{"id":333,"date":"2005-07-18T13:52:00","date_gmt":"2005-07-18T13:52:00","guid":{"rendered":"http:\/\/journal.electric-rocket.com\/?p=333"},"modified":"2005-07-18T13:52:00","modified_gmt":"2005-07-18T13:52:00","slug":"decipher","status":"publish","type":"post","link":"https:\/\/journal.electric-rocket.com\/?p=333","title":{"rendered":"DeCipher"},"content":{"rendered":"

A while back’s post was an encrypted message.<\/p>\n

Entry tags:\tgzdq
\nThirteen<\/b><\/p>\n

\r\nEZLZJ IQAFZ TQOCX QGMKC MYOSY DOYRX CGZDQ VYCXT QLCXY FCQQO\r\nGZORF MCJBM CYZOE LZJGM OOZVF QMDSL EQGFQ CKZEC E\r\nCZRQC XQFVQ VYBBF JBQCX QVZFB D\r\n<\/pre>\n
<\/p>\n
I had just finished a re-read of Cryptonomicon<\/u> a while back, and there was an appendix written by Bruce Schneier about a cipher used in the book.  It mentioned he was the author of Applied Cryptography<\/u>, which I noticed was on my co-worker’s shelf (we work in the secure payment industry, so this stuff comes up now and again).  I borrowed it and read through the first few chapters, which gave a very high level view of cryptography.  Fun stuff.<\/p>\n
Both Cryptonomicon<\/u> and Applied Cryptography<\/u> talk about techniques of cryptanalysis, the act of breaking encryption.  So I’ll pretend I don’t know the message and apply one.  (Actually, I don’t really remember the message anymore.)<\/p>\n
Assuming this is a substitution cypher of english “cleartext” (unencrypted text), we can apply a letter frequency analysis<\/a>.  We also have a small burst of encrypted text where we know what the underlying word is, thanks to :<\/p>\n
: If I guess it, is there a prize?
\n: LQE<\/p>\n
As  surmised, this is “YES”.  So L=Y, Q=E, E=S.<\/p>\n
Using a text analyzer tool<\/a>, the frequency of letters in my message is: <\/p>\n
Q -15
\nC -13
\nZ -11
\nF, O -8
\nY -7
\nM,X -6
\nB, E, G, V -5
\nD, J, L -4
\nR-3
\nS, T, K -2
\nI, A -1
\nN, P, H, U, W -0<\/p>\n
letter frequency in the english language: e t a o i n s r h l d c u m f p g w y b v k x j q z<\/p>\n
So Q=E makes sense.  If we also assume that C=T and Z=A and know L=Y & E=S, the message looks like:<\/p>\n
Q=E, C=T, Z=A, L=Y, E=S<\/p>\n
\r\nEZLZJ IQAFZ TQOCX QGMKC MYOSY DOYRX CGZDQ VYCXT QLCXY FCQQO\r\nSAYA   E  A  E T  E   T             T A E   T   EYT    TEE<\/b>\r\nGZORF MCJBM CYZOE LZJGM OOZVF QMDSL EQGFQ CKZEC E\r\n A     T    T A S YA      A   E   Y SE  E T AST S  <\/b>           \r\nCZRQC XQFVQ VYBBF JBQCX QVZFB D\r\nTA ET E   E         ET  E A    <\/b>  \r\n<\/pre>\n
Doesn’t look like anything yet.<\/p>\n
So, on to digraphs  From this site again<\/a>:<\/p>\n
These letters often go together. These are known as digraphs.
