5 ms·

> Me, I would have backed it up with one-time pads. Even one-time pads are subject to the efforts used to counter Enigma, such as so-called gardening. I fully

> Me, I would have backed it up with one-time pads. Even one-time pads are subject to the efforts used to counter Enigma, such as so-called gardening. I fully agree that layers are better than a single method like Enigma was many times in practice, which is usually all-or-none with no failsafe, at least until later in the war, when Enigma variants started being used in combination with coded messages and code words on top of the Enigma cipher machines themselves, but those efforts were foiled by the dedication and planning of the gardeners’ known-plaintext attacks. https://en.wikipedia.org/wiki/Gardening_(cryptanalysis) https://en.wikipedia.org/wiki/Gardening_(cryptanalysis) > In cryptanalysis, gardening is the act of encouraging a target to use known plaintext in an encrypted message, typically by performing some action the target is sure to report. It was a term used during World War II at the British Government Code and Cypher School at Bletchley Park, England, for schemes to entice the Germans to include particular words, which the British called "cribs", in their encrypted messages. This term presumably came from RAF minelaying missions, or "gardening" sorties. "Gardening" was standard RAF slang for sowing mines in rivers, ports and oceans from low heights, possibly because each sea area around the European coasts was given a code-name of flowers or vegetables. > The technique is claimed to have been most effective against messages produced by the German Navy's Enigma machines. If the Germans had recently swept a particular area for mines, and analysts at Bletchley Park were in need of some cribs, they might (and apparently did on several occasions) request that the area be mined again. This would hopefully evoke encrypted messages from the local command mentioning Minen (German for mines), the location, and perhaps messages also from the headquarters with minesweeping ships to assign to that location, mentioning the same. It worked often enough to try several times.

