Will Codebreaking Blow Your Mind?

An interview with Elonka Dunin and Klaus Schmeh.

Kryptos contains an unbroken code. (Photo credit: Elonka Dunin.)

I expected my interview with Elonka Dunin and Klaus Schmeh to be neat, but it totally blew my mind.

I hope that it blows your mind too.

Elonka Dunin is a cryptographer, game developer, and management consultant. She’s the world’s leading expert on an encrypted sculpture at the Central Intelligence Agency called Kryptos. She even has a character named after her in Dan Brown’s The Lost Symbol, which is the sequel to The Da Vinci Code.

Dunin has a wide-ranging website that has a section that focuses on Kryptos. I urge readers to watch Dunin’s excellent 2021 TEDx talk “2000 Years of Ordinary Secrets” that will introduce you to how fascinating codebreaking and historical ciphers really are! And see also Dunin’s 2015 DEF CON talk on Kryptos in which she says that a child might make the “intuitive leap” that will crack the famous cryptogram!

Klaus Schmeh is a computer scientist and encryption expert—he works in the cybersecurity industry. His bilingual German/English blog Cipherbrain covers everything about historical cryptography and puts forward various unsolved codes that the world’s top codebreakers race to solve. Cipherbrain’s conversation threads contain fascinating comments from participants who constitute a real “Who’s Who” of codebreaking.

Schmeh’s blog Cipherbrain covers many intriguing mysteries. To start with, see his 2019 piece on the encrypted messages that a parapsychologist wanted to use to prove that communication with the dead was possible—someone actually decrypted the messages! Schmeh also has a list of the “50 most important unsolved cryptograms”—make sure to take a look at the ones that top his list!

Dunin and Schmeh have a new book called Codebreaking: A Practical Guide that’s received interesting praise from a wide range of people and from many big names. 

I was honored/thrilled to interview Dunin (ED) and Schmeh (KS). See below our interview that I edited for flow, organized by topic, and added hyperlinks to.

This document was extremely collaborative. Dunin and Schmeh provided incredible hyperlinks that I incorporated into this interview. 

Please click on—and zoom in on!—these fantastic hyperlinks that Dunin supplied for me and that I incorporated into the “Voynich” section. Those images are good examples of how interesting these hyperlinks really are.

And also make sure to click here and zoom in, since Dunin took a stunning photograph!

(I’ll leave “Kryptos” unitalicized throughout the interview below.)

Exciting Projects

1) What are the most exciting projects that you’re currently working on?  

ED: Our book!

KS: It’s been published in the UK, and should be out in the United States soon. We’re doing our promotion tour. That’s our main joint project at the moment.

ED: And you can read online our new article—“How we set new world records in breaking Playfair ciphertexts”—that should appear in the next printed issue of the academic journal Cryptologia. 

KS: The article is about the Playfair cipher that was invented in the 19th century. We co-wrote it with four people we know who have set new world records in breaking the shortest Playfair-cipher message.

ED: There were five different countries between all of us, so it was really fascinating to see how it all came together.

2) What are the most exciting projects that you know of that others are working on?  

ED: We know people who are working very intensively on various unsolved codes. You can’t say for sure when any of these codes will be solved, but it’s very exciting.

KS: There’s a very exciting project about the Somerton Man who died in Australia in 1948, was never identified, and left behind something that looked like an encrypted message. They’re now exhuming this man after 70-or-so years, so we expect to learn more about this man soon, though we won’t necessarily learn more about the encryption.

ED: It would be nice to find out who he was and where he was from, even if this doesn’t help with the encryption. Why could no one identify this guy when his picture was put all over Australia and all over the world? It’s a big mystery.

3) Which of your publications can people read in order to get up to speed on your research?  

KS: Our joint book is the important source. Elonka has her website, and I have my blog. I’ve also published a lot of books in German.

ED: The two best blogs on this stuff are Klaus’s blog and Nick Pelling’s blog Cipher Mysteries. These blogs put out new stuff every couple days. I have a good website, but I only update it a few times a year.

4) Would you be able to crack a crazy code that I dreamed up that had all sorts of crazy grids/sequences/steps?

KS: Not necessarily—it depends. It would probably be very hard to solve.

ED: You have to think about the reason that a code is written. Generally codes are intended to be sent between a sender and a receiver who are sending messages back and forth, so they have a system that’s relatively simple for them to use. And in wartime, it needs to be solvable in battlefield conditions.

But we don’t really think it’s a fair test if someone takes a message and makes it as complicated as possible and says: “Here, solve it.” That’s not being sent back and forth between two people. Unfortunately, a few famous unsolved codes would probably fall into that unfair category, since they’re probably—if they’re even solvable—one-time creations that use systems that would be very tedious to use for communication. 

I wouldn’t spend time on a bunch of random characters that someone gave me. It takes hours and hours to research a code in order to crack it. And I wouldn’t even know that a random code was solvable—sometimes people troll me with unsolvable things, and sometimes people make mistakes.

5) So a layperson like me could come up with something that you wouldn’t be able to solve?

KS: Yes. That would definitely be possible.

ED: It would not be solvable if you had good security and you just did your thing with a one-time pad and gave us that message.

But we might be able to solve your crazy matrix thing if you had multiple messages that all used the same crazy matrix thing. But we’d need to have some incentive to work on that—generally we prefer to work on historical things that were intended for a receiver to read.

6) What are the main ideas in your 2020 book Codebreaking? The 2020 book received interesting praise from Dermot Turing, Phil Zimmermann, and Ed Scheidt—and also from a former Chief Technology Officer at Apple.

KS: It’s about breaking paper-and-pencil codes that use the systems of the past 500 years. It’s not about breaking the modern encryption that’s used in your web browser or in your smartphone.

Other books explore this topic, but ours does these new things that no other book does: we discuss useful computer programs, we discuss helpful websites, we discuss the people who are active in this community, and we mainly cover real-world ciphertexts.