\nth, he, at, st, an, in, ea, nd, er, en, re, nt, to, es, on, ed, is, ti <\/p>\n
I know C=T, so I’ll attack those digraphs.<\/p>\n
These might be TH, TO or TI
\nCX 4
\nCM 1
\nCG 1
\nCQ 1 (TE)
\nCJ 1
\nCY 1
\nCK 1
\nCZ 1<\/p>\n
So, assume CX = TH, meaning X=H<\/p>\n
\r\nEZLZJIQAFZTQOCXQGMKCMYOSYDOYRXCGZDQVYCXTQLCXYFCQQO\r\nSAYA  E  A E THE   T         HT A E  TH EYTH  TEE<\/b>\r\nGZORFMCJBMCYZOELZJGMOOZVFQMDSLEQGFQCKZECE\r\n A    T   T A SYA     A  E   YSE  ET ASTS<\/b>             \r\nCZRQCXQFVQVYBBFJBQCXQVZFBD\r\nTA ETHE  E       ETHE A<\/b>     \r\n\r\nQ=E, C=T, Z=A, L=Y, E=S, X=H\r\n<\/pre>\n
We see some “THE”s!  That’s something.  Maybe.<\/p>\n
Now the other T Digraphs…
\nThese might be AT, ST, or NT
\nQC 3 (ET)
\nMC 2
\nEC 2 (ST)
\nOC 1
\nKC 1
\nXC 1
\nYC 1
\nLC 1 (YT)
\nFC 1<\/p>\n
M is common in the two digraphs (CM and MC).  Given the letter frequency of M, I’d say it’s either I, N, or R.  N seems to be the best first guess (because MC is frequent, and ST and AT are known), so I’ll try M=N.<\/p>\n
\r\nEZLZJIQAFZTQOCXQGMKCMYOSYDOYRXCGZDQVYCXTQLCXYFCQQO\r\nSAYA  E  A E THE N TN        HT A E  TH EYTH  TEE<\/b>\r\nGZORFMCJBMCYZOELZJGMOOZVFQMDSLEQGFQCKZECE\r\n A   NT  NT A SYA  N  A  EN  YSE  ET ASTS<\/b>             \r\nCZRQCXQFVQVYBBFJBQCXQVZFBD\r\nTA ETHE  E       ETHE A<\/b>     \r\n\r\nQ=E, C=T, Z=A, L=Y, E=S, X=H, M=N\r\n<\/pre>\n
I also know that Q=E, so another batch of digraphs:<\/p>\n
These might be HE or RE
\nXQ 3 (HE)
\nTQ 2
\nFQ 2
\nIQ 1
\nDQ 1
\nCQ 1 (TE)
\nQQ 1 (EE)
\nEQ 1 (SE)
\nRQ 1
\nVQ 1
\nBQ 1<\/p>\n
Probably TQ or FQ is RE.  F has the closest letter frequency to R, so I’ll try F=R.<\/p>\n
\r\nEZLZJIQAFZTQOCXQGMKCMYOSYDOYRXCGZDQVYCXTQLCXYFCQQO\r\nSAYA  E RA E THE N TN        HT A E  TH EYTH RTEE<\/b>\r\nGZORFMCJBMCYZOELZJGMOOZVFQMDSLEQGFQCKZECE\r\n A  RNT  NT A SYA  N  A REN  YSE RET ASTS<\/b>             \r\nCZRQCXQFVQVYBBFJBQCXQVZFBD\r\nTA ETHER E       ETHE AR<\/b>    \r\nQ=E, C=T, Z=A, L=Y, E=S, X=H, M=N, F=R\r\n<\/pre>\n
Ah-hah!  At the end of the first line, if Y=I and O=N, then that word is THIRTEEN, which was the subject of the message.  Except, we said M=N… let’s pull that out and try the different substitutions…<\/p>\n
\r\nEZLZJIQAFZTQOCXQGMKCMYOSYDOYRXCGZDQVYCXTQLCXYFCQQO\r\nSAYA  E RA ENTHE   T IN I NI HT A E ITH EYTHIRTEEN<\/b>\r\nGZORFMCJBMCYZOELZJGMOOZVFQMDSLEQGFQCKZECE\r\n AN R T   TIANSYA   NNA RE   YSE RET ASTS<\/b>            \r\nCZRQCXQFVQVYBBFJBQCXQVZFBD\r\nTA ETHER E I     ETHE AR<\/b>    \r\n\r\nQ=E, C=T, Z=A, L=Y, E=S, X=H, F=R, Y=I, O=N\r\n<\/pre>\n
More E digraphs:<\/p>\n
These might be EA, ER, EN, ES, or ED<\/p>\n
QC 3 (ET)
\nQV 3
\nQO 2 (EN)
