*** Anagrams: Transpositions *** Instead of (or in addition to) renaming characters (substitution) We can rearrange them Don't change the characters, mix them up Trivial example: Reverse them "palindrome" is meaningful (the same) forwards and backwards Or reverse each word: Or mix each word up randomly. Note that single-letter frequencies are unchanged Generally, especially for long messages, many meaningful rearrangements are possible if there are no constraints on rearrangements. live <==> vile <==> evil Makes cryptanalysis problematic for arbitrary transpositions About as useful (and not as nice) as one-time pad since k! transpositions means very long keys If a particular transposition is reused, however, then crypto-analytic attack is feasible. (as with one-time pads) "Block transposition" is reuse of same re-arrangement on successive groups of n characters. * Specify with list of numbers specifying permutation. * Key phrase works for n <= 26 (use character values mod n) Classic (very insecure) transposition ciphers Tape wrapped around cylinder or cone Transposition of rows and columns in rectangular block Ciphertext only attack on block transposition ciphers Secret is rearrangement scheme, and there are n! for block size of n. so brute force is out for all but smallest n. Basic tool is restricting search space by trying to maximize number of common bigrams, and reduce number of uncommon ones "contact method" e.g. ACSKH might be some combination of CK + SH + A ==> SHACK Condition that SAME rearrangement must lead to meaningful fragments in ALL blocks provides enormous leverage. "multiple anagram attack" Likely pairings ==> likely pairs of pairs ==> words ==> whole thing cracks Mix of automation and hand puzzle solving makes fairly short work of any block transposition cipher with two or more blocks. With lots of blocks, full automation is possible with fairly simple search algorithms (e.g. A*). Special vulnerability to incomplete blocks. Known plaintext - fairly simple. Each block highly constrains possible transpositions. Chosen plaintext - can be designed to reveal key immediately ABCDEF or ABZZZZ ZZABZZ ZZZZAB if blocks are longer than number of letters. Security can be greatly increased by multiple encryptions with different (relatively prime) block sizes. Leads to effective blocksize that is lcm of bases. *** Relevant Mathematics: Permutations *** Permutation == rearrangement of n elements Technically, a "bijection" (one to one and onto) of a set X to itself. Questions * How many are there? * How many times can a permutation be applied before elements return to original order? (what is the period or "order"?) (shuffling, random number generations) Permutations form a "group" S_n called the "Symmetric group" on n elements. (Group is a set + distinguished "identity" + one operation on pairs of elements that is associative, and has an inverse) Standard way of writing permutations 1 2 3 4 5 6 2 4 5 3 6 1 could leave first list off, but is handy when "composing" permutations Composition (product): g o h. First apply h, then g. Note that this is just another permutation. Sometimes written gh (product notation) if no confusion will result * Composition is group operation on pairs of permutations. * Trivial (identity) permutation (123, 123) * Associative: (g o h) o i = g o (h o i) * Always an inverse * NOT commutative: g o h != h o g (in general) A "k-cycle" is a permutation where i_1 ==> i_2, i_2 ==> i_3, ..., i_k ==> i_1 (and anything else unchanged) e.g. 1 ==> 3, 3 ==> 2, 2 ==> 4, 4 ==> 1 or (1,3,2,4) == (4,1,3,2) ... * a k-cycle has order (period) k * there are k ways of writing a k-cycle * not all permutations of k elements are cycles * permutations that are disjoint cycles commute * every permutation can be decomposed into a product of disjoint cycles (uniquely up to the ambiguity in writing cycles) * this gives a way of determining the order of a permutations it is the lcm of the size of all the component cycles * it also says something (not entirely obvious) about the maximum order for permutations of size n. Permutations can be used in the analysis of various operations For example, shuffling cards. Number cards of a deck with 2n cards 1, 2, ..., 2n (as opposed to 0, 1, ..., 2n-1) Two "perfect shuffles" a "good riffle" and a "bad riffle" "bad" riffle leaves top and bottom cards the same, and is the same as the good riffle on the middle 2n - 2 cards. Good riffle ends up in order n+1, 1, n+2, 2, ..., 2n, n. This is a permutation. We can specify it by a formula, f(x), which turns out to be f(x) = 2x % (2n + 1) * Proof: First half just get indexes doubled by interleaving = 2x (mod 2n + 1) Second half end up in 2(x - n) - 1 = 2x - (2n + 1) = 2x mod 2n + 1 Order of shuffle permutation is smallest t > 0 such that 2^t = 1 mod (2n + 1) * Proof: Basically we just keep multiplying by 2. So x = 1 will come back to 1 when 2^t = 1 mod 2n + 1. The same t will bring x back to x because of properties of mod reduction, since x goes to x * 2^t % 2n + 1. For 2n = 50, (bad riffle for 52 cards) order is 8. (2^8 = 256 = 5 * 51 + 1), and 2^4 < 51. Note that we used the fact that every t such that 2^t = 1 mod k is a multiple of the smallest such t. (positive t) Another example: Block interleavers. Classical transposition cipher. Write groups of mn by m rows of n, and read off by n columns of m So the 3-4 block interleaver is 0 1 2 3 4 5 6 7 8 9 10 11 ==> 0 4 8 1 5 9 2 6 10 3 7 11 We can figure out a kind of formula for this too. * Represent x by nq + r. q gives the row, r the column (numbering from 0) * then f(x) = mr + q Formula is also given by f(x) = mx % (mn - 1) * Proof: mx = m(qn + r) = mn * q + mr = (mn - 1)q + (q + mr) Trying to get mr + q, which is our known formula which shows that mx = mr + q (mod mn - 1), and thus mx % (mn - 1) = mr + q = f(x) as desired. (since mr + q < mn - 1 ) We can look for order by finding t such that m^t = 1 mod mn-1 as before. In fact, note that a good shuffle is just the center of a 2 x n+1 block interleaver (and a bad shuffle is the 2 x n block interleaver) We can also do cycle decompositions on these permutations to get an idea of how well they mix things up. Reading assignment: Garret chapter 4, Singh, chapter 2. Problems: 3.3.02, 3.3.04, 3.3.05, 3.3.08, 3.3.10, 3.3.12, 3.4.02, 3.4.04, 3.5.02 Due Tuesday Sept 17 Encryption assignment. Write or find software (with source) to do block transposition encryption with block of 16 characters using a key derived from a key phrase. Encrypt two segments of English prose at least 200 letters, output in groups of 16. Make sure the last group is filled by adding some random prose. Due Tuesday Sept. 17