Professional Documents
Culture Documents
03 Bean HistoCrypt2021
03 Bean HistoCrypt2021
Richard Bean
School of Information Technology and Electrical Engineering
University of Queensland, Australia 4072
r.bean1@uq.edu.au
Meanwhile, a period of 84 is often seen with • p(O) + k71 = p(E) + k21 = c(F) =⇒ k71 6=
base eight and primer length five, further ex- k21
plained below.
• p(N) + k25 = p(O) + k26 = c(Q) =⇒ k25 6=
3 Search k26
Given the 24 known plaintext letters, we discov- • p(T ) + k24 = p(L) + k66 = c(V ) =⇒ k24 6=
ered that a simulated annealing search (see for in- k66
• p(A) + k31 = p(K) + k73 = c(K) =⇒ k31 6= 267178388511636279989
k73 687754542999618857963
265958144395872435967
• p(H) + k29 = p(B) + k63 = c(N) =⇒ k29 6= 845352988717658831361
k63 44975836231985
• p(S)+k32 = p(T )+k33 = c(S) =⇒ k32 6= k33
Table 6: Expansion of 26717 primer at base 10
• p(I) + k67 = p(N) + k68 = c(T ) =⇒ k67 6=
k68
method used to determine the most likely key
• p(R) + k27 = p(C) + k72 = c(P) =⇒ k27 6= primers. In this case, starting with the key 98800
k72 gives an index of coincidence of 0.0625, which is
the highest of any of the keys and closest to the
• p(S) + k23 = p(T ) + k28 = c(R) =⇒ k23 6= index of coincidence of typical English plaintext.
k28 The restrictions above can be applied to primers
For base 10, primer length 5, out of the ini- of other bases and key lengths: for instance,
tial 99,999 possible non-zero keys, this left 1,040 the only possible base 10, four digit primers are
remaining. If the digits in each key were ran- 33015 , 6740, and 9903, and the four possible base
domly chosen and uncorrelated within each key, eight, five digit primers include 00351 and 00537.
we have 21 inequalities and one equality at base As seen in Table 7 the expansions of these base
10; the proportion of keys satisfying all these eight keys have period 84 and the extra property
would be ( 109 21 1
) ( 10 ) = 0.01094, which implies in that all columns at width seven, as well as at width
some sense that the Gromark key digits are ap- 21, have either all odd or all even key digits.
proximately “random”.
003510306133674615327
After this, we can apply further restrictions.
605156566333416675745
The SageMath software (Stein, 2007) allows us to
443110742173630211323
compute the Gröbner basis for the set of equations
245556122373452271741
showing the relationship between the 24 plaintext
00351030613367
and ciphertext letters. This leads to another set of
14 inequalities and one equality which each have
Table 7: Expansion of 00351 primer at base eight
either four or six terms. The full set may be found
in the Github source. After this, different key expansion rules can be
This process ultimately showed that only 39 dif- tried, perhaps inspired by the raised letters on the
ferent primers (for the base 10 five digit case) sculpture. We restricted ourselves to rules where
could lead to the 24 letters of known plaintext in the first digit in the primer (shift register) is used
the correct positions. in the generation function, as explained in Beker
Two of these primers, 26717 and 84393, are and Piper (1982, p. 183).
equivalent, up to length 97, using a variation of Although many plaintexts close to ordinary En-
an observation of Blackman (1989): the keys are glish were discovered, none were entirely convinc-
inverses of each other (modulo 10). So, for any ing. If a Gromark variant was indeed used in the
given plain and cipher alphabet P and C, the result K4 encryption process, with a more general key
of encrypting with 26717 is equal to the result after expansion rule, it becomes difficult to test all the
encrypting with 84393, with the original alphabets possibilities. Instead, it may be worth consider-
P and C reversed. See Table 6. ing implications of the other observations in this
These are the only two of the 39 keys which use paper.
only nine different digits. Of the 99,999 keys of
length 97, only 88 keys do not contain the zero 4 Conclusion
digit anywhere.
One of Blackman’s ideas is that, for a given nu- With the use of Monte Carlo sampling analy-
meric key, the index of coincidence can be cal- sis, the known plaintext released by Sanborn pro-
culated for the ciphertext letters corresponding to 5 Which reminds one of the Internet mystery “Cicada
each digit, and the average taken. This is the 3301”
vides strong indications that transposition is not Bob Bogart. 2019. CNN Documentary about Kryp-
involved in the K4 encryption process. tos a making of report with many photographs.
https://scienceblogs.de/klausis-krypto-
If the “Gromark” cipher of the ACA was used as kolumne/2019/03/15/cnn-documentary-
the encryption method, this would explain many about-kryptos-a-making-of-report-with-
of the observed properties of the ciphertext and many-photographs/.
known plaintext. The “unicity distance” (Deav-
Joan Boyar. 1989. Inferring sequences produced by
ours, 1977b) of the Gromark cipher is approxi- pseudo-random number generators. Journal of the
mately 48 letters, not accounting for the numeric ACM (JACM), 36(1):129–141.
primer, which means the solution would be unique
at a ciphertext length of 97 letters. Lambros D. Callimahos. 1977. Military Crypt-
analytics Part III. National Security Agency.
As the Gromark cipher is the inspiration for an- https://www.governmentattic.org/39docs/
other high-security cipher of Rubin (1996) such NSAmilitaryCryptalyticsPt3 1977.pdf.
a cipher may be quite difficult to solve, fulfilling
Sanborn’s stated intention of it “going on for a Daikon. 2015. Things I noticed about Z340.
http://www.zodiackillersite.com/
century, hopefully long after my death.” (Sanborn, viewtopic.php?f=81&t=2625.