\nQG 2
\nQL
\nQQ (EE)
\nQM
\nQF (ER)
\nQA<\/p>\n
Since we know EA, ER, EN, and ES, perhaps QV=ED.  The letter frequency looks good for that match.<\/p>\n
\r\nEZLZJIQAFZTQOCXQGMKCMYOSYDOYRXCGZDQVYCXTQLCXYFCQQO\r\nSAYA  E RA ENTHE   T IN I NI HT A EDITH EYTHIRTEEN<\/b>\r\nGZORFMCJBMCYZOELZJGMOOZVFQMDSLEQGFQCKZECE\r\n AN R T   TIANSYA   NNADRE   YSE RET ASTS<\/b>             \r\nCZRQCXQFVQVYBBFJBQCXQVZFBD\r\nTA ETHERDEDI     ETHEDAR<\/b>    \r\nQ=E, C=T, Z=A, L=Y, E=S, X=H, F=R, Y=I, O=N, V=D\r\n<\/pre>\n
Does nothing for me.<\/p>\n
Letters that are often doubled, as in sniff: ll, tt, ss, ee, pp, oo, rr, ff, cc, dd, nn<\/p>\n
Consider the BB in the last line.  Judging from the letter frequency (and eliminating the letters we know), it could be ll, cc, ff.  ll is most common, so we’ll try B=L.<\/p>\n
\r\nEZLZJIQAFZTQOCXQGMKCMYOSYDOYRXCGZDQVYCXTQLCXYFCQQO\r\nSAYA  E RA ENTHE   T IN I NI HT A EDITH EYTHIRTEEN<\/b>\r\nGZORFMCJBMCYZOELZJGMOOZVFQMDSLEQGFQCKZECE\r\n AN R T L TIANSYA   NNADRE   YSE RET ASTS<\/b>             \r\nCZRQCXQFVQVYBBFJBQCXQVZFBD\r\nTA ETHERDEDILL  LETHEDAR<\/b>    \r\nQ=E, C=T, Z=A, L=Y, E=S, X=H, F=R, Y=I, O=N, V=D, B=L\r\n<\/pre>\n
In the second line, towards the end, SE RET could be SECRET.  so we’ll try G=C.<\/p>\n
\r\nEZLZJIQAFZTQOCXQGMKCMYOSYDOYRXCGZDQVYCXTQLCXYFCQQO\r\nSAYA  E RA ENTHEC  T IN I NI HTCA EDITH EYTHIRTEEN<\/b>\r\nGZORFMCJBMCYZOELZJGMOOZVFQMDSLEQGFQCKZECE\r\nCAN R T L TIANSYA C NNADRE   YSECRET ASTS<\/b>             \r\nCZRQCXQFVQVYBBFJBQCXQVZFBD\r\nTA ETHERDEDILL  LETHEDAR<\/b>    \r\nQ=E, C=T, Z=A, L=Y, E=S, X=H, F=R, Y=I, O=N, V=D, B=L, G=C\r\n<\/pre>\n
I’m getting a sense that there are mistakes in there.<\/p>\n
Let’s try some trigraphs.<\/p>\n
Trigraphs are much like digraphs, but for three letters. Here are the most often seen trigraphs:
\nthe, and, tha, hat, ent, ion, for, tio, has, edt, tis, ers, res, ter, con, ing, men, tho<\/p>\n
I feel confident about all the letters in THIRTEEN, so THE should be solved.  Perhaps AND?  We have all those letters, A & D I don’t feel as solid about. If we look for three letter combinations with N in the middle, perhaps we’ll notice a different possibility for A or D.<\/p>\n
QOC (ENT)
\nYOS (INx)
\nDOY (xNI)
\nZOR (ANx)
\nZOE (ANS)
\nMOO (xNN)
\nOOZ (NNx)<\/p>\n
No duplicates, so not much to work with in terms of frequency.<\/p>\n
Perhaps THA?<\/p>\n
Keying off TH, which I have confidence in…
\nCXQ 3 (THE)
\nCXY 1 (THI)
\nCXT 1 (THx)<\/p>\n
T=A is more unlikely than Z=A, by letter frequency.<\/p>\n
