Mafia Boss Using Crook Crypto Captured

boggis writes "Discovery is running a story on Bernardo Provenzano, the recently arrested 'boss of bosses' of the Sicilian Mafia. He apparently wrote notes to his henchmen using a modified form of the Caesar Cipher, which was easily cracked by the police and resulted in further arrests of collaborators. Discovery's cryptography expert describes it as a code that 'will keep your kid sister out'."

Comments

Substituion Cipher?

[Whiney Mac Fanboy]

God, he used a simple (rot3) substitution Cipher, with not even a Vigenère keyword and didn't expect it to get broken?

People have been using frequency analysis for over a thousand years to crack substitution ciphers!

Re:Substituion Cipher?

[holdenholden]

Yeah, but the Police were in clear violation of the DMCA ;-).

Re:Substituion Cipher?

[courtarro]

Even worse, people decode random-substitution ciphers in newspapers daily, for fun. A rotating cipher is even easier to break since the letters remain sequential. I guess we could give the guy a break though, since, according to the article, he only has about a 3rd-grade education.

Re:Substituion Cipher?

[Anonymous Coward]

In his defense, this clearly wasn't the most important element of his information security. Surely he had other mechanisms in place (fear) to prevent people from getting their hands on the paper.

This was probably only meant to thwart the efforts of the guy carrying the pieces of paper for him; who may have been picked for his lack of literacy anyway (as some natl lab workers were in the past, with simiar security logic behind it).

Sadly, over half the time I see PHP programmers commit just as bad a mistake when they hard-code databasee passwords in plain text in their PHP. Like Provenzano they assume noone will grab the information with the password; but like him that doesn't really help the case.

Re:Substituion Cipher?

[Rekolitus]

Err. Just about every PHP program I've seen does that. What alternative do you suggest?

Re:Substituion Cipher?

[qwijibo]

Fear may also be the reason no one told him that this wasn't a good way to send messages.

Re:Substituion Cipher?

[IDontAgreeWithYou]

I am going to assume/hope he meant an SA or DBO password as opposed to a limited user-account password.

Re:Substituion Cipher?

[argStyopa]

Read TFA - the guy dropped out of school at EIGHT. Not eighth grade - EIGHT YEARS OLD.

Rather surprised he can write, actually.

Re:Substituion Cipher?

[bunratty]

Use Apache directives to create an environmental variable with the password stored in it. This way, you can store the password in a file only root can read. That's far more secure than storing the password in a PHP file any user can read.

Re:Substituion Cipher?

[Tack]

People have been using frequency analysis for over a thousand years to crack substitution ciphers!

Frequency analysis attacks work against Vigenere too.

Re:Substituion Cipher?

[dwandy]

sheesh ... ROT-3? That's not security.
Somebody shoulda told this guy about ROT13! And for extra security, always apply it twice.

Re:Substituion Cipher?

[aplusjimages]

Maybe it was an advanced school for gifted kids. ;)

Re:Substituion Cipher?

[Tack]

Use Apache directives to create an environmental variable with the password stored in it. This way, you can store the password in a file only root can read. That's far more secure than storing the password in a PHP file any user can read.

How is this fundamentally different from hardcoding the password in a php file? In either case, the password is readable.

Re:Substituion Cipher?

[outsider007]

I guess you're assuming that all php files are world-readable. Why is that?

Re:Substituion Cipher?

[Anonymous Coward]

Uhm... Just make the PHP file only readable by apache (www, www group, etc), or disallow SSH access to your web-server by untrusted people?

Why do individuals need read access to the PHP files anyway? You don't "use" PHP through vi/emacs/etc... The only reason they need read access is either if you have an existing and kludgy access control mechanism, or if they are also page authors/editors. And if that's the case, they can just change the file to print out the dang password when they go there with their browser...

Re:Substituion Cipher?

[MADCOWbeserk]

I believe the Italian alphabet is 22 letters not 26, so you would end up with ROT-4.

Re:Substituion Cipher?

[bunratty]

But following the instructions I gave you, the password is readable only by someone with root access. By storing them in a PHP file, users other than root can read it.

The advice I gave is available from many books on PHP. If it's wrong, please write the authors to correct their mistake.

Re:Substituion Cipher?

[Ithika]

They still write using the Latin alphabet (ie all 26 letters) but only use the 4 non-Italian-native ones for foreign words.

Re:Substituion Cipher?

[Tack]

But following the instructions I gave you, the password is readable only by someone with root access. By storing them in a PHP file, users other than root can read it.

I suppose technically what you said earlier is true: a password stored in a file only root can read is more secure than a password stored in a file any user can read. But this statement doesn't preclude the possibility of ensuring the php file that contained the password is readable only by apache. Any admin who allows other users to read such a file is incompetent anyway, and I think the reason others here are casting you perplexed looks is that properly configuring access control on a file holding a password is just obvious stuff, whether that's a php file readable by the apache user, or some other plaintext file readable only by root.

I can certainly buy an argument that it's good practice to store passwords in a file specifically designated for the task, if you ever need to store a password in the clear. I do this myself, mainly for convenience, so that I'm not changing a bunch of scripts every time I change the password. And if you store the files in some clearly labeled place (like /etc/secrets, which is what I use), you could easily argue that you're more likely to be careful about access control and less prone to mistakes, which is a security advantage.

But fundamentally it's all the same, and the approach you suggest is not "far more secure" as long as the files have the appropriate ACLs.

Re:Substituion Cipher?

[Anonymous Coward]

See, kids? Stay in school!

Re:Substituion Cipher?

[geminidomino]

The advice I gave is available from many books on PHP. If it's wrong, please write the authors to correct their mistake.

Explains a lot.

Practical knowledge suggests the same thing could be accomplished, in a far less convulted way, by two commands and basic sysadmin rules (like daemons get thier own users whenever possible).

$sudo chown $APACHE_USER config.php
$sudo chmod 600 config.php

Re:Substituion Cipher?

[AJH16]

Technically it isn't even a rotational cipher. A rotational cipher is far more complex, such as the ciphers used in the enigma coding machiene. A rotational cypher does only substitute letters, but it changes the nature of the substitution at each letter. This was really only an r3 shift cipher which might as well not be "encrypted" at all.

Re:Substituion Cipher?

[OlafMarzocchi]

Remember that he couldn't use any computer, he had to do it by hand and that you don't have to use strong algorthms when you only have to hide something from other bosses. The police was not on schedule :-)

Re:Substituion Cipher?

[Anonymous Coward]

I don't get it. I dropped out of [public] school at age eleven, and I vaguely comprehend RSA.
Are you trying to say that education influences intelligence or the willingness to learn?

Re:Substituion Cipher?

[gweihir]

God, he used a simple (rot3) substitution Cipher, with not even a Vigenère keyword and didn't expect it to get broken?

Pathetic, really. This was somewhat secure 200 years ago.

In my University crypto course we wrote a small tool to break Vigenère automatically. Needed about 500 characters of ciphertext and gave you plaintext and key in a matter of seconds on very slow (by todays standards) VMS hardware. Of course it was not perfect, but even a patial solution made the text human-readable and the rest of the key trivial to discover. Took two afternoons to implement.

Re:Substituion Cipher?

[Ced_Ex]

What's amazing is that a gang can be formed *UNDER* a guy with a 3rd grade education?! What does that say about the members' education?

If he was dumb, the lowliest member of that mafia must have been a retard!

Re:Substituion Cipher?

[inaequitas]

Being dumb and being uneducated are somewhat different things. Intelligence is a measure of being able to adapt and understand situations 'on the fly' [well, this would be one limited definition, of course].

He was the most apt man in Sicilia to run the world's most notorious criminal organization. I think we should give him some credit in regards to his intelligence.

Of course, if he read Schneier he might have been better at what he did [in terms of crypto]. Even pen-and-paper ciphers have advanced but not being able to read properly has certainly had an influence on it all.

Re:Substituion Cipher?

[ultranova]

Use Apache directives to create an environmental variable with the password stored in it. This way, you can store the password in a file only root can read. That's far more secure than storing the password in a PHP file any user can read.

You could simply make the PHP file only readable by Apache. Better yet, if you're using PostgreSQL and it's running in the same machine than Apache, you can simply use the "ident" method of controlling access - that way you don't need passwords at all.

Re:Substituion Cipher?

[angel'o'sphere]

Rather surprised he can write, actually.


You learn reading in 1st class, and writing in the 2nd ... so afeter the 3rd he should be able to do both, shouldn't he?

angel'o'sphere

Re:Substituion Cipher?

[Impy the Impiuos Imp]

There used to be an expert system (rule-based) engine that would "compile" the text-based file of rules for distribution with their runtime engine. The file was, suspiciously, the exact same size as the source text file. A quick test by myself demonstrated the "compilation" just added 1 to every ascii value in the file.

It allowed me to develop a quick little program to update rules dynamically after distribution.

This was well before the DCMA, so a little reverse engineering of encryption was no problem. Heck, I could argue I was actually reverse-engineering a "compiler", since that's what they called it.

I forget what it was called, but the head of the company called his own op-ed piece in the monthly newsletter "From the Fountainhead".

Re:Substituion Cipher?

[angel'o'sphere]

That is not "ancient chineese" but ancient greek!
AFAIK its called the "spartan encoding". Even Caesar used it. BTW: (as some follow ups point out) the pole was not just a simple pole but either one with a narrow and a vide end (and variable start point for wrapping the note around) a plank with notched out edges.

angel'o'sphere

Re:Substituion Cipher?

[Impy the Impiuos Imp]

Oh for god's sake, just add 1 or 49 to it, it's already in extended ASCII anyway, most web sites parsing cedillas (cedillae?), etc., just fine.

Re:Substituion Cipher?

[Will2k_is_here]

And for extra security, always apply it twice.

You're giving away *my* cipher! I already use it for all my communications. Oh well, Maybe it's time to move on to something stronger like applying it four times

Re:Substituion Cipher?

[GiMP]

> the password is readable by only someone with root access.

It is also visible in the environment -- make sure you don't accidently print the environment out on some page -- don't publically expose phpinfo(); !

This false-security also assumes one of the following:
1) You have access to the httpd.conf file (and as such, there are better solutions...)
2) Other users don't have access to Apache.

You can't put the environmental variables into a .htaccess since, of course, thats just as secure as putting the variables into a .php file.

> By storing them in a PHP file, users other than root can read it.

Only if your server isn't securely configured.

You can secure your PHP files from reading in at least the following 2 ways. Both ways are considerably more secure than throwing variables into Apache.
1) Use PHP as a fastcgi /w suexec.
2) Run apache as your user, with your home directory non-readable by other users, and use mod_php.

My company, btw, provides both solutions.

Re:Substituion Cipher?

[Mr Z]

Which... if you read TFA, is actually what he was using, sorta. (A == 4 up to Z == 26.)

Re:Substituion Cipher?

[skuzzlebutt]

Wow...you guys are wa-a-a-ay overthinking this situation...the guy is a 73 year old murdering gangster in a rural area in Sicily. This was, I'm sure, some pretty high-tech stuff for him and his no-neck band of merrymen.

Re:Substituion Cipher?

[Anonymous Coward]

The guy is directly responsible for a very, very long list of murders, among other things.

Public ridicule for his lack of education is, from my point of view, more than acceptable in this case...

Re:Substituion Cipher?

[patio11]

I guess we could give the guy a break though, since, according to the article, he only has about a 3rd-grade education.

Nothing wrong with only having a 3rd-grade education, so long as your cipher is only intercepted by adversaries with a 2nd-grade education.

Re:Substituion Cipher?

[klmth]

Not quite as such. Once you extract the keylength, you can do a frequency analysis for each sub-message corresponding to a key. The most important thing in breaking a Vigenere cipher is finding the keylength, which can be done by several means, such as finding the coefficient of coincidence.

Re:Substituion Cipher?

[Chandon Seldon]

This works great to protect against an attack that rarely matters (other users on the same server reading your data). I mean... I guess that comes up in shared hosting environments, but I don't see how it would matter in any serious application.

On the other hand, it does nothing to protect against the most common security issue - a bug in a CGI or PHP script that lets web users read arbitrary files. This more common issue can be fixed by storing the password in a place readable only by root.

Re:Substituion Cipher?

[geminidomino]

On the other hand, it does nothing to protect against the most common security issue - a bug in a CGI or PHP script that lets web users read arbitrary files. This more common issue can be fixed by storing the password in a place readable only by root.

As someone else pointed out, it's in the environment, too. That would be just as readable by the same remote exploits.

Oh no!

[Deltaspectre]

Nothing for you to see here. Please move along.

Must be using the crypto on this story!

If only..

[Ckwop]

You see, now if you want to do secure pencil and paper ciphers here's how you do it.

• Get two decks of cards, including the jokers. You should have 108 cards in all.
• Encode a face up card as one and a face down card as zero.
• Find a dense primitive polynomial of order 108.
• Randomize the face up and face down cards in the pack.
• Construct a self-shrinking linear feedback shift register.
• The keystream you clock off is reasonably secure.

Self-shrinking generators are broken but the best attack requires an insane amount of plain-text. Far, far, more than you could ever generate by hand. If Mr Mafia had used this instead of a crappy cipher from two thousand years ago then he might not have been caught.

Throughout history lives have literally depended on the strength of the cryptography people have deployed. I find it exciting that these times are still with us and are not mearly confined to the history books.

Simon

Re:If only..

[networkBoy]

I'm willing to bet he "discovered" this cipher on his own. Had he researched it at all he would have known better.
-nB

Re:If only..

[The Warlock]

Or you could try the one in Cryptonomicon. The details elude me, but I recall it being something like RC4 with a deck of cards.

Re:If only..

[Ckwop]

Or you could try the one in Cryptonomicon. The details elude me, but I recall it being something like RC4 with a deck of cards.

This was a cipher called Solitaire, which was created by Bruce Schneier. It has been horribly broken.

Simon

Re:If only..

[Anonymous Coward]

Couldnt you just, like, flip a coin 108 times and use the results as a one time pad?

Re:If only..

[somersault]

Since he's italian, maybe he heard that Caesar used it, and wanted to do the same? It says in the article that he dropped out of school at 8 years old, and that he conducted business on a typewriter, so he probably wouldnt have been able to handle any more complex a crypto scheme

Re:If only..

[Redwin]

Considering ancient cyphers, if I remember correctly the ancient Chinese used to write messages Ceaser cypher style messages on fabric that had to be wrapped around a pole. The pole had to be the exact length and thickness or the text wouldn't align up and the decyphering process couldn't be started. If anyone was stopped, they could hand over the fabric covered in text and it would be meaningless without knowing what kind of pole was used to algin everything up.

Re:If only..

[gbobeck]

For more information concerning the solitaire encryption algorithm, see either http://www.schneier.com/solitaire.html or read Cryptonomicon.

To see all of the problems concerning the solitaire algorithm, see http://www.ciphergoth.org/crypto/solitaire/

Re:If only..

