45
$\begingroup$

I, myself, do not plan on getting into a situation where I would be unable to use a computer in order to communicate securely. However, I can think of many practical situations in which mental cryptography would be useful.

Is there a secure cryptosystem that is simple enough to be performed mentally?

Clearly, one of the challenges is remembering >100 bits of entropy to leverage, but I am assuming that this can be done beforehand.

How susceptible would any such system be to side channel attacks (like trash rummaging)?

Improve this question
$\endgroup$
7
  • 1
    $\begingroup$ I suppose "Pen & Paper" is much more easily done than "mentally". Would such answers be welcome, too? $\endgroup$
    – Paŭlo Ebermann
    Sep 28 '11 at 18:16
  • 3
    $\begingroup$ OTP's can be done mentally, would you consider OTPs a fair answer? $\endgroup$
    – Ethan Heilman
    Sep 28 '11 at 18:39
  • $\begingroup$ @John Gietzen: Can you be more specific about what you mean by "secure"? For example, do you mean secure against a computer or secure against other humans only? Also, secure for any number of plaintext/ciphertext pairs, only secure against ciphertext-only attacks, etc. $\endgroup$
    – mikeazo
    Sep 29 '11 at 1:37
  • $\begingroup$ What I mean is, if you were in duress and needed to communicate without your message being discovered. This would include being captured by a small faction, while still being able to leave coded messages, etc. $\endgroup$
    – John Gietzen
    Sep 29 '11 at 13:14
  • $\begingroup$ @IlmariKaronen, I would allow pen and paper as long as the side channel attacks could be rather easily mitigated. That is, once you are done with your encryption, you should be able to destroy the internal state of the cypher. $\endgroup$
    – John Gietzen
    Sep 29 '11 at 13:25
30
$\begingroup$

(Converted to answer from a comment.)

If pen and paper are permitted, one could probably carry out the RC4 algorithm fairly easily using 256 numbered pieces of paper (small post-it notes might be ideal, since they'd be harder to move by accident) arranged in a 16 by 16 grid (I'd suggest numbering the notes in hex for easier indexing), with two coins or something to keep track of the $i$ and $j$ indices. The algorithm itself is simple enough to memorize, too. To destroy the internal state, just shuffle the notes (and cut them up and burn them if you want to be sure).

The hard part would be key setup. The usual way of keying RC4 is not only laborious to do by hand (it's more or less equivalent to 256 encryption steps), but doesn't really shuffle the state all that well. The standard remedy for that is to discard the initial part of the output, which makes for even more work for our would-be computerless cryptographer. If you can safely carry around the state as a stack of notes, you can do it once and then just keep churning out more of the same keystream for each message, but if not, some alternative key setup mechanism would be highly recommended.

Also, there's always Solitaire, although it needs a deck of cards and has significantly worse biases than RC4. In fact, the design of Solitaire bears a strong resemblance to RC4, and was almost certainly inspired by it. Given the known weaknesses of Solitaire, if you want a hand cipher using playing cards it might be better to go with RC4-52 (i.e. standard RC4, only with 52 instead of 256 elements in the state array), although I don't know if anyone's done any serious cryptanalysis of that. (It's almost certainly weaker than normal RC4, but I'm not sure how much weaker. Probably still better than Solitaire, though.)