If Z=A were wrong, it would be more likely that F, O or Y = A, because of letter frequency.  I’ve said F=R, O=N and Y=I, so something is probably wrong here.  I feel confident about F=R, O=N and Y=I (because of THIRTEEN).  M=A or X=A is possible.  What if we change Z=A to M=A?<\/p>\n
\r\nEZLZJIQAFZTQOCXQGMKCMYOSYDOYRXCGZDQVYCXTQLCXYFCQQO\r\nS Y   E R  ENTHECA TAIN I NI HTC  EDITH EYTHIRTEEN<\/b>\r\nGZORFMCJBMCYZOELZJGMOOZVFQMDSLEQGFQCKZECE\r\nC N RAT LATI NSY  CANN DREA  YSECRET  STS<\/b>           \r\nCZRQCXQFVQVYBBFJBQCXQVZFBD\r\nT  ETHERDEDILL  LETHED R<\/b>   \r\nQ=E, C=T, L=Y, E=S, X=H, F=R, Y=I, O=N, V=D, B=L, G=C, M=A\r\n<\/pre>\n
What would Z decrypt to, then?  Z=O is the next possibility by letter frequency…<\/p>\n
\r\nEZLZJIQAFZTQOCXQGMKCMYOSYDOYRXCGZDQVYCXTQLCXYFCQQO\r\nSOYO  E RO ENTHECO TAIN I NI HTCO EDITH EYTHIRTEEN<\/b>\r\nGZORFMCJBMCYZOELZJGMOOZVFQMDSLEQGFQCKZECE\r\nCON RAT LATIONSYO CANNODREA  YSECRET OSTS<\/b>           \r\nCZRQCXQFVQVYBBFJBQCXQVZFBD\r\nTO ETHERDEDILL  LETHEDOR<\/b>  \r\nQ=E, C=T, L=Y, E=S, X=H, F=R, Y=I, O=N, V=D, B=L, G=C, M=A, Z=O\r\n<\/pre>\n
A-ha!  I see CONGRATULATIONS there, if R=G and J=U.<\/p>\n
\r\nEZLZJIQAFZTQOCXQGMKCMYOSYDOYRXCGZDQVYCXTQLCXYFCQQO\r\nSOYOU E RO ENTHECA TAIN I NIGHTCO EDITH EYTHIRTEEN<\/b>\r\nGZORFMCJBMCYZOELZJGMOOZVFQMDSLEQGFQCKZECE\r\nCONGRATULATIONSYOUCANNODREA  YSECRET OSTS<\/b>             \r\nCZRQCXQFVQVYBBFJBQCXQVZFBD\r\nTOGETHERDEDILL ULETHEDOR<\/b> \r\nQ=E, C=T, L=Y, E=S, X=H, F=R, Y=I, O=N, V=D, B=L, G=C, M=A, Z=O, R=G, J=U\r\n<\/pre>\n
I just realized I missed an F=R at the bottom.<\/p>\n
\r\nEZLZJIQAFZTQOCXQGMKCMYOSYDOYRXCGZDQVYCXTQLCXYFCQQO\r\nSOYOU E RO ENTHECA TAIN I NIGHTCO EDITH EYTHIRTEEN<\/b>\r\nGZORFMCJBMCYZOELZJGMOOZVFQMDSLEQGFQCKZECE\r\nCONGRATULATIONSYOUCANNODREA  YSECRET OSTS<\/b>         \r\nCZRQCXQFVQVYBBFJBQCXQVZFBD\r\nTOGETHERDEDILLRULETHEDOR<\/b>  \r\nQ=E, C=T, L=Y, E=S, X=H, F=R, Y=I, O=N, V=D, B=L, G=C, M=A, Z=O, R=G, J=U\r\n<\/pre>\n
Given that the bottom line reads TOGETHER DE DILL RULE THE DOR__, I’m guessing V does not equal D, but rather W.<\/p>\n
\r\nEZLZJIQAFZTQOCXQGMKCMYOSYDOYRXCGZDQVYCXTQLCXYFCQQO\r\nSOYOU E RO ENTHECA TAIN I NIGHTCO EWITH EYTHIRTEEN<\/b>\r\nGZORFMCJBMCYZOELZJGMOOZVFQMDSLEQGFQCKZECE\r\nCONGRATULATIONSYOUCANNOWREA  YSECRET OSTS<\/b>            \r\nCZRQCXQFVQVYBBFJBQCXQVZFBD\r\nTOGETHERWEWILLRULETHEWOR<\/b> \r\nQ=E, C=T, L=Y, E=S, X=H, F=R, Y=I, O=N, B=L, G=C, M=A, Z=O, R=G, J=U, V=W \r\n<\/pre>\n
And WOR__ is obviosly WORLD, so B=L, D=D.  And, shoot, I already knew B=L, but missed it.  Crap.<\/p>\n
\r\nEZLZJIQAFZTQOCXQGMKCMYOSYDOYRXCGZDQVYCXTQLCXYFCQQO\r\nSOYOU E RO ENTHECA TAIN IDNIGHTCODEWITH EYTHIRTEEN<\/b>\r\nGZORFMCJBMCYZOELZJGMOOZVFQMDSLEQGFQCKZECE\r\nCONGRATULATIONSYOUCANNOWREAD YSECRET OSTS<\/b>           \r\nCZRQCXQFVQVYBBFJBQCXQVZFBD\r\nTOGETHERWEWILLRULETHEWORLD<\/b>   \r\nQ=E, C=T, L=Y, E=S, X=H, F=R, Y=I, O=N, B=L, G=C, M=A, Z=O, R=G, J=U, V=W, D=D\r\n<\/pre>\n
