house
[Music]
everybody doing so far
excited to be back at a real conference
that's really live this is still
coming off of uh
they'll shut down over the last couple
years it's still kind of a new thing
it's still kind of special at least to
me anyway I hope it is to you too
did everybody figure out the name of my
talk beforehand I trust anybody not
figure it out I just
solve the pro the puzzle for you
I thought it was interesting
when I submitted this talk uh you know
this is called a rotation Cipher it's
more commonly known as a Caesar Cipher
I'll talk about that in a little bit
this is rotation 13 or route 13. I
submitted it I think as rot 20. so I
don't know why they decided to dumb it
down for you guys but I if I were you
guys I'd be a little bit offended
um
anyway my name is Jeff Mann
um
I will not be offended raise your hand
if you have really no idea who I am
don't know anything about my background
most of you shut up
honest answers only
you're actually in this talk not by name
so so there that'll come later
um
I want to apologize when I was putting
together these slides and I was reading
the abstract that I submitted and that
there that's up on the website I
realized I was a little bit rambling and
a little bit long-winded and I have no
idea what you're expecting from this
talk
because I really just wanted to rant
about one little simple thing but I had
to turn it into an entire talk so I'm
hoping you'll find this uh informative
maybe a little you might learn a little
bit of History
I'm talking about the evolution of
cryptography from not from the beginning
necessarily because I wasn't there in
ancient Greece
um
but I do bring up some of the history of
the past I got into cryptography in the
mid 80s let's say which to a lot of you
is probably as ancient history as
ancient Greece so
uh a little bit about me
um I've been in the what I call the
information security business for just
about 40 years now
my formative years where I cut my teeth
and you'll see why I'm giving this talk
is I worked at the National Security
Agency I was there from 1986 to 1996.
I did a couple different things there
and I was at NSA it's sort of a unique
time in history
when a lot of the stuff that we take for
granted now like the internet and a lot
of the technology and what we call the
digital age was really in its beginning
stages so I was there sort of at the
ground floor for a lot of technology I
am a certified Crypt analyst I earned
that there's a date on there somewhere
1990
three
um wow so I've been a cryptanalyst for
30 years almost
um
I was there at the beginning in the old
days NSA produced a lot of cryptograph
cryptologic
radios and Equipment little black boxes
I was basically working in an
engineering organization but I was
initially assigned to the office that
was called manual crypto systems we
produced all this stuff that nowadays
you're mostly finding in ctfs or if you
were at the dinner last night a lot of
the puzzles that were involved in last
night are the kind of things that I used
to deal with
um but I had a customer very early on in
my career come to me and say we're using
these one-time pads which I'll show you
how it works a little bit later on on in
the talk it is the only secure method of
communication out there again if you use
it correctly which you can say of a lot
of things but this a one-time pad is not
breakable but we had a we had a customer
coming and say we've got this PC on our
desk and it takes us sometimes hours to
do the encryption and the decryption of
the messages is there any way we could
do this use this computer and and I was
kind of like
I was young I was in my 20s I didn't
know any better I was like yeah we ought
to be able to figure that out so I was
able to drive a what I believe to be the
first software-based crypto system that
NSA ever produced
through an engineering organization that
only Built little black boxes and we
were able to get it fielded I didn't
appreciate it at the time how
rare that was now revolutionary that was
in fact this might have been the only
software-based encryption system that
NSA produced but I was able to meet a
client need and make things work and do
things creatively in software uh
a long time ago I also worked with
another client U.S Special Forces they
used a particular type of one-time pad
that used a a a cipher table that was
based on what's called a visionnaire
square and I came up with a visionnaire
wheel or what they came to call The Whiz
wheel
we ended up producing them and
distributing them to U.S Special Forces
they used it for 10 or 12 years I
believe
the third significant thing I did at NSA
was
I went to work later on in my career for
an organization that was doing a
valuation of fielded systems we were
looking at how well our users which was
primarily the military at the time were
using all the little black boxes and
secure radios and and telephones and
things like that that we were producing
and creating because somebody figured
out somewhere along the line that
the way that we NSA often were able to
break and compromise the the systems in
the communications of our adversary and
whoever it was we were listening to was
because we were taking advantage of
things like the users of those systems
not changing default settings finding
bypasses uh
you know one-time key one-time pads
instead of using the key only once
they'd use it for a week or a month or
something like that this creates
cryptographic vulnerabilities and we
thought well how do we know that our
people are using our perfectly good
secure systems in the same manner so
let's look at them
um that that office that I was in also
had a a branch or a division that was
focused on what at the time was called
networked systems and again this is sort
of at the beginning of the internet
and long story short I went to work for
with a couple guys and we started
learning how to break into networks and
break into our own systems there's a
book that came out
back in I think 2015 chapter 4 which is
entitled eligible receiver has a
paragraph that I use I like to do a
dramatic reading somewhere in the middle
there it says during its most sensitive
drills the red team worked out of a
chamber called the pit which was so
secret that few people at NSA knew it
existed and even they couldn't enter
without first passing through not one
but two combination locked doors
I was a member of this group of hackers
we were trying to learn how to be pen