It’s really important that our book uses real encrypted texts—postcards, letters, diaries, telegrams—from the early 20th century and from the 19th century and from much earlier. Other books use made-up examples like nursery rhymes, but our book isn’t a theoretical treatise, so we show you how to solve paper-and-pencil ciphers that actually were used or even are still used today.

ED: We chose not to include chapters on X/Y/Z if we couldn’t find any real-world examples where X/Y/Z had ever been used in the wild. We only covered things that we have real examples of.

7) What do you think about the 2014 film The Imitation Game? Alan Turing sees the problem that they have for him to solve and he’s like: “This is an exciting challenge for me!” And what excites you guys?

ED: Most people don’t understand that Turing didn’t do it on his own. The Poles had cracked Enigma, they could read Enigma messages, and they shared their information with the French right before Germany ran across Poland. And the French shared that information with the British. Turing took that information and other things, and then made additional discoveries.

The stuff that gets us excited is when someone writes to us that they found an encrypted postcard from 50 years ago, or an encrypted diary from 50 years ago, or what looks like a spy’s communication from 50 years ago. And the older the better—it’s even better if it’s from 100 years ago or from 200 years ago.

Then Klaus and I are like: “Ooooo!” [Laughs.]

Older things are more likely to be real, as opposed to hoaxes.

Like, we get really excited if we get a new diplomatic cipher that we didn’t know about, like an encrypted message that Charles I of England—who was imprisoned on the Isle of Wight in the 1600s—wrote to his son. We’ve found exciting things several times this year!

KS: I write about unsolved cryptograms on my blog. Someone will contact me with something once or twice a week. It’s not always interesting, but I definitely have enough interesting material to write about.

8) Will you come up with your own sculpture masterpiece that contains puzzles that tell you clues that lead to buried treasure? The whole world would get immersed in it if it was good enough. It would capture the whole world’s attention if it was these things to a sufficient degree: mysterious, brilliant, beautiful, well-designed, harmonious, and satisfying.

ED: I don’t work at CIA, so I could put a sculpture on my front lawn, but that doesn’t mean that the sculpture would be famous.

There’s a French company—Labsterium—that makes these kinds of things.

There’s a whole escape room industry that does things like this.

9) Do you enjoy escape rooms?

ED: I don’t personally, because I don’t like puzzles that I have to solve quickly. I like to think more carefully about things.

I’ve participated in the annual MIT Mystery Hunt where teams try to solve as many puzzles as they can over the course of a weekend in order to find a hidden thing. And it was so much fun, because I could find things that I could take my time to go through and leave the fast stuff to other team members.

10) Suppose that we designed a sculpture masterpiece that led to buried treasure—incredible buried treasure. How would we make it hard, but not too hard?

ED: It’s difficult. It’s an artform. You don’t want it to be solved too quickly. 

I’d wrap different systems within one another—there would be multiple easy entry-points so that the general public could actually solve certain things, and that would pull people into it, and then it would gradually get more difficult. 

I’d also add things to encourage people to learn different skills—a different language, or some geology/astronomy/history—and I’d have an overarching theme. 

And I might put in some speed brakes. For example, maybe you need to go to a website at some point, but the website doesn’t go live until a certain date. 

And you can also drop a clue every so often to make people progress at the rate that you want. 

Who will provide the “incredible buried treasure”? What’s their motivation for putting $100,000 of treasure out there? Do they want to advertise for something, do they want to sell a book, or does an angel investor want to do this because they think that it’s cool? 

How long do they want the puzzle to stay unsolved? They probably wouldn’t be too happy if they provided a big bag of gold and gems and then the puzzle was solved within a week! 

The NSA

1) What’s the difference between modern cryptography and classical paper-and-pencil cryptography, and to what extent is the NSA interested in each? 

ED: Pencil-and-paper—“classical”—cryptography was used for 1000s of years before the 20th century brought machine- and computer-based encryption.

The NSA does many different things, but they’re regarded as the US’s premier codebreaking agency. Their codebreaking history originates in classical cryptanalysis, but these days they primarily work on modern computer-based encryption, so they’re always recruiting university-trained mathematicians to work on the “high math” stuff that’s relevant to modern cryptographic techniques. 

The math that we’re talking about might require you to multiply two prime numbers where each prime number has 100 digits—imagine a number that’s 100 digits long!—or you might divide one of these long prime numbers by the other one and look for the mathematical remainder. 

But they maintain an interest in classical codes and ciphers in order to keep their skills sharp. And bad guys sometimes still use classical cryptography in the present day.

KS: Paper-and-pencil cryptography is probably not very important for the NSA, but they might have a small team dealing with this topic.

ED: The NSA did a great PDF—in 2012, for their 60th anniversary—that gives a good history of the agency. 

The NSA’s website also tells you a lot about the agency.

2) There are NSA people whose work relates to modern cryptography. Who exactly are these people, how talented are these people, what exactly do these people do, and to what extent are these people actually “cryptographers”?

ED: I’m not qualified to tell you what they do day by day.

The NSA employs some of the most talented mathematicians in the country. I couldn’t tell you how many of them are involved with cryptography (making codes) vs. cryptanalysis (breaking codes).

KS: The NSA has tens of thousands of employees, and they hire many mathematicians each year. I’m sure that many of these mathematicians work in cryptography, but only very few of their cryptographers are publicly known. This kind of information is generally classified.

ED: They’re the best in the world at what they do! 

3) How does the NSA recruit these people? 

ED: The same way that most companies do: university job-fairs, the “Come work for us!” section on their website, job-transfer programs for veterans, and any other place where they can find smart and patriotic people. For example, there’s a fan convention in D.C. called “Awesome Con”—it’s sort of like Comic Con—and intelligence agencies usually have recruiting booths there on the merchant floors among all the other booths.

