Low-tech high-security passwords

You’ve seen this advice many times: use a different password for each website you log into, including lowercase, capitals, numbers, and special symbols. Change it often. If you don’t, a hacker that breaks into one of those websites might be able to get into your bank account and your Facebook page, emptying the first of money and filling the second with child porn. But I’d bet you don’t do it because it’s just too hard to come up with a good password for each website, and then remember it. In this post, I’ll be telling you a paper-and-pencil trick derived from one whose author is none other than Turing award winner Manuel Blum, but far less taxing on your brain. Read More

Tabula Prava

In Latin, “Tabula Prava” means “crooked table.” This is a play on “Tabula Recta” (straight table), which is a grid full of letters used in a number of classic ciphers, including the Vigenère cipher. Tabula Prava is the straightforward combination of a high-entropy key derivation algorithm, which I published earlier on this blog, and the FibonaRNG cipher, also published here. The result is a very secure cipher that is still quite fast and easy to use with pencil and paper. Read More

Et Tu, WhatsApp

The “unthinkable” has happened: it is alleged that WhatsApp has a backdoor in its end-to-end encryption, and nobody has actually been getting any security all along. All of this while using  the acclaimed “open source” Signal protocol. This article will not break any news, but hopefully will make you think and be safer as a result.

Hint: it has all to do with the quotes in the first two sentences. Read More

High-security low-tech ciphers compared

mallet_tooth3-1Not a totally unlikely scenario: you need to send some extremely sensitive information to someone, using email or whatnot, and you suspect that your phone, your computer, and all electronic devices around you have been bugged. The only thing you have is paper, pencil, maybe some stone as in the picture, and your brains. Some people would prefer that everything is done in your head, but I will presume that you can burn the paper where you did your work afterwards, leaving no traces (hard to do with stone, though). There are a few admittedly low-tech symmetric ciphers that claim to work well in this situation, producing ciphertext that even the NSA would have trouble cracking. I go first over desirable features, then look at the different ciphers and what they have to offer, and conclude with some scores and comparison between them. Nothing prevented their having been invented centuries ago and, had they been available back then the history of the world might have turned out quite different. Read More

The Scrabble cipher

scrabble-610x445-1Back in 1918, John F. Byrne invented an encryption machine, which he called Chaocipher. He tried unsuccessfully to sell it to the US government until his death in 1960 while keeping it a secret. He published some samples of its output in his memoirs, mystifying a whole generation of cryptanalysts. Then, in 2010 his son’s widow decided to release the secret papers describing the inner workings of the machine. It turned out to consist of two rotors with movable letters, which shifted according to a simple pattern. The key was the initial position of the letters in both rotors. Simple and surprisingly effective, although it is somewhat doubtful that Byrne ever built a working machine (the only working prototype was allegedly destroyed (?), and only a cardboard mockup and a blueprint  of the original have survived). I ran into the concept a couple weeks ago and I haven’t been able to stop thinking on how to improve it, and I believe I’ve found something as powerful and quite a bit simpler to use. I call it the Scrabble cipher because you can run it with the help of letter tiles. Read More

Are today’s communications more secure than ever?

charles-barsotti-enemies-yes-but-doesn-t-your-moat-also-keep-out-love-new-yorker-cartoonI’m going to start this post blowing the punch line, which is an unequivocal: “yes, but…” Yes because today’s communications can use stronger encryption than ever, and it’s getting stronger all the time, historically speaking. Ah, but the but. . . . You’ve got to read the article to see how we’re managing to throw all that security out the window, and what can be done about it. Read More

This could have happened during WWI

painvin-1Back in 1914, the German Army used a cipher that we have later come to know as “übchi”. It was a double columnar transposition that was quickly solved by French cryptanalysts, including Lt. Georges Painvin, in the picture, who later went on to break the more difficult ADFGX and ADFGVX German ciphers. At the time, the US Army was using a very similar method to “übchi”, so it was fortunate that the French shared their discovery, so they could switch to something better (they didn’t). As it turned out, the French were so bad about keeping this secret that the Germans soon got word of it and replaced it with the ABC cipher, which turned out to be weaker. But not necessarily so, and this article is about what might have happened. Read More

The Joy to Be Server-Free

freedomA few months ago, I toyed with the idea of adding a server to my PassLok Privacy app. I reasoned that a server would be able to store users’ Locks so that other users could retrieve them automatically—very much like the General Directory does now, but even more deeply integrated with the program so that users wouldn’t even be aware that a server was being contacted. Everything would be real easy. Seamless. I also reasoned that everyone else was doing it, so why not? Read More