testers ethical hackers and so on and so
forth and we happened to nickname our
office the pit somewhere between the
early 90s and when this book was
published the the pit grew into folklore
I guess and was and was known as the
super Seeker chamber where the NSA red
team so I'm part of the first NSA red
team although we didn't call ourselves
at the time if you're not familiar with
that story and you want to learn about
it I have given several talks one is
called Tales from the Crypt analyst
where I talk about my early days with
the things that I was talking about
about doing the software-based
encryption system and The Whiz wheel and
then the sequel more Tales from the
cryptanalyst is where I tell the story
of how the first NSA red team was formed
you can find these Talks on YouTube
if you're also inclined you can listen
to Dark neck Diaries I'm featured in
episode 83 and talk a little bit about
this stuff as well as another podcast
called malicious life
you know if you're bored and you can't
sleep one night go listen to one of
these talks
um
it's been four years since I've been at
Cypher con
um how many is it their first ciphercon
so there's no context for a lot of you
thank you for coming it's great that
there's so many new people here what
have I been doing the last couple years
which
necessarily involved covid and not doing
anything for a couple years
I do a podcast called Paul security
weekly I've been a co-host on that for
gosh I think it's going on eight years
now so I still do that you can find us
at securityweekly.com
we were actually acquired by a corporate
entity a media company about two and a
half years ago now so if you get if
you're old enough to get this joke we
are Noah's arcade Paul security weekly
these days I'll leave it there and
Google that and you can figure out what
it is if you have no idea idea I you
know as a case in point I I was given my
own show I do in my day job a lot of PCI
so I do I'm a consultant I'm an advisor
and I approach security based on a
framework called the PCI Data security
standard they gave me my own show called
security and compliance weekly oh boy
they canceled it
a book came out a couple years ago tribe
of hackers there's four editions of it
the last two were published somewhere
during the lockdown I am one of two
people that are in all four Editions
why they let me do that hack for kids
which is going to go on here to tomorrow
I've been involved with them for several
years they asked me to join their board
somewhere during the lockdown so I'm now
Affiliated officially with act for kids
I mentioned I do PCI I've gotten out of
the business and was just an SME subject
matter expert for a while but I'm back
to doing PCI Consulting I'm back to
visiting clients and trying to help them
figure out how to do security in their
environment
um
uh
I met a guy a couple years ago that was
one of my former customers apparently
from Special Forces he remembered using
this thing called The Whiz wheel he was
so so excited to meet me uh you know we
took our picture that was at Defcon
probably I think in 18 maybe 19. uh
seems like a long time ago that he's
he's a member of their Alumni
Association which is called the Special
Forces Association and at some point he
said hey I think you're eligible for a
membership an honorary membership so he
got me in as a civilian to as a lifetime
member of the Special Forces association
their annual conference this year is
going to be in Indianapolis that's where
this guy lives he's hosting it and I'm
actually going to be speaking there that
scares me a little bit because I've
never met a whole lot of the Special
Forces guys that use my stupid little
wheel I'm looking forward to it but I'm
a little nervous about it
um last but not least for those that do
not know me I apologize for those that
do know me uh December 2021 my oldest
granddaughter Hannah was diagnosed with
stage four Hodgkin's lymphoma so most of
2022 we was spent
um focusing on her and getting her
through chemotherapy and getting her
back on her feet
at some point my daughter did a GoFundMe
and a lot of people in the community
contributed because insurance doesn't
cover all the costs of treatment like
parking at the hospital and and meals
because you spent a lot of hours while
you know persons going through treatment
having to do something and so on and so
forth so anyway
the great news is she's cancer-free and
to meet one of my goals I brought her to
a hacker conference and I I don't mean
to embarrass her but she's sitting here
in the front row Hannah just stand up
real quick and just wait to everybody
she deserves a hand she's one of the
toughest people I know if you've been
through cancer you know what it's like
to go through that and uh she's kicking
Cancer's butt and impressing all of us
and I think she might actually be a
hacker which is why I wanted to bring
her to this conference
all right anyway on to matters at hand
uh sorry for the long introduction but I
I felt like there needed to be a little
context I'm doing all right on time I
also noticed a couple hours ago I
actually looked at the whole schedule
and I saw that a couple hours from now
there's a gentleman is he in the room
that's going to give a talk on World War
II cryptography so I went and ripped out
all my World War II slots from this talk
real quick there weren't that many of
them but I I didn't want to trip over
what he was going to talk about
um so you're perhaps if you're going to
go to that talk you're going to get two
different perspectives on cryptography
um
very briefly cryptography keeping
secrets trying to disguise messages that
this has been going on for thousands of
years primarily and and even up to when
I was involved in it in the 80s and 90s
it was Communications it was keeping
secrets
when you're trying to communicate with
somebody you know like the military
trying to give messages to troops that
are in the field and you know covert
operations spies and Espionage I was I
was at NSA during the the final years of
the Cold War so that was very much a
thing
um
um you know
it's a little bit different these days
and you're going to get a little bit of
perspective on that tonight with the
other talk probably uh at least that's
what the title is about and I'm trying
to give you a little bit of a spin on
that too uh but bear with me it's from a
different perspective
codes and ciphers uh when I was working
for the manual cryptosystem shop back in
the 80s it was all about codes and