KS: They recruit from the universities good mathematicians who have just graduated.

ED: They also sometimes bring in outside mathematicians on temporary sabbaticals. 

Or use challenges to find people. 

During World War 2, the British government would put puzzles into the newspapers across the United Kingdom in order to find people to work at Bletchley Park. They just said: “Come help with the war effort if you can solve this puzzle.” That’s how they tested if someone enjoyed puzzles. 

4) To what extent would you love to talk to these people, and to what extent are you allowed to talk to these people?

ED: It’s not like they’ve got 1000s of them all chained to their desks living in a basement. They have normal jobs, they have spouses, they have children, they take the bus or whatever, and they have hobbies and socialize pretty much like the rest of us. So they’re out there, and you get a chance to meet them.

I’ve talked to many of these people where we have common interests, like in the classical cryptography scene—or even in geocaching, which is very popular among puzzle-solvers. Sometimes I know where they work, sometimes not. They generally don’t volunteer that they work for the NSA, but they might say that they work at the “Department of Defense” or that they work at “Fort Meade”. Also, I meet NSA-retirees in private industry. 

They’re generally just normal people who have a particular job for the government where their work was—or still is—classified. They know that the secrets might relate to the American people’s security and safety, and they take their responsibilities very seriously.

There’s a Cryptologic History Symposium every two years where NSA people sometimes give talks—it’s about history, but they still need to submit their talks in advance for approval. And then when they give their talks they need to stick to the approved talk, word for word, so it’s often frustrating for them because they often wish that they could share more information or that they could speak off the cuff. 

One NSA-retiree I know is open about the fact that he taught the class about classical ciphers at the NSA. He works for various outside organizations, and he gives talks at the American Cryptogram Association about things that interest him such as the Unabomber ciphers and so on. Really interesting guy.

KS: I don’t think that the NSA deals so much with paper-and-pencil codebreaking.

But it’s true that everybody who’s into modern cryptography would love to talk to NSA people and ask them what they’re doing. But it’s not allowed.

5) How do the following sets relate? Mathematical talent/knowledge/interest; puzzle-solving talent/knowledge/interest; being a “cipherbrain”; talent/knowledge/interest regarding classical paper-and-pencil cryptography; and NSA-relevant talent/knowledge/interest? 

ED: Many NSA people don’t do anything code-related at all, of course.

But anyone involved with modern cryptography should absolutely have some training in classical cryptography, even if they don’t pursue classical cryptography as a hobby. 

KS: A talented mathematician will not necessarily be a cipherbrain. 

And a cipherbrain will not necessarily have mathematical talent. 

My blog is named Cipherbrain, and that term comes from Herbert Yardley’s comment in his 1931 book that cipherbrains are very rare, that it’s very difficult to tell if someone is a cipherbrain unless you’ve worked with them for a certain time, and that he was never able to come up with an intelligence test or anything like that to tell if someone’s a cipherbrain.

NSA cryptographers need to have mathematical talent, but it’s irrelevant whether they’re Yardley-type cipherbrains. 

ED: I’ve spoken to plenty of NSA and CIA people, both current and retired. Some are cipherbrains, and some aren’t, and with some it’s hard to tell. 

6) To what extent do you have NSA-relevant talent/knowledge/interest, and to what extent would you want to work for the NSA? 

ED: My skill set is in classical cryptography. I enjoy learning about the history of codes—and about the people who made codes throughout history. And sometimes I solve puzzles at amateur competitions like the one that the American Cryptogram Association runs. 

But I’m a lightweight regarding modern computer systems and I don’t have the “high math” skill set that the NSA looks for. I have enormous respect for the NSA people who are way smarter than I am and who work to keep our country safe.

And personally, I wouldn’t be a good fit for the NSA anyway, since I love to teach and give talks and share information, and I wouldn’t be able to do that at the same level if I worked for an intelligence agency.

Klaus is fantastic, but his main skill set isn’t in codebreaking. He finds information about codes, blogs about codes, and stays in touch with the most famous codebreakers in the world. He posts things on his blog and codebreakers show up immediately to try to crack things. 

He sometimes posts a challenge that he thinks is incredibly difficult, and then someone will solve it within a few hours! [Laughs.] 

7) The terrorists don’t have bright people working for them, do they?

KS: Yes, but nowadays you can download very secure and very easy-to-use encryption programs for free from the internet—freeware, open source. Elonka and I have given talks about criminals using these encryption programs, which creates a huge problem for police because there are 100s of crimes that involve encryption.

There’s been for years an active debate about making these programs illegal, requiring backdoors in encryption software, and things like that.

ED: Do you remember the 2015 San Bernardino attack where the police had the terrorist’s phone and they couldn’t get into it so they went to Apple? Apple refused to help them, and it started a massive debate that continues to this day. They couldn’t get through the encryption, but they finally got in because a company in Australia found a security weakness.

Encryption Vulnerabilities

1) To what extent does our society depend on encryption, what threats (to our current encryption methods) can we anticipate, what can we do about these threats, and what consequences will we face if we can’t deal with these threats? 

KS: There are many consequences. Internet security and computer security are very important topics at the moment—there are countless security breaches and countless criminals dealing cryptocurrency.

There’s always a race between both sides of the law. There’s the illegal side vs. the people who try to protect computer systems from threats—and we of course hope that the good side will win, but the hackers and the criminals are getting better and better, so it’s a difficult situation at the moment.

Good modern encryption is very secure. Edward Snowden has stated that several times.

But good encryption isn’t everything. Security breaches are really dangerous, and can happen if the encryption is complicated to use, if the implementation has errors, if somebody uses a weak password, or if somebody doesn’t use encryption at all (which happens quite often).

