A 1941 Paper-and-Pencil Cipher

Schneier's blog links to a photo of a 68-year-old code being employed in wartime, with a plausible explanation of what is going on in it. (The photo is from the Life Magazine archive we discussed when it went live.) "What you see here is a photo that never should have been allowed to be taken, and one which provides an amazing, one-of-a-kind glimpse into the world of WWII espionage and counter-espionage. As far as I can tell, what is shown in this picture is an FBI agent in New York encrypting a message, passed from 'DUNN'... through Sebold, prior to transmitting that message to Germany via shortwave radio. ... [T]his appears to be real cryptology at work."

Comments

Duh?

[east coast]

Why didn't he just use a computer for this? I swear, those people were so dense.

Re:Duh?

[bobdotorg]

Why didn't he just use a computer for this? I swear, those people were so dense.

They weren't dense, Windows DE (Depression Edition) kept crashing that day with repeated PCODs (Punch Cards of Death).

Though now that I think about it, I've come to the realization that every version of Windows is Windows DE.

Re:Duh?

[Anonymous Coward]

They weren't dense, Windows DE (Depression Edition) kept crashing that day with repeated PCODs (Punch Cards of Death).

And 60 years later, we realize that even in the future nothing works.

Re:Duh?

[Anonymous Coward]

Actually, back then he probably was the "computer."

It had a definition before we invented the machines.

Re:Duh?

[corsec67]

Punch Cards of Death

Would that be a IBM Doily?

Re:Duh?

[VagaStorm]

Oh, indeed, http://en.wikipedia.org/wiki/Human_computer, they even did parallel computing :)

Re:Duh?

[timeOday]

Why didn't he just use a computer for this?

Actually he was a computer - that's what they called people who did mundane computations before machines took over their job.

Re:Duh?

[Sanat]

Back in the day of card punches in order to certify that a card punch was working properly a whole box (qty 2000) cards were fed, punched and read with only one error permitted. This was CDC equipment on the CDC 3100 and 3200 models.

If something was not quite adjusted properly usually a failure would occur much earlier in the cycle.

Sending out a new operating system was done with punch cards. A simple bootstrap program was keyed into the core and executed which would input from the card reader and a whole box of cards needed to be read without error.

The CDC card punch (can not remember the model number ... maybe 3114) also had a read station in it so that a read after write cycle could be employed. The error exit could be used to offset the card in the output deck about 1/4 of an inch so that the individual card could be easily located and re-punched.

Reading a lace card was a real dicey test. Usually we alternated rows and columns.

PCOD sounds about right.

Re:Duh?

[dpilot]

> Reading a lace card was a real dicey test.

I thought lace cards were what you stuck in the decks of other people in the computer lab, not your own. Kind of like "How many med students does it take to screw in a light bulb?"

Caveat: I have done real work with punch cards, I even made a lace card for the fun of it, and to see how fragile it was. But I have never stuck such a card anywhere where it could be fed into a reader.

Re:Duh?

[z-j-y]

Actually he was a computer - that's what they called people who did mundane computations before machines took over their job.

I doubt that his job was mundane or his title was "computer". Cryptanalysis is more than just some algorithms, you cannot crack the codes by using computers (meat or electronic) alone without human insight and intelligence(which we don't know how to program yet)

Re:Duh?

[troll8901]

Just read this TFWA. Score one for women!

Have I mentioned I worship smart, intelligent women?

Re:Duh?

[Anonymous Coward]

Oh, indeed, http://en.wikipedia.org/wiki/Human_computer, they even did parallel computing :)

a la mechanical turk?

Re:Duh?

[elgatozorbas]

Imagine a Beowul cluter of these...

Oh wait. It's called college.

Re:Duh?

[laddiebuck]

I never knew that "dual-core computer" was a sexual fantasy before it was a geek term...

(Well, I did know, but that'd spoil the joke... All right, here's another one: why the teacher fantasists? Well, half secretary, half nurse...)

Re:Duh?

[Hurricane78]

Eww... your sexual fantasies about two-headed humans are disgusting... :P

Re:Duh?

[CrossChris]

He didn't use a computer because the Americans were too thick to develop one. We had them in the UK more than a year before that photograph was taken!

Re:Duh?

[Reziac]

I still have a couple of lace cards Here Somewhere, from high school... dunno who made them, but they floated around our computer programming class.