Improve this answer
$\endgroup$
10
  • 2
    $\begingroup$ You could also change the RC4 state to the 56 of a deck of cards. Skip all the tedious rc4 initialization by simply shuffling the cards. Give Alice and Bob an identical deck. For the amount of communication they should be able to do by hand, they can just continue with the same cards as long as they manage to keep in sync. $\endgroup$
    – Thomas Ahle
    Oct 17 '12 at 20:17
  • $\begingroup$ @Thomas: That's what I suggest in the last paragraph above, just with a standard 52 card deck. I wasn't aware of 56 card decks being that common, although apparently they do exist. $\endgroup$
    – Ilmari Karonen
    Oct 17 '12 at 20:34
  • 1
    $\begingroup$ Is RC4 really safe today? And if no, is Solitaire even less secure? $\endgroup$
    – Smit Johnth
    May 4 '13 at 21:33
  • 1
    $\begingroup$ @SmitJohnth: If used properly (derive the message key using a secure hash, and/or discard at least the first 768 or so bytes of output, don't encrypt more than about 1GB per message key), RC4 is still considered secure, in the sense of "no known practical attacks." I still wouldn't recommend it for new designs. Hand ciphers are kind of a special case, though: on one hand, one generally doesn't expect as much security from a hand cipher as from a computerized one; on the other, it would be quite hard for anyone to generate as much encrypted material by hand as most of the known attacks need. $\endgroup$
    – Ilmari Karonen
    May 4 '13 at 22:04
  • $\begingroup$ Ps. Here's a blog post I found with more details about the current security status of RC4. And yes, RC4-52 is probably less secure, and Solitaire even less so. They may both still be adequate for manual use (where messages are likely to be few and short), though. $\endgroup$
    – Ilmari Karonen
    May 4 '13 at 22:07
19
$\begingroup$

I can think of 2 cryptographic systems.

One that can be done with a deck of cards is a scheme called Pontifex (aka solitaire) that was developed for the book Cryptonomicon. Some more technical details and example of it in use at Bruce Schneier's website. Although it should be noted that some weaknesses have been discovered in Pontifex .

Another one, although this one involves lots of paper, is a straddling checkerboard which formed the basis of the system used by Soviet spies in the US (the full system was more complicated and called VIC). The spy using the system would only need to remember a phrase and a date. From these 2 items, one could generate the checkerboard. It takes a simple set of rules to encode a message. The book Kahn on Codes has a couple of pages where they explain how messages were encrypted with this scheme. Several spies were detected by finding intermediate work in trash.

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ Ah, Pontifex is exactly the kind of thing I was looking for. $\endgroup$
    – John Gietzen
    Sep 29 '11 at 13:15
  • 1
    $\begingroup$ A straddling checkerboard itself was not secure. It also involved the use of a One-Time Pad to actually encrypt the message before sending it over the radio. $\endgroup$
    – WAR10CK
    Aug 23 '15 at 13:45
3
$\begingroup$

A self-shrinking LFSR can be implemented using nothing but a couple of decks of cards.

  • 0 equals face down
  • 1 equals face down.

You can then split the deck at each tap point and XOR the items in your head. After the XOR is done, you move the cards on to next split deck; this has the effect of shifting the register.

Key set-up is easy, each iteration is extremely easy however it would be painfully slow to operate.

Given a sufficiently long and dense polynomial, it is however, secure.

Improve this answer
$\endgroup$
3
$\begingroup$

People have long used code systems for this purpose, instead of ciphers. With a code, you pre-establish entire messages. "John has a long mustache" might mean "sabotage the phone lines". Or the number of suits on the dry cleaning order might indicate the size of the enemy force.

Sometimes the codes are awkward, and give away the existence of the code without giving up the meaning. A telegraph agent once received a reply to a message that asked "is mother 'dead' or 'deceased'?" which was a pretty pointless clarification to ask for unless there was a hidden meaning.

Used once, they're as secure as the endpoints who protected them. Used multiple times, they leave a distinctive pattern that can be decoded.

Improve this answer
$\endgroup$
2
$\begingroup$

this doesn't suit the entropy part

the old & basic encoding mechanisms like Caesar (easy) or Substitution (concentrate) Cipher could be done mentally too.

if you simply want to speak or signal an encoded message to few in public place. You could do "gibberish talk", which has several ways..... with basic outline as

  • decide on peices of 'gibberish' (some jumbled up letters) and their place-holders in the sentence (like spaces, fullstop); you can even choose multiple gibberish for same placeholder and use randomly any of it for more Confusion

  • decide on break-point length for actual words, after which the gibberish has to be inserted..... you can even have a series of queued break-points if you can process it

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ This is interesting, but not particularly secure, because simple frequency analysis could discover the message fairly easily. $\endgroup$
    – John Gietzen
    Sep 29 '11 at 13:16
  • $\begingroup$ @JohnGietzen agreed, not really very secure..... just something related to Q. popped up, so I shared it $\endgroup$
    – AbhishekKr
    Sep 30 '11 at 8:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.