Quantum computing is a major threat. But it’s still in its infancy, so I don’t think that anything will happen in the next 10 or even 20 years. It’s still important to research the new post-quantum systems. My employer does that, and I give many presentations on post-quantum cryptography. The main task is to implement in practice the cryptographic algorithms that we know to be quantum-secure.

But our customers aren’t really interested in post-quantum cryptography, because there are more important and more basic and more practical problems in cryptography at the moment: financing problems, user-friendliness (users don’t want to use cryptography, and they complain if they need to push another button or remember another password), and lack of awareness.

ED: I know very security-aware people who could do PGP encryption on all of their email, but they don’t do it because it’s too tedious and too complicated. They’d rather just send an email and not have to worry about encryption.

There’s hyper-encryption. But it’s an arms race, so new cryptography will prompt people to try to figure out ways to crack the latest thing.

ATMs are probably the most common way that we depend on encryption. We want to know that our bank accounts and our finances are safe. We want to know that the password is secure when we go to a website and type in a password, so we check that it’s “https” and not “http”.

I wouldn’t say that society would crumble if all of that broke. We’d recover even if everyone’s bank account was suddenly compromised, but it would be a royal pain while we were recovering from it.

2) Will hackers be helpful to you if you offer them lots of money to change sides?

KS: There are white hats. There are plenty of very skilled hackers or ex-criminals who work for the police authorities or for consulting companies.

But there are plenty of well-trained experts on the other side of the law in Russia and in China.

ED: Some countries encourage hackers and protect them—and refuse to extradite them even if law enforcement here in the US has identified them and located them—because these hackers bring money into those countries from foreign banks that they’ve hacked.

3) How vulnerable is Bitcoin to threats? Society doesn’t depend on Bitcoin, but I suppose that someone who cracked Bitcoin could make billions, since they could mine Bitcoin at an obscene rate and/or take previously mined Bitcoins. 

KS: I think that Bitcoin’s encryption is very sound. But it’s possible to hack the system based on non-cryptologic methods—Bitcoin exchanges have been hacked many times.

ED: They’re all constantly double-checking the ledger entries.

4) But could a quantum computer break Bitcoin’s encryption and bring that whole thing down?

KS: Quantum computers wouldn’t do much to break hashes and break the system in general. But quantum computers could break wallets, because wallets are based on RSA, so there’s a certain danger.

Hashes haven’t been proven to be unbreakable, but they’ve remained secure for 20 years, so it’s very unlikely that somebody will break them.

ED: And this wouldn’t happen in a vacuum. Other people would be learning as this issue emerged—they would establish other security measures in response to the danger.

5) What do you think about this interesting way that one can try to compromise a cryptosystem? 

KS: It’s a special type of side-channel attack that Paul Kocher invented in the 1990s where you don’t just have the ciphertext, but you also know how long it takes to do an encryption and how much energy is used. There are very good attacks based on this concept that sometimes allow you to retrieve the key. Smart cards allow you to get this additional information.

But it’s generally not difficult to prevent a timing attack. You just need to make the encryption process a little slower.

To simplify: the numbers of zeroes will affect how long it takes to multiply two prime numbers and how much energy the multiplication will use—more zeroes means faster multiplication and less energy consumption—and sometimes you can find out which numbers were multiplied if you know how many zeroes and ones the numbers include.

6) How hard is iPhone encryption to crack, and what methods might compromise iPhone encryption? 

KS: I don’t think there’s a chance to break the encryption itself. I’m sure that they’re using a good encryption algorithm like AES-256 that a quantum computer couldn’t break.

It’s very unlikely that someone will suddenly announce that they’ve broken AES-256, since we should see threats to more simplified AES versions before AES-256 comes under threat. These developments don’t happen in a vacuum, like Elonka said.

The problem is always in the environment, and I think that there will be cases where people will find ways to retrieve the key, bypass the checking procedure, use malware to make the encryption not happen, or manipulate the random number generator (that generates the key) to make the key guessable.

All systems have ways to bypass encryption. It’s much more important to focus on user-friendliness, software errors, good passwords, and things like that than to worry about the encryption system itself.

7) Is there a foolproof security method where any brute-force effort will wipe the device’s memory?

KS: It’s quite usual for systems to have self-destroying mechanisms that make the system more secure, but it’s not foolproof because there will be methods to bypass these mechanisms.

There’s always a tradeoff between security and safety—the system can mistake an earthquake for a penetration attempt and delete all the keys.

ED: The encryption doesn’t wipe anything out, but efforts to get into the encryption could hit a tripwire that activates the eraser that deletes the information.

The History of Codes

1) To what extent are older encryptions easier to crack?

KS: The older encryptions are usually not very difficult. But you run into language problems if you have a code from the 16th century, since language has changed a lot over the centuries.

2) What have been the major breakthroughs in creating codes over history, and what have been the major breakthroughs in cracking codes over history? 

KS: My publications always say that there are three eras in the history of encryption.

First, the era of manual paper-and-pencil encryption that lasted until 1920 or 1930.

And then the era of machine encryption—from roughly 1920 to roughly 1970—where encryption was done with machines like Enigma.

And then our era of computer-based electronic encryption began in the 1970s.

The codebreakers were usually the winners up to the 1950s, but during the early Cold War good encryption machines became available. Since the 1950s, you can usually assume that good encryption isn’t solvable.

So the code-makers have won the race, and I think that it will stay that way for the near future.

3) And what about quantum computing?

KS: I don’t think that we will face a disaster. We just have to replace our current codes with better ones. We can implement countermeasures before quantum computers arrive in 20 years—or however long it will take for them to arrive. 

Fiction

1) Is that incorrect in The Imitation Game where they’re in the bar and they come up with the idea to look for “Heil Hitler”?

KS: That insight wouldn’t have come in a bar. It would’ve been clear from the start that it’s a lot easier to break a code if you can guess what’s in the plaintext, and Alan Turing would’ve known from the start that terms like “Heil Hitler” were used in the Germans’ plaintext.