[hackstraw]

This was a cipher called Solitaire, which was created by Bruce Schneier. It has been horribly broken.

What they need to do is fire up a dubbie and get one of these.

Re:If only..

[Rick.C]

Don't know about Italy, but in the U.S. he would have been compelled to cough up his key to the Feds or be held for contempt until he rotted.

So why even bother with crypto?

Re:If only..

[TrueKonrads]

Speaking of card-deck based stuff. Everybody has read this: Solitaire Cipher as described by Schenier and used by Stephenson in Cryptonomicon. Much safer :)

Re:If only..

[arakon]

That sir, is cool. I'd love to mod you up as +1 informative/interesting but alas I am without mod points. Anyway Kudos for that most interesting factoid. I may have to try that one out on an anniversary present for the wife.

Re:If only..

[David Mazzotta]

I'm just trying to imagine the look on Paulie Walnuts' face as you explain that.

Re:If only..

[anotherone]

Trivial to break. Wrapping the cloth around a pole is just an easier way of looking at every x letters. It'd take about 2 minutes to brute force the value for x manually, a program with a dictionary could do it in milliseconds.

Re:If only..

[aiabx]

Since the Chinese use a pictographic alphabet, you could probably extract information even if you didn't have a selection of poles to try. You're still going to see the characters for "attack", "south", "gate" and "night" on the strip.
In any case, it isn't a killer to break one of these wrapping systems; you start with the first character, jump 2 spaces to the next, and see if you're making sense. Then try skipping 3 characters; then 4 and so on.

Re:If only..

[mrhartwig]

Hopefully she already knows all about the dimensions & length of your pole.

Re:If only..

[m50d]

Sure, but you'd need at least three and probably five flips for each letter you wanted to write. The whole thing of a one-time pad is you can only use it once.

Re:If only..

[SoVeryTired]

"if Mr Mafia had used this instead of a crappy cipher from two thousand years ago then he might not have been caught."

If you read the article carefully, you'll notice that they never explicitly say he was caught as a result of his code being broken. In fact, he was caught because police tracked a load of laundry which was being delivered from his house to his hideout.

Re:If only..

[Anonymous Coward]

i think it was ancient greeks using this trick.
http://www.resonancepub.com/homecrypto.htm

Re:If only..

[myth24601]

What if they used a pole that was one thickness at the top and a different thickness at the bottom? The message could also be constructed so that the only characters that counted were the ones on the south side of the pole and the north side could contain a decoy message (and the east and west sides too for that matter)?

Re:If only..

[arakon]

Well I wasn't quite thinking about it in that capacity, forgot to put my slashdot-dirty-mind hat on, but now that you've brought it up I do see potential in what you suggest. Of course, It'll probably take generous applications of hard alcohol to coerce that game into play.

Re:If only..

[enkidu]

It's actually pretty simple to crack it: you construct a long cone (or tapered stick), wrap the strip around it and slide it around until things match up. Then you measure the diameter of the cone/stick at that point and make a "key" stick with that same diameter.

Re:If only..

[Hrothgar The Great]

You could claim that you never wrote down the key and that you no longer remember it. You could claim a hundred things just like that, too, but it is, of course, exceedingly unlikely that you would have been arrested for a crime if the only evidence they had against you was encrypted and no one had read it yet, so what difference, indeed?

Re:If only..

[AKAImBatman]

Just an FYI on that, the Chinese pole method is described in several childrens books on basic cryptography and information hiding. I checked out a few from the library when I was a kid, and the Chinese method was listed along with such classics as Pig Latin, word skipping, newspaper encodings, and Caesar's Cipher. The primary difference was that the book described the original Greek method using paper instead of cloth.

As someone else noted, this is not a secure scheme by any stretch of the imagination. Don't rely on it for anything other than fun and games. :-)

Re:If only..

[tomjen]

He should have done as Cesar - write the hole thing in latin. That way nobody can read it.

Re:If only..

[hotdiggitydawg]

Trivial to break. Wrapping the cloth around a pole is just an easier way of looking at every x letters. ...assuming the pole is cylindrical. Get yourself a conical pole, or better a really weird-shaped pole and it gets a bit harder.

Re:If only..

[Sigma 7]

Since the Chinese use a pictographic alphabet, you could probably extract information even if you didn't have a selection of poles to try. You're still going to see the characters for "attack", "south", "gate" and "night" on the strip.

It's trivial to construct your writing so that glancing at those four words would cause a decoy. (Of course, I wonder if the tech level at the time let people worry about this, but that's another story.)

For example, go south and attack the gate after night.

If you mis-read that since you didn't decode the message properly, your troops will be fatigued once dawn approaches.

Re:If only..

[aiabx]

In order to wrap around a tapering pole and still present a coherent message, the spacing of the characters would have to be altered as the pole narrowed. An astute codebreaker could derive useful information from careful analysis of the spacing.
As for the decoy messages, they might be a good way to present disinformation, but you still need to face the fact that the real message has been read by the enemy. If he has to carefully watch two gates on 4 nights, you've still lost the advantage of surprise.

Re:If only..

[ebyrob]

Also, the grandparent is assuming that every letter is useful (there is no noise). This need not be the case, and you could easily create messages with multiple possible meanings.

Nothing like writing an encryption scheme that leaves your enemies thinking they know the answer when really it is quite different.

Re:If only..

[aiabx]

You'd make an excellent mafia boss.
Giving out any information about your plans can be used against you by a smart opponent, even if you disguise it with "not". To continue with the example we are playing with, only a foolish general would send his whole army to stand guard all night because of an intercepted message. But a wise general would know something was being planned and double his guards on all the gates for the whole week, send out extra patrols and take whatever precautions he could. The point of good cryptography is to prevent any information from getting to the enemy.

Re:If only..

[bgoody]

He's right, it was the Greeks not the Chinese who used the pole.

Re:If only..

[nytes]

I recall reading a book in grade school that featured a scene wherein a cryptographer breaks that system.

The crack is that the diameter of the rods will generally be something easily held in the hand. The cryptographer simply has a selection of sticks of various diameters in his desk, and he just tries each one until the letters line up evenly.

(Anyone remember what book that might have been?)

Re:If only..

[joggle]

While that is very secure, I think it would be impracticle to use on a daily bases without the aid of a mechanical device or computer.

Re:If only..

[Josuah]

Well, except Chinese characters are stand-alone. So a dictionary wouldn't help, and you might end up with several different plausible sentences on each pole. And you'd never end up with nonsense words. Possible nonsense sentences. Which one is the right one? Nonsense sentences might not be nonsense to other people.

Re:If only..

[Killshot]

I wouldn't really call it an alphabet.. currently there are over 80,000 chinese characters

Re:If only..

[drinkypoo]

Clearly you haven't read Cryptonomicon. The line to return your Geek Card begins to your left. (Whether or not the Solitaire algorithm is secure enough for this purpose is a subject for another thread.)

Re:If only..

[Sigma 7]

Giving out any information about your plans can be used against you by a smart opponent, even if you disguise it with "not". To continue with the example we are playing with, only a foolish general would send his whole army to stand guard all night because of an intercepted message. But a wise general would know something was being planned and double his guards on all the gates for the whole week, send out extra patrols and take whatever precautions he could.

As I said, leaving your troops out for the night will leave them fatigued.

The point of good cryptography is to prevent any information from getting to the enemy.

Sending messages gives information to the enemy, regardless of cryptography - it shows that something is being planned. Encryption is only meant to obscure what it could mean - no more, no less.

The mafia boss in question used Caesar this since it was simple and did enough of a job to prevent some random person who intercepts it from thinking that it is criminal activity.

Telegraph operators encountered this all the time - a simple substitution cipher protected a gold claim. In this case, encryption prevents the telegraph operators from leaking the data.

Re:If only..

[Chandon Seldon]

You can increase the difficulty to crack the message by increasing the complexity of the encoding and decoding process all day long. The problem with that strategy is that for the system to be useful you need to be able to encode and decode your messages in a reasonable amount of time - and the attacker will usually have more time than that to try to crack your message.

Re:If only..

[Ced_Ex]

I wouldn't really call it an alphabet.. currently there are over 80,000 chinese characters

Of which you only really need to know about 5000 characters to successfully navigate yourself through a daily paper.

Re:If only..

[rkanodia]

That and a OTP time-shifts a secure channel rather than creating one.

Re:If only..

[ArsenneLupin]

You could claim that you never wrote down the key and that you no longer remember it.

Ok, so just substitute "in the UK" instead of "in the US". In the UK, there is no presumptions of innocence, and the burden is on you, the accused, to prove that you forgot the key (or lost it, or never actually had it to begin with...). Of course, proving a negative is pretty tough, and "they" know it...

Re:If only..

[chiskop]

I do not think that word means what you think it means.

Please pardon my language-nazism, but I've been surrounded by pony-tailed marketing types all day and their constant misuse of the word factoid has made me all grumpy.

Re:If only..

[Chandon Seldon]

If you can come up with a cryptosystem that can be used conveniently by hand yet is secure in the face of of computer-assisted cryptanalysis that'd be most impressive.

Any system that can be done by hand *at all* and has that property is potentially pretty useful in a field-agent situation.

Re:If only..

[Chandon Seldon]

I'd guess that using the playing card based shift register would be slightly safer than using solitaire for exactly one reason: In order to figure out the shift register thing you'll need to do a lot more research, which will tend to help you avoid some of the stupid usage mistakes.

Re:If only..

[tender-matser]

he hasn't been caught for something like 50 years.

and now he has been "caught" because he has (most probably) made a deal with the authorities.

all this thing with teen ciphers & stuff is probably just silly journalism.

Re:If only..

[lgw]

That and a OTP time-shifts a secure channel rather than creating one.

That's all *any* code or cypher does! Keys that are short compared to the message are preferred when the alternate channel has limited bandwidth. Keys as long as the message are preferred when this is not a limit. Keys far longer than any message (codebooks) were used for centuries and are still quite resistant to analysis - easier to capture a codebook.

Either way, you're sending part of the message though one channel and the remainer through another channel, and if the attacked has access to both channels all is lost. All the clever math does is let you send less bits.

Re:If only..

[ultranova]

If you mis-read that since you didn't decode the message properly, your troops will be fatigued once dawn approaches.

No they aren't. They'll be itchy from having slept in their battle armor. The triple-strength gate guard will be fatigued.

Hard as it may be for modern man to comprehend, the ancient warchiefs were primitive, not stupid.

Re:If only..

[Anonymous Coward]

*rimshot*

Re:If only..

[Impy the Impiuos Imp]

> He's right, it was the Greeks not the Chinese who used the pole.

Ehh, hehe. Ya know,

Nah.

It's way too easy.

Re:If only..

[madmas2]

It is called scytale http://en.wikipedia.org/wiki/Scytale/

Re:If only..

[m50d]

That's all *any* code or cypher does!

Well, it becomes a bit different with public-key cryptography

Re:If only..

[Synn]

There are ways around that actually. You can use deniable cryptography in which you have multiple containers of encryption within the same volume like layers of an onion.

You can tell that there's encryption there, but it's impossible to know how many levels of it exist. So in court you cough up the first level which contains your mp3 collection, level your other data secure.

Re:If only..

[m50d]

AIUI he was using it to encrypt things for himself, so this doesn't really matter. Of course keeping the key secure is important.

Re:If only..

[lgw]

A little bit different, but in practice the public key crypto is just used to establish an alternate channel over which to send a key. I've been looking at crypto on embedded devices: if you're stuck with limited computing power, you really need someone else to generate your keypair for you, so you're back to an alternate channel (though it is a more convenient one!).

Of course, public key crypto has never been proven to be secure, so this may all be moot.

Re:If only..

[OneDeeTenTee]

There's a quicker way to solve this. Wrap the cloth around a cone and the bit where you get words tells you the size of the original rod.

Re:If only..

[epee1221]

TFA makes it look like only very short sections of text were actually encrypted.

Re:If only..

[Bishop]

it becomes a bit different with public-key cryptography

Not really. Public key crytography still requires a secure channel to exchange the public keys. If a secure channel is not used to exchange the public keys then the system is vulnerable to a man in the middle attack. The big advantage to public keys is simple key management. Alice does not need to maintain a private pre-shared key for every person with whom she wishes to comunicate.

Public keys can also be chained creating odd secure channels. A intermediary can be used to create the secure with no action on the part of the intermediary. For example: Alice trusts Bob. Bob trusts Charlie. Alice can trust Charlie via Bob. If pre-shared keys were used Bob would need to actively assist Alice and Charlie create their trust relationship. Private pre-shared keys could also be chained, but it would become impossibly messy in short order.

Re:If only..

[TheoMurpse]

How the hell do you do a Caesar cipher on a written language that has no alphabet? There is no one order to the characters (no alphabetical order, etc.). I'd be interested in knowing!

Re:If only..

[Anonymous Coward]

The act of censorship is always worse than whatever is being censored. Always.

How absolutely ridiculous.

Re:If only..

[Shanep]

Anyone remember what book that might have been?

The book which forgets that handles are often attached to items which would otherwise be difficult to grip?

Re:If only..

[Fred_A]

What if they used a pole that was one thickness at the top and a different thickness at the bottom?

Umm, like for example Lech Walesa ?

Re:If only..

[Anonymous Coward]

Public keys can also be chained creating odd secure channels. A intermediary can be used to create the secure with no action on the part of the intermediary. For example: Alice trusts Bob. Bob trusts Charlie. Alice can trust Charlie via Bob.

That was pretty much my point.

Public keys can also be chained creating odd secure channels. A intermediary can be used to create the secure with no action on the part of the intermediary. For example: Alice trusts Bob. Bob trusts Charlie. Alice can trust Charlie via Bob. If pre-shared keys were used Bob would need to actively assist Alice and Charlie create their trust relationship. Private pre-shared keys could also be chained, but it would become impossibly messy in short order.

Hmm. It also would rely on trusting Bob now rather than at a particular paint in the past.

Re:If only..

[Redwin]

Again if I remember correctly, the point of having a fixed length of the pole was that the cloth needs to overlap with iteslf slightly as it is wrapped around the stick, kinda like a tennis racket grip, finishing exactly at the end of the stick. Looking at the fabric as a whole you only see parts of characters which is no help. Also, this was for chinese characters, so I don't think a dictionary attack would help that much (some please correct me if I got this wrong, but doesn't the context of chinese characters change their meaning?).

Re:If only..

[jotok]

Ah...so...a factoid has truthiness.

The more you know...

Re:If only..

[Redwin]

Um, thats a very good point! I could very well have been wrong about the ceaser cypher bit (it was a while ago that I heard about it in a cryptography lecture - Sorry for the probable boring answer!) however I suppose changing the order of words, or whole characters once you get all the characters might add some obvuscation. whole having out words order of be might enough.

Re:If only..

[TheoMurpse]

Actually, to be fair, they might have done a Caesar-like cipher on the Bopomofo system. However, there is a risk of ambiguities cropping up due to the existance of so many homophones in Chinese. In any case, if a Chinese speaker here knows of a Caesar-like cipher for the Chinese language, I'd be interested in knowing.

