From: ichudov@algebra.com (Igor Chudov @ home)
Date: Thu, 9 Jan 1997 23:50:57 -0800 (PST)
To: mycroft@actrix.gen.nz (Paul Foley)
Subject: Re: encryption program
In-Reply-To: <199701100342.QAA20144@mycroft.actrix.gen.nz>
Message-ID: <199701100744.BAA07018@manifold.algebra.com>
MIME-Version: 1.0
Content-Type: text


Paul Foley wrote:
> 
> On Wed, 8 Jan 1997 19:32:20 -0600 (CST), Igor Chudov wrote:
> 
>    Cypherpunks, why don't we try to crack his encryption program? It seems
>    like a fun exercise.
> 
> Well, a few minutes looking at it turned up the following:
> 
> * Capitalisation and word lengths are retained in the ciphertext, so
>   there's no transposition involved (or he's being sneaky to make it
>   look that way :-) )

I also did a frequency analysis on letters of the ciphertext. Here's the
output of my frequency program: 

a:71 b:72 c:66 d:55 e:48 f:57 g:68 h:49 i:72 j:52 k:59 l:48 m:77 n:80
o:41 p:70 q:59 r:63 s:62 t:63 u:53 v:55 w:62 x:60 y:45 z:66

Min = 41, Max = 80, mean = 60.500000, std = 10.044899

16 letters' frequencies are within 50--70, 10 are out, which 
suggests that the distribution may not be "normal". For a normal the
proportion should be something like 84:16.

I also tried xoring the plaintext line with the ciphertext line, w/o
much enlightenment.

> * The two 'e's in the first word have different ciphertext equivalents,
>   so it's not a single-alphabet substitution

yes

> * The words "wjq nwcc" occur together twice, 300 characters apart,
>   the word "iyn" occurs three times, 375 and 300 characters apart,
>   the word "fhw" occurs twice, 1400 characters apart, and
>   the word "git" occurs twice, 500 characters apart.  This suggests
>   a repeating key of length 5 or 25 characters.

I also likes "follows": "vkbcjtp" note how ll gets translated to "bc".
That suggest that after some encryption of each letter from the plaintext
there is a consecutively increasing number added.


> * However, the letter 'r' in "Here" and "encryption" and the letters
>   'am' in "example" and "program" occur 25 characters apart and have
>   different ciphertext equivalents.  Possibly the key position is
>   being incremented when "encrypting" digits and other non-alphabetic
>   symbols, so my counts above (only letters) are wrong.

> Also, I suspect that in the following ciphertext, EJMDLH.WKN and
> ZFIYVZ.XGA are "CONFIG.SYS", KALMF is "FILES" and "ZPKQUST" is
> "BUFFERS".

agree, there is a lot of other similar stuff
 
>    ##>      Pbg qpypmjf EJMDLJ.WKN prbthucy hxzb tbcmsfs iyn bsfijsyey hdokz:
>    ##> 
>    ##>       KALMF=20
>    ##>       ZPKQUST=20
>    ##> 
>    ##>      Z ixyh ZFIYVZ.XGA crxg ckqm wam wjq nwcc qjt QMUSAXH dsi ei:
> 
> -- 
> Paul Foley <mycroft@actrix.gen.nz>       ---         PGPmail preferred
> 
> 	   PGP key ID 0x1CA3386D available from keyservers
>     fingerprint = 4A 76 83 D8 99 BC ED 33  C5 02 81 C9 BF 7A 91 E8
> ----------------------------------------------------------------------
> Life is a POPULARITY CONTEST!  I'm REFRESHINGLY CANDID!!
> 



	- Igor.