Slashdot Mirror
200-Year-Old Cipher Finally Cracked
Attila Dimedici writes "A code expert just cracked a code used by a friend of Thomas Jefferson in a letter written to Jefferson some 200 years ago. This code is fairly easy to crack using a computer, but extremely difficult without one. I think it would have been much harder if the author had not included an indication as to what code algorithm he used in the letter accompanying the coded message."
The message says:
"In Congress, July Fourth, one thousand seven hundred and seventy six. A declaration by the Representatives of the United States of America in Congress assembled. When in the course of human events..."
the Voynich manuscript is a much more compelling and difficult mystery.
A code expert just cracked a code
The article says "After unlocking its hidden message in 2007". This is hardly 'just'. The solution was more recently published though. Interesting article.
"Hey Jefferson, you might want to try keeping it in your pants. I saw that slave girl today and she's starting to show. People will start asking questions."
Obscurity IS a level of security, which is good, but it's only one level. Hopefully you have a security system that is robust enough that even when the obscurity is pierced, it is still secure. In the past when people complain about Microsoft depending on security through obscurity, they were referring to the fact that Windows was at one time so insecure that it was only a matter of obscurity that gave it any security at all. That isn't to say obscurity is all bad for security.
In this case, unless you knew the key, it would have been extremely time consuming to discover the solution, even if you knew the algorithm used. Notice it took the guy a week to solve it, even with a computer, and modern cryptanalysis techniques.
Qxe4
"In Congress, July Fourth, one thousand seven hundred and seventy six. A declaration by the Representatives of the United States of America in Congress assembled. When in the course of human events..." Why even bother writing a code to tell someone that?
A Magic the Gathering Article and Forum Aggregator
http://en.wikipedia.org/wiki/Schneier's_Law
Did you mount a military-grade, variable-focus MASER on an unlicensed artificial intelligence?
All your base are belong to us!
My SIG is a P226
After about a week of working on the puzzle, the numerical key to Mr. Patterson's cipher emerged -- 13, 34, 57, 65, 22, 78, 49.
This week's lotto numbers, here I come!!!
greed@All_Evils:~#
The message was: "Be sure to drink your Ovaltine."
If you didn't come to party don't bother knocking on my door. Prince '1999'
It wasn't nearly as strong as the author thought, but was still strong enough to resist cryptographers for a long time. That's impressive.
I wonder, though. There's a certain level of indirectness and jitter in the system used, but not enough to raise the complexity even to the single millions, let alone the millions of millions. Would it be possible to increase the strength of the system and still have it memorizable and usable by any person in the field without book, computer or other aid?
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Even if the key to this exact code wasn't known, you'd think that all of the types of codes in use at that time would have been known and only a lack of interest kept this one from being cracked much earlier.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
So you're saying, that when i changed my SSH port, the sudden halt in bots trying to login over SSH suddenly stopping was pure coincidence?
Obviously that doesn't do anything to protect me against directed attacks, but obscurity does a heck of a lot to protect against undirected attacks which are the majority of exploits these days.
Liberte, Egalite, Fraternite (TM)
changing ports is not obscurity.
port knocking is.
Nice try though.
"Be prepared, son. That's my motto. Be prepared." --Joe Hallenbeck
... it's not going to do much good for President Jefferson at this point.
#DeleteChrome
... but they had to wait for the copyright to expire.
Don't fight for your country, if your country does not fight for you.
He used a computer, he cheated. If he really wanted to work out it as a test of skill he should of used only tools people in that time had.
I don't know, port knocking starts to sound like a password to me.
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
The message read: Just abolished the slave trade. With any luck, we'll soon have a black president...
The elusive Zodiac Killer's 360 character cipher was never cracked, either, and it's been decades since he mailed it to newspapers. That cipher also seems a bit grid-like, with spacing made deliberately in rows. I wonder if this method would help, at least in part, in cracking it?
If anything, would be nice to see something come up to ascertain his identity, and if alive, put him behind bars.
Port knocking is a form of password in essence. I can know everything about the method of security, but without the actual sequence it does me no good.
Changing ports on the other hand, requires at the absolute most for me to brute force all ~32k ports, there are port mapping tools that will do it much more simply. Thus obscurity, since once I know what the method is, I can break it easily.
