Download presentation
Presentation is loading. Please wait.
Published byJeffry Horton Modified over 9 years ago
1
Solitaire CRyptography Applications Bistro 8 April 2004
2
Tuesday: –High-tech crypto with sophisticated, expensive equipment using the principles of quantum mechanics to solve a problem most people don’t have Today: –Low-tech crypto with ordinary, inexpensive equipment using the principles of shuffling to solve a problem most people don’t have
3
Solitaire Output-feedback mode stream cipher Designed by Bruce Schneier in 1999 Implemented using a deck of cards Featured in Neal Stephenson’s novel Cryptonomicon
4
Tin-foil hat time You want to communicate securely with other people You don’t want the secret police to be able to decode your messages You don’t want to have to keep around incriminating evidence, such as a computer with PGP You want to be able to do this without electricity
5
Requirements Cannot rely on security-through-obscurity Must be secure even against a well-funded adversary Must be simple enough that someone can remember it Must not require incriminating equipment Must be entertaining enough to go in a Neal Stephenson novel
6
Overview of Solitaire The key consists of a shuffled deck, with two jokers: A and B A sequence of cuts and rearrangements generates a pseudo-random keystream The keystream is added to the plaintext, modulo 26, to encrypt The keystream is subtracted from the ciphertext to decrypt
7
The Algorithm 1.Move the A-joker one card down 2.Move the B-joker two cards down 3.Perform the triple-cut 4.Perform a count-cut, using the card on the bottom to count with 5.Find the output card, using the card on the top to count with
8
1. Moving the A joker If the joker is on the bottom, move it to one below the top card 99 22 66 *A*A 10 9 99 22 *A 66 10 9
9
2. Moving the B joker If the joker is on the bottom, wrap around like we did with the A joker 22 88 JJ *B*B 33 Q 22 88 Q JJ 33 *B
10
AA 3. The Triple-Cut AA AA AA AA *B AA AA AA 6 *A AA AA AA 22 AA AA AA 22 *B AA AA AA 6 *A AA AA AA AA AA
11
4. The Count Cut 55 55 55 55 JJ 55 55 55 55 55 55 55 55 55 55 3 55 55 55 55 55 JJ 55 55 55 55 55 3 55 55 55 55 JJ 55 = 0 + n = 13 + n = 26 + n = 39 + n *A = *B = 53
12
5. Finding the output card 77 55 55 55 JJ 55 22 JJ 55 55 55 55 55 55 55 3 55 = 0 + n = 13 + n = 26 + n = 39 + n *A = *B = 53 1.Convert the top card to a number 2.Count down that many from the top 3.The next card is the output card 4.If the output card is a joker, go back to step 1 5.The deck does not change J = 13 + 11 = 24
13
PLGRM BZIVF JGH A 1 J10S19 B 2 K11T20 C 3 L12U21 D 4 M13V22 E 5 N14W23 F 6 O15X24 G 7 P16Y25 H 8 Q17Z26 I 9 R18
14
Key Distribution Solitaire is a symmetric cipher, so we must have a key known to both parties –Use identically shuffled decks: 54! 2 237 requires distributing decks requires good shuffling –Use a bridge ordering: 52!/(13!) 4 2 95 need way to position jokers the secret police read newspapers too –Use a passphrase to key the deck
15
Keying the Deck with a Passphrase 1.Move the A-joker down one card 2.Move the B-joker down two cards 3.Perform the triple cut 4.Perform the count cut based on top card 5.Perform a second count cut based on a letter from the passphrase
16
How many shuffles does it take to be “random”? In an ideal riffle shuffle, we split the deck in halves, then interleave the halves Cards in the same half are not reordered This yields 54!/(27! 27!) 2 50 We’d need five shuffles to reach 2 237
17
Shuffling, in practice In practice, the 2 50 interleavings are not equally likely –cards near each other don’t separate much Keller [1995] claims seven shuffles are needed
18
How many bits are in a passphrase? English text is highly redundant –some studies claim you get 1.4 bits per character –You need at least 80 characters
19
Bias in Solitaire One would expect that, if Solitaire is a good CPRNG, the probability of getting the same keystream letter twice in a row would be 1/26 Crowley [2001], through simulations, found that this is not the case: it appears to be about 1/22.5 This information could, in theory, be exploited to form an attack
20
Non-reversibility The cipher was designed to be reversible –You should be able to reconstruct the previous deck state from the current deck state However, the rules allowing the jokers to move from the bottom to the top of the deck are not reversible: * 1 2 3 4 5 6... 51 52 1 * 2 3 4 5 6... 51 52 1 2 3 4 5 6... 51 52 * 1 * 2 3 4 5 6... 51 52 Reversibility is not necessarily a problem, but reversible ciphers are easier to analyze
21
Practical Issues Solitaire uses output-feedback mode: –A single bit error in the ciphertext results in a single-bit error in the plaintext (good) –Not self-synchronizing: drop a bit of ciphertext and everything after it is lost (bad) –The keystream can be generated in advance of receiving the message Encryption and decryption are slow Key distribution is difficult Potential attacks based on lack of randomness
22
Future Work Develop attacks on Solitaire Develop a hand-computable asymmetric algorithm –This would address key distribution problem –You could, in theory, compute RSA by hand, but not with reasonable key sizes (for further details, see Dave’s license tag)
23
Other Games A deck of cards doesn’t have enough entropy for an assymetric key (237 bits) –Two decks might be enough (474 or 578 bits) An 8x8 chessboard has 64!/(32!8!8!2!2!2!2!2!2!) 2 141 states –a group in CS588 designed a chess-based cipher last year A 19x19 go board has 3 361 2 572 states Cellular automata might be computable by hand as well
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.