I remember when we got a paper tape reader... it was a big upgrade over loading our IBM1620's OS from punch cards!

Re:Duh?

[srmalloy]

I thought lace cards were what you stuck in the decks of other people in the computer lab, not your own. Kind of like "How many med students does it take to screw in a light bulb?"

As I recall, the most entertainment with punchcards wasn't slipping lace cards into someone else's deck, but in taking blank cards, punching them as an 80-column 'DUP' field, and sticking them onto the program drums of the IBM 029 keypunch machines, then flipping the program mode switch to 'ON'. An unsuspecting user sitting down to punch out some cards for their FORTRAN program without noticing either the program card or the switch position would punch their first card normally, then as soon as it registered the card under the read station it would start duplicating the first card as fast as the punch would run -- and then feed the duplicate to the read station and repeat the process until the user either flipped off the program switch or pulled the blank cards out of the hopper.

Human computers

[El Lobo]

More than 13 000 special trained persons worked with encryption/decryption related tasks in WWII (and that's allies only). Yes, there were no computers then the way we know them now, but 13 000 people working shifts day and night was a significant force as well.

Re:Human computers

[Linker3000]

Wow - imagine if those people clustered around someone reading Beowulf!

Re:Human computers

[Anonymous Coward]

Even better -- can you imagine if this piece of paper could run Ubuntu Linux?!

Re:Human computers

[memristance]

Of course, some methods were better than others...

Re:Human computers

[estarriol]

Funniest Slashdot comment I've ever seen, thanks!

Re:Human computers

[lysergic.acid]

speaking of which, here's a screen shot of an early pre alpha build of the Folding@Home client.

Re:Human computers

[aliquis]

Ah, I see their problem, they all seem to use the same algorithm but it always generates the same result. Personally I go with a more randomized approach.

Re:Human computers

[Anonymous Coward]

Wow - imagine if those people clustered around someone reading Beowulf!

Made me blow soda out my nose. Worth it, though.

Re:Human computers

[Anonymous Coward]

I think you Sir just won Slashdot

Re:Human computers

[trevdak]

I'd like to see them run linux.

Re:Human computers

[BlueStrat]

Wow - imagine if those people clustered around someone reading Beowulf!

Yes, but did they use Linus' great-great grandfather to organize the operation?

Re:Human computers

[Anonymous Coward]

You are a fucking idiot! And the sad thing is, you will just dismiss this comment out of hand, because of stupid human ego. Look in the mirror. Think about what you wrote. Think about your LIFE, for fuck's sake. Doesn't ANYONE engage in introspection anymore?

And before you say it, yes, I have done the same thing. My comment here is dickheaded, just like me. But I REALIZE it.

Re:Human computers

[3waygeek]

Not counting this guy.

Very cool!

[vvaduva]

Very cool; this is handy for beginning students and those keeping a history of cryptography, which boomed starting with WWII.

Double bluff

[adamwright]

We may consider, however, that the people allowing the photograph to be taken may not have been *entirely* honest when setting up the contents and cryptographic "method" being demonstrated.

Re:Double bluff

[Anonymous Coward]

If you RTFA, that's very unlikely. The photo the blogger says "never should have been allowed to be taken" shows a message using real codewords of an actual (flipped German) spy ring. So if the Germans got their hands on this photo and compared it to the messages they received, they would have realized it was a double cross. And the historical record bears out that this was a successful double cross that we would not have wanted to reveal.

Re:Double bluff

[devnullkac]

There is another picture with the same message apparently being approved by Hoover. It also shows most of the text so carefully covered up in the photo in TFA. Part of it is in shadow and perhaps someone more skilled than I with GIMP can tease it out (frankly, I think you'll need access to the photographic negative), but "... the following message to:" is what's visible. This lends credence to the "setup" theory, since that's hardly worth covering up for a photo op and even if it were, why be so careless as to reveal it in another photo (on J. Edgar Hoover's desk, no less).

Re:Double bluff

[mlwmohawk]

You are working on the assumption that what you see is an authentic photo of someone actually working.

If you have any professional experience at all, you'd know that pictures are NEVER taken of actual work. The photos are always staged to look good.

Be it a technician posing in front of the product with tools, an engineer posing in front of an oscilloscope with an interesting wave form displayed, another engineer in front of a very neat and orderly (but complex looking) white-board, and so on. Every company in which I've worked, the arrival of a photographer is carefully orchestrated.