ED: I went with friends to see The Imitation Game. And when we came out my non-cryptographer friends said: “That was an amazing movie!”

And I was like: “They got so much wrong!” [Laughs.]

2) What are your favorite codes that have been included in fiction?

ED: Sir Arthur Conan Doyle came up with creative codes, and so did Edgar Allan Poe.

KS: There’s a good chance that one of my blogposts inspired the encrypted newspaper ad in Enola Holmes. And that film also shows an encrypted message that plays no role in the plot and that looks like a Playfair ciphertext—interestingly, none of my readers have been able to solve it. It’s a good movie.

3) Did you read Graeme Base’s 1989 masterpiece The Eleventh Hour? It’s a mystery, with coded messages and big beautiful illustrations, and every picture has so much going on! You’ll probably make short work of the ciphers, but that doesn’t mean that you’ll solve the mystery right away! I really want to know if you’ll solve it!

KS: I’ve blogged about some particular puzzles in it.

ED: It looks like someone had a lot of fun with this.

4) But don’t read a spoiler, OK?

ED: [Laughs.]

5) Elonka: Do you like Dan Brown’s novels, do Dan Brown’s novels have interesting cryptography in them, and do you crack his puzzles with ease?

ED: His novels are fun. They make me turn the page.

He’s writing for a mass audience, so he doesn’t want things to be too difficult. And you have to ask what kind of flow you want—some readers will stop reading when they get to a puzzle and try to solve the puzzle on their own, and other people will turn the page right away to find out what the puzzle said.

Sometimes I solve his puzzles easily, and sometimes I just want to keep reading.

Dramatic Moments

1) What dramatic moments have you had? Champollion apparently collapsed (due to excitement) after he made his breakthrough that allowed him to decipher the hieroglyphs.

ED: I solved the PhreakNIC v3.0 Code in 2000. I’d been working on it for a week and a half, but it felt like a lot longer.

It was about 2:00 AM. It was a series of layers. And when I finally peeled off the final layer of the onion and got to the very center, it said “Congratulations”, and then I had to announce my win with a haiku or sonnet about why I like to “go swimming with bow-legged women and swim between their legs”—a reference to an old song. 

So I was like: “Oh my god! I solved it! Wait…I need to do what?” The guy who wrote it had not considered that a woman might crack this. It was a mix of emotions!

The Cyrillic Projector was an exciting race. We could see the plaintext, but we couldn’t read it because it was an unspaced wall of Russian text. So I was up all night trying to find a native Russian speaker, and I finally found an associate of my father’s who was kind enough to translate the whole thing. 

I was the first person to take it all and post the full English answer online, but I contributed only partially to the decryption. It was definitely a team effort!

KS: I broke an encrypted diary a couple years ago. I think it was already 2:00 in the night when I finally had the breakthrough. And it was a great experience.

I usually blog about encrypted texts and ask my readers to solve things, but in this case the diary’s owner didn’t want me to publish it, so I had to do it myself. I was quite lucky to find the solution after a few hours. I guessed a word, and then it got easier and easier from there.

2) Would the hieroglyphs have been decipherable without the Rosetta Stone? They only found the Rosetta Stone by pure chance! 

KS: I don’t know, but I’m pretty sure that linguists would be able to break it anyway, since there’s so much hieroglyph material to work with.

3) Look at this stunning image. How are you possibly supposed to find out what those symbols are supposed to mean if you don’t even know the language?

ED: Ah, the Phaistos Disc. We’re not even sure if it’s text. It might be symbols related to a religious ceremony, or it might be a child’s plaything. We don’t know.

4) What’s the most time you’ve ever spent on a hoax?

KS: Hmm. [Laughs.] The Voynich manuscript might be a hoax from the 15th century!

ED: A lot of people worked on the bottles!

KS: Eight messages were found in bottles in Hamburg. The messages seemed to be encrypted and all looked similar. I blogged about this story several times. My readers analyzed the messages, but to no avail.

Finally a newspaper reported the story, and then someone contacted me and said: “I know who created these texts. It’s a mentally ill person. It’s pretty clear that these texts don’t have real meaning.”

ED: But it was kind of a breakthrough to at least know for sure what it was.

Voynich

1) How much time have you spent on the Voynich manuscript?

ED: A lot. Klaus and I have both spent many hours making our own books that imitate the real book, with every single page in its correct position and even with the foldouts.

We’ve also spent hours preparing talks on it, and I’m sure that we’ve also spent hours just looking at each page.

And I want as many ideas as I can possibly get about it, so I’ve also spent hours just showing it to people and just saying: “Please look at this. What do you think?”

Klaus and I even flew to Italy to the Villa Mondragone for the 100th anniversary of when Wilfrid Voynich purchased the thing.

2) How do we know that there’s a real message in there?

KS: I don’t know which theory is most likely, but I could easily imagine that the Voynich manuscript was created in the 15th century as a hoax or to defraud a book collector.

But we’d like to know what method was used to create the contents, even if it was a hoax.

ED: Does it have a message? It depends who you ask. It depends on the day that you ask them.

It’s so obviously about herbs!

But it’s very mysterious that we can’t identify a single herb among the 100s of herbs depicted in the book!

These bizarre herbs are being placed in mysterious bathing tubs—and in other mysterious contraptions—that have tiny naked women in them. One foldout folio looks like a map, but has nothing that we can actually relate to a real location. You can also see in the book illustrations of astrological signs and charts.

Everyone finds the book interesting if they look at it. The book doesn’t look sinister—only mystifying. 

I showed it to an EMT friend of mine to get his impression, and he told me that it made him feel like “life was coming up from the pages”. 

The book has fascinated artists and scientists over the years, and has earned the well-deserved title of “The World’s Most Mysterious Manuscript”.

3) What about this method?