Re:If only..

[Shanep]

Don't know about Italy, but in the U.S. he would have been compelled to cough up his key to the Feds or be held for contempt until he rotted.

So why even bother with crypto?

Use single use keys which are meant to be destroyed after use. The proper procedure for One Time Pad use for example, is to encode the plaintext with a OTP to make the ciphertext and then destroy the OTP. The recipient is also supposed to destroy his copy of the OTP, once she has used it.

So well before a court has requested the key (in this case, the OTP involved), the suspect can simply claim that the order is impossible to comply with, because the key was truely randomly generated and destroyed at the time of use as a matter of proper procedure.

However, the great thing about OTP crypto, is that you could choose to provide an alternative OTP which can be used to decode the captured ciphertext into ANY other plaintext of the same size! So all you have to do is come up with an alternative message of the same size, but one which is reasonable to believe that you would want to be kept secret, then encode that fake message with the ciphertext as if the ciphertext where the OTP, this will give you a ciphertext which you can refer to the court as being the original OTP. When they decode the real captured ciphertext (the one the court has had all along), with this new fake OTP which you claim to be the the real original OTP, they get the new fake plaintext. A non incriminating one, maybe even one which reinforces a previous alibi of yours. Like magic, the fake OTP looks like it must be real and true, because it (random looking characters) used with the original ciphertext submitted as court evidence, makes a very clean real message. Nobody can deny this plausible decryption using cryptographic methods.

So there you have perfect secrecy, along with perfect plausible deniability.

Re:If only..

[Shanep]

If you can come up with a cryptosystem that can be used conveniently by hand yet is secure in the face of of computer-assisted cryptanalysis that'd be most impressive.

Well, I think here we could agree or disagree depending on what we consider to be convenient. Dating back to 1917, the One Time Pad can be used by hand and unbreakable when done properly.

Any system that can be done by hand *at all* and has that property is potentially pretty useful in a field-agent situation.

A field-agent can be provided with a small booklet of OTP, with pages which can be removed and easily destroyed. The HQ of course has the one and only copy of that OTP booklet, under the highest security lockup. If the field-agent believes he is about to be captured, he can destroy the booklet. This would prevent the enemy from sending disinformation as appearing to come from the field-agent. Seperate to that scenario, when the field-agent wants to send a secure message, he simply makes the desired message, encodes it against a page of OTP to create the ciphertext and then sends the ciphertext. He should then promptly destroy the message, OTP page used and the ciphertext. This way, everything except for his own recollection of that plaintext message is destroyed. If he is a real patriot and hears the enemy coming for him (they heard the cipher transmission), he will now eat a round from his silenced H&K Mk.23 .45 semi auto. ; )

The encoding (and decoding if need be) in the field is easy to do by hand. The crypto "device" can easily be destroyed too.

Re:If only..

[Rick.C]

Like magic, the fake OTP looks like it must be real and true, because it (random looking characters) used with the original ciphertext submitted as court evidence, makes a very clean real message. Nobody can deny this plausible decryption using cryptographic methods.

You, sir, are a diabolically clever genious!

Re:If only..

[Chandon Seldon]

Using a one time pad is actually a pretty solid plan. I was going to recommend it myself, but a remembered cryptosystem and key has an important property that a one time pad does not: you can't find it when you search the agent's luggage.

When selecting what cryptosystem to use for a given application, there are a number of tradeoffs. It's entirely possible that a playing card based system is the best deal.

Re:If only..

[Shanep]

Using a one time pad is actually a pretty solid plan. I was going to recommend it myself, but a remembered cryptosystem and key has an important property that a one time pad does not: you can't find it when you search the agent's luggage.

Yes, it's a shame that the specific impracticalities of the OTP can be pretty bad.

But, where will his luggage be searched? Being a good spy, he naturally ejects out of an SR-71 Blackbird travelling at mach 3, 150,000 feet above the enemy. Where he will not pull his parachute until 50m from above the rooftop of exactly where he wants to be, which does of course have a single armed guard who will not hear him land or the thrust of his black anodized razor sharp knife/C4 detonator/satelite communicator. Unless of course, that guard is a hot babe with an Eastern European accent, in which case he first infiltrates her and she falls for him and decides to defect. ; )

I better get some sleep. I'm feeling sleepy drunk. Anyone else get that with very long stints at their computers? A drunk'ish silliness?

Re:If only..

[Shanep]

You, sir, are a diabolically clever genious!

Worse still, I realised after I typed that...

If you were not using a OTP, but rather some crypto which does use a smaller-than-typical-plaintext key, to make the ciphertext that the court has as evidence and the other side have not been able to decrypt it (and you safely think they won't be able to), you could just claim that you did in fact use OTP crypto to generate that ciphertext and then produce a fake OTP which decodes the courts copy of the ciphertext to anything you want, of the same size.

They would either have to believe you, or keep trying to crack the very strong crypto/key that you really did use.

Muhahahahaaaa!! I think I should move into a life of crime. Go move to switzerland, open up some bank accounts and get into some serious extortion over the net. Hmm, on second thought, maybe not, I *really* would like to keep my ass secure and tightly fortified. Prison is not my cup of tea. ; )

Re:If only..

[Chandon Seldon]

How absolutely ridiculous.

Counterexample?

Re:If only..

[Chandon Seldon]

That kind of spy doesn't use an OTP. They use directional microwave trancievers that they point at a spy satilite by hand.

Re:If only..

[Anonymous Coward]

Yeah, it's just that easy.

Except for the part that you'd have to have a fucking degree to understand half of what you just said. GPG seems like it's a whole lot easier to use than some insane deck of cards method.

Or in other words

[gowen]

8 jqe3 y8j qh 9rr34 y3 d97oeh[5 43r7w3.

Re:Or in other words

[Kagura]

F346 h8d3 u9g 5y343 jah! %y8w 8w qd57qoo6 i8he 9r r7h!

Svefg Cbfg!

[PIPBoy3000]

Behold the power of Rot 13! It's ten times more powerful than that weak Rot 3.

Re:Svefg Cbfg!

[Deltaspectre]

Then Rot 26 should be a whole 20 times more powerful!

I'd hate to imagine what ROT 208 would be like !

Re:Svefg Cbfg!

[Anonymous Coward]

Ten times? I guess you're operating on radix-27.

Re:Svefg Cbfg!

[umedia]

"hold the power of Rot 13! It's ten times more powerful than that weak Rot 3."

hear he tried yEnc but was flamed by henchmen that preferred uuencode.

I have a feeling this was more about the man seeing himself as a "Cesar", than encryption methodology however.

Re:Svefg Cbfg!

[Anonymous Coward]

It might be just as secure as a ROT0!

You didn't expect

[WebHostingGuy]

these people to be brain surgeons did you?

Re:You didn't expect

[Zephyros]

Certainly not, but I would think that those whose livelihoods and lives depended upon secrecy would be a little more careful with information. Okay, so according to TFA, the guy dropped out of school when he was 8. Maybe he wasn't the sharpest knife in the silverware cabinet - hell, maybe he was a spoon - but he seemed to have some leadership talent. You don't become a "boss of bosses" otherwise. Part of leadership is making sure if you don't know yourself how something important works, you have somebody you trust who does know it. Surely somebody in the organization knew that such a simple code wouldn't hold up...

Re:You didn't expect

[LoonyMike]

Judging from some movies, some of them are at least *aspiring* brain surgeons

Re:You didn't expect

[MasterC]

You didn't expect these people to be brain surgeons did you?

If they were then they would have used "braintography" where they hide messages inside the brain either by direct surgical insertion or careful manipulation of neurons (aka brainstegonography).

Sorry, what does cryptography have to do with brain surgeons again?

Re:You didn't expect

[Zephyros]

Maybe, but unfortunately due to dropping out of school at the age of eight, they can't tell the difference between a bullet and a scalpel...

Re:You didn't expect

[qwijibo]

A good leader would delegate tasks like communication security to someone who could do that well. However, I get the feeling that someone who dropped out of school at 8 and became a mob boss may not have been keeping up to date on the latest management training strategies. =)

Re:You didn't expect

[Zephyros]

It's a business like any other. Gotta get efficient, stay in touch, and increase your profits. And when your competition is looking to take you down, you've gotta stay ahead of them. He did pretty well, obviously, for a while...but if he can't be arsed to keep up with the times, it's his arse in the fire.

Re:You didn't expect

[zippthorne]

Aparantly people believe brain surgeons must be very smart, considering the delicate nature of the organ they concentrate on.

This is undoubtably the case for many in the profession, especially considering the hurdles necessary to get there, but if I were to go under the knife, I'd prefer someone with rediculously fine motor control and the experience of thousands of hours of drills.

The actual act--open head, cut something out--while certainly complicated, hopefully shouldn't require much thought..unless something goes horribly wrong.

Re:You didn't expect

[Ruphuz]

A good leader would delegate tasks like communication security to someone who could do that well.

Well, most surely the man had one or more consiglieri, who most surely got to think twice about suggesting the capo he was doing something stupid.

And, most surely, this/these sidekick/s got a paid vacation to a nearby lake. With concrete shoes, of course. :P

Re:You didn't expect

[Kadin2048]

I get the feeling that someone who dropped out of school at 8 and became a mob boss may not have been keeping up to date on the latest management training strategies.

He was really just ahead of his time. You just wait, I'll be he'll write a tell-all book from prison: "10 Habits of Highly Effective Mobsters."

I can just imagine....

Manager: "Hi Joe, what's happening."
Cubie: "Oh, hi Stan. ... What's with the baseball bat?"
Manager: "It's a new team-building technique I'm trying out."
Manager beats Cubie savagely with bat, until his head completely dissolves.
Manager: (to office) I WARNED YOU, NO READING SLASHDOT AT WORK.

Re:You didn't expect

[elpapacito]

Primitive yes, but not far away from today managing techniques

Re:You didn't expect

[MasterC]

I guess the humor in my previous post didn't implicitly make the question rhetorical in nature. Don't get me wrong, I wholly understand the proverbial usage of "brain surgeon" and "rocket scientist" as means of attributing and/or gauging intelligence which is why I played on it and made it a joke. So here's a reply anyway.

I know plenty of people with MDs that couldn't make Firefox their default browser to save their life, let alone generate a public/private key pair or even understand good crypto from bad crypto.

Brain surgeons are no more apt to be crypotographers than rocket scientists by the shear fact that they are smart.

Not even computer engineers or computer scientists are more apt to be crypotgraphers. It's when people think they know cryptography but don't that cryptography blows up in their face spectacularly (CSS, WEP, HDCP, countless anti-piracy-on-CD techniques, etc.).

Cryptography is one of those fields (like nuclear engineering and brain surgery) that if you do not know exactly what you're doing then you're bound to fail and cause some bad stuff to happen (meaning that there is no way to repair the damage). Imagine if all of the classified documents were protected with nothing more than CSS or WEP.

Re:You didn't expect

[CheeseTroll]

hopefully shouldn't require much thought..unless something goes horribly wrong.

The same could be said for every profession. It's what separates the real experts from the amateurs.

Re:You didn't expect

[Zan Zu from Eridu]

I wonder if the latest management strategies would keep you out of jail for more than 40 years while running a crime empire? Hmm, maybe that's not a very good question...

More importantly, in the crime business you can't even expect your own employees to be trustworthy, so telling a lot of your secrets to one person (which is capable of hiding his own secrets effectively from you) might not be a good idea. I expect anyone to become a mob boss not to be a complete moron so I guess he was using the cypher to hide information from his fellow mobsters and not from outsiders.

Re:You didn't expect

[Mercuria]

Micheal Bolton: How is it that all these stupid, Neanderthal, Mafia guys can be so good at crime and smart guys like us can suck so badly at it?

I guess office space was wrong...

Re:You didn't expect

[lRem]

Given that he steered the mafia for 50 years, evading the police and keeping control over the organisation at the same time, furthermore without usage of any modern technology including cryptography... Well, I would call him a good leader. Probably way better than your typical manager with a bucket load of certificates.

Re:You didn't expect

[Bob3141592]

A good leader would delegate tasks like communication security to someone who could do that well.

Well sure, but then you have to rub out the guy who did the encoding so he doesn't squeal later. After a few dozen messages, good encoders get harder to find.

Re:You didn't expect

[qwijibo]

Getting advice on something is different than having someone else do all of it for you. I would think someone who wants to be truly paranoid would get recommendations of how to secure messages himself, then have someone else pass those encrypted messages over a secure channel.

To put it in terms of other mafia business, it's similar to getting advice on where to get an inexpensive gun without a paper trail. You don't have to tell them what you're going to do with it, you only have to tell them what you want.

Re:You didn't expect

[qwijibo]

I seem to have no problem setting up a network of machines with secure communication between them. I don't have to know what data is being sent to make the secure communication possible. A good consultant would be able to demonstrate this for a prospective client in such a way as to help them understand that he can provide ongoing support after installation without jeopardizing the security of the organization's data. In fact, for this kind of situation, I'd recommend an unrelated third party audit the system to ensure that the client is getting the security they expect and the client is fully in control of the environment.

Re:You didn't expect

[Zan Zu from Eridu]

Agreed, but the problem still remains the same, as long as you let anyone else give you advice on your encryption, it better be strong encryption so your advisor can't easily decode your messages if/when he intercepts them. The catch 22 is you can't determine the strength of your encryption unless you're a fairly knowledgable cryptographer yourself, in which case you don't need anyones advice on how to secure your communication in the first place. If you're truly paranoid, you don't trust anyone.

Re:You didn't expect

[ArsenneLupin]

hell, maybe he was a spoon

There is no spoon.

Re:You didn't expect

[idiot900]

but if I were to go under the knife, I'd prefer someone with rediculously fine motor control and the experience of thousands of hours of drills.

I'm a medical student and have scrubbed in on a bunch of surgeries. Surgery is (relatively) easy if nothing goes wrong. Any idiot can learn how to go through the motions. The difference between me and an actual surgeon is that the surgeon knows what to do when something goes wrong, and can use his or her extensive knowledge of the anatomy, physiology, and the procedure to adapt to the situation and make it right.

Also, many surgeons aren't necessarily less shaky than most people. They have just learned to steady their hands against things - such as the hands of the medical student who is retracting :)

Re:You didn't expect

[geekoid]

but you know it exists, and that's enough.

Re:You didn't expect

[dfenstrate]

What's the difference between a professional and an amatuer?

A professional fixes his mistakes fast enough that no one notices.

Re:You didn't expect

[Zephyros]

Maybe not, but I'm guessing there'll be plenty of spooning in prison.

Hello, My name is Simon.

[CaffeineAddict2001]

xfmm tpo tpnfujnft tboub hpuub hfu xbdlfe

Re:Hello, My name is Simon.

[gEvil (beta)]

...and you like to make drawerings?

Re:Hello, My name is Simon.

[Fizzl]

well son sometimes santa gotta get wacked
(rot-25)

Re:Hello, My name is Simon.