All pictures have a perspective and something that the photographer's employer wishes to convey. It is very likely that the picture is a standard professional photo that shows "what it looks like" without showing actual work. The words chosen carefully to spark interest in the subject by those who view it. Like now.

Re:Double bluff

[argent]

You are working on the assumption that what you see is an authentic photo of someone actually working.

It doesn't matter whether it was staged or not, it only matters that it contained code words relevant to what we now know was an active intelligence operation at that time it was taken.

Re:Double bluff

[mlwmohawk]

It doesn't matter whether it was staged or not, it only matters that it contained code words relevant to what we now know was an active intelligence operation at that time it was taken.

Of course the words are relevant to what we know, we know the information we are allowed to know. This picture is no different.

Re:Double bluff

[Anonymous Coward]

Of course the words are relevant to what we know, we know the information we are allowed to know.

You're just being a jackass. His point is that if the information was such that the Germans could have deduced that they were being double-crossed then it makes no difference in the world if it were staged or not. It's still a blunder.

Re:Double bluff

[westlake]

If you have any professional experience at all, you'd know that pictures are NEVER taken of actual work. The photos are always staged to look good.

LIFE's photo essays were always scripted before production.

The editors knew the story they wanted to tell and the photographer would be sent out to capture it on film.

He might resent the constraints.

But his logistical and technical problems are mostly solved. People know he is coming, all his ducks are in a row.

He should have no problems making his deadline and if the schedule isn't realistic or he hasn't received the proper clearances, he has the editors to blame.

Consider the lighting and composition in these photographs.

These are not candid shots.

The photograph in the archives is not, of course, the photograph in print. There would have been a dramatic loss of detail.

Re:Double bluff

[Z00L00K]

It is possible that this was a partial setup, but in this case it was the question of a deception message that was about to be sent using encryption that was probably already blown at the time.

And mind that the encryption wasn't US encryption, but German encryption so if the encryption was blown and the agent was already cold then it may have been a semi-arranged situation where it was real life data that already had cooled that was used.

And the whole setup could have been intentional from the intelligence point of view because in some cases you may want to double-deceive the counterpart. This means that the counterpart may have to think that they got false data, but the data was actually real, and then it was necessary to seed confusion. Be aware that this message may not be the message intended to be the one they wanted to obscure but another much more sensitive. Because if you reveal that you know of something then a lot of the earlier messages also will be cast in doubt.

So the question why this photo was taken may be revealed in another message, but we may never see an answer to that.

Espionage and counter-intelligence is never straight, it's full of deception and double-deception.

This actually leads to a story (I can't confirm it, but someone else may) that an intelligence officer with knowledge about the D-day landing sites was captured in France and when the Germans questioned him he did give them the correct info straight on, but they didn't trust that so after some torture he instead claimed that the beaches around Calais was the landing site.

Re:Double bluff

[jdege]

It is possible that this was a partial setup, but in this case it was the question of a deception message that was about to be sent using encryption that was probably already blown at the time.

Yep.

The worksheet shows the cryptanalysis of a simple transposition cipher using a technique that was included in Helen Gaines' "Elementary Cryptanalysis", published in 1939.

Whether it was ever a secure cipher I can't say. But by the late 30's, it was appearing in the advanced puzzle magazines.

Re:Double bluff

[Anonymous Coward]

Consider also that the subject holds his pen in his right hand, just above the typewritten sheet, while the handwritten sheet is on the left. He'd more logically reverse the two sheets of paper for actual work, as he could then write with his right hand while not obstructing the typewritten sheet, which would be on the left.

Re:Double bluff

[Anonymous Coward]

I could see this method working back when brute force methods of breaking codes weren't exactly readily available.

I played with something similar to this at one time. The basic idea is that it's just a grid of letters A-Z going across, and then cycling through the alphabet starting with the following letter in the column going down. Basically it's a kind of lookup table.

First you have your message, and then below it your key. Then what you do to make it encoded is lookup the letter for the message going across and the letter for the key going down and then where the row and column meet up, that's where you find the coded letter. The reverse is to look up the letter of the key first, then go down to the letter on the recieved encrypted message. Then on the first column in the corresponding row is the decoded letter.

In this case the grid is also cut apart so you could use various methods of shifting parts up or down. So you could add or subtract a value for each starting letter to mix things up even more. You could probably use various math equations and then go to the nearest integer as you feed in numbers going from 1(A) to 26(Z)...

