Rotor machines (e.g. German Enigma) Invented in early 20th century. * Electro-mechanical encryption device. * Aurthur Sherbius patented the first enigma in 1918 * Commercial failure initially (expensive, no demand) * Similar devices invented about the same time in at least 3 other countries, all were commerical failures * German army eventually decided better encryption was needed, and began purchasing enigmas about 1925. * Very good security, not cracked until WWII. Basic idea * Set of "scramblers", each implementing a particular permutation of S26 via wires running between connectors on a rubber disk. * if such a disk is set between a set of connectors representing characters, then by rotating the disk, 26 different cipher alphabets can be implemented - one for each possible rotation. * In particular, if the permutation implemented by a disk is D, then the permutations produced by rotating the disk by n positions is S_i^-1 * D * S_i, where S_i is a caesar shift of n positions. * If several such disks (D1, D2, D3, ...) are placed in series, then 26^n different cipher alphabets can be implemented by rotating each disk by a different amount D_ijk = S_k^-1 * D3 * S_k * S_j^-1 * D2 * S_j * S_i^-1 * D1 * S_i * The basic enigma machine had 3 disks connected with an odometer-like gearing mechanism that rotated one step after each character was entered on a keyboard. * Thus each character was enciphered by a different cipher alphabet, and 26^3 = 17576 characters could be enciphered before the sequence of alphabets repeated. * The process can be started at any of the 26^3 positions, thus providing a mechanism for using a 3-character key. Additions * To increase the number of keys, the machine had a plugboard that allowed up to 6 pairs of characters to be exchanged before entering the scramblers. This can be done in 26! / (14! * 2^6 * 6!) = 1.00391 * 10^11 ways, and is easily (if slightly redundantly) represented by a 12 letter key. The function is now D_ijk * P * The disks could be inserted in 3! = 6 different orders. later additional disks were provided, so there might be 5 choose 3 combinations. This represents a rather minor increase in security. * A reflector R was added at the end of the disks, which switched pairs of characters and sent them back through the machine. This gives an overall function E = P^-1 * D_ijk^-1 * R * D_ijk * P. Because the reflector is reflexive, the overall function is as well, which means that the decryption operation is exactly the same as the encryption. * Another way of looking at this reflexive property is that every permutation implemented by the machine is some set of character swaps. One result of this is that a character is never encrypted as itself. * A few other minor modifications (e.g. "rings") Use * Key consists of 1. Order (and selection) of scrambler disks 2. initial setting of scrmabler disks 3. cabling of plugboard. Total of 6 * 17576 * 1.00391 * 10^11 = 10 * 10^15 keys. * Generally the disk order and plugboard was constant over some large period of time (e.g. a day) * Each message had a separate 3 character message key, representing the initial position of the rotors. * Various protocols for transmitting message key. One example: Fixed "day key" consisting of plugboard settings, disk order, and some ground position of the disks is used to transmit a three character message key, which is then used with same disks and plugboard settings for body of message. * One protocol used early, repeated the message key. This provided a weakness exploited by the Poles Marian Rejewski in particular, to crack early encrypted traffic. * Later versions eliminated this, increased the number of disks, (though not the number used at once) and increased the number of cables in the plugboard. Cryptanalysis * complicated * Generally you assume you have the machine, and thus know the scrambler wirings. * Initial Polish effort, however, had to reconstruct the wiring from known plaintext and key examples, which was not trivial. * General goal is to recover key (plugboard and scrambler settings) * A large chunk of the strength of the cipher lies in the plugboard cablings. * The 17K rotor settings are within the realm of exhaustive search. * A lot of effort thus was focused on finding techniques that decoupled the effects of the rotors from the effects of the plugboard. Chosen Plaintext. * first example we have had where this is not trivial. * Try giving machine an endless stream of A's * Without plugboard, output stream over 17K cycle could be cataloged, indexed, and matched to obtain scrambler settings 3-4 characters should be enough on average. Probably a few instances where a couple more would be needed. * With plugboard input is turned into a endless stream of some letter, but output is scrambled. * Can't match on string anymore, but could match on distance until repetition of 1st output character, 2nd output character, etc. This would be preserved under plugboard transformation. * Or compile 26 catalogues for streams of As, Bs, ... Zs A bit more work. Might use distances of first 4 or so distinct repeats rather than repeat distances of first 4 distinct characters... * And there are cleverer ways, but this gives an idea of the sort of techniques that work. * Once rotor settings and plugboard output for A are determined, use enciphered output for string of A's to get the remaining plugboard settings (we know where A goes just before it enters the plugboard for final output, so each new output character gives us another entry in the plugboard table. Known Plaintext (Crib) * Very clever method discovered by Alan Turing * Assume we have a segment of matching plain and ciphertext that has a character loop in it. S+123456 wetter S S+1 S+3 ETJWPX w->E e->T t->W * This allows us to cancel out the effect of the plugboard * Then we just try all the scrambler setting until we find the one that has the effect of turning some character L0 into L0 + (e-w) = L1, L1 into L1 + (t-e) = L2 at the next step, and L2 into L2 + (w-e) = L0 two steps after that. * In WWII, this was accomplished mechanically by wiring together multiple copies of an enigma, and running them in offset lockstep with appropriate connections. * A complicating issue is that for any rotor setting, there is a good chance of SOME loop exisisting just by chance. To make things work, we really need multiple character loops involving the same letter. (at least as far as I can make out; I have not found any good references on this) * This establishes the rotor settings (and choices) * plugboard settings can then be worked out from other ciphertext matches. (start by finding unaltered characters, if any, by looking for matches when decoding ciphertext with correct scrambler settings and a clear plugboard. Any such (probably) indicates a double unswitched channel at a particular scrambler setting. * One of these will lead to identification of other plugboard settings at other scrambler settings at which one or the other characters recur. These can be made, and the process repeated. Once you get one correct connection * If there are no unswapped channels to start, similar method will allow us to home in on correct guesses. Ciphertext only. * The fact that not all the characters are switched with the plugboard provides a weakness that can be exploited in a ciphertext only attack. * Basic idea is to compute index of coincidence (averaged version, or against sample text) for text decrypted with null plugboard at all rotor settings. * Since some of the characters will be correctly decrypted (those not switched by the plugboard), the correct rotor setting will be revealed by an increased IOC. * The plugboard settings can then be discovered by looking for further increases in the IOC under trial plugs. * Somewhat computationally intensive, but has been demonstrated to work. (Cryptologia, Vol. XIX, Number 4, p 405-413, Oct. 1995).