8 ms·
This cipher is pure security-through obscurity and it held up well.
by DSingularity 6y ago
This cipher is pure security-through obscurity and it held up well.
- obilgic 6y agoso It held up pretty well, because he made several mistakes along the way, which made much harder than It is to figure out.
- camjohnson26 6y agoWhat does “much harder than it is” mean, it took 51 years to decipher it, that’s how hard it was.
- thatwasunusual 6y ago...and still the killer is unknown. That's pretty good, IMO.
- the_af 6y agoWhat's the connection between the killer's identity still being unknown and the strength of this cipher? The killer lied: the plaintext doesn't contain personal information, or if it does, it's a riddle unrelated to the cipher.
- evolve2k 6y agoThe killer sent three cipers, my reading is that maybe 1-2 are now solved, they are not all solved yet. Are they?
- camjohnson26 6y agoThey sent more than 3, the first 3 were solved quickly, this was a 4th that was sent years later. I believe the only undeciphered message is the text at the end of the 3rd cipher: ebeorietemethhpiti https://www.zodiacciphers.com/chronicle-letter.html https://www.zodiacciphers.com/chronicle-letter.html
- evolve2k 6y agoMy error, article header mentioned 3 and then later said there was a forth.
- thatwasunusual 6y ago> What's the connection between the killer's identity still being unknown and the strength of this cipher? Maybe none. This person killed several people, and THAT is your biggest problem?
- nl 6y ago> This person killed several people, and THAT is your biggest problem? There's a discussion about how strong the cipher is, and: thatwasunusual> ...and still the killer is unknown. That's pretty good, IMO. Someone pointed out that measuring the strength of the cipher by the fact that the killer is unknown is a bad metric, and you seem to believe this as a defence of murder? They are merely pointing out there is no connection between the fact the killer is unknown and if the cipher was strong or weak.
- obilgic 6y agoHe made mistakes using his own cypher.
- kshacker 6y agoJust curious. If someone were to start today, with today's computing power and knowledge of computers, how long would it take? The answer to this can tell how easy it may be to create a similar problem today.
- elliekelly 6y agoMistakes? Or misdirection?
- tomcooks 6y agoI think the mistakes could have been intentional traps, to make code breaking more difficult and waste more resources. Once you solved it you can understand the message (good propaganda), but using misspelled words could throw off some attempts and generate "false negative" results when beginning to solve it, making detectives believe they are on the wrong tracks. Given he fooled everyone for 40+ years I find it hard to believe he would overlook details, especially when it's about his main publicity tool.
- saberdancer 6y agoIn his public (non encrypted) letters he has some spelling mistakes. swiches instead of switches, cid instead of kid, figgure instead of figure, cerous instead of curious There are more. Even if it was intentional, I am not sure that spelling mistakes would make 60s/70s decryption attempts any worse. They did not work by brute force and it's unlikely he predicted someone will use a supercomputer to crack his code decades later.
- SV_BubbleTime 6y agoThink one of the most interesting things I learned in encryption, was that a random xor sheet the same length as your plaintext is perfect encryption. That the problem only happens when you reuse that sheet. This doesn’t apply here specifically, but if you would have told me this previously I would have assumed it was securing through obscurity.
