Al Qaeda crypto reportedly fails the test

[John Denker]

Ian Grigg wrote:
> 
> Read about one of their coding systems here:
> 
> http://www.thesmokinggun.com/archive/jihad13chap1.html

Perry wondered:

>> ... if the document on the "Smoking Gun" website is even remotely 
>> real. It is amazingly amateurish -- the sort of code practices that
>>  were obsolete before the Second World War.

I believe it's real.  As for WWII, remember that Lt. John F.
Kennedy used a Playfair cipher to arrange the rescue of his
PT-109 crew.  That doesn't mean that Playfair is unbreakable
in general.

As Ian pointed out in his commentary:

> http://www.financialcryptography.com/mt/archives/000119.html

there is such a thing as a "field cipher" and it is appropriate
to use it for *some* purposes.

========

It appears there are two different conversations going on
here.  It may be useful to distinguish between:
  -- a cryptosystem, writ small,
  -- a communication security system, writ large.

IF (!) a field cipher had been used for long-term storage
of lengthy al-Qaeda surveillance reports, it would have
been a gross misapplication of the field cipher.  But ...
   a) I don't think that's what happened in this case, and
   b) Even if it did happen, IMHO that sort of thing should
not be considered a failure of the cryptosystem _per se_.
Instead it should be considered a failure of the comsec
system in the larger sense.

By way of analogy: Students misapply Newton's 2nd law of
motion all the time, but that doesn't mean the laws of
motion are invalid.

==========

It now appears that our current discussion of field ciphers
is moot.  It is now reported that al Qaeda's commsec system
succumbed to _practical cryptanalysis_.  That is, a communcation
officer in a highly responsible post was turned, i.e. arrested
then left in place as a double agent.  According to the news
wires:

> Reuters learned from Pakistani intelligence sources on Friday that 
> computer expert Mohammad Naeem Noor Khan, arrested secretly in July, 
> was working under cover to help the authorities track down al Qaeda 
> militants in Britain and the United States....

The outing of Khan will presumably be richly covered in news/talk
shows in coming days.

If reports are true, then Tom Ridge has found an amazingly
unhappy medium:  divulging enough detail to burn an invaluable
source, but not enough detail to make ordinary citizens believe
the alerts are well-founded.

This would not be the first time that high government officials
have allegedly burned important sources.  It was widely reported
that in 1998 bin Laden stopped using his Inmarsat phone when US
officials boasted about their ability to track his position.

=============================

Here's a challenge directly relevant to this group:  Can you
design a comsec system so that pressure against a code clerk
will not do unbounded damage?  What about pressure against a
comsec system designer?

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com