[mpathetiq]

Quit looking at my bum! Cheeky monkey!

Not very smart

[AKAImBatman]

He apparently wrote notes to his henchmen using a modified form of the Caesar Cipher

To put that into computer terms, he ROT13ed the text. This sort of cipher was used by Caesar not because it was secure, but because most people couldn't read. Even those that could read undoubtedly lacked sufficient education to consider a cryptoanalysis of the text. But if someone does consider a cryptoanalysis, it is incredibly easy to break this cipher.

Simply substituting the first letter with each letter of the alphabet allows for a brute force attempt at decoding by then replacing the rest of the letters with the exact same offset used on the first character. This method ensures that the message will be decrypted even if the alphabet has additional characters. (Either for purposes of obfuscation or additional information.) The only method that can be used to prevent an attacker from using this simple decoding method (you don't even need a computer!) is to mangle the alphabet somehow. For example, if the alphabet is backwards an attacker would have more trouble decrypting the cipher. Even then, however, a simple statistical analysis on the occurance of the letters would quickly decrypt the message and reveal the secret alphabet used.

That being said, this particular mobster was smart enough to realize that a simple cipher like this would be insufficient to deter a decoder. So he attempted to confuse would-be attackers by using a number code to obscure names. I imagine that he thought that attackers would assume that he was using a codebook to keep track of the assigned names. Unfortunately (for him), his 8th grade education was obviously insufficient for him to know that his number sequences are very similar to compression techniques. Anyone with experience would note that the codes were far too long, and that the number 1 appeared quite often. Its appearance suggests that its a "trigger" for interpreting the next number differently.

So there you have it, security through obscurity does not work.

Re:Not very smart

[Anonymous Coward]

Yeah, it only worked until the guy was 73 years old.

Re:Not very smart

[AKAImBatman]

Minor correction to myself: The article seems to suggest that he was 8 years old when he dropped out of school, not in 8th grade.

Re:Not very smart

[qwijibo]

Correction: It only worked until the police got ahold of his messages.

Re:Not very smart

[AKAImBatman]

it only worked until the guy was 73 years old.

I have a feeling that this has more to do with careful control of the information pipelines, large payoffs to corrupted officials, lots of money poured into lawyers, and the ability to disappear when things get hot. The purpose of using a cipher is to create a last line of defense in the case that your information pipeline is compromised.

Given that murder has no statute of limitations, he would have been equally stupid to use a more secure cryto but with unsecured channels. Even if it took the police 10 years to decrypt his message, they could still drag him into court and nail him.

Heavier crypto would have even more problems. Not only would computers be required, but the constant use of such a crypto would ensure that at least some of the keys would eventually be captured by the police. This is almost as bad as using a codebook, something I'm sure this mob-boss was looking to avoid.

His best bet would have been a combination of physical security, with crypto dependent on how sensitive the message was. Sensitivity could easily have been determined by the legal penalty. For example, burning down someone's shop would have been low enough to use a hand cipher. Committing murder, OTOH, would have been sensitive enough to require the use of military grade encryption.

Re:Not very smart

[Anonymous Coward]

but it does and can. the decoder ring can be usedto create a UNBREAKABLE cipher easily.

using a 1 time pad of numbers you start by advancing the ring for each letter. it just requires you henchmen to have the same ring and same pad.

This was used to make it easy for them to mentially decode it. anything with some strength takes time and effort to decode and thus will not be used with the brainless types of the criminal.

Re:Not very smart

[Alarash]

Well, to be fair, the guy lived in a stable, and was a grandpa. So I don't think he knew much about algorithms and stuff. But, even if he was a godfather that eluded the police for 43 years, I don't think he's smart. Even if he didn't have any knowledge about cryptology (-graphy? Gee, I never know), he should have hired somebody who did know about it as an "advisor". But then, there's a trust issue, and I'm not sure the poor guy would have survived after he advised on picking the correct encryption system.

Or the godfather just wanted to play it old school all the way thinking it was the way to go. But then again, he lived in a stable.

Re:Not very smart

[AKAImBatman]

but it does and can. the decoder ring can be usedto create a UNBREAKABLE cipher easily.

Right up until someone captures the ring. Which means that the rings would have to be disposed of in a secure fashion, or the message would be open to all. When you think about this for a bit, it's easy to realize that the use and disposal of so many "codebooks" would have eventually resulted in a huge slip-up.

Re:Not very smart

[hackstraw]

So there you have it, security through obscurity does not work.

So, my private key is not good anymore?

Re:Not very smart

[drdewm]

Smart enough to become "the boss" anyway and for it to work until he was 70ish years old. Just because he dropped out of school at the 8th grade does not make him stupid. Before large scale public education people got along pretty well without formal education. Also 60 plus years ago the 8th grade education was probably more like todays senior in high school.

Re:Not very smart

[starm_]

In the Provenzano code the key is the +3 shift," mathematics expert Alessandro Martignago told Discovery News.

eh... They had to get the specialists of integer additions to crack the case?

Re:Not very smart

[symbolic]

So there you have it, security through obscurity does not work

I generally agree with this, but that's exactly what encryption is- security through obscurity.

Re:Not very smart

[Hillgiant]

I dunno. Tell me what it is, and I can run it through my obfuscator.

Re:Not very smart

[maxume]

Avoiding storing the message in readable form is better than any cipher. If he trusted somebody to commit murder for him, he could probably find somebody he trusted to deliver the message. Encryption doesn't help with trust, you still have to trust the reciever of the encrypted message...

Re:Not very smart

[Jerf]

"Security through obscurity" is well known to mean attempting to keep the algorithm/implementation secure, not a key.

A modern encryption technique is considered secure if an attacker is assumed to have full knowledge of the algorithm/implementation and all other relevant data other than the plaintext and the encryption key, and still can not extract the plaintext from the encrypted text. (This is probably simplified a bit.)

If you're trying to be snarky, you've merely shown you don't understand the meaning of "security through obscurity" in this context. The key doesn't count, by definition.

The encryption technique in question is very crackable through a non-computer-assisted analysis based on just the plaintext; for Caeser ciphers you don't even really need to know the algorithm because standard analysis will cause it to jump out of the statistics and slap you across the face. Calling a use of the most famous encryption technique in the world an attempt at "obscurity" is a great example of that low-key mathematician humor, but it's clearly the only hope of security this guy had.

Re:Not very smart

[Hrothgar The Great]

"Security through obscurity" refers to security of the encryption algorithm, rather than the encrypted text.

A really secure encryption algortithm can be shared with everyone, i.e. I would hand you a sheet of paper with an encoded message and say "Hey, I used this algorithm right here to encode this text," and then I would hand you a detailed technical description of the algorithm I used, and you would STILL not be able to break the encryption even with the best resources available at the time.

"Security through obscurity" on the other hand would mean that my encryption is only secure as long as you never are able to find out which method I used to encode the text on the paper.

Re:Not very smart

[budgenator]

This stuff I used in the military back in the day when computer programs were loaded by reading punched tape and ram was little ferrite cores and tiny wires, frequently had any extra letters to disrupt frequency analysis, like 10 e's, 7 a's; some cyphered letters and whole words into code groups of a couple of letters.

Re:Not very smart

[drinkypoo]

Consequently, each person should have a separate OTP book for each person they communicate with. Nothing else is secure.

Re:Not very smart

[hackstraw]

If you're trying to be snarky, you've merely shown you don't understand the meaning of "security through obscurity" in this context. The key doesn't count, by definition.

I was half being funny, half saying that my private key is secure because its obscure. If I gave you my key and passphrase protecting it, you have free access to all the goodies I do.

I know what security from obscurity is. Honestly, I believe in it. A wise landscaper once told me, "The less people can see, the less likely they are to steal it".

Honestly, if OS X or Linux had the marketshare of say, MS Windows, I would guess we would have almost the headaches that they do. Because I'm in the < 10% or so range of systems out there, honestly, I'm more secure because I'm more obscure. X86 attachments, even if I or someone else on an OS X or Linux or whatever that is not on an x86 architecture won't do anything.

Security is a game, like cat and mouse. Nothing is secure. Think your lock on your house can keep me out? Think your alarm on your house can't have the phone and power cord cut? Think I can't sweet talk someone in HR for their username/password and get your SSN? The greater the illusion of the necessity of security, the greater the illusion of better security measures. Its kinda like "Well, security must be important to us because we pay XXX dollars for it". I've worked at places that because they are top 10 research facilities in the world, they think security is a big deal. When Bush was behind in the polls, and he used to jack up the security color from pink to purple, we would have to have our cars searched on entry, blah blah. I always thought. You know, if I were a terrorist and I've been planning for months or years this nasty attack on this national lab, hmm, maybe I should wait until next week or month until they just let me drive in like last week. Nah, I'll risk it and just go on in.

I'm mindful about security, but other than that I think its a joke. I use "weak" passwords, I don't change them on the hour, I use public key authentication, I don't run remote services when not necessary. I layer my good stuff behind stuff that can be blown away at any time and replaced. Basic stuff. Oh, and I don't run Windows. Anyone who cares about security and runs Windows is just someone that enjoys job security through patches, virus updates, and reboots. I work for a living, and simply don't play those games.

Re:Not very smart

[DulcetTone]

Passwords (of any length, of any devious degree of randomness) are obscure.

tone

Re:Not very smart

[epee1221]

Go back and read the post, then try again.
One-time pads are only used once and then discarded.

Re:Not very smart

[AKAImBatman]

I think you may want to reread my post. If you use one time pads using decoder rings, then the decoder rings each need to be properly disposed of after the message is decoded. If the ring falls into the wrong hands (or if the same code is used twice!) then the message will be compromised. Using that many rings will eventually result in a ring/message combo being captured.

Re:Not very smart

[epee1221]

If the ring falls into the wrong hands
Ok, I'll let you see my "decoder ring" here: it shifts the plaintext character by the amount given in the key segment. Now explain how that helps you defeat the one-time pad.

or if the same code is used twice
If the same code is used twice, it's not a one-time pad.

Re:Not very smart

[AKAImBatman]

Now explain how that helps you defeat the one-time pad.

Your decoder ring contains the one time pad used to decode the message, right? Then by showing me the ring, you've just shown me the key I need for the message. The problem with a ring is that it is incredibly difficult to dispose of the pad. When you're using a scheme like Solitare, the cards can be quickly dumped or shuffled to destroy the key. But with a decoder ring? Not likely. Either there's a secondary key that sets the ring to produce the same pad (in which case any of the rings can be captured for decoding the message) or each ring contains a unique pad, thus requiring the complete and utter destruction of the ring after the message has been received.

Given enough time, it's likely that someone would slip up.

If the same code is used twice, it's not a one-time pad.

Uh, yeah. But these are humans we're talking about. Constantly producing and disposing of pads is a costly process. If the humans involved reach a sense of false security, they may be tempted to reuse the same key more than once on the off chance that two messages using the same key will not be intercepted. A foolish choice, perhaps, but humans often prefer convenience over absolute security.

Re:Not very smart

[epee1221]

Your decoder ring contains the one time pad used to decode the message, right?
No. Why would it?
It seems that you do not know what a decoder ring is. Perhaps this can clear things up for you.
A decoder ring is a set of permutations, usually the set of shift ciphers (which will be used for examples) on the alphabet in question. The key, which is distinct from the decoder ring, tells which permutation to use on which letter in the message. A shift key would use the same shift permutation on every letter. A Vigenère key would be a repeating sequence of shift keys -- the first shift goes with the first letter, the second with the second letter, etc. A one-time pad is a random sequence of shift keys which is just as long as the message.

Constantly producing and disposing of pads is a costly process.
Actually, the main issue with one-time pads is making sure both sender and receiver know the key. Producing keys is rather easy -- pseudorandom number generators are nothing new or expensive. Destroying keys is simply a matter of overwriting some disk space or burning a piece of paper.

Well?

[Anonymous Coward]

So what's the low down on the story? Was his kid sister able to decypher his notes or not?

Journalists these days. :rolleyes:

Please help me pick up my jaw from the desk

[b1t r0t]

When I started reading the headline and blurb, I thought "oh he probably used PGP or something". Then my jaw dropped when I read that he was using the Caesar cipher, which is so weak that it can't really even be considered encryption any more. I mean, people on the internet regularly use a variant of it (rot13) to hide movie spoilers.

Even HTTP passwords are better hidden, using base64 by default! Dumbass doesn't even begin to describe this.

Re:Please help me pick up my jaw from the desk

[Anonymous Coward]

To be fair, he dropped out of elementary school, and didn't use computers. Encrypting your memos with modern encryption methods gets a bit trickier when all you have is a third-grade education and a typewriter.

Re:Please help me pick up my jaw from the desk

[Asic Eng]

Well, his security system wasn't really cryptography-based. It was based on (relatvely) secure channels. Rather than trying to prevent the police from decoding his messages he was trying to prevent them from intercepting them in the first place. Often the problem is that merely sending a message is already conveying information, even if the message is not decoded - e.g. a phone call or email message gives another person the chance to trace down your location, even if they cannot read your message.

The cypher may have been good enough for some purposes - e.g. the couriers may not have been able to understand them, and thus been unable to carelessly talk about them. It's not likely that all of them were terribly smart. Also, even delaying decoding for a little while already has a positive effect for someone who is on the run.

The system appears to have worked well enough for 40 years. In fact the police state that it's exactly this low-tech approach which enabled him to escape for so long. I do hope the flaws in his system will keep him locked up for the rest of his live.

Re:Please help me pick up my jaw from the desk

[JohnnyDoesLinux]

I am sure that a visit from a large, hairy, sweaty, gold chain clad member from the mafia customer support staff will gladly help you (and has already been dispatched).

He would most likely remove your head and set it on top of your recently dropped lower jaw. Please make sure there is room around you for a large mammalian head that usually accompanies these visits.

Re:Please help me pick up my jaw from the desk

[Frozen Void]

Not everyone is expert to write ciphers . Most people can't handle complex procedures of decoding the plaintext(manually,with paper and pencil).The cipher was quick to decode.

Re:Please help me pick up my jaw from the desk

[vidarh]

I did actually once work in a company where the director of engineering was shocked to find I could "decrypt" their base64 encoded internal customer id's (knowing the id would allow anyone who held it to set up 30-way conferencing calls to anywhere in the world and leave it hanging - the dumbasses also didn't think about the fact that the id's were allocated in sequence and your own id was visible in the url's when you logged in, so they were trivial to guess anyway)

High security.

[Rob T Firefly]

Also seized from his rooms were records for bookies operations filling several Barbie diaries with real plastic locks, and hit orders folded tightly into paper origami footballs.

Re:High security.

[dr_dank]

Also seized from his rooms were records for bookies operations filling several Barbie diaries with real plastic locks, and hit orders folded tightly into paper origami footballs.

Not to mention the little paper fortune tellers that ran the operation.

Ok, ok, will Vito grow up to marry Rick Springfield?

*fwip*fwip*fwip*fwip*fwip

Yes! Oooooh!

