Computer Security and Cryptography

6.14 CRIBBING SZ40 CIPHERTEXT

Much of the cryptanalysis of SZ40 ciphertext described next is included in a Master's Thesis at U.C. Santa Barbara by Nitesh Saxena.

Depth (in ciphertext) occurs when two or more SZ40 ciphertexts y_i (i = 1, 2,…) were intercepted in a period

• During which the pin-wheels are unchanged and
• Both messages are identified with the same indicator.

The computation of the differences with depth Δ y_1,2 ≡ y₁ + y₂ = Δx_1,2, ≡ x₁ + x₂ eliminates the key. The differenced plaintext might be searched for probable words (cribs); for example,

• German cipher-clerks often prefaced their messages with SPRUCHNUMMER (= message number), and
• Messages might contains references to various organizations such as LUFTWAFFE, WEHRMACHT, OBERKOMMANDO, or GESTAPO.

For example, if the crib SPRUCHNUMMER might be slid across the differenced ciphertext; with the letter S in position j, the XOR of the crib and the difference plaintext produces putative plaintext:

The fragment of putative plaintext x₂(j), x₂(j + 1), x₂(j + 2),…, x₂(j + 8), x₂(j + 9), x₂(j + 10) is tested; if it is (grammatically) readable text, a hit has been obtained, which might reveal additional plaintext. With good luck, both plaintexts x₁ and x₂ may be read and the common key k used to encipher them recovered.

Early in the GCHQ SZ40 cryptanalysis, an interception of the near-repeat of a message of 4000 characters enciphered ...