I suppose nowadays you could use javascript to make a code like that work. And instead of A-Z, you could use the unicode character set. And if you wanted to get fancy with the key, you could use an entire webpage of text as the key. Thus you could agree ahead of time to use various websites at various days to encrypt/decode a message with a key that's as long as the entire page's content. Not sure how secure it would be though. Seems like it would actually work fairly well though for as simple as the idea might be.

Here's one that works with a simple alpha grid and no shifting:
this is a sample key
hcid ba n wsgrvw nvg grrg ul l hl

what's the big deal?

[gEvil (beta)]

I don't see what the big deal is. You guys have never seen someone doing a word search puzzle before?

Re:what's the big deal?

[Tumbleweed]

I don't see what the big deal is. You guys have never seen someone doing a word search puzzle before?

And the answer to today's word jumble is: "NORMANDY"

Re:what's the big deal?

[Alpha Whisky]

Like this? http://www.historic-uk.com/HistoryUK/England-History/Crossword.htm

Cryptography vs Cryptology

[Doc Ruby]

What is at work there is cryptography , not just "cryptology. It's actually the generation of encoded symbols, not just any practice connected to the study of hiding information.

Re:Cryptography vs Cryptology

[ResidntGeek]

Maybe the blogger was using "this" to mean his own post. He was using cryptology to figure out what was going on in the picture.

Re:Cryptography vs Cryptology

[Anonymous Coward]

Awww, pedants are so cute! Go fuck yourself.

July 1940 != prewar

[Anonymous Coward]

Just because America was neutral doesn't mean the war hadn't started.

Re:July 1940 != prewar

[IvyKing]

Since the US did not declare war on Japan until December 8, 1941 (and Germany on December 11, 1941) July 1940 is legitimately pre-war as far as the US is concerned. BTW, the first US casualties from WW2 took place in China in 1937.

Re:July 1940 != prewar

[lysergic.acid]

according to the comments FTA, the phrase "pre-war German espionage code" is referring to the age of the encryption algorithm being used, not when it was used in the photo:

Thiago: It's not meant to be Americentric: Duquesne entered German service in February 1939, and I'm willing to bet that the cipher in question dates back earlier than that, based on what I know of wartime crypto history. As I recall, at the time (1939-1941) the high-level military and diplomatic traffic was encrypted with Enigma machines, and everything else used codes that dated back to the early 1930s, or before (and were fairly easily broken by, e.g., Bletchley Park.)

Hence, "pre-war", as opposed to a later, military, war-time code.

Re:July 1940 != prewar

[vux984]

Since the US did not declare war on Japan until December 8, 1941 (and Germany on December 11, 1941) July 1940 is legitimately pre-war as far as the US is concerned.

er... By that logic since Switzerland did not declare war at all, July 1940 is legitimately 'prewar' for them too? Of course, so is November 2008... in fact as far was the Swiss are concerned there was no war?

Are we still 'legitimately pre-World War II as far as the Swiss are concerned'?

Any Swiss care to weigh in on this absurdity? ;)

Re:July 1940 != prewar

[z-j-y]

To be fair, it's pretty hard to count all the wars in Europe.

Re:July 1940 != prewar

[IvyKing]

er... By that logic since Switzerland did not declare war at all, July 1940 is legitimately 'prewar' for them too?

Since Switzerland didn't declare war, "pre-war" is a non-sequitor for them. The US was still pretty much on a peace-time economy in 1940 and full war time conditions didn't start until December 1941.

I agree with the Chinese viewpoint that WW2 started in 1931 as there was pretty much continuous fighting taking place there until 1945 - the US had sent the "Flying Tigers" to help out the Chinese prior to the Pearl Harbor attack and a US gunboat was sunk by the Japanese in 1937. The Eurocentric view is that the war started with the invasion of Poland by Germany and the Soviet Union.

On the gripping hand, there's always Pournelle's view of 20th century Europe and the 70 year war that started in 1914 and ended when Yeltsin took over the Soviet Union.

Re:July 1940 != prewar

[vux984]

Since Switzerland didn't declare war, "pre-war" is a non-sequitor for them.

Not at all. Just because a country wasn't in the war, that doesn't mean they don't acknowledge that it existed, that it started or that it ended. Switzerland can talk about what it was doing pre-WW2, post-WW2, and during WW2 without it being a non-sequitor.