Re:High security.

[inKubus]

Interestingly, he could have used the "Magic 8-Ball" to increase the strength of his encryption. I'm not sure how, but it would be funny.

What, he couldn't afford a consultant?

[aminorex]

No evil genius he! You would think that a "boss of bosses" -- I guess that makes him a middle manager? -- would have at least an administrative assistant who could tell him he's acting dumb. But then, I guess it doesn't work for Donald Trump either.

Really, there should be a new term for this: Disorganized crime.

Re:What, he couldn't afford a consultant?

[Anonymous Coward]

"No evil genius he! Really, there should be a new term for this: Disorganized crime."

Perhaps. But if such is the case and it takes this long to take him down (at least potentially since we still have a trial to go through), how does that reflect on the organization and capability of our law enforcement? Keep in mind this is a 73-year-old man. Reminds me of the saying if cigarrettes are so bad, why do they take 30-40 years to kill you?

Re:What, he couldn't afford a consultant?

[Billly Gates]

He was an old man who was caught living in a barn in Silcilia. The man is smart but has been in hiding for many many years.

He can't even see his own family anymore out of the fear of being caught and is always on the move. Finding an ISP to each location would be difficult.

My guess is us used the algorithm by hand when writing letters or dictating them to someone else. I doubt he would post anything on the internet as this would be where the police would look first

Proving once again...

[BadDoggie]

Security through obscurity doesn't work. (And how much more obscure can you get than a 2,000-year-old-code?)

Actually, what it tells you is to stay in school, kids. This mook dropped out when he was 8.

woof.

Re:Proving once again...

[imsabbel]

I hope you are joking if you call caesars cde "obscure".

Just like the wheel or fire, being old doesnt make it obscure or uncommon.
In fact, everybody who ever looked at the puzzle page of a newspaper will know it and how to break it...

Re:Proving once again...

[192939495969798999]

no, but security through hiding in the mountains and controlling the influence of the entire mob apparently works pretty well -- he was hidden for almost his whole adult life.

Re:Proving once again...

[Anonymous Coward]

Flamebait? Jeebus! Why don't they ever pass out crack when I get mod points? Overrated, perhaps, but that's all.

I see this one needs to be spelled out:
Part 1: Security through obscurity: a constant theme here. No, a Cesar shift isn't obscure but damned near anything that's a couple thousand years old is. Of course it would've been funnier if I could've worked "archaic" in there somehow but I couldn't. You'll get over it.

Part 2 (and probably what garnered three "Flamebait" mods: I didn't slag off Italians. It was a generic "stay in school" message. The fucktard dropped out when he was in what? first or second grade! That's neither a flame nor the seed for flaming. It's a fact. The guy had no book smarts and as it turns out, book smarts are actually useful in this world. Some geeks here actually know this.

woof.

Re:Proving once again...

[Jetekus]

Since when did "obscure" mean "given away in cereal packets"?!

Re:Proving once again...

[chmod a x mojo]

HA!! as if schooling makes a difference.
1. he was smart enough to run the mob for how long? i had a boss that had 10-12 years of managment training and several degrees, the stupid S.O.B. couldn't run a rabbit hutch... he had no people skills whatsoever.
2. you would be surprised at the number of people who can't do the crypto-quips in the news papers. Remember kids, not everyone is a geek... there is a whole world outside /. and computers.

I AM....

[i_want_you_to_throw_]

your kid sister you insensitive clod!

He should've at least read

[gregarican]

this book. I found it an enjoyable yet educational walk through the history of encoding/decoding. Cool stuff. I guess Sicilian mobsters typically aren't Mensa members...

Re:He should've at least read

[caffeination]

Seconded. Especially for the puzzles in the back. I had a great time doing one of them the hard way by making a crappy frequency analysis graph (pictured in the wikipedia article).

The only bad part was the amount of hypothetical "Adam" and "Eve" style in there, which was a bit of a shock to someone used to code and grammar books which just bluntly state their points.

Realistically, though, I would never have taken the time to learn those basics of cryptography if the level had been much higher, so it's highly recommended.

Re:He should've at least read

[mbourgon]

Check out his TV show - probably floating around the internet somewhere. 6-part series about the history of cryptography. Neat stuff, probably doubly so if you've read the book.

Re:He should've at least read

[Kadin2048]

I wish it was floating around the 'net somewhere, but if it is, I haven't found it.

It was produced for a British TV channel by a company that does mostly public television and documentary programming, their name escapes me at the moment but I found them online a while back, and as far as I can tell it's never been released on DVD and they don't have any immediate plans to do so (although they will happily sell you the rights if you want to run it on your network, I'm sure).

It's one of those situations where I'd buy it if I was able, but since it's not I wouldn't exactly lose a lot of sleep being racked with guilt if I found a way to download it instead.

Re:He should've at least read

[pthisis]

The names are standard in crypto texts, even rigorous academic ones.

e.g. Alice (first communicator), Bob (Second communicator), Eve (passive attacker--eavesdropper), Mallory (malicious active attacker), and Trent (trusted third party)

See:
http://en.wikipedia.org/wiki/Characters_in_cryptog raphy

Re:He should've at least read

[Anonymous Coward]

Sharon Stone is in Mensa. What does that say about your precious little organization?

Re:He should've at least read

[markyb74]

It was called the science of secrecy (and is well worth watching if you can get hold of a copy) and was produced for Channel 4. They have some information on their website about the programme http://www.channel4.com/science/microsites/S/secre cy/index.html though I don't think it has ever been released on DVD. Mark

Re:He should've at least read

[nuzak]

Bob & Carol & Ted & Alice, actually.

Re:He should've at least read

[Anonymous Coward]

Mensa members are hot?

OK , he doesn't know cryptography...

[Viol8]

... but it still took the police almost 50 years to catch him
so he must've been doing something right. I imagine the ceaser
code was simply to prevent other knuckle dragging criminals from
understanding the message, not a load of top crypto crackers
at police HQ.

Re:OK , he doesn't know cryptography...

[SpaghettiPattern]

but it still took the police almost 50 years to catch him

That my friend is probably due to the social engineering skills of his organisation. Probably a combination of convincing, bribing, forcing, scaring etc...

Re:OK , he doesn't know cryptography...

[slashflood]

OK, he doesn't know cryptography but it still took the police almost 50 years to catch him so he must've been doing something right.

I don't know. Maybe it isn't a coincidence that this guy has been cought just after Berlusconi lost the election.

Re:OK , he doesn't know cryptography...

[Anonymous Coward]

Exactly. If the 'brains' of the operation has a 3rd grade education, I bet the grunts are truely lowbrows.

Re:OK , he doesn't know cryptography...

[mbaciarello]

Although not a Berlusconi fan myself, I've watched TV interviews of the prosecutor in charge for the investigation. He said it took them years thanks to the "social engineering skills" the "organization" has, as another reader pointed out.

The guy made a mistake, so the police made the first connection between a messenger and the boss himself. It was something about him needing fresh linen if I'm not mistaken. Of course they broke the code in a matter of minutes, but it took them ages to just get a hold of one message. Then they had to trace back the messengers chain.

To sum it up, I'd say that the biggest part of the investigation has been done under the Berlusconi administration and the center-left government before that.

Re:OK , he doesn't know cryptography...

[Panagiotis]

I agree with you, the encryption was used not for the police but for the people who could read the message before it could arrive in it's final destination. The encryption technology is evolving rapidly and i do not believe that mafia would have 20 IT guys trying to keep all the criminals up-to-date with the current best encryption method. If we go there then other problems wll rise.

This is why you outsource.

[qwijibo]

This is a good example of when you should outsource. If your business is not security, you should get security consultants to give you advice on securing your communications. Even the paranoid can hire multiple unrelated consultants and compare their recommendations. If they had done this, they might be using something out of date, but at least it would help. For example, no one would still recommend PGP 2.3 with 512 bit RSA keys, but it would have at least been an improvement over this.

This is also an example of where business continuity plans come into play. Organized crime has more risks than most businesses, so it's important to mitigate against those risks. The organization needs to ensure that individual members are complying with the security guidelines. I would expect the mafia to have a cement boot policy for people who leave incriminating, poorly encrypted data available. This data should have been encrypted and stored in a mafia run data center. There's simply no excuse for such pitiful data security in any organization.

of course not

[xmodem_and_rommon]

Of course we don't...but it is NOT hard to use good crypto

Had he used AES rather than his shitty substitution cypher, he would still be at large (assuming the encryption key was secure). AES isn't the simplest algorithm, but you do not need a fast computer to encrypt data to it.

On windows, check out 7-zip ( http://www.7zip.org/ ) for good, simple crypto. Us Mac OS X users have it built into the OS in the form of encrypted disk images and filevault. Not to mention encrypted virtual memory (for the turly paranoid)

Re:of course not

[amliebsch]

7zip isn't really necessary. Windows has built-in file encryption using EFS.

Re:of course not

[lgw]

Be warned, however, that the default installation of EFS is insecure on a non-domain Windows machine. Read up on it before you use it.

Gee...

[Spy der Mann]

At least he could've gone fancy and use a Secret Decoder Wheel or something.

Behold the power of ROT13 times 2!

[Dark Coder]

Stand back!

Behold twice the power of a ROT13 used twice!

Re:Behold the power of ROT13 times 2!

[Jugalator]

Arrgh! I just see a sequence of ASCII characters now! B... e... h... What the hell did you do!?

Re:Behold the power of ROT13 times 2!

[Rorschach1]

Hah! Your double-ROT13 is no match for my quadruple-XOR encoding!

Re:Behold the power of ROT13 times 2!

[Eudial]

Hah! Your double-ROT13 is no match for my quadruple-XOR encoding!

A feeble encoding, compared to the double-xor + double rot-13 + double character order reversal encoding!

Showing your hand: word to the wise-guys

[thomn8r]

Now, right this minute, every other mobster is in a mad rush to implement a real crypto scheme. The cops, for the sake of some PR, have pretty much guaranteed that it will be harder to decode such communications in the future.

There was an American mobster a few years ago who did something using PGP, and the only way the FBI were able to crack it was to bug his keyboard http://www.theregister.co.uk/2000/12/06/mafia_tria l_to_test_fbi/

Re:Showing your hand: word to the wise-guys

[Cthefuture]

There was an American mobster a few years ago who did something using PGP, and the only way the FBI were able to crack it was to bug his keyboard

Well we don't know if that's the only way they had of breaking it. It was probably one of the easiest though. Often the weakest part of any cryto algorithm isn't the algorithm. It's cheaper and faster to go for the soft targets first.

Re:Showing your hand: word to the wise-guys

[Rydia]

You generally don't catch mobsters through breaking cryptography. You generally get the group's peons, threaten them with jail and/or search the house of everyone they know (who you also know is in the mob, these things are more public than people assume), and then eventually smack people around with RICO.

This guy put about as much thought into data (rather than operational) security as I think would be worth it.

Re:Showing your hand: word to the wise-guys

[Aladrin]

Somehow, I think releasing this information in a court case to convict the guy is just as much 'showing your hand' as announcing it to the world and grabbing the PR as well.

You could argue that 'nobody goes through court cases', but then you'd have to explain the presence of 'Court TV' and this IS a major mob boss, not some joe nobody that hired a hitman. All the other mob bosses will know about the case.

In other news: He came free...

[Anonymous Coward]

...because the evidence couldn't be used after it was found that the prosecutors broke his encryption without permission.

Keep my kid sister out!? Impressive!

[2short]

"Discovery's cryptography expert describes it as a code that 'will keep your kid sister out'."

Considering my kid sister is a mathematician at NSA... Hmm, maybe he meant a hypothetical kid sister?

Re:Keep my kid sister out!? Impressive!

[Anonymous Coward]

Tell her I said "xibu jt zpvs ovncfs?"

Re:Keep my kid sister out!? Impressive!

[scovetta]

Nice caesar cipher (n -> n+1). What are you, some kind of mafia boss?

Re:Keep my kid sister out!? Impressive!

[Anonymous Coward]

No. I'm certain he meant your exact sister.

Re:Keep my kid sister out!? Impressive!

[chris_eineke]

Considering my kid sister is a mathematician at NSA

I guess you have set up an excellent supply chain of tinfoil hats?

Re:Keep my kid sister out!? Impressive!

[Ohreally_factor]

That must be cool when you need to contact her. You can just dial any number at random and ask to speak to her.

Re:Keep my kid sister out!? Impressive!

[Anonymous Coward]

This thread is worthless without pics

/sorry

Re:Keep my kid sister out!? Impressive!

[smoker2]

Hmm, maybe he meant a hypothetical kid sister?

Did Schrodinger have a kid sister ? How's she doing ?

I hope she's thinking outside the box.

Re:Keep my kid sister out!? Impressive!

[Anonymous Coward]

you don't need to dial a number, and if you're in the US, I'm pretty sure you don't even need to pick up a phone.

Re:Keep my kid sister out!? Impressive!

[geekoid]

Maybe it was actually a really tough code,and he was talking about your sister? everyone here is just misinterpeting ans assuming it was for their smarter(yet still stupid) Kid sister?

Re:Keep my kid sister out!? Impressive!

[Pathetic Coward]

My kid sister would have no trouble with that thing.

My boss, on the other hand ...

Technomoron

[Fitzghon]

This is the first article I have ever tagged "technomoron".
I think it is appropriate.

Re:Technomoron

[archgoon]

Neal stephenson's next hit book! Technomoronicon.

Better headline

[Anonymous Coward]

Crime Capo Caught Cribbing Caesar Ciper

h4x0r

[mdboyd]

Looks like the mafia boss was pretty 1337 ;)

Re:h4x0r

[CleverNickName]

Looks like the mafia boss was pretty 1337 ;)

Wouldn't he be 47710?

Didn't need crazy encryption

[192939495969798999]

Odds are if you were holding one of the Godfather's messages long enough to decipher it, that means you had to get it from someone in the mafia. They took these from him, which is one thing. Of course you can do that if you're the police/fbi/etc. and you've captured the boss. If you're just some shmoe, you can break the code all you want, the boss is still coming after you.

Note to self:

[just fiddling around]

Do not keep copies of orders to henchmen after their execution.

Now that this is taken care of, I'll order my henchmen to stop keeping logs of our communications.

The article is misleading

[Gzlegobrath]

I read about this in the local newspaper a few days ago. Their angle was that because he used small pieces of paper as the only means of communication he was able to prevent being caught by the police (implying that had he used modern technology it would have been much easier for the police intercept his messages and catch him). That article didn't even bother mentioning his use of "cryptography".

And the secret message is...

[rehtonAesoohC]

Be sure to drink your ovaltine?!

Re:And the secret message is...

[Is0m0rph]

Come on someone has to mod that funny!

Re:And the secret message is...

[Anonymous Coward]

I saved a bunch of money by switching to Geico!

Must have taken after the Italians from WWII

[rockhome]

The Italians used some of the worst cipher systems during the war, and were pretty easy to break.