ED: The problem is that nobody can reproduce a single paragraph of the Voynich manuscript with that method.

Fake Codes

1) What do you think about these striking glyphs? One should be skeptical about whether these hidden messages are real. But these messages are striking, so there must be some way to account for them. 

KS: You can find almost anything if your method incorporates enough levels of complication.

ED: People claim that you can find codes in the Bible. But the software will also find things in any text—like, say, Moby-Dick.

As for these glyphs, I’ve seen this kind of method so many times on Kryptos. I call it the “Scrabble method”.

You can make pretty much anything you want when it comes to these very short words. It’s incredibly easy to get the word “HERE” out of the English language because there are so many E’s in there.

I think that he’s seeing what he wants to see.

KS: I have a 2012 article in Cryptologia about the fake codes that people find in Shakespeare and in other texts.

2) What about the brown glyph that looks like Westminster Abbey’s floor plan?

KS: One problem is that there are very many degrees of freedom here and infinitely many things you can look for. You can look for many different shapes and many different orders.

3) Could you two find messages about Mickey Mouse being Shakespeare if I gave you some time to massage the text? Note that he arbitrarily put the text into a grid with 19 columns—that’s a degree of freedom.

KS: We could definitely find messages that seem meaningful. But we wouldn’t be able to find a particular message that you specified.

ED: How about this? [Refers to the “V” in the 16th column.]

Say I want to find something in his grid here about the Garden of Eden, right? I start at that “V” and I go “V-I-P-E-R”. So that’s a snake. And here we have “E-V-E” for “Eve”. And I could probably find “T-R-E-E” not too far away. And I could probably find “A-D-A-M” in here somewhere.

So you just choose the words you’re looking for and then move things around.

KS: Many fake codes have been disproved with an absurd comparison code that finds an absurd message in the same text or finds a similar message in something completely different.

ED: People will spend hours looking for things. It’s often a symptom of schizophrenia to find fake codes. Someone wrote to me once and said that he was sure that he’d found his home address in Kryptos and that it was proof that the government was watching him.

4) What’s the most sophisticated fake schizophrenic code that you’ve ever seen?

ED: Klaus and I both think that James Hampton was mentally ill and that there’s no message in his notebook.

KS: The notebook doesn’t look like ordinary text, so it must be a very strange method if it’s an actual encryption. And it’s unlikely that he filled a 104-page book with a complicated code, so either it’s a simple code or it’s nothing at all.

ED: Perhaps he thought that angels were talking to him and tried to transcribe it in whatever way that he could.

The Codex Seraphinianus isn’t mental illness, but the artist said that the entire thing was just created as art. It looks like a code, but it isn’t.

5) These illustrations from the Codex Seraphinianus remind me of the Voynich manuscript.

KS: It was certainly inspired by the Voynich manuscript.

Zodiac

1) What codes remain to be cracked regarding the Zodiac Killer, what methods might allow us to crack those codes, and why are some Zodiac codes harder to crack than other Zodiac codes? 

KS: There are four Zodiac Killer ciphers altogether. The two longer ones have been solved, but the two shorter ones remain.

ED: We’ll probably never solve the two shorter ones if they’re standalone.

But they might be solvable if they’re encrypted in a way that relates to how the longer ones were encrypted.

KS: There are 408 characters in the longest solved one, so that’s quite a lot of material to analyze. There are 340 characters in the one that was solved in 2020, which is also enough to break a message in many cases. But the other two are really short, so it’s probably not even possible to confirm potential solutions.

2) Why can’t you just check and see if it’s a coherent message?

KS: For the shortest one, there are only 13 letters, with some repetitions. A computer program can easily find solutions that fit, but you can’t confirm which one the Zodiac Killer intended.

You can try to narrow it down to the solutions that make sense in this context, but this might still give you dozens of options.

ED: Our friend thinks that the shortest one says: “Alfred E. Neuman”.

3) How much skill did the Zodiac Killer actually have with codes? 

KS: My guess is that he read a couple of books on cryptography. There’s even a book that was available at that time that includes an alphabet that’s somewhat similar to the Zodiac’s.

4) Are his codes intelligently encrypted?

ED: I would say yes. Our colleague David Oranchak made a wonderful video on how the 340 was put together.

KS: He certainly understood the concept of homophonic ciphers, but you don’t need to be a genius to understand that. You just need to read a book and do some research.

Somerton

1) The Mystery of the Somerton Man is a remarkable mystery in which a well-dressed corpse showed up on Somerton Beach in Australia in the 1940s. No ID. No tags on his clothing. Unknown cause of death. They found in his pocket a scrap of paper that had been torn from a book that they found nearby in someone else’s car. And the book apparently had an encrypted message written in it. How do we know that the Somerton Man’s code actually contains a message, and that that message was actually urgent/important? 

KS: It could be gibberish. My guess is that it’s not meaningless, but not important either—it might be a shopping list for all we know.

He could have written it years before he died, or maybe he purchased the book from somebody else and the letters were already in there.

2) Do you guys have a theory about whether the Somerton Man was a spy? 

KS: My favorite theory is that he wasn’t a spy, but a fugitive. Maybe he wanted to escape from Europe because he’d committed crimes—or even war crimes during the Second World War. His picture was in every newspaper in Australia, but it makes sense that nobody would’ve recognized him if he’d only been in Australia for a short time before he died.

ED: Nick Pelling came up with a good theory that the guy was involved with organized crime. And so people did recognize him, but wouldn’t come forward because they were in organized crime too. So maybe it was just a professional hit.

Kryptos

1) Have you ever heard about this sculpture at the CIA called “Kryptos”? 

ED: [Laughs.] One of my favorite topics! 

It’s a 30-year-old sculpture, about 12 feet high and about 20 feet long, with about 1800 characters cut into its copper plates. 

It has at least four codes. Three have been solved, and the fourth is one of the most famous unsolved codes in the world. 