I agree with the Chinese viewpoint that WW2 started in 1931...

The date the world has agreed a war started is pretty arbitrary in almost ANY war, but it serves as useful frame of reference, and its not generally useful not use the 'agreed date'.

Schneier's post

[bobbozzo]

Since tfa didn't link to Schneier's blog, here it is:
http://www.schneier.com/blog/archives/2008/11/1941_pencil-and.html

Re:Schneier's post

[elgatozorbas]

Imagine a Beowulf cluster of these...

Oh wait, it's called college.

Re:Schneier's post

[Anonymous Coward]

(oblig)

In Soviet Russia the Beowulf cluster of these was called academia, you insensitive clod

The cipher

[Anonymous Coward]

from comments under the article (for those who don't read comments except on slashdot):
It looks to be just a transposition cypher. The "key" is the arrangement of columns from 1-18. You write the message down with 18 columns across, then read down each column in the order given by the key, grouping in 5s. I suspect the caption is actually correct ... you wouldn't need such a complicated worksheet and all those typed strips for encryption, but they would make it easier to get the columns lined up when decrypting, so I imagine the cryptographer is decrypting the message to make sure it was encrypted correctly before sending it.

Re:The cipher

[jdege]

I've posted it over there, I'll post it here.

Read section 12-3 of FM 34-40-2:

http://www.umich.edu/~umich/fm-34-40-2/ch12.pdf

This technique of solving incomplete columnar transposition ciphers had been described in the open literature prior to 1941.

It was described in Helen Gaines' "Elementary Cryptanalysis", published in 1939. Many of the techniques in Gaines' book originated in M.E. Ohaver's column "Solving Cipher Secrets", in "Flynn's Weekly Detective Fiction" magazine, which ran from 1924 to 1928. I'd not be at all surprised to find that this technique was described there.

It's beyond the realm of possibility that any German intelligence agency would have been using single transposition in 1941. It's not at all impossible to believe that someone at the FBI, asked to create a worksheet for a Life photo-op that didn't reveal anything of substance, would choose to demonstrate the cryptanalysis of a cipher that was already widely-known among the well-informed amateurs. and hence wouldn't compromise any of the systems the Germans were actually using, or how effective they were at breaking them.

Re:The cipher

[jdege]

It's beyond the realm of possibility that any German intelligence agency would have been using single transposition in 1941.

Or not!

I was reading David Kahn's "The Reader of Gentlemen's Mail" - his biography of Herbert Yardley. In 1941, Yardley was working with the Canadian government, helping them set up a crypto bureau. Most of what they were cracking were messages to German spies working in South America - and yes, they really were using a simple transposition cipher, just like had been appearing in puzzle books for decades.

Wait, I thought...

[WED Fan]

Actually he was a computer - that's what they called people...

I'm confused, I thought...

Soylent Green == People

Computers == People

Soylent Green is edible.

People are edible.

Question: Will be Dell laptop work with a South Beach diet?

Ic eom Beowulf!

[spaceyhackerlady]

Hwaet! We Gardena in geardagum,
theodcyninga, thrym gefrunon,
hu tha aethelingas ellen fremedon.
Oft Scyld Scefing sceathena threatum...

I think it loses something in the translation. And not just because Slashdot botches the eths and the thorns.

...laura

Re:Ic eom Beowulf!

[jdege]

Monster Grendel's tastes were plainish
      Breakfast just a couple Danish...

(Maurice Sagoff)

Re:Ic eom Beowulf!

[Reziac]

Wow, now THAT's what I call encryption! ;)

More Cryptology Secrets or More Data Storage?

[Anonymous Coward]

Well, here's the tradeoff... we can keep a secret for only 30 years in Cryptology, meaning this code was probably used in 1911 and known to everyone at the time. Or, we can keep something a secret that everyone already knows, and have less data storage in our new computers. This was all I got to know about cryptology in the 80's, and when the freedom of information act was born and also the first personal computers.

Re:More Cryptology Secrets or More Data Storage?

[Anonymous Coward]

The first "personal computers" were in the late 70s, not 80s...

Re:Beware

[Anonymous Coward]

You're posting on /., chances are you'd never have used it anyway.

FBI WATCH MAKING CRUELTY VISIBLE

[Anonymous Coward]

for a partial list of crimes committed by FBI agents over 1500 pages long see
http://www.campusactivism.org/phpBB3/viewforum.php?f=29