Oh, if only he could have gotten his hands on a 4-rotor steckered Enigma. At least that would have stood up for a day or 2.

Best cipher is no match for bad practices.

[UnknowingFool]

There's all sorts of ciphers that could be used. Unfortunately, usually the weak points are not the system but the people. In this case the cipher was easy to crack. But you could have an almost unbeatable system like a one-time pad like the Soviets used during the Cold War. However, low level lackeys re-used the pads, allowing the US to break some of their messages. During WWII, German coders did things like not changing the daily cipher key or sending the same message at the same time every day but using a different cipher.

Re:Best cipher is no match for bad practices.

[fireboy1919]

During WWII, German coders did things like not changing the daily cipher key or sending the same message at the same time every day but using a different cipher.

Close. They sent the same kind of message every day at the same time - namely, the list of wins and losses was sent every morning. This was far more valuable than using the same cipher twice.

Of course, we probably wouldn't have figured it out without an Enigma machine.

Re:Best cipher is no match for bad practices.

[Tim82]

an almost unbeatable system like a one-time pad

A one-time pad is not almost unbeatable, it is entirely unbeatable. A completely random, non-repeating one-time pad is currently the only known method of encryption that cannot be broken. Admittedly there are several known ways that would take millions of years to break, but in theory, at least, they are breakable. A one-time pad is not.

Unless....

[Anonymous Coward]

Discovery's cryptography expert describes it as a code that 'will keep your kid sister out'."

Hah, unless your kid sister is an italian police officer.

mafia speak

[Anonymous Coward]

He should have only spoke to the guy about the thing thats going down you-know-when as soon as you-know-who brings the stuff in from the place.

Kahn Do.

[Anonymous Coward]

Snort some Kahn. You'll love it. Might be a bit redundant if you've just read Singh, but when you get the urge to reread Singh, go Kahn instead.

What's up with the annoying alliteration?

[Doom bucket]

"Crook Crypto Captured"?

Come on guys, this isn't Townsville Local Newspaper. Really.

Re:What's up with the annoying alliteration?

[colinrichardday]

Don't be silly, the Townsville Local Newspaper would have the headline:

Powerpuff Girls Nab Crime Boss

More alliteration please

[v8interceptor]

How about: Corleone-like Crook Captured: Crap Caeser Crypto

Re:More alliteration please

[Anonymous Coward]

Let me guess: you've never heard the name "Caesar" pronounced properly.

Re:More alliteration please

[v8interceptor]

Yeah but it looks good written down. If only it was called Kaiser Soze...

Re:More alliteration please

[allanc]

Oh, you can do way better than that. E.g.,
"Corleonesque Crime Captain Captured: Cops Crack Crappy Caesar Crypto Concealing Critical Communications"

Re:More alliteration please

[Anonymous Coward]

Or: Corleone Capo Caught by Crappo Crypto

Re:More alliteration please

[oojah]

Huzzah! Alliteration is fun.

Re:More alliteration please

[allanc]

Agreed. Alliteration? Always awesome.

DMCA to the rescue!!!

[Pig Hogger]

Thanks to the DMCA, he does not need to have a strong cypher, since this law makes it illegal to decrypt it anyways!!!

Re:DMCA to the rescue!!!

[liquidsin]

maybe they're trying to work out an interoperable system so that they too may send orders to his henchmen. in that case, i believe there's an exception...

Re:How many letters are in the alphabet?

[bano]

The Italian alphabet only uses 24 letters.

Re:How many letters are in the alphabet?

[yppasswd]

Perhaps. Or, more probably, Italian alphabet only has 21 letters. As a side note, you live in US, don't you?

The code wasn't why he got caught.

[Anonymous Coward]

He got caught because of good police work. He sent his laundry home to get washed and then the clean laundry was returned to him. The cops just followed the package with the laundry in it.

As for not being very smart; the guy stayed out of the cops' hands for 40 years. He must have had something going for him. Running a mob is best done with a wink and a nod anyway. That way if your henchman gets caught murdering someone, you can deny any knowledge. Sadly, that's also the way a good politician works. The guy at the top of the chain never delivers a clear order to do anything questionable. His aides just understand his wishes and carry them out. That way he (like several presidents of the USofA for example) has plausible deniability.

Any coded message can be decoded eventually. Coding it just buys you a bit of time.

Yeah this guy must be really dumb.

[Anonymous Coward]

He only managed to evade capture for 40 years. Maybe if he had used better crypto he could have died before he was caught.

21

[ziggamon2.0]

If you RTFA properly, you'd know the Italian alphabet only has 21 letters...

http://en.wikipedia.org/wiki/Italian_alphabet

Sorry for going all wise-ass on you ;)

Re:How many letters are in the alphabet?

[morie]

They also state that the italian alphabet only uses 21 letters.

like corporations...

[Hatte]

Even the mafia has its PHBoB's.

From TFA

[rhesuspieces00]

"Now we will have to work on the newly discovered pizzini, which contain several coded names." With a highly trained detective working round the clock, that should take oh, 45 minutes or so.

Re:From TFA

[rhesuspieces00]

dammit. stupid html tags.

Re:How many letters are in the alphabet?

[Anonymous Coward]

In TFA, they say the Italian alphabet has 21 characters. So actually, they can add. Too bad you cant read.

Re:How many letters are in the alphabet?

[AKAImBatman]

Apparently Palazzolo and Oliva can't add.

You need to RTFA. He was using the Italian alphabet, which only contains 21 letters. With an offset of +3, the last letter would be '24'.

It's possible

[courtarro]

Maybe he used a simple cipher because he wanted the codes to be cracked. Now the police have been arresting his enemies because he "secretly" mentioned them in his letters.

Oh my!

[mukund]

And they're worried about terrorists using modern cryptographic alogrithms... ;)

But seriously, though these guys were bad, I'm surprised how much the old world still hangs on to what they believe is "tried and tested" stuff which is outdated and vulnerable. If these guys had any PGP/GPG user, he'd have laughed at caesar subsitution (and showed a copy of bsdgames). Some people in parts of the world use strong harmful "natural" medicine (with little effect but other harmful side effects --- note: many natural medicines are not bad), or useless medicines (quackery) are used in the belief that it'll work.

Re:Oh my!

[Aaron Isotton]

The old world? Hmm? AES is from Belgium; Diffie-Hellman was originally invented in the UK. Cryptography is not a "US only" thing.

I'd sure hate to be...

[gwayne]

the mafia IT guy that recommended that cipher to the Godfather...

Mob lackey: Heya, yous got a computa problem ova he'.

IT guy: Where?

Mob lackey: Down in da basement.

IT guy: Down th..

Mob lackey: [gunshot rings...]

Talent or Sheer Violence

[WebHostingGuy]

>>but he seemed to have some leadership talent. You don't become a "boss of bosses" otherwise.

Maybe, he just whacked anyone who dared to disagree. Everyone else just fell into line.

I think this is one occupation where traditional management styles may not apply.

Re:Talent or Sheer Violence

[Anonymous Coward]

Crimial org charts look surprisingly similar to corporate org charts. Organization and management of people makes only minor adjustments for the illegality of the activities, people are still people.

Nice alliteration in the title, but...

[RareButSeriousSideEf]

...easily topped with "Crime Captain Corresponded with Crappy Crypto, Consequently Captured"

What I'd like to know...

[WWWWolf]

...is how much he paid for the computer program that did the encryption (or instructions on how to do this on paper).

I've heard people actually sell this sort of hard-core bedazzling cryptomagrophical systems to unsuspecting suckers for quite a nice sum of money... *cough* Adobe vs Sklyarov *cough*

Hahah yes yes everyone laugh but..

[carn1fex]

Whats a better way to do encryption, on the fly, on the back of a cadillac on a reciept with no dice, no playing cards bla bla and NO ELECTRONICS, and no way to hand out one-time pads to whoever needs an urgent message? Not to say there isnt another better way without tools but saying LAM3R USE 512 Bit KEYLOL!! is a missing the context.

Re:Hahah yes yes everyone laugh but..

[Anonymous Coward]

Uhm... here's a tough one -- use a key-word - e.g. XPCPROUZLIS -- or, better yet, a key phrase

It ain't perfect, but it's a damn-sight better than ROT-3, and can be easily done in one's head, on the fly [or, for that matter:

"on the back of a cadillac on a reciept with no dice, no playing cards bla bla and NO ELECTRONICS, and no way to hand out one-time pads to whoever needs an urgent message."

Re:Hahah yes yes everyone laugh but..

[z1234321]

The vigenere cipher is a far better alternative for short messages, and it is fairly quick to encrypt with it if you use a table. All you ever wanted to know about the vigenere cipher: http://www.trincoll.edu/depts/cpsc/cryptography/vi genere.html

Re:How many letters are in the alphabet?

[Anonymous Coward]

I guess the question should be how many letters are there in the Italian alphabet. http://en.wikipedia.org/wiki/Italian_alphabet

Leaving out J, K, W, X and Y gives a range from 4 - 24.

Most interesting part...

[MojoRilla]

...wasn't that he was using an obsolete code, but that the Italian alphabet is missing k, j, w, x, and y.

Just how the heck can they express themselves without those letters? That must leave pretty big holes in their keyboards!

Re:Most interesting part...

[Sigma 7]

...wasn't that he was using an obsolete code, but that the Italian alphabet is missing k, j, w, x, and y.

Just how the heck can they express themselves without those letters? That must leave pretty big holes in their keyboards!

For this, I turn to the advise of Mark Twain:

A Plan for the Improvement of English Spelling
      by Mark Twain

For example, in Year 1 that useless letter "c" would be dropped to be replased either by "k" or "s", and likewise "x" would no longer be part of the alphabet. The only kase in which "c" would be retained would be the "ch" formation, which will be dealt with later. Year 2 might reform "w" spelling, so that "which" and "one" would take the same konsonant, wile Year 3 might well abolish "y" replasing it with "i" and Iear 4 might fiks the "g/j" anomali wonse and for all. Jenerally, then, the improvement would kontinue iear bai iear with Iear 5 doing awai with useless double konsonants, and Iears 6-12 or so modifaiing vowlz and the rimeining voist and unvoist konsonants. Bai Iear 15 or sou, it wud fainali bi posibl tu meik ius ov thi ridandant letez "c", "y" and "x" -- bai now jast a memori in the maindz ov ould doderez -- tu riplais "ch", "sh", and "th" rispektivli. Fainali, xen, aafte sam 20 iers ov orxogrefkl riform, wi wud hev a lojikl, kohirnt speling in ius xrewawt xe Ingliy-spiking werld.

He is completely correct - there's no need for letters if they sound like others. Bekause of this, I suggest that we should follow in his footsteps.

Re:Most interesting part...

[shutdown -p now]

Have a look at some of the existing Cyrillic alphabets (e.g. Russian is a rather basic one). You might be surprised even more.

Re:Most interesting part...

[Anonymous Coward]

So does this mean Mark Twain is alive and making hundreds of posts per day on Slashdot?

Re:Most interesting part...

[Anonymous Coward]

aafte sam 20 iers ov orxogrefkl riform, wi wud hev a lojikl, kohirnt speling in ius xrewawt xe Ingliy-spiking werld

For some reason, to me, this looks like dutch.
I guess they've come farther than the rest of us...

-Peder

Cryptography is not the important point

[VincenzoRomano]

The (poor) cryptography used by Bernardo Provenzano (more accurate infos in the Italian page) was meant to be used only by himself to avoid possible sneakes by his waiters. That was enough.
The important point is that he managed to stay at large, not as a fugitive, in the neighbourhood of Corleoni (Sicily, Italy) for almost 43 years without being noticed or identified and while still heading at full steam the Cosa Nostra!
So, as far as security and privacy is concerned, a good design can make poor technology rock!

Re:Cryptography is not the important point

[Anonymous Coward]

"I'm not a gay pansy like you are. I'm not attracted to men. I'm just horny," said the man nervously. "I probably made a mistake inviting you over."

He was a man in his early seventies, nice looking, a little over weight, most of his hair thinning and gray but with a nice face. He had invited me to his condo after we met in a park mensroom.

"You can tell me to leave any moment you want to and I will, " I smiled, "but give me a try for a few moments."

"I'm willing to do that much, " he grinned back at me, "but I get nervous real fast. What do we do now -, you want to see my cock."

"If you want, I'll just kneel here in front of you and, if you take out your cock I'll suck it until you cum in my mouth, if that's all you want. I'm a submissive guy so I'm here to please you," I kind of whispered. There are more interesting ways to do it thought."

"Now, just suck me off and go - uh, what interesting ways did you have in mind."

"Let me show you," I whispered, "just being with you makes me so hot, I'd love to undress you, starting with your shoes."

"My shoes? Well, what the hell, try it."

I got down on the floor next to his shoes and untied the right shoe, pulled it off, and then I removed his sock. I took his warm foot into my hand and massaged him gently, working my hands from his toes, across his arch and then his heel.

"It feels good," he breathed.

I took of his left shoes, his left sock and repeated the action and then I had a foot in each hand. I lowered my head to his feet and took his right foot toes into my mouth and ran my tongue between each of his toes and began to lick across his arch while massaging the top of his foot with one hand.

He was relaxing now, just as I wanted him to. I began licking the toes of his left foot massaging and licking and sucking his feet. When I am with a nervous man who has never been sucked by me before, I like to relax him and I know that tons of nerve endings are in his feet and that's where I start.

Sucking a man's feet does two things for our relationship: it relaxes him so he will be more responsive to me later when his cock is in my mouth; it shows him my view of our relationship - he is the dominant person and I am kneeling and crawling at his feet like his slave. His foot slave first and later, his cock slave. I love to be on the floor licking a man's feet, knowing that he thinks of me as some kind of submissive gay freak. I am so hot for him I simply can't help myself; I want to worship his entire male body.

I have been on the floor licking his feet for some time and now it is time to move on. "Let me take your shirt off," I whisper to him. My eyes are always lowered so he understands that even though now I have risen to my feet, I am still his servant. I unbutton him and remove his shirt.

"Lay back on the bed," I whisper to him," raise your arms - if it's alright with you, I'd like to lick your arm pits."

No words are necessary, his arms are raised and I lay beside him, my mouth open, my tongue out and I am gently licking his arms pit and he feels it and loves it. I love the taste of his male sweat, I can't get enough and yet I must keep moving and I lower my mouth from his right arm pit to his right nipple which I gently suck into my mouth while my tongue circles it finds it nerves and works it hard. Then my tongues dances across his chest to his other nipple and I repeat the sucking and licking process while my hand plays with his other nipple and arm pit.

Then I shift position to his other side to his other armpit and taste his male sweat another time. So good. I hope he is enjoying this because I love doing it and I want him to come back to me another time for more.

Finishes with his armpits, I lick across his chest and move down licking and massaging his stomach gently until my chin reaches his pants.

"May I pull your pants down, Sir"?

There is a grunt and I unbuckle his buckle while my mouth kisses his fly and I rub my face against his crotch

Re:Cryptography is not the important point

[VincenzoRomano]

That's a good cryptography example. Quite astonishing!