ciphers I took training courses
cryptography 101 102 103 all sorts of
different courses learning about Cipher
wheels and and this that and the other
I just have a few slides to demonstrate
you know how it's been involved in in
military operations let's say in in the
U.S history
Paul Revere's Ride uh you know you're
all familiar with the story one of by
land two of by sea that's a coded
message that you know one light meant
one thing two lights meant the other
thing that's a code
um
I gave these I gave a talk a couple
years ago at b-sides Northern Virginia
and we were at the Masonic temple so it
was all about Freemasonry and George
Washington and Thomas Jefferson they're
all in there
um so I stole slides from previous talk
is basically what I'm saying there was a
spy ring that operated during the the
American Revolution called the call
perspiring they used a code book where
they had a big long list of words and
phrases and numbers so they could
communicate primarily with numbers as a
quick example there was agent 711 who's
actually George Washington you know
leader of you know the Supreme Commander
general of the army General the
continental army I think that was his
title there were ciphers that were used
back then it's hard to read but you know
basically that's weird symbols that kind
of look like letters but it's
essentially a substitution alphabet it's
like a rotation thing I'm sorry it's not
a rotation thing it's a substitution
thing
um
on to the Civil War Caesar Cipher again
hey it's a wheel it's where I might have
gotten the idea for my wheel
um
the Freemasons I mentioned they had
their own Cipher that they use for
communications a lot of Freemasons have
written final messages on their
tombstones and it's it was called the
pig pen or is called Pig Pen Cipher and
it's you write the Letters Out in these
grids and then instead of writing
letters to your message you substitute
the the geometric shape that that that
letter occupies so it kind of looks like
that
anybody ever seen the movie National
Treasure
I love that movie because it's it's like
a it's like an escape room it's all
sorts of puzzles they talk about
something called the ottendorf cipher in
the movie it's actually in reality uh
called the Arnold Cipher it's a book
Cipher where you write it you write
numbers down you got to know the book so
the book's kind of the key but the
numbers are typically a page a line and
either a letter or a word and that's how
you would write the message out
um various other methods to try to
scramble things the other type of Cipher
is called a transposition
um it's it's where you're taking the all
the letters in the message but you're
scrambling them around somewhere you're
not substituting anything you're just
mixing it up one method was you would
write a message out on a strip of
leather I think this goes back to like
Egyptian times this is this one's really
old
um but you would write you would wrap
the leather around a stick of a certain
size write your message out and then
send it and then the thought was the
person on the other end has has to have
this stick of just the right size to
wrap the thing around to line up the
letters just right to read your message
probably worked pretty well for the time
until people figured out hey if I just
try a bunch of different sticks I can
probably figure this out another example
of transposition is using some sort of a
thing that looks like a crossword puzzle
grid where you've got openings in a grid
and you rotate it four times which
creates openings in this overall space
you write your message out using the
openings flip it keep going flip it keep
going so when you're done you get this
table of gibberish and who knows what
the message is
um
a Playfair substitution
is a way of taking the alphabet and
writing it into a grid and and the way
Playfair works is the encryption if you
can tell there
um
do I have one of these pointers oh damn
it
there's my laser I don't know if it
works a t you find a and you find T and
you basically form a square you know so
you know upper left lower right you're
going upper right lower left to create
the cipher it's if it's in the same
column you go to the right if the two
letters are in the same row you go below
and then reverse the process you get it
back uh very popular and common system
used in the days my One World War II
slot I left because I didn't have many
examples of codes but the Navajo code
talkers in World War II they used a they
were speaking in their own language
number one that the Japanese the enemy
didn't understand but they also had
words for everything and this is just a
sample of their code book where they had
different words that they used to
represent different things you know I
always thought it was interesting like
the word for Battleship was whale it
kind of makes sense and it kind of makes
you wonder why the Japanese didn't
figure that out but they didn't National
Treasure again they talk about secret
writings here's a actual letter from the
American Revolution called the Benjamin
Thompson letter you can sort of see some
of the words or the sort of darker than
the other that's that highlighted part
of this seemingly innocuous letter that
was written is the actual message I
don't have a good blow up of it but it
was a hidden message within a longer
message and you just had to know what
the right words were I don't actually
know how they figured that out I'll have
to look that up another method of
writing a letter out is again having
some sort of stencil that you put on top
of the letter and what's left is the
actual really message that you're trying
to get up get up across to the recipient
so there's a message right there that's
hidden in uh
you know some sort of jumbled
letter that doesn't necessarily make
much sense but hopefully hides what the
real intent is
um
you know in the movie National Treasure
they talk about invisible inks that was
certainly a thing I don't know that
there's one on on the back of the
Declaration of Independence but you know
I tried to avoid World War II but that's
just a smattering of an idea of what
historically cryptography was all about
in terms of producing secret messages
primarily for transmitting communication
um so how does cryptanalysis work this
if nothing else will hopefully help you
solve ctfs and Escape rooms and puzzles
at dinners the night before conferences
and stuff like that
um
the goals of data security have have
