4 ms·

It's worth saying that the book isn't entirely declassified. 18 out of 84 sections (including quite a few "Further remarks" or "Final remarks" sections) are com

It's worth saying that the book isn't entirely declassified. 18 out of 84 sections (including quite a few "Further remarks" or "Final remarks" sections) are completely whited out by the censor's box. Also, the actual PDF is here: https://www.governmentattic.org/39docs/NSAmilitaryCryptalyticsPt3_1977.pdf https://www.governmentattic.org/39docs/NSAmilitaryCryptalyti...

ffhhj 5y ago
> 6. Fundamental cryptanalytics in the solution of aperiodic systems. That section is white. Is there any information on cyphers that generate codes indistinguishable from absolute randomness based on the properties of entropy?
- thaumasiotes 5y ago
  https://en.wikipedia.org/wiki/One-time_pad https://en.wikipedia.org/wiki/One-time_pad Note that for the code to be indistinguishable from absolute randomness, you need the key to be as long as the text.
  - hanche 5y ago
    In theory, yes. You might say that cryptography exists in the gap between the theoretically impossible and the practically achievable.
- qsort 5y ago
  The only cypher that satisfies your request is "XOR the signal with noise, where the noise is a shared secret". Generally, you only require a weaker property: that a time-bounded attacker is unable to assert that the cyphertext is random with neglegible probability.
  - anchpop 5y ago
    I think modular addition also has that property
    - sirsar 5y ago
      XOR is modular addition on single bits!
    - adrian_b 5y ago
      For this kind of encryption, any operation between plaintext symbols and the random masking symbols that belongs to a commutative group can be used. Nevertheless, modular addition, including addition modulo 2, a.k.a. XOR, is almost always chosen, because any other kind of operations are slower in hardware without having any advantages over modular addition (when the masking symbols cannot be distinguished from a random sequence). For example, instead of using modular addition, you can use multiplication modulo 2^16+1 (a Fermat prime number), to encrypt each 16-bit plaintext symbol, but that is slower than modular addition without being better (unless your method of generating the pseudo-random mask is weak, which is easy to avoid).
- AnotherGoodName 5y ago
  I mean all working (non broken) cyphers are indistinguishable from randomness since you could simply do an entropy attack against a cypher that didn't have this property.
quantumwannabe 5y ago
For anyone interested, I think these are the PDFs for the first and second books: Part 1: https://www.nsa.gov/Portals/70/documents/news-features/declassified-documents/friedman-documents/publications/FOLDER_242/41748189078749.pdf https://www.nsa.gov/Portals/70/documents/news-features/decla... Part 2: https://www.nsa.gov/Portals/70/documents/news-features/declassified-documents/friedman-documents/publications/FOLDER_257/41751589079090.pdf https://www.nsa.gov/Portals/70/documents/news-features/decla...
- comboy 5y ago
  How does content of this compares to e.g. newer (still 30 year old) book like Applied Cryptography by Schneier? I understand these PDFs are even more "applied" but in terms of concepts behind them?
  - elahieh 5y ago
    This book, like the MILCRYP series, is focussed on cryptanalysis of "classical" (pre-computer) ciphers. The "Principles of Cryptodiagnosis" chapter (which I think is the most interesting "reveal") is an update of the author's 1970 monograph "Ars Conjectandi". Around 1976/1977 when the book came out, the stronger "modern" cryptography was becoming public - DES, public key crypto, Diffie-Hellman key exchange, the paper "New Directions in Cryptography" etc. The Schneier book is all about those - e.g. DES, RSA, GOST etc and applying known systems. It's not about cryptanalysis of pre-computer "classical systems" - at the start he says "This is not a book about classical cryptography". There's a brief note mentioning that "double transposition" is a very strong classical system, and that's about it.
    - schoen 5y ago
      Also, Schneier is trying to teach people how to implement cryptosystems, not how to break them or how to design them (which you allude to by saying "applying known systems"). One difference between classical and modern cryptography is that classical cryptography usually works at the letter or character level, while modern cryptography usually treats plaintexts and ciphertexts as uninterpreted sequences of bits and uses bit-level operations. Sometimes these two perspectives have equivalences or similarities, but mostly not if you're looking at stuff like block cipher S-boxes or block cipher modes of operation or Merkle-Damgård hash functions or whatever.
nick__m 5y ago
I love this footnote, it explains so much: 11 This is really not stealing. For the pure in heart, this should be thought of as conversion of raw data, and that the parties so generously supplying these raw data are, unknowingly, cooperating in government work.
- ganzuul 5y ago
  This reads like the Devil's own penmanship.

