Slashdot Mirror
Codebreaking - Taking the First Step?
Master Spy asks: "Here's something that the Slashdot community might be able to help with. If you receive a message in code how do you take the first step? Back in the days of WWII it was easier. The codebreakers at Bletchley Park already knew that the messages were encoded using an Enigma machine so all they had to do was work out the positions of the rotors using brain power, the Bombe or later the Colossus machine. American codebreakers also knew the basic details about the methods the Japanese used but now however things are more complicated. Suppose you are listening to a transmission and you receive the following: 'sdjek dYqkP 1Nt$% GGl9) MHrYD +++' How do you know how the message has been encrypted? It could be an Enigma machine, it could have been XOR'd with a second message or a one-time pad or it could use some form of software encryption such as Blowfish or DES. Before you start ripping the message apart for decoding how do codebreakers find out what method has been used to encode the message?"
This is a question that probably takes a CS PhD to be able answer. So different encryption schemes have different suseptabilities (sp?) to different attacks. For example, if you are using a one-time pad stream cipher using a pad that has never been used before, you are totally SOL as an attacker. It isn't breakable without that pad. Period. If you are using some of the more sophisticated ciphers that have short keys (block ciphers), then there are sophisticated statistical analyses that can be performed to determine the likely method being used.
What you are referring to however is a situation where you don't know the encryption method. This is extra security through obscurity, which we know doesn't work very well. Many encryption schemes are very, very good, and you won't able to attack them easily even with knowledge of what they are. Usually, for example, you need to know a bit of the message, in addition to the cipher to be able to break it. For example, a bunch of emails may start with "From: xxxxx." If you have a lot of emails, encrypted similarly, you may be able to mount a reasonable attack, depending on the method used.
-Sean