According to Wikipedia, this homebrew cipher was originally used in PGP, before Phil Zimmermann replaced it with IDEA. Supposedly, insecurities in the algorithm were pointed out to him, leading to this change. While I could read the PGP 1.0 source code and see the implementation of the cipher, that wouldn't help me actually understand it. I can't seem to find any complete description of the algorithm or, particularly, its weaknesses other than what is provided on Wikipedia:

The chosen key schedule produces a total of 8 permutation tables, each a permutation of the numbers 0 to 255. Each round consists of 4 operations: XORing the block with one of the permutation tables, shredding or permuting individual bits throughout the block, an unkeyed diffusion called raking, and a substitution step using the permutation tables as S-boxes. The shredding step can either permute all 8 bit-planes independently, or in groups of 4, depending on control bit 3. The permutation tables stay the same through all rounds of encryption on a given block, but if control bit 5 is set, then the tables are regenerated after each block.

I could also find a published quote from the book which Wikipedia used as a citation:

After Biham and Zimmermann go their food and sat down, Zimmermann took out a few pages of computer listings. Within minutes, Birham was finding fundamental flaws in Bass-O-Matic. Some of the flaws were subtle-weaknesses that made the algorithm susceptible to differential cryptanalysis, which was Birham’s speciality. Others were more embarrassing, like a conceptual error in Zimmermann’s algorithm that prevented the last bit of each byte from being properly encrypted. After ten minutes of Birham’s onslaught, Zimmermann realized that Bass-O-Matic was a lost cause.

How did BassOmatic work, and what were the weaknesses that lead to its replacement?

This question has an open bounty worth +100 reputation from 比尔盖子 ending in 10 hours.

Looking for an answer drawing from credible and/or official sources.

BassOmatic was an insecure block cipher, developed by Phil Zimmermann and used in the original PGP 1.0, described by him as "a cautionary story I have told elsewhere". Although its implementation can be obtained from its source code, but there is no detailed description and analyze of its design, nor explanation on its weaknesses on the Internet. An authoritative answer from a cryptographer is needed, both for a historical understanding of PGP, and or the education of the public about the dangers of homebrew ciphers.

  • For what it's worth, a (tiny) bit more info can be found in the "Algorithm" section at but that's about all I could find about that 80s cipher thingy. If all fails, you could of course extract the exact workings of the cipher from the old PGP sourcecode (<= version 1). – e-sushi Sep 1 at 10:12
  • @e-sushi Yep, that does have a bit more info about the control bits, but it's just an exact copy of the Wikipedia page, so nothing I haven't already seen (I just didn't quote it). – forest Sep 1 at 19:21
  • 6
    For reference, everyone can download the original PGP 1.0 source code from, the BassOmatic implementation is available in basslib.c. – 比尔盖子 Nov 8 at 19:28

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.