ffhhj 5y ago

> 6. Fundamental cryptanalytics in the solution of aperiodic systems. That section is white. Is there any information on cyphers that generate codes indistinguishable from absolute randomness based on the properties of entropy?

thaumasiotes 5y ago
https://en.wikipedia.org/wiki/One-time_pad https://en.wikipedia.org/wiki/One-time_pad Note that for the code to be indistinguishable from absolute randomness, you need the key to be as long as the text.
- hanche 5y ago
  In theory, yes. You might say that cryptography exists in the gap between the theoretically impossible and the practically achievable.
qsort 5y ago
The only cypher that satisfies your request is "XOR the signal with noise, where the noise is a shared secret". Generally, you only require a weaker property: that a time-bounded attacker is unable to assert that the cyphertext is random with neglegible probability.
- anchpop 5y ago
  I think modular addition also has that property
  - sirsar 5y ago
    XOR is modular addition on single bits!
  - adrian_b 5y ago
    For this kind of encryption, any operation between plaintext symbols and the random masking symbols that belongs to a commutative group can be used. Nevertheless, modular addition, including addition modulo 2, a.k.a. XOR, is almost always chosen, because any other kind of operations are slower in hardware without having any advantages over modular addition (when the masking symbols cannot be distinguished from a random sequence). For example, instead of using modular addition, you can use multiplication modulo 2^16+1 (a Fermat prime number), to encrypt each 16-bit plaintext symbol, but that is slower than modular addition without being better (unless your method of generating the pseudo-random mask is weak, which is easy to avoid).
AnotherGoodName 5y ago
I mean all working (non broken) cyphers are indistinguishable from randomness since you could simply do an entropy attack against a cypher that didn't have this property.

quantumwannabe 5y ago

For anyone interested, I think these are the PDFs for the first and second books: Part 1: https://www.nsa.gov/Portals/70/documents/news-features/declassified-documents/friedman-documents/publications/FOLDER_242/41748189078749.pdf https://www.nsa.gov/Portals/70/documents/news-features/decla... Part 2: https://www.nsa.gov/Portals/70/documents/news-features/declassified-documents/friedman-documents/publications/FOLDER_257/41751589079090.pdf https://www.nsa.gov/Portals/70/documents/news-features/decla...

comboy 5y ago
How does content of this compares to e.g. newer (still 30 year old) book like Applied Cryptography by Schneier? I understand these PDFs are even more "applied" but in terms of concepts behind them?
- elahieh 5y ago
  This book, like the MILCRYP series, is focussed on cryptanalysis of "classical" (pre-computer) ciphers. The "Principles of Cryptodiagnosis" chapter (which I think is the most interesting "reveal") is an update of the author's 1970 monograph "Ars Conjectandi". Around 1976/1977 when the book came out, the stronger "modern" cryptography was becoming public - DES, public key crypto, Diffie-Hellman key exchange, the paper "New Directions in Cryptography" etc. The Schneier book is all about those - e.g. DES, RSA, GOST etc and applying known systems. It's not about cryptanalysis of pre-computer "classical systems" - at the start he says "This is not a book about classical cryptography". There's a brief note mentioning that "double transposition" is a very strong classical system, and that's about it.
  - schoen 5y ago
    Also, Schneier is trying to teach people how to implement cryptosystems, not how to break them or how to design them (which you allude to by saying "applying known systems"). One difference between classical and modern cryptography is that classical cryptography usually works at the letter or character level, while modern cryptography usually treats plaintexts and ciphertexts as uninterpreted sequences of bits and uses bit-level operations. Sometimes these two perspectives have equivalences or similarities, but mostly not if you're looking at stuff like block cipher S-boxes or block cipher modes of operation or Merkle-Damgård hash functions or whatever.

nick__m 5y ago

I love this footnote, it explains so much: 11 This is really not stealing. For the pure in heart, this should be thought of as conversion of raw data, and that the parties so generously supplying these raw data are, unknowingly, cooperating in government work.

ganzuul 5y ago
This reads like the Devil's own penmanship.