWOOP
GVRSFIBBTJTW
LHWWAHTMJVB
Classic cryptology
2-23
Probable word: THAT
Cipher: B A W I S M E W O O P G V
Plain: i t w p
h p i z
d b s t
p l m l
z f e d
t x w y
l p o v
d h o w
. . .
. . . T M J V B
d t h a
h a t t
Classic cryptology
2-24
12
Zagging to the plaintext
We guess that dhow
continues on the right to dhowever
and use ever to recover the additional
key fragment CANB
Cipher: B A W I S M E W O O P G V R S F I B B . . .
Plain:
s h o u l d h o w e v e r
Key:
E B E S T T H A T C A N B
Similarly , we guess that dhowever
continues on the left to shouldhowever
and use should to recover the additional
key fragment EBEST
Now the keytext surely
Reads THEBESTTHATCAN
Classic cryptology
2-25
13