always and forever been
confidentiality integrity and
availability when it comes to to
encryption it's mostly about the
confidentiality that's primarily what
you're trying to do is you're trying to
keep a secret
isn't that a cool slide
um
what we used to do what I was trained to
do as a crypt analyst was to learn how
to do number one first of all frequency
analysis whatever the characters or
letters that you had in a message you'd
count them see how many there were
because every language has unique
characteristics this happens to be
English of how often the letters show up
and if you just think about our language
you know briefly
you know cues don't show up a lot and
and even in terms of pattern recognition
if you think you have a cue what's the
next letter
going to be more than more times than
not a u
um so anyway this is the this is the
frequency count I was trained on what
were the eight most commonly used
English letters I I learned it as the
senorita letters that was just an
anagram a jumble of the letters but in
in frequency order it's e t n o r i a s
the etnorias letters are the senorita
letters e is the most common letter in
our alphabet
let me show show you what that looks
like a little bit so this is the
preamble to the Constitution and this is
the the count of the letters that appear
in that message
call let's call it a message
this is a a rotation Cipher a Caesar
Cipher substitution of the same thing I
kept it in word order so you can see the
very top we the people of the United
States so you kind of know what you're
looking at a little bit look at the
frequency counts now
uh they're certainly not e is not not
the most common letter now it's y
see that
well let's check it we know that the
first couple words we the people of the
yep that's that's the E so a way to
solve a simple substitution other than
typing it into Google and finding one of
the Thousand apps that will do it for
you these days is to start guessing and
plugging in the letters and then look
for the next most frequency and then
start looking for patterns especially
easy when the word order you know a
three letter word that repeats twice in
the first sentence nby it ends in e
probably going to be the word the maybe
it would be the word r you start
guessing and then you sort of cross back
and forth cross check what you have and
eventually you might figure out oh this
is a substitution Cipher it's just you
know it's a three or it's a seven or
it's a 13 rotation
um
the key which is the key element of
cryptography even up to today but it's
transformed
started out at the very beginning like
as a letter you're going to do an offset
of the alphabet a rotation of the
alphabet you got to pick what letter I
mean we talk about it in terms of
offsets by numbers but you're really
just lining up a with some other letter
that's the key letter
um
something that people did to try to make
it a little bit trickier was instead of
just using using a slide they'd start
writing a word in I used crypto in this
example and then the rest of the letters
of the alphabet it's not
that hard to break it doesn't give you a
whole lot much more to complexity if
you're trying to break it but people
thought it did so they started doing
that the next kind of element was to use
more than one alphabet what's called
poly alphabetic substitution and that
also was then
you'd pick a word in this case I'm using
the word lemon as the first letter for
five different alphabets so when you're
doing your encryption process every time
you're going to encrypt a letter you're
using it from a different alphabet and
then you keep repeating and keep
repeating
um what does this look like
so I've taken the same we know what the
plain text is this is still the Preamble
and I've encrypted it with some number
of alphabets so I'm going to walk you
through very quickly what a crypt
analysis exercise would look like and I
did use the app that I found on the
internet for simplicity's sake
um but you would go through and count
all the alphabets but let's you know we
started by one alphabet and you look at
the distribution I'm like crap every
every letter is used nothing stands out
it's probably not single it's probably
poly alphabetical so let's try two
alphabets I do a frequency count but I
keep track of every other letter and and
so I sort of developed the counts of two
alphabets which is what I'm showing here
and then for reference there's the
English distribution and then there's
the overall message frequency
distribution that we have
you look at this and you're like well
that first one is using all 26 letters
the second one's using 25 that doesn't
really happen especially if you're doing
every other letter so that that doesn't
look right go to three alphabets still
especially that middle alphabet that's
not right you can look at it immediately
what you're going for is looking for a
frequency distribution that resembles
English distribution obviously it's
going to be jumbled in some different
order
four alphabets now we're starting to
look a little bit more realistic there's
some definite especially in the second
one there there's a definite Spike but
one three and four again there's there's
too many spikes you know if you look at
the English distribution there's
basically four spikes that you get based
on the the letters so let's go to Five
alphabets now it's starting to look
interesting
now I'm starting to see what looks more
like English distribution there's spikes
there's there's Hills and Valleys this
is not scientific it's what it looks
like so let's check out our hypothesis
that maybe it's five alphabets that are
involved so we the people of the United
States we know what the message is we
know what the E's are
and we also have to keep track of what
the order of the letter is so I've
numbered them there and let's cross
check so the first time an e shows up
it's the second alphabet and it's m
that's the highest peak in that alphabet
that looks pretty good to me let's try
the next one it was the V that's in the
fifth alphabet that's not so high but
that's okay you know because you're only
doing every fifth e with this alphabet
you're going to get some flattening out
but there's still Peaks and valleys so
that's not necessarily bad what's the
next letter uh G which is in the first
alphabet yep there's a spike again
that's looking pretty good in fact if
you look at the fourth alphabet e is the
most common letter so the fourth
alphabet was actually rot 26.
