From view-source:https://web.archive.org/web/19990224060310if_/http://www.cl.cam.ac.uk:80/PGP/pgpdoc1/pgpdoc1_29.html
:
When I was in college in the early seventies, I devised what I believed was a brilliant encryption scheme. A simple pseudorandom number stream was added to the plaintext stream to create ciphertext. This would seemingly thwart any frequency analysis of the ciphertext, and would be uncrackable even to the most resourceful Government intelligence agencies. I felt so smug about my achievement. So cock-sure.
Years later, I discovered this same scheme in several introductory cryptography texts and tutorial papers. How nice. Other cryptographers had thought of the same scheme. Unfortunately, the scheme was presented as a simple homework assignment on how to use elementary cryptanalytic techniques to trivially crack it. So much for my brilliant scheme.
By Philip Zimmermann, according to the about page of that same website. Emphasis mine.
The crux of it is "A simple pseudorandom number stream was added to the plaintext stream to create ciphertext." This can be read multiple ways:
- it is added to the end (unlikely)
- it is interjected as in "h4e7l2l5o" (also unlikely, unless he meant the numbers are turned into letters, in which case I find it somewhat unlikely)
- the numbers are added to each character
The latter seems like the only sensical option to me. But as far as I know, adding (equivalent to xor, security-wise) random numbers to each position is actually secure, assuming a good source of randomness. But it sounds like the scheme is broken using "elementary cryptanalytic techniques", not the underlying RNG. And of course the RNG (which has to qualify as CSPRNG) is the crux of such an algorithm, not the way of mixing its output with the plaintext.
The only thing I can think of is that it is unauthenticated, but that's rather a flaw in bad usage and not in this primitive itself. Does anyone know what "elementary cryptanalytic techniques" Phil is talking about? He makes it sound as though any basic cryptographer should have come across it and would know what it means (and how to break it), but I don't.