- shishy 6y agoone time pad! so impractical but so good
- afrodc_ 6y agoThere's an interesting episode of Darknet Diaries where a former analyst at the NSA talks about OTPs and how he created an automated system for field agents to encipher and decipher them who found them exhausting to do manually. Edit: Forgot the link https://darknetdiaries.com/episode/83/ https://darknetdiaries.com/episode/83/
- chowells 6y agoIt's worth expanding on that observation a bit. What makes encryption "perfect"? This is not obvious, so I'll just skip ahead to the conclusion: encryption is perfect when it's impossible to distinguish which candidate plaintext led to a specific ciphertext without knowing the entire key. It's easy to see that a one-time pad qualifies here. Even knowing all but one character of the plaintext doesn't give you any cryptographic way to determine what the last character is. The list of possible keys associating the known plaintext with the current ciphertext allows for every single character in the unknown position. This isn't a matter of computational power, it's an information-theoretic limit. You just don't have enough information (from the cryptography, anyway) to prefer any choice over another. You can apply a pigeonhole principle argument here and see that this requires the key to have the same size as the message. (Something along the lines of each key specifying a permutation between messages of the same length, and you need the key size to be big enough to specify every possible permutation for that message length.) That argument can then be used to demonstrate the information-theory quality of the encryption is related to the ratio between the lengths of the message and the key. When you look at modern cryptography, you can see that we're not depending on information-theoretic security at all. If you had all but one characters of the plaintext and all the ciphertext, it's quite likely there'd only be one key that matches the known permutation. We've gone in a different direction: computational security. It should require an implausible amount of computation to derive what the key is, even when you know matching plaintext and ciphertext. It's certainly more convenient than moving terabytes of key around, and computational limits are actually pretty compelling, as long as flaws aren't found in the construction. But it lacks the satisfaction of provably unbreakable.
- buescher 6y agoIt can be fiendishly difficult to break a completely unknown cypher, or one that has key elements withheld, even if it's quite trivial to break if the encryption algorithm is known.
- thatwasunusual 6y agoCan confirm. Did a ROT-13/15 (vowels vs consonants, if it matters) test on _smart_ collegues. Turns out they fear the worst and start top-down.
- nl 6y agoWere they experienced at breaking ciphers? Plenty of smart people don't jump straight to a solution when seeing a ROT13 ciphertext, whereas I think most people who are experienced would realize pretty quickly there seems to be a simple transformation going on.
- cm2187 6y agoOne of the first things I was taught in math class at university. If there are two potential solutions, one extremely unlikely but quick to verify, and one more likely but hard to verify, start by the very unlikely one!
- tasty_freeze 6y agoAre you saying you did ROT-13 on vowels and ROT-15 on consonants? If so, that isn't a conformal mapping so how do you reverse it?
- 2OEH8eoCRo0 6y agoObscurity can be a valid layer in a multilayered defense.
- diarrhea 6y agoMy defenses are multiple layers of obscurity.
- WantonQuantum 6y agoGiven your username, I suspect your method of obscurity is very good at putting people off the scent.
- deleted 6y ago[deleted]
- jgalt212 6y agonever roll your own crypto, but sometimes maybe ....?
- smegger001 6y agonever roll your own crypto is the type of advise the lead to heartbleed being so bad. it leads to a monoculture where one bug in the implimentaion makes everyone vulnerable.
- DSingularity 6y agoYeah. I think it is better to say “never roll your own crypto if your adversaries have infinite budgets and/or you have a lot to lose. Otherwise, knock yourself out!”
- digikata 6y agoWouldn't one of the "obscurity" features in this case be how few messages were encrypted with the cipher? If there were a larger database of encrypted messages, it may have been more susceptible.
- DSingularity 6y agoI think so. These types of ciphers are definitely vulnerable to analysis across messages especially if you can make a guess about something common to both messages (eg - common ending like “sincerely”).
- cwwc 6y ago“Security-through obscurity” ——— that’s my quote of the week.
- SamBam 6y agoI don't think that's the usual meaning of security through obscurity, unless I'm misunderstanding you. It's sounds like you're saying that something like a substitution cypher, or even a one-time pad, would be security by obscurity, because they key is "obscure." My understanding is rather that security by obscurity means you're relying on the attacker not to have knowledge about you system -- e.g. that you have an admin backdoor at /s3cr3t-admin-pag3.html (real-world example), or that you can ping the server at an unpublished end point to get a token. The opposite of security by obscurity is when the entire structure of your system is a complete open book (e.g. everything is completely open sourced) except the password, and yet the system is sound enough to resist an attack. But note that possessing a "secret" (a password, a key, a one-time pad, the substitution rules, etc) doesn't mean it's now security by obscurity.
- DSingularity 6y agoI see your point! I think you are totally right here. I think I fell for the trap of undermining the cipher just because it’s not based on modern crypto like prime factorization even though I was trying to praise it!