so it turns out it was five but that's
the process that we would go through and
we didn't have the benefit of Google
back in those days our primary tool that
I learned was using graph paper colored
pencils pencils we did have access to
supercomputers in those days but we
didn't really get to use them they were
used for the large number crunching
because you can imagine NSA was
capturing lots and lots and lots and
lots of data which in those days was
primary an analog signal that was being
intercepted out of the air
the way you break it frequency analysis
we've gone through that pattern matching
it's helpful when the words are in the
right order but when they're split up
you have to start guessing it's a little
bit harder but you can still recognize
patterns key recovery when we used to
break systems and I worked on the
operations side of the house the the
actual code breaking side for a couple
years if we solved a system and got key
from it we would have to turn that over
to a group that was doing analysis of
the key they would in fact sometimes we
would throw the messages away and just
send on the key because the the trick
was let's see how there are they
generating the key in some way and can
that be predicted that's when the
mathematicians started getting involved
in the computer scientists and they try
to figure out what the key is because if
you have the key you can read other
messages or if you can figure out how
they're making the key you can figure
out other messages
user error people forget to do the
encryption people use the the one-time
pad more than once so on and so forth
um
I'm not going to say much about assumed
plain text you're going to hear that
later tonight I'll give you a hint a
teaser it's how we broke the Enigma
machine and by we I meant the polls the
Polish cryptographers are the first ones
to break the Enigma machine I will say
this about the Enigma machine everybody
knows what the Enigma machine is I took
the slide out German
unbreakable supposedly code machine when
I started working at NSA in 1986 the
fact that the Enigma machine had been
broken was still a secret
can anybody guess why
yes
it was still being used
it wasn't be it wasn't being used for as
high a level of communications traffic
but it was still being used Soviet block
countries and so on and so forth I can't
say who they were
but you know the enabling machine was
built in the 30s it was broken in the
30s and 50 years later the fact that we
knew how to break it was still a secret
that's a whole other story right there
and might be touched on tonight
um One Time Pad that's my favorite
because that's what I dealt with mostly
that's what they look like I I would
love to get my hands on one but because
they were considered to be cryptographic
material they were classified and so
they they don't just you know you don't
see them on Google for sale or or
anything like that but I'm working on
trying to find one
um
again the one with special forces was
based on a visionaire square which is 26
offsets of the alphabet but the alphabet
is in reverse order in the table the way
it worked with uh with the one-time pads
of Special Forces used is and
conveniently I have a slide that will
demonstrate it this is a page from a
one-time pad it has random characters on
it this is the key the way that these
characters were generated was done in a
very highly classified manner so that
this pad if you did a statistical
analysis of just the letters that were
showing up and a pabatab maybe 50 60 80
Pages just like this
few more lines this is just for
demonstration purposes it would be
statistically random it would be flat we
called it flat if there weren't Peaks
and valleys it's flat if it's flat
you're not breaking it you're not
reading it but this was just the key
um if somebody wanted to send a message
they skipped the first five characters
um because that was the code or the key
to the recipient on the other end
knowing which page of the one-time pad
to use now in theory it would be the top
page because you use a page and you
destroy it but every once in a while
maybe a message takes longer to get sent
or it's been you know it's being hand
carried instead of being sent by morse
code for whatever reason you know you're
not going to burn the page before you
use it if you're on the receiving end
and you find which message you what page
to use by that first five characters
then you write out your your message one
character at a time and using that
trigraph the table row column find the
element in the middle you get what
essentially is the ciphertext this is
the message that you're gonna you're
gonna send
then the recipient he's he finds the
right page because he's looked at the
five characters
and all he has to do is look at the same
table
the two letters that are there produces
the same third letter
I don't know what the mathematical
explanation is for this but the
visionnaire table
produces a unique relationship with
three characters if you know two letters
it's always the same third letter no
matter what the order is so if you know
if you have the three letters memorized
you see two of them you know what the
third is and that's what special forces
would do they would memorize these three
letter combinations if I go back and I
gotta reverse it I should add a slide
after the first page of their one-time
pad every one time pad had this table
that listed out every single three
letter combination it's like 123 or
something like that they memorized them
I met a guy just a couple weeks ago X
Special Forces used to use this wheel
and he's like it was the wheel was great
because you know when you've been up for
50 hours and you're you know you've been
working real hard and you're you know
you're under a high stress situation
your memory isn't that good so
apparently he you know tipped me on to
something I hadn't heard before but it
came in handy because uh when you're in
a high stress situation your memory
isn't great and so they could rely on
the wheel and use it I've been told that
they used it and they used it for quite
a long time anyway
that's why I'm a lifetime member of the
Special Forces Association you use a
one-time pad you do a cryptographic
analysis a statistical count of the
messages that are being sent it's
getting flattened out
sorry I've moved to microphone
um the if you don't have the key
you've got two out of three letters and
I'm sorry you've got the message you've
stolen it you've got one letter you
don't know what the key is you're trying
to get the the third message you
basically have
any 26 letters could be any one of the
keys and there is no way to pick one