Liberte, Egalite, Fraternite (TM)
He wrote the entire draft. The only parts that changed were minute portions and the choice of language he used was replaced by less forceful language for fear of being too alienating to the common man. The WSJ cites him as a contributor. The author needs to read Jefferson's letters. It's right in there. I suppose Stephen King or any other author should be called a contributor to their work after an Editor comes in and helps modify it.
The only reason it's not been solved until now is because no serious cryptanalyst was working on it. As soon as I read the description of how it's done, I knew it would be highly vulnerable to a known-plaintext attack. (The guy who cracked it used frequency analysis of letter pairs, because there was no known plaintext available. But if someone were using the cipher on a regular basis, there would be.)
Cut that out, or I will ship you to Norilsk in a box.
...muttering something about the DMCA.
Have gnu, will travel.
Obscurity IS a level of security
Only for so long as it's actually obscure.
And, also, with computer things, there are a lot of things that people commonly assume are obscure, but which, in fact, are not. So be careful what you take to be obscure. It could be that it's a secret to everybody.
You see? You see? Your stupid minds! Stupid! Stupid!
No shit... I'm taking a (required) summer course on architectural theory and my eyes were permanently crossed by the time we got to Heidegger. What's all this about "the thinging of things?" I'll stick with Vitruvius, thanks.
As for the Voynich Manuscript, the only explanations that make sense to me are that it's a constructed language of some kind, or an elaborate joke played on us by our Renaissance-era European forbears. Though I do like XKCD's "RPG handbook" theory...
Yes, but say a 20 port sequence for port knocking is the equivalent (2^16)^10 = 2^160 keys. That's pretty hard to bruteforce, and any sane portknocking system would block you before you got anywhere close
Err, that was obviously a 10 port sequence. A 20 port sequence would be 2^320.
The article said he had this all figured out in 2007 - yet the details of this cypher are just now being published in July 2009. What took so long - the quest to gain ITAR compliance?
> It's just a waste of effort to use crypto, as this story supports.
> It's all one big waste of time, effort, and manpower.
Crypto is like a lock (not by coincidence the symbol frequently used to indicate use of crypto IS a lock). A lock is not a once-and-forever solution, but defined in physical security circles correctly as a "time-delay device". With other words, given enough time any lock will be circumvented...broken if you want. Likewise with crypto.
BUT, with a human lifespan somewhere around 80 years (YMMV), a lock that protects your secrets/valuables long enough for it not to matter anymore to you or even your next couple offspring-generations has, IMHO, more than fulfilled its purpose. Even governments likely would have little need for protecting secrets longer than that.
Even governments likely would have little need for protecting secrets longer than that.
I disagree. There are numerous crimes for which there is no statute of limitations, and in the court of public opinion, there is no such thing anyway; only those things which the public forgets.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
unless of course your password is 123456, as then it will be found instantly.
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
>> Even governments likely would have little need for protecting secrets longer than that.
> There are numerous crimes for which there is no statute of limitations,
> and in the court of public opinion, there is no such thing anyway
Of course any real democratic government shouldn't be using locks/crypto in the first place, to protect its dirty secrets from its own public that they represent and work for.
Thus obscurity, since once I know what the method is, I can break it easily.
Well, duh, because he just told you, so it's no longer obscure. The whole idea is that others DON'T know what the method is. Even if you do figure it out though, you still have more levels to get through. Password, etc.
Security through obscurity is not sufficient, but it can be an important part/em of an effective security solution.
Any sufficiently simple magic can be passed off as mere advanced technology.
Thats exactly what I'm arguing. Specifically that obscurity protects against certain styles of attack.
Liberte, Egalite, Fraternite (TM)
Which is why I deny port knocking is security through obscurity. Its actually a glorified password, with the advantage of being immune to certain password weaknesses (nobody can make their password 'password' for example) and with different weaknesses instead (a port knock sequence has to be stored somewhere instead of memorized).
Liberte, Egalite, Fraternite (TM)
This story was published in (IIRC) American Scientist a month or two ago. Yep, here we go : A Cipher to Thomas Jefferson.
Loath though I am to send money to America, I do find myself strongly tempted to subscribing to that magazine. Seriously good brain-fodder.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"