WalterBright 1y ago
I can see gardening working against Enigma alone, or one time pads alone, but not with the two used serially.
- harshreality 1y ago
  OTPs are not vulnerable to anything except compromise of the OTP itself (the pre-shared keystream).
  - WalterBright 1y ago
    Of course. And that's why one shouldn't rely on a single layer of encryption. With 1940s technology, generating a practical one time pad generator would have been an interesting engineering project. I would have simply used a newspaper. Even if your enemy knew you were using Die Zeitung, with the computer technology at the time it would have been tough to brute force which date and which article was used.
    - mannykannot 1y ago
      I don’t know much about encryption, but I can see a couple of concerns about such a scheme. The first is that such keys will have all the statistical regularities of the German language, which I believe is problematic, even though I don’t know how one would go about exploiting it. The second is the matter of how much encrypted text had to be transmitted every day, by the German military as a whole. If it significantly exceeded the daily output of Germany’s newspapers (and I would guess it did) there would seem to be considerable key reuse under this scheme. For submarines and other units not receiving newspapers daily, there also seems to be a key-distribution issue. I don’t know if there is a better way to guarantee that communication can be maintained through a patrol than to depart with the equivalent of a stack of old newspapers. Is this a problem? I don’t know, but if the allies had figured out the broad outlines of the scheme, I imagine they might be able to do some preparation in anticipation of messages being intercepted.
      - WalterBright 1y ago
        By itself, yes, the newspaper would not be a great one time pad. But in conjunction with Enigma, it could be enough to make it not practical to brute force Enigma with the available compute technology.
        mannykannot 1y ago
        I feel it is important to recognize that schemes like this are not OTP, and drawing an analogy between the two risks inducing false intuitions. This discussion started with a proposal to back up Enigma with one-time pads, but harshreality pointed out that OTPs are not vulnerable to anything except compromise of the OTP itself. This has the unstated corollary that if you are using a true OTP system, adding Enigma to the process does nothing to improve security (unless your pre-shared keystream is compromised - and even then, capturing one U-boat's OTP will not compromise any other's communication.) You then raised the concern of generating keys in sufficient quantity, which is certainly part of the problem (though I suspect that an electro-mechanical solution for that problem was well within the capabilities of contemporary technology, especially as, by then, Konrad Zuse had produced the first digital computer.) If, however, we are restricting our source of keys to the amount of text in a daily newspaper (or even all of the Third Reich's daily newspapers combined), that is something that could be achieved by a corps of dice-rollers, if it came to that, which would avoid one of the other problems of using newspapers: the statistical regularities of newspaper text. Even then, you still have the problems of key reuse [1] and key distribution, and another which I think might be by far the hardest: training people to use it. Even just considering the submarine fleet, at least one person on each U-boat would have to be trained in properly using the technique. This would delay implementation, and once deployed, even with no mistakes, it would be slow in use. Alternatively, a machine to do the work might have been developed (together with another to generate physical machine-readable keys), but that itself would have meant considerable delays in implementation. In view of this, I feel that the measure actually adopted - adding another rotor position to the Enigma machine - was one of the better options (though it would have been even better if the additional rotor were interchangeable with the others.) This took time to implement and was ultimately defeated, but anything other than an OTP system would likely have the latter problem, and all would have had the former. [1] Maybe not so much of an issue if one is only dealing with submarine communication, given that most of this was with the U-boat High Command in Germany, and assuming that it was of sufficiently low volume for each U-boat to be be given its own unique set of keys for each patrol.
- aspenmayer 1y ago
  I would agree in the ideal case, that with diligent usage of the Enigma machine with fresh keys/pads for each transmission, one’s transmissions would likely be secure, at least from the means and methods available to the Allies at the time. However, in the fullness of time and with research into and with declassification of wartime intelligence thereof since the war of the now-known semi-regular failures to key and operate the Enigma machine properly, the hypothetical serially encoded (Enigma + one-time pad) materials would possibly be able to be attacked due to operator errors/failures of key rotation independently of and/or combined with known-plaintext attacks, but I will defer to you on the actual cryptanalysis and mathematical modeling. I humbly admit that am not well-versed in this field, and I am not anything other than a fan of you and your work in the computing field, as it is mostly over my head.
  - WalterBright 1y ago
    The one-time pads could simply be a national newspaper on a particular date. Another simple method would be to add an offset to the "rendevous at XX longitude and YY latitude" coordinates and time.
    - aspenmayer 1y ago
      I’m reminded by your newspaper suggestion that I once read that Dread Pirate Roberts aka Ross Ulbricht had part of their setup infected by a 0-day delivered via a news website, possibly via a third party ad network, but I don’t remember the details and don’t have a source at hand, nor do I know as a matter of fact that this occurred or was merely reported or rumored. All of this is to say that I’m not sure that inconsistencies couldn’t be intentionally introduced in even the printed material to throw off encryption attempts if the source of the one-time pad were to have leaked. Knowing what is public knowledge regarding Crypto AG being compromised, I’m not willing to bet that a newspaper would be a safe bet for source material. A King James Version Bible, perhaps. On the other hand, you have more fingers, and the long arm of the law casts an even longer shadow in wartime. Multi-armed bandits exist.
ramchip 1y ago
One-time pads are not vulnerable to gardening.

WalterBright 1y ago

I can see gardening working against Enigma alone, or one time pads alone, but not with the two used serially.