over the other there is no statistical
test there's no mathematical equation if
you don't know what the key is you could
decrypt it to anything and you know it
could be a verse from the Bible and you
can make it valid it could be an article
from the newspaper those are things you
don't know what newspapers are if you're
young
it could be a a Twitter feed
things like that
um
so here's your story the last time I was
here at cyphercon a gentleman who's in
the third row came up to me and said
have you ever heard of this thing called
the Special Forces Diana
Cipher wheel and I'm like tell me more
he said yeah there's uh this this place
that I found that's making wooden
replicas of cryptographic equipment and
devices and I'm like why are they
calling it Diana I looked it up and I
found it and and I had I have a
prototype with me and I asked him I said
does that look like this and he said yes
it does so it turns out that there's
somebody that used to use the wheel that
wanted to preserve its history and so
arranged with this guy that does wooden
reproductions of cryptographic devices
I got in touch with the guy he sent me
several copies that thing in the middle
was the three rotors of the Enigma
machine the the very complicated wheel
on the bottom I want to say that's like
Mexican Mexican Army Cypher wheel but
he's got two different sizes of my
Cipher wheel called The Whiz wheel it's
available for purchase feel free to buy
one you know I don't get anything for it
but if you want to have a piece of
History I'll even sign it for you the
next time I see
um anyway moving on uh while I was at
NSA most of the focus was on machine
encryption
um we were doing things really cool
again mostly with with with sound waves
it was radios and various frequencies
um secure voice systems that did uh you
know half duplex Communications if you
don't want half duplex is it's like a
walkie-talkie push to talk release to
listen it's not like a telephone not
that you use telephones anymore where
you talk back and forth and everybody
can hear everything and and all that
kind of stuff
um
Park Hill device was a device that I
actually analyzed when I was at that
office doing the fielded systems
analysis it converted an analog voice to
digital because if you have digital ones
and zeros it's a lot easier to do more
fun different types of encryption with
them
um frequency hopping radios uh
broadcasting on pseudo random different
frequencies so if somebody's
interrupting the signal you know they've
tuned into a particular frequency they
hear a little bit but then it's gone I
would tell you who invented frequency
hopping but that bleeds into the World
War II talk so I don't want to steal his
Thunder again it's a sneak peek
these machines had keys that were
you know chunks of bytes of data that
would get fed into them and they had to
be distributed electronically so the
office next to me was responsible for
putting the key on these little boxes
that would get sent out and and have to
be injected into these machines
periodically it'd be similar if any of
you have ever worked retail the the card
reader device those things are typically
encrypted these days and they have to be
seated with a key or what they call
injected with a key nowadays very often
it's done online but in the early days
it had to be done manually
one of the one of the early forms of
digital encryption was something called
the ko-43 a guy next door to me at the
next office over he tried to push these
on Special Forces that's another story
what I was doing one out
early encrypted cell phones these
when I was at NSA in the early 90s we
were using what was called a stu 3
telephone it was encrypted telephone and
they had instead of building it
themselves they'd put it out to
commercial bids so there was three
versions built by three different
vendors three different contractors gosh
it was RCA Motorola and I can never
remember the third one of them one of
the three was still half duplex it was
horrible when they did work full duplex
everybody sounded like Donald Duck you
know so it wasn't perfect we've come a
long way
um very briefly you know we're getting
into digital cryptography
um what's changed with encryption on the
internet these days I mean we're still
trying to keep secrets but there's more
opportunity now to do bad things with
data and so we've had to come up with
new ways of protecting it
um
this I'm sure is not an exhaustive list
because I I try to avoid technology to
be honest
um but you know where where cryptography
comes up uh very often is still
passwords checksums obviously https
everybody's on TLS now
um
but what's really new in the digital age
is this concept of protecting data at
rest when it's being stored I remember
when I was in that office fielded
systems evaluations there was a popular
show on at the time called The X-Files
and there was an episode of The X-Files
where the whole premise of the episode
was
um you know the the good guys the FBI
agents that were trying to uncover all
these nefarious secret things going on
um they were investigating some super
secret data being stolen and they were
suspecting that it had been stolen from
data some some database somewhere and
I'm like that's silly because who would
take all your most secret data which at
those time at the in those days was
printed on paper and locked in safes and
digitize it and you know photocopy it
whatever and put it online because
obviously it would get stolen obviously
that's not happened Much Anymore anyway
so that's new we have to think about new
ways of protecting data not being
transmitted but also when you're holding
it in your perception just something new
uh the primary forms of cryptography
these days at least what I deal with and
I think what most of us deal with again
there may be more variations but the big
ones are hashing functions which are how
you get your passwords how passwords
work and then symmetric algorithms and
asymmetric algorithms and this part
might bore you you might know all this
but I find as a cryptographer a lot of
people don't understand these basic
concepts so very briefly symmetric
encryption means you're using the same
key to do the decryption and the
encryption so you have a message you
have something that you're trying to
send to someone you encrypt it with a
key using some algorithm and the person
on the receiving end uses the same key
to do the decryption it's basically how
all your websites work once you get past
all the initial handshakes and things
like that but the speed of using the
same key is What enables us to have
https on every website these days
um asymmetric key encryption or what's
