In this article, we demonstrate a subtle but devastating backdoor in finite-field Diffie–Hellman. By computing public keys modulo $p^2$ instead of $p$ while restricting the secret exponent to $x \leq p-1$, the discrete logarithm becomes efficiently recoverable using Fermat quotients. We show the full derivation and provide a working Sage implementation. Backdoors are always bad — but they are catastrophic when they are embedded in a fundamental primitive like Diffie–Hellman key exchange. If your browser shows a green lock, you assume your connection is secure. But what if the implementation of Diffie–Hellman contains a tiny change that looks harmless in code review — and yet allows an attacker to recover the private exponent in milliseconds? In this post I’ll show a nasty little backdoor that requires only a tiny modification: using a modulus of $p^2$ instead of $p$, while keeping the secret exponent bounded by $p$ This ...
Elgar seems to have been so familiar with his cipherbet, that he even was able to quickly write some notes or annotations. Which means, that he either learned this cipherbet by heart or he could quickly deduce the corresponding cipher symbol from a given letter. And if so, why shouldn't it be possible that he quickly writes to Penny the more or less irrelevant note
as Tim Roberts solution suggests? In Figure 1 one can the three Pigpen circles for his solution.
The red marked letters indicate symbols that are not used in the Dorabella cipher. Of course, he did not use this representation but used the key setence
"LADY PENNY, WRITING IN CODE IS SUCH BUSY WORK", but this is how it
would look like.
"P.S. Now drocp beige weeds set in it – bure idiocy – one endtire bed! Luigi Ccibunud lu'ngly tuned liuto studo two."
or reinterpreted
"P.S. Now droop beige weeds set in it - pure idiocy - one entire bed! Luigi Ccibunud luv'ngly tuned liuto studo two."
as Tim Roberts solution suggests? In Figure 1 one can the three Pigpen circles for his solution.
 | |
| Figure 1. The Pigpen circles for T. Roberts solution. |
 |
| Figure 2. The cipherbet of Roberts (borrowed from www.ciphermysteries.com) |
Applying this cipherbet to the Liszt-Fragement yields gibberish, which is not surprising, since he seems to (if Roberts is right) have chosen a special version for this Dorabella cipher.
To be honest, the chances that Robert's recovered plaintext is wrong are almost negligible. If a simple monoalphabetic substitution of a ciphertext yields not only English words, but in a meaningful order, then it is hard to believe that it is just a coincidence. There are so many letter dependencies in the text that it has to be correct somehow.
So, albeit i think it is overall the correct solution, it still bothers me that there are some shortcomings in its explanation.
In 1896, the Pall Mall Magazine published a code challenge, said to be "uncrackable", which finally was solved by E. Elgar. It was the Nihilist cipher and he was so proud of his solution that he painted it later on a wooden floor. He explained the solution on a set of nine cards (the Courage card set). On the first of these cards he drew the symbols:
I am not sure if the order is correct. Since this is a full rotation of the 3-cusps symbols concatenated with the two other symbols in upright direction, its hard to believe that this encodes a word. What could have be his intention to draw this symbols on that card set?
To be honest, the chances that Robert's recovered plaintext is wrong are almost negligible. If a simple monoalphabetic substitution of a ciphertext yields not only English words, but in a meaningful order, then it is hard to believe that it is just a coincidence. There are so many letter dependencies in the text that it has to be correct somehow.
So, albeit i think it is overall the correct solution, it still bothers me that there are some shortcomings in its explanation.
In 1896, the Pall Mall Magazine published a code challenge, said to be "uncrackable", which finally was solved by E. Elgar. It was the Nihilist cipher and he was so proud of his solution that he painted it later on a wooden floor. He explained the solution on a set of nine cards (the Courage card set). On the first of these cards he drew the symbols:
 |
| Figure 3. The symbols from the Courage card set. Order unknown. |
While Tim's 'solution' is tantalizing, the method he uses is too flexible and that flexibility opens up many more possible solutions. It's unlikely that it's correct.
ReplyDeletePersonally, I think we stand little to no chance of deciphering the message. It is almost positively not a mono-alphabetic substitution cipher (it completely fails on all the best known decryption algorithms),
and it's highly unlikely that Elgar thought the recipient had the skills to decipher anything more complex than that.
My guess is that the solution is very simple, but requires very specific information that Elgar assumed Dora would remember, or it is just a simple tease (with no solution at all)...but who knows.
It's fascinating how Elgar was able to decipher complex codes like Nihilist and potentially apply similar skills to the Dorabella cipher.
ReplyDelete