Some guesswork leads to: I=V, A=B, T=K, S=M, K=P.<\/p>\n
\r\nEZLZJIQAFZTQOCXQGMKCMYOSYDOYRXCGZDQVYCXTQLCXYFCQQO\r\nSOYOUVEBROKENTHECAPTAINMIDNIGHTCODEWITHKEYTHIRTEEN<\/b>\r\nGZORFMCJBMCYZOELZJGMOOZVFQMDSLEQGFQCKZECE\r\nCONGRATULATIONSYOUCANNOWREADMYSECRETPOSTS<\/b>            \r\nCZRQCXQFVQVYBBFJBQCXQVZFBD\r\nTOGETHERWEWILLRULETHEWORLD<\/b>  \r\nQ=E, C=T, L=Y, E=S, X=H, F=R, Y=I, O=N, B=L, G=C, M=A, Z=O, R=G, J=U, V=W, D=D, I=V, A=B, T=K, S=M, K=P\r\n<\/pre>\n
The Rot, with key 13.<\/p>\n
\r\nPLAINTEXT  ABCDEFGHIJKLMNOPQRSTUVWXYZ<\/b>\r\nCYPHER     MAGDQ?RXY?TBSOZK?FECJIV?L?\r\n<\/pre>\n
We can assume that the codewheel was rotated 13 times, and can be thus unrotated to get the base position.<\/p>\n
The C code I came across on the web to do this automatically is here<\/a>.  I modified it to spit out letters instead of numbers.<\/p>\n
What I didn’t know when I wrote the message was the real Cap’n Midnight decoder ring<\/a> was actually alphabetical order, just shifted (“rot”).  The folks that wrote the Captain Midnight C code must have been too appalled at the simplicity to match that.<\/p>\n
Well, that was a pointless use of several lunch hours.<\/p>\n","protected":false},"excerpt":{"rendered":"
A while back’s post was an encrypted message. Entry tags: gzdq Thirteen EZLZJ IQAFZ TQOCX QGMKC MYOSY DOYRX CGZDQ VYCXT QLCXY FCQQO GZORF MCJBM CYZOE LZJGM OOZVF QMDSL EQGFQ CKZEC E CZRQC XQFVQ VYBBF JBQCX QVZFB D<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[53],"class_list":["post-333","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-cryptography"],"_links":{"self":[{"href":"https:\/\/journal.electric-rocket.com\/index.php?rest_route=\/wp\/v2\/posts\/333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/journal.electric-rocket.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/journal.electric-rocket.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/journal.electric-rocket.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/journal.electric-rocket.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=333"}],"version-history":[{"count":0,"href":"https:\/\/journal.electric-rocket.com\/index.php?rest_route=\/wp\/v2\/posts\/333\/revisions"}],"wp:attachment":[{"href":"https:\/\/journal.electric-rocket.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/journal.electric-rocket.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/journal.electric-rocket.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}