Hacker News Reader

Comment by laurencei | Hacker News Reader

"The country's top codebreakers too seemed flummoxed until Sievey's son Stirling recalled how his dad would get the children to fill an outer row with random symbols, while Sievey would insert real code into the inner row."

Is it really that hard to fool some of the worlds top code breakers, simply by including some random digits?

So a code where every {x} symbol is random, and suddenly you've got an uncrackable code? Surely it cant be that simple?

View on HN

I doubt and hope that they didn't dedicate a ton of time on the problem. The hint probably just got them there faster.

Every {x} could be cracked by normal methods if it was simply added as a rule. So let's assume something just barely more sophisticated and we use a nonrepeating function instead of a fixed {x}. For instance, maybe the nth digit of pi means the next n mod 3th digit is random. How would you even begin to crack this? So imagine "thecodeisx". The first digits of pi are 141592653. So we get a noise pattern of: 1, 1, 1, 2, 0, 2, 0, 2, 0. So the code in deciphered format, but with our noise added, could look something like:

tlhpebcokqodengisxf

And keep in mind that is the code before it's enciphered. Even better, the random characters could be not entirely random but rather weighted to try to bring most characters in the message to a roughly similar frequency. So far as I know the primary tool of code cracking is just plain old frequency analysis. Curious if anybody has any proposals on how this would even be possible to crack.

Does code cracking still work in the era of modern cryptography? I thought that cryptosystems like AES and others were essentially impossible to crack if implemented right. What role do codebreakers play these days?

The very complex modern approaches to cryptanalysis still borrow from the oldest attacks.

A simple substitution cipher is easily broken by frequency analysis - find the most common letter in the ciphertext and it'll probably be E in the plaintext. Nothing so simple would work today, but we often see vulnerabilities in cryptosystems due to pseudorandom number generators with inadequate entropy. It's the same basic principle (exploiting a lack of randomness to identify patterns in the ciphertext), albeit with vastly more mathematical sophistication. The NSA allegedly took advantage of this principle to deliberately weaken cryptosystems by promoting an intentionally weak PRNG.

https://en.wikipedia.org/wiki/Dual_EC_DRBG

frequency analysis works easily if you know the source language, i.e. English in this case, while entropy of the message is critical to cracking, complex approaches are not the only ones which are immune to attacks, for example simple ciphers like using a one time pad is mathematically impossible to crack.

The power of a one time pad relies on the inherent entropy of the pad though. So attacks against a real one time pad still need to deal with entropy.

Things like the decipherment of Linear B are probably what come close to classic code breaking.

With AES etc, though, building a system that uses them effectively is the core principle of modern security and crypto.

> if implemented right

This step is harder than people think.

Theres still room for users to 'mess up' though.

I believe allied code cracking in WW2 was helped by one wireless operator habitually ending their transmission "Heil Hitler" or something.

Also ...

German Enigma operators in WW2 were told always to send a certain number of messages per day to make it harder to perform traffic analysis. One bored operator sent a message composed entirely of "W" repeated 4000 times (or so).

One on-the-ball analyst noticed a message that had no "W"s in it, and deduced what had been sent[0]. That allowed the daily settings to be cracked, and thus all messages for that day.

[0] Enigma has a weakness in that no letter can be encrypted as itself[1].

[1] Enigma is effectively a "one-time-pad" where the pad is a pseudo-random sequence determined by the daily settings.

I imagine they weren't trying all that hard.

Reply on news.ycombinator.com