Wouldn't have helped in this case anyways...

[ArsenneLupin]

Indeed the "pizzini" (cryptograms) have not been intercepted while in transit, but found at his home after his arrest (... which police made using other sources, unrelated to the pizzini...).

Had he used a more secure algorithm, such as the one described, he would have needed to have kept the key (the appropriately shuffled deck of cards) somewhere, which police would just as easily have found at his home. Or we would have needed to remember the 108 bit number in his head, but somehow I doubt he would have gone through such length. He was a mafioso, not a memory genius.

Re:Wouldn't have helped in this case anyways...

[Dmala]

He didn't need cryptography, he needed a shredder. Once you've read the message and obtained the information, wouldn't it have made sense to destroy the evidence?

Re:Wouldn't have helped in this case anyways...

[TubeSteak]

I think an appropriately shuffled deck of cards would be somewhat innocuous.

If the police aren't looking for something like a deck-of-cards-as-key, then they won't find the key, all they'll find is a deck of cards.

I only say this because I recall reading an article some years back about drug dealers storing their business information on USB thumbdrives & wearing them as necklaces or on keychains. The police would arrest the dealer, but since the police didn't know what they had, the thumbdrive was treated as any other possesion & sealed up till the dealer was released.

You're still hiding your 'key', you're just hiding it in plain site & hoping no one sees it for what it is.

Re:Wouldn't have helped in this case anyways...

[SamSim]

This is what I've been saying for a very long time. The best code is the one that nobody realises is a code at all.

Re:Wouldn't have helped in this case anyways...

[caffeinemessiah]

not true --- security by obfuscation is not security at all. that's one of the founding principles of modern cryptography.

Re:Wouldn't have helped in this case anyways...

[Anonymous Coward]

That's because cryptography is not steganography.

Re:Wouldn't have helped in this case anyways...

[Shanep]

He didn't need cryptography, he needed a shredder. Once you've read the message and obtained the information, wouldn't it have made sense to destroy the evidence?

Yes. He would have been a lot better off if he employed a One Time Pad which was distributed to all his trusted allies. He would encode his message against a page of OTP and then burn the message and OTP. He should then send the ciphertext and the trusted person who receives it should decode it from his OTP, commit the message to his memory and then burn the ciphertext and the appropriate OTP page. Even if someone recorded the ciphertext in transit, it would be useless without the appropriate OTP. Assuming of course that the OTP's were not made in any deterministic manner.

Of course this puts all of the security into the security of the initial transporting of the OTP's and the storage of the OTP's at each site. Also, there is the problem that if you employ this type of communication between more that two points, you have to somehow get the used OTP pages at ALL locations destroyed or otherwise have seperate OTP's for each combination of possible communications between each point. With a mafia scenario though, with the boss being the hub, the "leaf nodes" need not be able to communicate with each other without going through the boss, since they could keep secrets from him or otherwise manage to accidentally cause a misinterpretation to occur. So really in that situation, I imagine the boss would need multiple seperate OTP's and single copies of each for each of his people he wishes to communicate with.

Re:Wouldn't have helped in this case anyways...

[Shanep]

not true --- security by obfuscation is not security at all. that's one of the founding principles of modern cryptography.

Please provide links or quotes and names of prominent authorities on cryptography please. I am very interested because encryption IS obfuscation.

Also realise that the data on those USB thumbdrives may have employed both encryption and steganography.

Yep.

[Anonymous Coward]

This is a good example of when you should outsource.

Not only that, some schlub in India would have gotten busted instead.

Re:Yep.

[qwijibo]

Outsourcing doesn't have to mean India. Just giving the task to someone who has the appropriate area of expertise.

I'm sure the mafia would want to outsource to a local security consultant. The client would want to be able to penalize a vendor not acting in their best interests. Someone half way around the world is inconvenient. A local expert is much easier to file a complaint against. I hear that the Mob Business Bureau has a complaint resolution process that involves an all expenses paid vacation to the coast. =)

Deja vu

[goodmanj]

"Organized crime?"
"Hah. Don't kid yourself. They're not very organized."

Re:Deja vu

[inKubus]

But the key meeting took place July 3rd, 1958, when the Air Force brought the space visitor to the White House for an interview with President Eisenhower. And Ike said, "hey look, give us your technology, we'll give you all the cow lips you want."

A hidden meaning ?

[Psycoach]

'will keep your kid sister out'

Is the use of the female gender supposed to show how easy it was ?

Solitaire

[Kadin2048]

Do you have any information on the break? I just did some searching and couldn't find anything about it. At the bottom of Bruce Schneier's page on Solitaire there is a link to an article Problems with Bruce Schneier's "Solitaire" by Paul Crowley, but it's dead. Is this what you're referring to?

(The article does exist in the Internet Archive at
http://web.archive.org/web/20050206214237/http://w ww.ciphergoth.org/crypto/solitaire/
It does describe what sound like they might be some problems with the randomness of the keystream, but it doesn't seem like a complete break. Sorry for pasting the address, but Slashdot doesn't seem to like IA links much.)

Anyway, I'd be curious in knowing what the problems with it are.

Re:Solitaire

[Unnngh!]

I'd be curious as well. The cipher was only meant for very short cryptic messages to begin with - just enough security to give a field agent a means of quick and dirty communication that could not be broken within a reasonable timeframe. The idea was to give someone without a computer strong encryption. With the 52-bit key of the deck of cards, this qualifies, unless there is a real break...

Re:Solitaire

[Ckwop]

I took a PDF print of the page. You can see it here

Simon.

Re:Solitaire

[volpe]

If only we could make stupidity more painful...

... I'd invest my life savings in Bayer, Tylenol, and Motrin.

Re:Solitaire

[Chris Burke]

I looked all this up after first reading the book, when the page was still live. From what I read, this observation simply means that Solitaire has undesireable properties and that therefore there may be an attack that is possible against it. There is no mention of any specific attack, which is what I would call "broken".

Re:Solitaire

[Anonymous Coward]

You're underestimating the strength of a deck as a key. A 52-bit key would be 52 ones or zeroes that is 2^52 posibilities... but with 52 decks, you get: 52! = 52*51*50*...*5*4*3*2*1 possibilities. This is way more than 2^52! I recall it being about 238-bit(!), but you can easiliy check this yourself with a calculator that can handle large enough numbers

False security

[moankey]

He is just like any other technical layman. He had a false sense of security by using some form of security.

I dont know how many managers, executives, or non IT type people I have talked to that think once the firewall is in place we never have to think about it again. Or now that we have an antivirus we can go and do whatever we want and not worry about downloads and such again.
Then they turn the deaf ear until... unfortunately for this guy its going to cost him more than just a few dollars and some downtime.

Re:False security

[Sigma 7]

He is just like any other technical layman. He had a false sense of security by using some form of security.

No, he just wanted it so that layman who steal the letters (e.g. couriers) won't be able to leak information based on quick glances of the letter. That, and the Caesar cipher is easy to encrypt and decode - and is not prone to errors that can occurr with more complex substitution/transposition ciphers.

The police already have a brute force decryption method that can break any encryption, regardless of key size or technical complexity. While rubber hose cryptanalysis doesn't work in constant time, it is still highly effective.

I dont know how many managers, executives, or non IT type people I have talked to that think once the firewall is in place we never have to think about it again. Or now that we have an antivirus we can go and do whatever we want and not worry about downloads and such again.

All a lower level tech has to do is mention about bit rot where random bits inside the computer gradually rot over time - thus requiring general maintainence and performance testing. In most cases, the problem is solved.

Kid-sister turned him in?

[rdmiller3]

Discovery's cryptography expert describes it as a code that 'will keep your kid sister out'.

So after 50 years, she finally cracked it and turned her brother in.

The Cesar Cypher was Created...

[saridder]

...back when literacy rates were very low. Suprised someone would try this today.

Crude, maybe, but dumb, no way

[FishandChips]

We cannot be sure that Provenzano's crude attempts at a code were intended to foil the police. Why should he care? By now, several hundred Mafia informers (the pentiti) have already told the police just about everything you could think of. Besides, pencil and paper have turned out to be quite a good system, probably yielding a fraction of the information that electronic eavesdropping would.

The coded notes are more likely have been intended to prevent his fellow mafiosi from getting too close and knowing too much. There was nothing dumb about this man's rule as a godfather. He evaded capture for forty years, rebuilt the organization after the disasters of the Riina years, retained power by remaining as invisible to his fellow mobsters as he was to the authorities, and simply survived into his 70s in a "profession" in which many are lucky to reach their thirties.

Yes, it's good news that another gruesome killer is behind bars. But the more worrying question is why the godfather found it unnecessary to take more stringent precautions, suggesting that clearing out the Mafia-infested lands of Western Sicily and the corruption-prone "public works" economy still has a very long way to go. It's going to take more than a few smart remarks about cryptography to do that.

Re:Crude, maybe, but dumb, no way

[sweborg]

> We cannot be sure that Provenzano's crude attempts at a code were intended to foil the police.

I think you are right. In most articles about the capture they mention that his communication with the outside world was through his encrypted letters. The letters were passed through several couriers (some say up to 10) before reaching their destination.

To me it is quite obvious that he was trying to hide the content of his letters from the couriers and not the police.

Re: interesting posit

[BitterAndDrunk]

I'm sure I'm not the first to notice that Berlusconi is an Italian name, too! All signs point to Yes, indeed!

OK, that was an awful joke since I did think your post was rather insightful.

yes it's one big conspiracy

[BitterAndDrunk]

To keep women down. It's certainly not a semi-cliched term suggesting ease of use from an editor/submitter who's not a writer nor known for originality or wit.
Nope, can't be that, it's probably people trying to keep the Womyn from realizing their true potential.

Nice alliteration in the headline...

[tengennewseditor]

But you could have taken it further - Corleone Capo Conveying Communication Cum "Crook Crypto Caesar Cypher" Captured

In ancient Rome...

[Paolone]

This sort of cipher was used by Caesar not because it was secure, but because most people couldn't read.

Actually in ancient Rome most people could read. Most Romans at least... :)

This is a clever guy.

[Anonymous Coward]

So he used was is essentially an elementary cipher found in children's puzzle books. Hell even my kid sister (in high school) can manage to do a word jumble that's been substituted and still get it. In high school we used a large pad of rotating dials that we switched based on the letter number and the previous letter... We weren't genius, our little cipher only had one let for the key, but we were proud of ourselves at the time. I'd beat that not only did he use a foolishly easy cipher, but he goons had to write the letters above the ciphered message to read it. They obviously aren't very smart.

When pig Latin is outlawed,

[Anonymous Coward]

Only-ay outlaws-ay ill-way ave-hay yptography-cray.

Wow...

[GooglePlexity]

He should have used a keytext

The truth is

[Anonymous Coward]

that Provenzano was not the boss of the bosses since ages. He probably agreed to be captured being old and ill. The italian mafia put its roots into the italian government more than 10 years ago.
Time will tell, but I'm pretty sure that no high profile politician will be hurt by Provenzano's "revelations": the real bosses now are elected politicians like Berlusconi and Dell'Utri, but there's no way to get rid of those criminals in charge: the fake opposition will do nothing.
As an italian I'd pay big bucks to see my country invaded by some really democratic country (there are plenty in northern Europe) and all the corrupt politicians being thrown in jail for life.

Hmmm....

[Dracolytch]

Looks like homeboy coulda taken a hint from my sig...

~D

In soviet

[Anonymous Coward]

aww Cmon!
In Soviet Russia The code breaks you.

Well, We use...

[Anonymous Coward]

I don't know about youse guyses, but our Mafia uses PGP.

Idn' 'at right, Big Tony?

IT Consultant

[Johnny Mnemonic]

Frankly, I'm surprised that someone who's responsible for moving around millions, or even perhaps billions, of dollars of ill-gotten gain won't spend $250K a year on a team of competent IT consultants. I wouldn't think it'd be too hard to find a bent IT guy to give advice on security, encryption, what can be recovered from a hard drive etc. Either they think they're too smart to be caught this way, or they think the cops are too dumb to break their encryption, or they just haven't modernized their business practices because they think the old ways still work.

Interestingly, by all accounts Al Queda is much more technically savvy.

Re:IT Consultant

[drinkypoo]

Al Queda doesn't even use encryption for a lot of their communications, and they use commercial-grade cellular phones to do much of their business. They speak in "code" that is pretty easily translated when you have some messages and some history to correlate.

Re:IT Consultant

[Anonymous Coward]

Okay, I'll trust a guy on the Internet named drinkypoo when it comes to explanations on how international terrorist organizations conduct their business.

Perhaps drinkypoo can also teach quantum physics at Cal Tech University this summer? Or how about a cure for cancer concocted by none other than drinkypoo? Maybe one day drinkypoo will become a world-renowned astronaut and establish his country on Mars, The United Martian Principalities of Drinkypoopistan, after flying there on his own homemade rocket from cutting-edge technology drinkypoo invented that he won't sell to NASA because the profound knowledge required to understand such technology will make NASA's best mathematicians and scientists go insane just trying to comprehend the multiplication equations in it.

Oh, drinkypoo, why can't the rest of Slashdot be as informed, educated, and intelligent as you?

Re:IT Consultant

[Motherfucking Shit]

I wouldn't think it'd be too hard to find a bent IT guy to give advice on security, encryption, what can be recovered from a hard drive etc.

Hmm.. you're right..

Hello, mafia! For $250K/year, I am an IT guy who can give advice on security, encryption, what can be recovered from a hard drive etc. In addition to IT, I enjoy pasta, Chianti, parmigiano, and pitted olives (preferably all in one night). Salary is negotiable if you can provide an "Italian woman," something I keep hearing about but, being a geek, haven't figured out the details of just yet.

References available upon request.

Re:IT Consultant

[drinkypoo]

Oh, drinkypoo, why can't the rest of Slashdot be as informed, educated, and intelligent as you?

Ah, but they can be! All they have to do besides be a natural-born genius and all-around pimp daddy mack is to read slashdot. That's where I got the heads-up on what's Inside Al-Qaeda's Hard Drive. Asshole.

Thought they always were spoke in vague terms

[sgant]

Always though the Mafia never really spoke about anything openly. It's always "We need to talk about that thing with our friend".

Now, if they had used this simple code and THEN just did the "The thing we talked about last night needs to be looked into". Or something like that.

Re:Thought they always were spoke in vague terms

[flyingsquid]

The Sicilian Mafia were pretty well protected even with lousy encryption. There's a culture that discourages anyone from talking about it, there's fear, and there's corruption in the Italian government.

If you're interested in this kind of thing- or just looking for a good read- try picking up Excellent Cadavers. It's the story of two Italian judges who finally tire of the fear, the silence, and the corruption, and take on the Mafia; the article makes reference to this guy being involved in the murders of two judges and I assume that's who they're referring to. It's one of the best nonfiction books I've ever read- it really gets into the characters but also gets into the social underpinnings and economics of the Mafia. It's a tragic book because the judges end up assassinated, but it's also really inspiring because they refuse to back down, they refuse to compromise, and at the price of their lives they dealt a crippling blow to the Sicilian Mafia.