harshreality 1y ago
OTPs are not vulnerable to anything except compromise of the OTP itself (the pre-shared keystream).
- WalterBright 1y ago
  Of course. And that's why one shouldn't rely on a single layer of encryption. With 1940s technology, generating a practical one time pad generator would have been an interesting engineering project. I would have simply used a newspaper. Even if your enemy knew you were using Die Zeitung, with the computer technology at the time it would have been tough to brute force which date and which article was used.
  - mannykannot 1y ago
    I don’t know much about encryption, but I can see a couple of concerns about such a scheme. The first is that such keys will have all the statistical regularities of the German language, which I believe is problematic, even though I don’t know how one would go about exploiting it. The second is the matter of how much encrypted text had to be transmitted every day, by the German military as a whole. If it significantly exceeded the daily output of Germany’s newspapers (and I would guess it did) there would seem to be considerable key reuse under this scheme. For submarines and other units not receiving newspapers daily, there also seems to be a key-distribution issue. I don’t know if there is a better way to guarantee that communication can be maintained through a patrol than to depart with the equivalent of a stack of old newspapers. Is this a problem? I don’t know, but if the allies had figured out the broad outlines of the scheme, I imagine they might be able to do some preparation in anticipation of messages being intercepted.
    - WalterBright 1y ago
      By itself, yes, the newspaper would not be a great one time pad. But in conjunction with Enigma, it could be enough to make it not practical to brute force Enigma with the available compute technology.
      - mannykannot 1y ago
        I feel it is important to recognize that schemes like this are not OTP, and drawing an analogy between the two risks inducing false intuitions. This discussion started with a proposal to back up Enigma with one-time pads, but harshreality pointed out that OTPs are not vulnerable to anything except compromise of the OTP itself. This has the unstated corollary that if you are using a true OTP system, adding Enigma to the process does nothing to improve security (unless your pre-shared keystream is compromised - and even then, capturing one U-boat's OTP will not compromise any other's communication.) You then raised the concern of generating keys in sufficient quantity, which is certainly part of the problem (though I suspect that an electro-mechanical solution for that problem was well within the capabilities of contemporary technology, especially as, by then, Konrad Zuse had produced the first digital computer.) If, however, we are restricting our source of keys to the amount of text in a daily newspaper (or even all of the Third Reich's daily newspapers combined), that is something that could be achieved by a corps of dice-rollers, if it came to that, which would avoid one of the other problems of using newspapers: the statistical regularities of newspaper text. Even then, you still have the problems of key reuse [1] and key distribution, and another which I think might be by far the hardest: training people to use it. Even just considering the submarine fleet, at least one person on each U-boat would have to be trained in properly using the technique. This would delay implementation, and once deployed, even with no mistakes, it would be slow in use. Alternatively, a machine to do the work might have been developed (together with another to generate physical machine-readable keys), but that itself would have meant considerable delays in implementation. In view of this, I feel that the measure actually adopted - adding another rotor position to the Enigma machine - was one of the better options (though it would have been even better if the additional rotor were interchangeable with the others.) This took time to implement and was ultimately defeated, but anything other than an OTP system would likely have the latter problem, and all would have had the former. [1] Maybe not so much of an issue if one is only dealing with submarine communication, given that most of this was with the U-boat High Command in Germany, and assuming that it was of sufficiently low volume for each U-boat to be be given its own unique set of keys for each patrol.
aspenmayer 1y ago
I would agree in the ideal case, that with diligent usage of the Enigma machine with fresh keys/pads for each transmission, one’s transmissions would likely be secure, at least from the means and methods available to the Allies at the time. However, in the fullness of time and with research into and with declassification of wartime intelligence thereof since the war of the now-known semi-regular failures to key and operate the Enigma machine properly, the hypothetical serially encoded (Enigma + one-time pad) materials would possibly be able to be attacked due to operator errors/failures of key rotation independently of and/or combined with known-plaintext attacks, but I will defer to you on the actual cryptanalysis and mathematical modeling. I humbly admit that am not well-versed in this field, and I am not anything other than a fan of you and your work in the computing field, as it is mostly over my head.
- WalterBright 1y ago
  The one-time pads could simply be a national newspaper on a particular date. Another simple method would be to add an offset to the "rendevous at XX longitude and YY latitude" coordinates and time.
  - aspenmayer 1y ago
    I’m reminded by your newspaper suggestion that I once read that Dread Pirate Roberts aka Ross Ulbricht had part of their setup infected by a 0-day delivered via a news website, possibly via a third party ad network, but I don’t remember the details and don’t have a source at hand, nor do I know as a matter of fact that this occurred or was merely reported or rumored. All of this is to say that I’m not sure that inconsistencies couldn’t be intentionally introduced in even the printed material to throw off encryption attempts if the source of the one-time pad were to have leaked. Knowing what is public knowledge regarding Crypto AG being compromised, I’m not willing to bet that a newspaper would be a safe bet for source material. A King James Version Bible, perhaps. On the other hand, you have more fingers, and the long arm of the law casts an even longer shadow in wartime. Multi-armed bandits exist.

ramchip 1y ago

One-time pads are not vulnerable to gardening.