Jim Sanborn—a US sculptor—received the commission in 1988, and worked together with the CIA’s Ed Scheidt to create a cryptography-themed piece. 

Sanborn chose the messages to encrypt, Scheidt provided encryption methods (Sanborn may have contributed to the encryption process as well), and Sanborn carved the ciphertext—by hand—into the sculpture. The piece was dedicated in 1990. 

2) Was K4 intended to be way harder than the previous three sections?

ED: Yes. Scheidt said that the first three parts give the solver the advantage of the English language—the solver knows the patterns of the English language (which letters are more common than other letters).

But he said that that advantage was removed in part four, so our first challenge is to figure out which masking technique was used.

The first three parts use basic systems that a good cryptanalyst could solve fairly easily—and indeed, the NSA solved the first three parts pretty quickly once they got their Kryptos transcript.

3) What’s Kryptos about? What was the artist—Jim Sanborn—trying to convey?

ED: One of Sanborn’s themes is to make the invisible visible. So one of his pieces tries to represent the Coriolis force, and several others relate to magnetism.

He did pieces that involve magnetism right around the time he made Kryptos. One piece involved a hidden lodestone that you could find if you followed a compass needle—that doesn’t point north—that’s on a compass rose that’s engraved in stone.

He also did a piece at the IRS where a large metal screen flows through a massive 11-ton lodestone, and the message goes in as words and comes out as ones and zeroes.

So he tried with Kryptos (Greek for “hidden”) to represent the CIA’s mission of making visible the invisible things that relate to our enemies. 

And after Kryptos he made a piece called Antipodes that juxtaposed encrypted text from Kryptos with encrypted Russian text from classified KGB documents. 

4) What can we say with confidence about how K4 might be solved? 

ED: With confidence? We can say with confidence that we don’t know.

5) What can we say with confidence about K4 based on the techniques that Kryptos’s creator used for the first three sections? 

ED: We don’t know. We have no idea what the fourth part uses. We don’t know whether the fourth part uses something related to the first three techniques, or whether it uses some combination of the first three techniques, or whether it uses something else.

Sanborn said that he wanted it to be more difficult and that he put it through the “washing machine”. That might mean the masking technique. But maybe he wrote it on a piece of paper, folded the paper, turned the paper upside down, crumpled the paper up, and held the paper up to the light—we just don’t know what he did.

I can say that he tends to reuse things from one piece to the next. So he had a sandstone phase where he did several pieces with sandstone, and he had an entire phase where he would go out in the Southwestern United States and beam light at mountains and then do time-lapse photography.

I’ve researched everything he’s ever done, both before and after Kryptos. Kryptos was the first time he used text, let alone encryption. But after Kryptos he created several pieces that used encryption. There are certain encryption methods that he’s reused from sculpture to sculpture, and Kryptos includes all of these methods except ASCII-binary.

So it’s possible that the fourth part involves some sort of ASCII-binary step.

6) What can we say with confidence about K4 based on what the first three passages actually say? I’m not talking about hidden clues here, but rather just what the passages say. 

ED: With confidence? Nothing.

7) Are there any hidden clues in the first three Kryptos passages that you can interpret with any confidence, and if so then what do these hidden clues tell us? For example, what about that weird “Q” in “ILLUSION” in the first passage?

ED: Sanborn said that it’s not a mistake. But he said that it’s not what it is that’s so important, so much as its orientation or positioning.

The best thing that I’ve found so far—which may or may not mean anything—is that for a “Q” to be there, you need to have a “K” in the ciphertext.

And then the “U” in “UNDERGROUND” in the second passage requires a letter “R” in the ciphertext.

So you have “K” and “R”, which might be related to “K-R-Y-P-T-O-S”. Maybe.

The words “palimpsest” and “abscissa” were used as keys for the first two parts, so these two words may be clues.

On “abscissa”, which refers to a graph’s horizontal (x) axis, Kryptos does sort of look like a graph.

8) What do you make of the word “palimpsest”? What happens if you put the four grids on top of one another—“palimpsest”, right?

ED: It’s a good idea. 

Who knows? You may solve it!

9)

7PCgcr87HsrahVJ8Pt5ukeu8nv5jGa61B1wuZ7iElMGktUZVnv2qL5Dbo9GSIRbnle+5bmy1zHE9Dqb4kmOtHeP+jPCQSuEjgLtmPri6sivlINq58m500717HxgBOuO3+fhHmVcUtLPKOjDIFQ27ZcKCY04B1xOP/dY7Yeg0tkQv2dGKJ7sVXHEUygOKMhKP80QCa3MjMlmPXt+eKjfEhhJMmIFe4zrqMG45rECOUfW2i7h2RL98fOb/fA1ZuYF/Iv3pr6QaZmwtA8tZ+21SqfBMaiBVd3GKbHZ47q+xxT3OfZQJkMieP4bHbVptKYhgx4mJkxa/pF/baZeumx1DmjwPBjidaWvlhB43iLrQZJn8m14jpslhtdBOBgLVNJIcy9FA0g5mysIhh7+RGjtMQf13hr2asqWE6IZa5IXc9lg=

ED: [Elonka used this to decrypt the question, and then replied.]

I think that that’s very likely. I think that it’s not a standard code and that Sanborn threw in one or more twists.

You asked me what I can “say with confidence”. I can say with confidence that university-trained cryptanalysts have worked on this for 30 years and have not been able to solve it, so whoever cracks it will probably come in out of left field with some creative idea.

10) What does his past work tell us about whether Sanborn is the kind of artist who would go “outside the box” and put the grids on top of one another?

ED: He loves grids! He would beam grids at mountains in the Southwestern United States. He would also go out on the beach and beam grids at hills on the beach. He did interesting things with lodestones. 

But there’s real cryptography that uses grids, so it’s not necessarily “outside the box” to manipulate grids.