more commonly referred to as public key
cryptography is
getting into math that I don't
understand necessarily but the concept
basically is you have two keys now you
each person that wants to communicate
has a pair of keys a private key that
they hold and nobody sees it but them
and a public key that they give to
anybody so anybody takes my public key
encrypts a message and I can only
decrypt it with my
secret key and then conversely if I want
to if they want to communicate back to
me
or I want to communicate I got mixed up
the other person however I did the
analogy also has the public key of the
other person encrypts whatever they want
to send to them message wise sends it
back and that person only has the secret
key that can decrypt it it's in a more
involved process it's slower it's it is
used essentially in how sessions are
negotiated on you know websites https
traffic but only to do the exchange of a
key that gets used back and forth very
broad over overview of that
um I bring up Whitfield Diffie because
he's got an affiliation with NSA he's
the Diffie in the Diffie Hellman
algorithm which was the first public key
algorithm you know so he kind of
invented it with Hellman I only bring
him up because I actually took a course
with him at NSA so he was my teacher
once uh so Fanboy moment for me
the future of cryptography you know I
touched on this a little bit in my
abstract uh you know what's the talk
these days besides AI because that's
sort of taken the the stage but a lot of
talk about Quantum cryptography
um you know so I have a very detailed
slide that explains it very clearly that
I don't know all I know is uh Quantum
Computing gives you you the ability to
break public key cryptography based on
what the mathematical premise that
public key cryptography is based on it
doesn't do so well on symmetric
cryptography where it's one key because
those keys can be really really really
really really long and it still takes
computing power to try to which is the
most common attack Brute Force try every
possible combination
um
homomorphic encryption this is another
one that's come up a lot lately
especially you know because I do a
podcast we get a lot of vendors on
trying to talk about all their cool new
things
this might be really legitimate it's the
idea that you have encrypted data that
you can extract information out of and
and figure things out without decrypting
the data if you're a mathematician and
want to try to explain it to me great
others have tried and failed it just
eats at me because everything I've
learned about cryptography is you're
trying to keep a secret and the whole
idea is you don't want anybody to know
anything about the information that
you're you're you're protecting using
encryption so my premise is simply
it might be really cool technology it
might have a really good use case and be
very useful for the for people that are
designing it just don't call it
encryption please that's all I'm going
to say about that another thing I got
briefed on a couple yeah a couple months
ago now by another vendor this actually
sounds kind of cool the guy that I
talked to used to work at Bell
Laboratories which was a think tank back
in the 70s and 80s that did a lot of
cool things I guess they still do cool
things
um but in in PCI language we talk about
the data that we want to protect which
happens to be credit card data existing
in one of three states either being
transmitted sent communicated being
stored data at rest or being processed
what this company is doing is they've
come up with a way of basically
securing what they call us an enclave
where the processing can occur and so
you're doing something with your
encrypted data and all of it's encrypted
whatever the application or processing
thing that's going on the data itself
that's being processed it's like Voodoo
to me but it's really cool in the sense
that I have never seen anybody come up
with a really good way of protecting the
data when it's being processed when it's
in memory you know in my pen testing
days we used to do things like try to
get applications and programs to Hiccup
and and interrupt and on Unix systems
which is what I worked on back in those
days that would that would dump all the
data that was in memory out into a file
we called it a core dump and very often
that core dump had all the credentials
and all the passwords in them because
they were all stored in memory during
the operation of the operating system
and so on and so forth so this is the
potential for doing that in a secure
Manner and I said to the guys that it's
kind of like a skiff skiff is a
government term for a super secret
chamber where you can do the equipment
and the radio communications and the
computer Communications and nobody can
see into it nobody No Electronic
ammunition emanations are going to bleed
bleed out of it it's like this big box
that you get into
um
Moore's Law
I bring this up primarily because the
guy that came up with this idea uh
actually died like a week ago but
Moore's law was some was a very
important principle when we were
designing systems back in the day and it
was essentially the computing power
that's a very long explanation that was
probably from Wikipedia pedia but
basically
the computing power are all over the
world the the potential of it the power
of it doubles every two years
he came up with this idea like back in
the 60s or 70s and we used to use it
when we were trying to Design Systems uh
secure communication systems secure
algorithms you know we if we needed to
protect messages for 20 years or forever
they had to be strong enough to resist
the anticipated advancement in computing
power you see that a lot these days in
the digital age with password cracking
you know and and you know there's team
tables figuring out how long of the
password how long is going to take to
crack it that type of thing
it's an extension of Moore's law but
yeah Gordon Moore he just died like six
days ago less than a week ago so I
wanted to give him an honorable mention
and a nod here because he was an
important part of my cryptographic
history all right all that built up to
the simple point of my story and what's
been eating at me
um
uh is this essentially every time I hear
people talking about cryptography
especially in our age they throw around
terms like coding and encoding and
encryption and decryption and Cipher and
this and that and they invariably are
using the words incorrectly and it may
not matter to anybody but me but it bugs
the heck out of me because
they're not saying it right I was on a
podcast one of our episodes gosh a
couple months ago which is what gave