2009)
Charles David. 1996. A World War II German army
Acknowledgments field cipher and how we broke it. Cryptologia,
20(1):55–76.
The author wishes to thank Ed Hannon for his ex- Cipher A Deavours. 1977a. The kappa test. Cryptolo-
tensive correspondence on this subject, and also gia, 1(3):223–231.
Jim Gillogly and Eleanor Joyner (SCRYER and
HONEYBEE of the ACA). Cipher A Deavours. 1977b. Unicity points in crypt-
analysis. Cryptologia, 1(1):46–68.
Wayne G Barker. 1984. Cryptanalysis of Shift- Jim Gillogly. 1999a. another news article
Register Generated Stream Cipher Systems, vol- on Kryptos. https://groups.google.com/g/
ume 39. Aegean Park Press. sci.crypt/c/HTQqcW9XDAI/m/yC JQZYxBPUJ.
Craig Bauer, Gregory Link, and Dante Molle. 2016. Jim Gillogly. 1999b. Kryptos Morse code.
James Sanborn’s Kryptos and the matrix encryption https://groups.google.com/g/sci.crypt/
conjecture. Cryptologia, 40(6):541–552. c/d3SNKxTYsBA/m/BoQwYMWdWQIJ.
Edward Hannon. 2011. Oct 8th DC Meet with San- Joan B Plumstead. 1982. Inferring a sequence gener-
born and Scheidt. https://kryptos.groups.io/ ated by a linear congruence. In 23rd Annual Sym-
g/main/message/12611. posium on Foundations of Computer Science (sfcs
1982), pages 153–159. IEEE.
Joshua Holden. 2018. The mathematics of secrets:
cryptography from Caesar ciphers to digital encryp- Redacted. 2007. The CIA Kryptos Sculpture: A
tion. Princeton University Press. summary of previous work and new revelations
in working toward its complete solution. https:
AJ Jacobs. 2020. Ed Scheidt Kryptos Tran- //www.nsa.gov/Portals/70/documents/news-
script. https://kryptos.groups.io/g/ features/declassified-documents/cia-
main/files/PersonalFolders/AJJacobs/ kryptos-sculpture/KRYPTOS Summary.pdf.
EdScheidtKryptosTranscript.pdf.
James Reeds. 1977. “Cracking” a random number
David Kahn. 1996. The Codebreakers: The compre- generator. Cryptologia, 1(1):20–26.
hensive history of secret communication from an-
Eugene Rogot. 1975a. Cycles for the Gromark Run-
cient times to the internet. Simon and Schuster.
ning Key. The Cryptogram, 41(1).
Tim Kirchner. 2003. Don’t know what this means, Eugene Rogot. 1975b. Gromarks 1-4. The Cryp-
but... . https://kryptos.groups.io/g/main/ togram, 41(5).
message/232.
Frank Rubin. 1996. Designing a high-security cipher.
Donald Knuth. 1985. Deciphering a linear congruen- Cryptologia, 20(3):247–257.
tial encryption. IEEE Transactions on Information
Theory, 31(1):49–52. Jim Sanborn. 2009. Oral History inter-
view with Jim Sanborn, 2009 July 14-16.
George Lasry. 2018. A methodology for the cryptanal- https://www.aaa.si.edu/collections/
ysis of classical ciphers with search metaheuristics. interviews/oral-history-interview-
kassel university press GmbH. jim-sanborn-15700.
Geoffrey LaTurner. 2016. New member introduc- Klaus Schmeh. 2015. 2015-10-25-Kryptos Workshop.
tory message. https://kryptos.groups.io/g/ https://youtu.be/25YFYKKKkDo?t=2704.
main/message/18246.
Christian Schridde. 2020. Kryptos The Cipher Part
Frank W. Lewis. 1992. Solving Cipher Prob- 4. http://numberworld.blogspot.com/2020/
lems: Cryptanalysis, Probabilities and Diagnostics. 07/kryptos-cipher-part-4.html.
Aegean Park Press, Laguna Hills, CA.
John Schwartz. 2014. Another Kryptos Clue is
William Mason. 2012. ACA Reference Statis- offered in a 24 year old mystery at the CIA.
tics. https://bionsgadgets.appspot.com/ https://www.nytimes.com/2014/11/21/us/
gadget forms/acarefstats.html. another-kryptos-clue-is-offered-in-a-
24-year-old-mystery-at-the-cia.html.
William Mason. 2013. Compare unknown ci-
pher against ACA cipher types (extended). Ferdinando Stehle. 2000. help needed to break
http://bionsgadgets.appspot.com/ KRYPTOS. https://groups.google.com/g/
gadget forms/refscore extended.html. sci.crypt/c/EYd9673EihM.
William Mason. 2016. Neural William Stein. 2007. Sage mathematics software.
net ID test collection. http:// http: // www .sagemath .org/ .
bionsgadgets.appspot.com/gadget forms/
Jarl Van Eycke. 2015. Schemes 340. http://
nnet id test collection.html.
www.zodiackillersite.com/viewtopic.php?p=
Greg Materna. 2020. Keyword for K4. 38542.
https://aivirai.com/2020/08/24/4-3-
kryptos-aivirai-muko-series-and-the-
keyword-for-k4/.