Re:Thought they always were spoke in vague terms

[Anonymous Coward]

Always though the Mafia never really spoke about anything openly. It's always "We need to talk about that thing with our friend".

This also happens in business and even legal circles.

I have worked as a technical advisor to some big legal firms and I never get phone calls, emails or any communications in documented form when it comes to specifics. It is always a phone call asking me to speak with the team or a specific lawyer. Emails and other documented forms of communication are subject to legal discovery and those plus phone calls to illegal eavesdropping by the other side. Even notes hand written on paper are supposed to be retained. Of course they are easy to shred and deny the existence of.

No matter how strong your crypto is, if a court orders you to decrypt emails or documents, you have to do it. Especially if you are a lawyer, you'll comply with the court if you know what is good for you. I doubt any top lawyer wants to lose his ability to be a lawyer, over one case. Better not to have anything to encrypt in the first place.

Re:Thought they always were spoke in vague terms

[espo812]

It's a tragic book because the judges end up assassinated

Thanks for the spoiler warning.

Yeah, we know to use something stronger than ROT13

[Skapare]

That's why we've advanced to using triple-ROT13.

Alliteration makes the title more fun

[johnbr]

Catalina Con Caesar Cipher Cracked by Cunning Cryptologist's Kid Sister

Had to be said...

[Aqua_boy17]

Maybe someone made him a cipher he couldn't refuse?

*ducks*

MS used this kind of cipher in the 80's

[slagell]

I believe it was the dos shell program that could be used to make a text based menu to run DOS programs (v4.0 maybe). Anyway, when I was a kid I cracked how they stored the passwords that could protect menu items (like if you didn't want your kids running Lotus123 or something). The shifted all the ascii characters by 13 if memory serves me right.

It isn't like it mattered a lot since there where so many ways to prevent this menu system from coming up on boot and thus getting to a eal DOS prompt anyway, but it was enough to stop your parents. :-)

Bald Messenger

[Asklepius M.D.]

Really now - if he insisted on using such an antiquated cipher, he should have replicated other historic details like writing on the messenger's head and waiting for the hair to grow back for concealment - primitive steganography!

Slightly less trivial

[wytcld]

Is anyone appreciating that this isn't a simple substitution cypher? Let's say you get the string:

"211720125" - just checking it for substitution doesn't tell you where to break the numbers. Is it the "2" on the front end that matches a letter? Or the "21"? Or even the "211"? Then what does the next number consist of? 1? 11? 17? 170? 720? Only if you surmise that any 1 or 2 includes the next digit, and only that next digit, does it become a simple substitution.

Get the cadance right...

[Anonymous Coward]

Corleone Crook Captured; Used Ceasar Cipher Crypto-crap.

And what offer was that?

[mr_3ntropy]

8 jqe3 y8j qh 9rr34 y3 d97oeh[5 43r7w3.
I made him an offer he couldnot refuse.

wow.That missing space almost threw me off.
Hey this ain't no ROT, you cheat.

Helful links:

http://www.infoplease.com/applets/xwordsearch.php
http://www.fizzl.net/projects/crypto/
http://www.mcld.co.uk/decipher/

Re:And what offer was that?

[lgw]

8 jqe3 y8j qh 9rr34 y3 d97oeh[5 43r7w3.
I made him an offer he couldnot refuse.

That's couldn't refuse, silly. It was a keyboard-shift cypher, not an alphabet-shift cypher.

True story...

[cachimaster]

I work in a group writting CAD systems in Argentina. One of my coworkers, is Mr. Provenzano's nephew, but he didn't know anything about his uncle "activities" on the past, until that day. He was reading a online newspaper and suddenly started yelling "My uncle! damn is my uncle Bernardo, my mother's brother! A mafia boss! I can't believe it!! etc. (in spanish, of course)" He took it with humor anyway. (Now we RESPECT him a little more hehe)

And to stay on topic,

[cachimaster]

I remember now, one time a few months ago we were running a security audit on our software, and I was able to crack the security system implemented by this guy, his nephew. Of course, was not that simple, in fact it was pretty advanced, but he stored the password as a combination of random characters, and I spotted it in the debugger easily.
weird...

Variation

[iamlucky13]

A variation I heard that would be much tougher (I think, anyways), is to wrap a string around a stick and write on it. No section of the string would contain a complete letter, making it extremely difficult to find the wrapping interval. The stick is essentially a random unique key and the more unique the shape of the stick the better. Since sticks usually change profile along their length, it's very tough to "guess" the key.

The string and the stick could be delivered seperately. If either messenger were intercepted, one would have a length of dirty string, the other would have a walking stick. The recipient might have trouble wrapping the string around the stick in exactly the same manner, though.

I think a more modern variation would be possible using a bitmap. The original message, perhaps a secret document or maybe a map saved as a bitmap of any legible size. The image is sliced into sections of string with a small diameter, like maybe one pixel, and a certain amount of the margin is removed from each section before they are all spliced together to form a really long skinny bitmap (or rewrapped into a more normal looking ratio for transmission). The amount of margin removed from each piece of the string is analogous to the varying profile of the stick. One communication would carry the bitmap (or the string). The other would carry the original dimensions and the profile of the margin removal, either as a sequence of random pixel counts trimmed off each string section or an equation defining the trimmed amount along the width of the bitmap.

I don't doubt this can be cracked, especially with the help of character recognition, but I think it would require a fair amount of computing and somebody recognizing that it was more than just a dirty length of string and a walking stick.

Re:Variation

[ultranova]

A variation I heard that would be much tougher (I think, anyways), is to wrap a string around a stick and write on it. No section of the string would contain a complete letter, making it extremely difficult to find the wrapping interval. The stick is essentially a random unique key and the more unique the shape of the stick the better. Since sticks usually change profile along their length, it's very tough to "guess" the key.

Are you kidding ? You can crack that simply by lining up the marks on the string. You don't even need to be literate to crack it; it's just a jigsag with an abstract line-pattern then.

I guess there's a reason why it takes experts to design good ciphers...

Re:Variation

[iamlucky13]

That assumes that not only the person intercepting it realizes the string is a message in the first place, but also that there is only one possible combination in which all the dots line up. Plus, the finer the string, the more difficult it is to keep all your wraps together while you try to make out letters. I know it's not impossible, but I don't think it's trivial.

You're right about needing experts to design good ciphers though. I can't even claim to have thought that one up myself. I just found it a fascinating approach to cryptography predating computers or cipher machines.

should've used freenet

[heliosphan6666]

where you can name yourself adolf hitler and list child pron

One Time Pad

[acro55]

He should have read Cryptonomicon and used a one time pad http://en.wikipedia.org/wiki/One_time_pad If he has the time to tell his folks what the substitution cipher is, he can give them pads. Though getting random data from Hotbits http://www.fourmilab.ch/hotbits/ may be a pain in the bits.

The -logy vs. -graphy thing.

[Anonymous Coward]

Cryptographers make ciphers, cryptologists break them.

HTH.

Re:Has anyone...

[splatter]

You are correct about that, which is partly why it was used by Ceaser, also keeped the message handlers who may be able to read from leaking information.

But here is what I pose to you. Most organized crime members don't have a high level of education. They can read sure but can you really see Tony Soprano or Sil sitting down and figuring this out?

still was hiding for more than 40 years...

[kipple]

....so yes, a good crypto system will help, but nothing like having your "friends" in the (local) government, in the police, and at a much higher level...

OT Your sig, comment 15000000

[AnotherFreakboy]

Comment 15000000 is over here.

Re:OT Your sig, comment 15000000

[SamSim]

Thanks!

exactly

[geekoid]

If people couldn't read Why would you need ANY crypto?

OTOH, soem peope think the populace have been reading for only 100 years, and befor then everyone lived in mud huts and said:
"What do you want to eat?"
"I don't know, what do you want to eat?" ..some things never change.

The best crypto...

[MickLinux]

My brother developed a 2-document crypto version: you use one document to encode or decode the other. That is relatively easy to encode, and is probably more immune to frequency analysis (though I'm sure it isn't completely immune to it.) However, its other characteristic was that you could write a normal looking letter, and yet have a hidden message inside it. Even that would be better than a simple substitution. However, he says that in terms of increasing effectiveness, crypto should: (1) Make it difficult to read (writing in mirror images). (2) Make it difficult to break (cryptoquotes on up to PGP) (3) Make it difficult to detect that communication is even going on (watermarking a photo with encrypted text, or photocopiers printing copy information in very light yellow ink) (4) Convert the decryption agents to your own side. His double-text document has the capability of doing #3 and #4, provided that your source document *is* your manifesto.

Re:The best crypto...

[nachoboy]

My brother developed a 2-document crypto version: you use one document to encode or decode the other.

Sounds suspicously like a one-time pad, which was developed long before your brother came up with it. It's also horribly insecure (your brother's implementation, that is). Read any basic cryptography text to understand why. Real one-time pads are 100% secure if implemented properly, with the caveat that the key has to be at least as large as the message. Poorly-implemented one-time pads can actually be worse than no cryptography at all, because they present the illusion of security that's not really there. In reality they're not so very different than the simple substitution described in the article - they're targeted at keeping your kid sister out, not a dedicated professional.

he says that in terms of increasing effectiveness, crypto should:

Rather than relying on someone related to you who clearly doesn't have a grasp of simple cryptographic theory, why don't you read a little from a recognized expert?

(1) Make it difficult to read (writing in mirror images).

If my little brother can decipher your message by holding it up to a mirror, that's not cryptography, that's a cereal-box game.

(2) Make it difficult to break (cryptoquotes on up to PGP)

Ahh, the single relevant point of the bunch. This is the SOLE point of cryptographic techniques - to encipher a message such that only the intended recipient can recover said message. Well, one out of four's not bad.

(3) Make it difficult to detect that communication is even going on (watermarking a photo with encrypted text, or photocopiers printing copy information in very light yellow ink)

Well, see, now we've stepped out of the realm of cryptography and into another discipline: steganography. This is the art of hiding the very existence of a message - not a method of securing that message from other potentially interested parties. Though the two are related (and, clearly, easily confused), they serve different purposes. Repeat after me: Security through obscurity is no security at all.

(4) Convert the decryption agents to your own side.

Wow, that one really came out of left field. Not sure I've ever heard that one described as a design point of cryptography, much less the most effective one. If you want people to read your manifesto, surely publishing it outright would be more effective than obscuring it and hoping the enemy has smart cryptographers. (Unless, I suppose, your alternate universe values cryptographer's souls some order of magnitude more than regular folk, but in that case I'm willing to bet that there are still several more effective techniques one would employ first.)

Cryptography is one of those areas where (unlike, say, brain surgery) it's quite easy to convince yourself you have developed some new expert technique. Even the crypto experts are cautious about making such statements - flaws are found in our very best efforts sometimes decades later. If you're interested in it at all, may I recommend any of Bruce Schneier's writings. His book Applied Cryptography is the gold standard in the field, and he maintains a fascinating blog at www.schneier.com.

Re:The best crypto...

[Shanep]

Security through obscurity is no security at all.

Hmm. This gets thrown about a lot, especially here and I think it is starting to lose its meaning. Obscurity can provide some security. The security gained can vary with the strength of the obscurity. The various meanings of obscurity include, "keep from being seen; conceal" and "make unclear and difficult to understand". In fact encryption obscures a message and steganography obscures the existence of a message (especially effective if they are combined where the message is in ciphertext form and hidden with stego amongst noise). "Security through obscurity" does not always have to mean "security through poorly obscured design".

Cryptography is one of those areas where (unlike, say, brain surgery) it's quite easy to convince yourself you have developed some new expert technique. Even the crypto experts are cautious about making such statements - flaws are found in our very best efforts sometimes decades later.

Yes, I agree. Usually, if a person thinks they know cryptography, they don't. So many times I've seen someone come up with something they think is brilliant, only to have someone answer them with something like, "oh that is a blah cipher, invented in 18xx and cracked in 19xx. A P4 3GHz can crack that at about 400Mb/s". ; )

If you're interested in it at all, may I recommend any of Bruce Schneier's writings. His book Applied Cryptography is the gold standard in the field, and he maintains a fascinating blog at www.schneier.com.

Applied Cryptography is not in my bookshelf. Reason being that it is out right now and is almost always out somewhere in the house, because it's the number one book which has me coming back and re-reading bits because it's such a great book. In my copy pages have started to come out and the book is now filthy looking. I hope he gives it a good update one day (I've got the 2nd ed). I was really excited to discover in that book that Linear Feedback Shift Registers were in there. Because years before, playing around with flip-flop shift registers made from JK's (from memory), I'd discovered that I could generate psuedo random numbers which would eventually repeat (oddly enough:). I had independently discovered LFSR's for use as PRNG's and then years later discovered with this book that I was actually onto something. That was super cool. I still have the breadboard with the IC's laid out with connecting wires.

I've been wanting to simulate in software various LFSR designs to plot their output to strange attractor images, just for the heck of it. One day I might get around to that. Pitty LFSR's are not very efficient in software.

Re:The best crypto...

[MickLinux]

Ummm, my point was not that he had developed anything stunning and new. Rather, he had developed a way of using a One Time Pad (and there are many large one time pads -- go to your local library: every book there can be an OTP.)

As an OTP, a book is not quite random, nor is it secure -- but your automobile probably isn't secure either.

But his OTP also allowed him to obscure the encrypted text. As such, it becomes more secure: secure, in specific from most people randomly stumbling upon the encrypted message and then devoting time to its solution.

His point was to look at the overall engineering problem -- why do you want to encrypt? If your purpose is to conduct financial transactions, then RSA128 is probably just fine for you. On the other hand, you aren't going to encode RSA with a pencil and paper.

But if your purpose is to have hidden wartime field communications, then the encryption + obscurity + use of an OTP that *might* just put the enemy decryption agents on your side ... then his method is perhaps a little better.

mafioso cryptology

[Anonymous Coward]

"catch da fish when its commin home from woik"

Doesn't seem too hard to crack, does it?

Sorry Sis...

[boggis]

625512 6226 1587 1228 14518 35187712 178015

I see stupid people. They're everywhere.

[Shanep]

They don't even know they're stupid.

I know why this guy managed to evade the law for more than 40 years. He was living in the dark ages.

Pretty arrogant.

Not a fantastic job

[xenocide2]

I think the last job title I want is "Mafioso Cryptologist;" once you've got them set up, the only thing left for them to do is solve the fact that you know about it.

Man evades police for 45 years using ROT13

[Anonymous Coward]

Man evades police for 45 years using ROT13, police declared dumb and are all fired. IQ tests now required for all police departments.

Film at 11.

Speak for your kid sister ...

[RockDoctor]

Discovery's cryptography expert describes it as a code that 'will keep your kid sister out'
A Caeser cypher wouldn't keep my kid sister out. My older sister, maybe, but not my kid sister.