birth to the idea of this talk and some
some something about encryption or
encoding came up and I actually went to
look it up what is the actual definition
I found that the the definition that's
listed on encryption it says in the
middle there in cryptography encryption
is the process of encoding information
and I'm like no that's not right
encoding is one method of encryption but
that's not all there is
another example security.com they had
something up here they talk about Secret
because what is encryption the formulas
used to encode and decode messages are
called encryption algorithms or ciphers
no ciphers and codes are two different
things and this is what I want to hammer
home to you and again nobody it may not
matter to anybody but me but if you if
you learn one thing today from my talk
it's what the meaning is or what the
difference is between code and Cipher
and encryption here we go
um
codes this is an old slide I used I'll
update it in a moment codes are
basically a way to to process uh
thoughts uh bigger chunks of data
ciphers are uh
you know things that I worked with
transport transposition and substitution
ciphers
they're they're manipulating letters
basically one at a time where codes tend
to be more more than one letter let's
just say
um but don't take my word for it and I'm
kicking myself I was going to bring
these books these were my guidebooks
when I was a cryptanalyst at NSA they
were written in the 50s by Two Gentlemen
lambros kalimaos you know a giant in the
cryptographic field because he wrote
these books for one thing
um he would you won't have time to read
all that I'm going to switch on but you
can find this this is all taken from the
NSA website they've got like a
uh you know a Hall of Fame of famous
cryptographers you can find the whole
write-up on lambrose Kalima hosts and
also William Friedman
um you know these two guys wrote these
books and this is where I'm getting the
the real definitions from I tried to go
back to the source and this is what I
could do oh by the way William Friedman
was married to Elizabeth Freeman she was
actually a better cryptographer than he
was cryptanalyst she was they they both
met in in some Think Tank back in like
the the 19 teens and they got married
and they there they were a cryptographic
couple they're both in the Hall of Fame
again lots of she actually did a lot of
code breaking during prohibition and she
was catching Bootleggers I don't know if
that's a cool thing or not but that's
what she's got famous for
um they they loved this thing called the
baconian cipher where they came up with
this it's a substitution but for every
letter of the alphabet it's every letter
is represented by five letter that are
that are either an A or a b and and it's
the position of the letters A and B that
produce
a different five-letter grouping that
represents 26 letters
on the tombstone
for both of them they're both buried in
Arlington National Cemetery I learned
this at a shmukh Khan conference several
years ago somebody figured this out
knowledge's power is written on the
bottom of the tombstone
when they graduated their graduating
class from some military cryptologic
school and this is from like 1919. if
you look closely at the people in this
Photograph some people are standing
straight ahead some people are turned to
the side and what somebody figured out
was you know if you take every five of
the people here they were representing
one of the five characters of the
baconian cipher and these all these
people in this graduate graduating class
collectively are spelling out knowledge
is power
which is on their Tombstone somebody
figured out on the tombstone that
um the the fonts that they used I don't
think about tombstones and fonts but
they were different and somebody figured
out that they also did the baconian
cipher on the tombstone so the knowledge
is power converted back to basically
William F Friedman the initials of
William Friedman and his wife arranged
for that
and that's this is a handwritten note
from her to a publisher or an author
that was doing a biography that said oh
yeah on the tombstone it says knowledge
is power but it's really his initials
anyway a little sidebar
um military cryptanalytics here's here's
the meat of it finally to encrypt is to
convert or transform a plain text
message into a cryptogram to decrypt
reverse the process
ciphers
read all the text individual letters
codes read all the texts words phrases
sentences there are two different things
and then key really cool language that's
very archaic that talks about what
essentially a key is and this book was
actually written I think before like
one-time pads came into Power the early
keys I learned in reading through this
book were the the mechanical settings of
the cryptographic devices like I'll
steal the Enigma machine example the
Enigma machine had three or four rotors
and every day those rotors would change
settings the settings that were for the
day that was the key to use that machine
anyway
so to sum up
code ciphers encryption and let's learn
a new term cryptogram the jumble the
cipher the encrypted text whatever the
ciphertext it's really according to the
Friedman's and Kalima hoses a cryptogram
so ciphers single letters codes
sentences phrases words
an encryption it turns out is the
generic term that applies to either
encoding or enciphering messages plain
Text data
quickly acknowledge the company that I
work for because they let me come here
and do these talks and then somebody's
giving a talk on PCI 4-0 and I'm not
going to steal their Thunder but we do
have a resource page at our website if
you guys have to do PCI and are
interested we've you know PCI has rolled
out a new version that comes into effect
in the next year
photo credits A lot of the photos I got
from an online Museum called the crypto
Museum or the national crypto
cryptologic Museum if you're ever in
Maryland reach out to me if I'm
available I'd love to give you a tour
you can see stuff that I used to work
with like the super computer I used to
use is in the museum that's how old I am
I probably don't have any times for
questions so I encourage you to question
everything I'm here all evening uh
do we have any time for questions
no not really
find me afterwards if you want to talk
about NSA Pitt you know pen testing red
teaming that's fair game anything's fair
game here's my contact information and
sincerely feel free to reach out to me
if you want to talk or have questions or
want life advice or want to know the key
to Life's puzzle that's never been
solved like the crypto statue that's in
CIA headquarters that's it thank you
[Applause]
[Music]