Crypto AG was a company located in Switzerland that specialized in communication security. They produced a number of encryption machines (some similar to the infamous Enigma) used for secure communication.

The company was secretly bought in 1970 by the CIA and the German intelligence agency BND. It has recently been revealed (11. February 2020) that the CIA & BND were responsible for installing backdoors in Crypto AG's machines (with knowledge of some high level Swiss state officials). The operation was first known by the code name "Thesaurus" and later "Rubicon".

Crypto AG was apparently a desirable target for it's neutrality as it is a Swiss company and because they sold products to over 120 governments (Iran, Argentinia, Italy, Vatican City, UNO, etc.), indifferent of political orientation.

Edit: Further information

Machines / designs that were definitely and intentionally compromised:

  • C52 / CX52, first manufactured in 1951

    Many of the C-52 and CX-52 machines sold by Crypto AG were compromised to benefit the US and British national signals intelligence agencies, National Security Agency (NSA) and Government Communications Headquarters (GCHQ), respectively. (Wikipedia)

  • H460, first manufactured in 1967

    In 1967, Crypto released the H-460, an all-electronic machine whose inner workings were designed by the NSA.

    The warning proved prescient as Caflisch (American electrical engineer who applied and subsequently was hired by Crypto AG without knowledge of the American intelligence services) soon began probing the vulnerabilities of the company’s products. She and Spoerndli, a colleague in the research department, ran various tests and “plaintext attacks” on devices including a teletype model, the HC-570, that was built using Motorola technology, Spoerndli said in an interview.


    “The algorithms,” he said, “always looked fishy.”

    In the ensuing years, Caflisch continued to pose problems. At one point, she designed an algorithm so strong that NSA officials worried it would be unreadable. The design made its way into 50 HC-740 machines rolling off the factory floor before company executives discovered the development and stopped it. (Washington Post)

Machines / designs that were compromised with (so far) uncertain involvement of intelligence agencies (I have not yet found any reference other than Wikipedia mentioning these machines):

  • CD57, first manufactured in 1957

    Sullivan shows how the CD57 can be attacked using a hill climbing search technique. (Wikipedia)


These backdoors (as others) could apparently be achieved on the basis of mathematical principles.

My questions are:

  • How did the machines work?
  • How exactly did the backdoors work?
  • 3
    $\begingroup$ Bruce Schneier: "Back when the NSA was routinely weakening commercial cryptography, their favorite technique was reducing the entropy of the random number generator." $\endgroup$ Feb 12 '20 at 12:15
  • 2
    $\begingroup$ Didn't get much from the Washington post, but they did mention "repetition in short enough intervals". We may have to wait until more info becomes available. Or crack it ourselves of course, anybody got a (virtual) machine? $\endgroup$
    – Maarten Bodewes
    Feb 12 '20 at 14:26
  • 1
    $\begingroup$ @MaartenBodewes I will do some more research on the topic (since I live in Switzerland and speak the language I might find more sources). $\endgroup$ Feb 12 '20 at 15:00
  • 1
    $\begingroup$ Bruce Schneier in a comment yesterday: "Those early machines ran in output-feedback mode (key autokey in NSA language), so they did something to reduce the period of the keystream." Not clear to what degree he speaks from concrete knowledge vs. conjecture. There's also a lengthy comment by Clive Robinson arguing that it was likely deceptive key-generation methods that resulted in targets generating weak keys. $\endgroup$ Feb 12 '20 at 18:14
  • 2
    $\begingroup$ it seems that the folks @cryptomuseum were involved, cf. here cryptomuseum.com/intel/cia/rubicon.htm - let's hope some mathematical details wlll come out soon. From the existing documentation, at least for the older models, it looks as if they introduced basically OTP devices (cf cryptomuseum.com/manuf/crypto/friedman.htm, OTT). But technologically not so advanced countries couldn't create their own random numbers, so there was a fallback with a mechanical PRNG. I suspect that this (designing the PRNG to create weak entropy) would be an excellent vector of attack. $\endgroup$
    – ndbd
    Feb 14 '20 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.