Smigrodzki, Rafal wrote,
> In response to Harvey Newstrom:
> It is a code where I use a document (extropians-digestV6#269), and
arbitrarily
> choose the word Dejanews in your message as the starting point. I counted
all
> the characters till I found an occurrence of the first letter of my
intended
> message - this is the first number in my message. Then again I counted
characters
> until the second letter of my message occurred, and so forth. If I use the
document
> only once, you cannot use any statistical method to find the letters. You
have to
> know at least the document I am using, then with much trial and error you
might
> find the arbitrary starting point and decode the message.
So apparently your message was only a few characters long. I did not guess
it was that short, and was indeed guessing that you were counting words
instead of characters. This is a pretty good method, but you should be
aware that such codes were common during World War II. They were discarded
because better security can be found with strong encryption.
> Now, suppose you used the brute force approach of searching everything on
the
> net and trying which one fits - this message was too short to decode with
> certainty - you would find thousands of documents yielding reasonable and
> totally irrelevant decryptions.
Very true. Extremely short codes are hard to decrypt because they could be
anything. A coded message of one character "X" could be decrypted to any
letter, and we still wouldn't know what it meant.
> So you might stumble on the right one but you wouldn't know it and you
> couldn't claim your million dollars if you had a whole zip disk full
> of possible meaning for my message. If I wanted to send a longer
> message, such that it would be unlikely to produce random but
> meaningful decryptions, I would of course never use a codebook
> available to to potential eavesdroppers - I would personally deliver
> a CD-ROM full of digitized pictures form my wedding to the intended
> recipients and in that case neither statistics, nor brute-force net
> search would help you.
Yes, this method is much more secure than the simpler version that I had
guessed you were using. You might be recreating a weak type of one-time
pad. A good one-time pad is uncrackable, but it requires the pad to be
truly random. Your pad is English text which is less than random, and you
are counting rather than XORing bits. Still, you are very close to
re-inventing a known secure method. See
<http://pubweb.nfr.net/~mjr/pubs/otpfaq/> for a description of strong
one-time pads. You will see some similarities with what you have developed.
-- Harvey Newstrom <www.HarveyNewstrom.com> Principal Security Consultant, Newstaff Inc. <www.Newstaff.com> Board of Directors, Extropy Institute <www.Extropy.org> Cofounder, Pro-Act <www.ProgressAction.org>
This archive was generated by hypermail 2b30 : Sat May 11 2002 - 17:44:11 MDT