Fascinating Codes

1) Does a code become a lot more fascinating if there are bizarre circumstances around it (like this code that’s associated with a mysterious corpse) or if it’s supposed to tell you the location of something (like this code that’s supposed to tell you where a massive treasure is buried)? 

KS: Yes. Absolutely.

2) How important is it to determine that a code is crackable before trying to crack it? Take the Voynich manuscript: maybe someone wanted to make money off a fraud, or wanted to do an artistic/philosophical experiment, or just liked the idea of having an eternally indecipherable book, or had a mental health problem of some kind. 

KS: It’s generally very difficult to tell if there’s a real text behind it. You can’t be sure.

3) What are the most fascinating codes that you know of that will intrigue people?

ED: It really depends what you’re interested in! 

What interests you most? Spies? Terrorists? Encryptions that royalty used? A famous composer? Something that might lead to a hidden treasure? 

Do you want to learn how to solve something that we already know the answer to, so that you can work through the steps yourself? Or do you want to try to crack an unsolved code? 

Do you learn best when you experiment hands-on, or when you read a book, or when you read a blog, or when you watch a video? Everyone’s different. 

I’ll mention a few codes that seem to intrigue people.

The Babington Plot. 

The Voynich manuscript.

The Beale ciphers.

The Zodiac Killer.

There are incredible stories where spies used codes. 

Prisoners have used codes to communicate both with non-prisoners and with other prisoners, and non-prisoners have also used codes to get messages to prisoners.

And there are codes that terrorists wrote, like the ones that the Red Army Faction wrote.

4) What are the oldest encryptions that we have, both solved and unsolved?

KS: I think that the oldest known encryption is a 3500-year-old Babylonian cuneiform message. It’s a recipe for a ceramic glaze.

The Voynich manuscript is the oldest unsolved code. There are many unsolved encryption mysteries from the 18th century or even older, but none of them are older than the Voynich manuscript.

5) What are the most fascinating examples of ancient codes being cracked in the present day?

KS: I’ve introduced 100s of unsolved encryptions on my blog, and my readers have broken many of them.

I mostly introduce unsolved encryptions that are more than 70 years old—from the Second World War or older—and many are from the early 20th century or from the 19th century.

My readers recently broke several 17th-century letters that an English king—who was imprisoned on the Isle of Wight—wrote to his son.

ED: Johannes Trithemius wrote Steganographia around the year 1499, and he hid a secret message in it that wasn’t solved until two cryptanalysts—Thomas Ernst and Jim Reeds—independently decrypted it in the 1990s. 

It’s a great story that’s barely been written about!

6) Why did it take so long to decrypt the king’s 17th-century encryptions?

KS: The system was really tough work to solve, since it had symbols both for letters and for common words.

ED: We’ve found many of these nomenclator ciphers in European archives. And many more—maybe even 1000s more, or 10s of 1000s more—remain to be found, along with the nomenclator tables that we need to decrypt these messages. 

7) What are the most consequential cracked codes?

KS: Enigma.

Purple.

Lorenz.

The Zimmermann Telegram. 

ED: And the US broke during World War 2 a whole bunch of Japanese naval codes, which led to the decisive American victory at Midway.

8) Was Purple easier to break than Enigma?

KS: Enigma was a more complex machine than Purple. But it’s difficult to compare those two codebreaking processes—the British already knew exactly how Enigma worked and they were trying to find out how to get the key rapidly, whereas the Americans had a different task where they needed to find out how Purple worked based on messages alone.

Actually, it’s a mystery what Purple actually looked like—the machine that the Americans built to simulate it was not the same thing.

9) Why isn’t there a fantastic Hollywood movie about breaking Purple?

KS: There should be.

There are dozens of very interesting stories about encryption, and it would be no problem to produce 20 or 30 extremely fascinating Hollywood movies about these stories.

10) Was Lorenz easier to break than Enigma?

KS: It’s again hard to compare. But it was quite hard to break Lorenz, and the British constructed a fascinating machine—to break Lorenz—that was completely different from the Turing Bombe, that was much more sophisticated than the Turing Bombe, and that was very modern for its time.

11) Should they make a Hollywood movie about Lorenz?

KS: Yes—it would certainly be an interesting story.

12) What are the most consequential cracked codes that aren’t related to wars?

KS: Hard to say. Many broken codes have impacted certain people or helped to solve certain crimes.

I’m sure that there were successful codebreakers during the Cold War who broke ciphers that were used for espionage, but I think that that’s mostly still classified. Some spies were caught because of codes—or were not caught due to good encryption. 

There was a very high profile case in 1982 where the Red Army Faction—a German terrorist group—used codes to communicate the locations of their weapon and money stashes. The police cracked one of the codes, waited at one of the stashes, and arrested one of the ringleaders.

ED: Various financial systems have been hacked during the last few decades. For example, Bitcoin wallets have been hacked.

We have extremely secure modern encryption systems like AES and RSA—the hacks have exploited weaknesses in the environments around these encryption systems.

13) What are the most consequential uncracked codes?

KS: My readers love various unsolved encryption mysteries that I blog about where the decrypted message might solve a murder. My readers haven’t solved any of these murder-related encryptions yet, but there’s still a chance.

It’s unlikely that the Zodiac codes will reveal anything useful, given what the first two messages said.

There are also spy messages that would give us insights about how certain spies worked if we knew what these messages said.

ED: Several uncracked codes related to alleged buried treasure. But it’s hard to say how consequential an uncracked code is, since an uncracked code might be a hoax. 

14) What about the Beale ciphers where there’s allegedly a massive buried treasure? Is that a consequential uncracked code?

KS: Maybe the Beale ciphers can be solved, but the whole story about the treasure makes no sense and can’t possibly be true.

But the Beale ciphers are consequential in that people have dedicated their lives to trying to find the treasure.

ED: The Beale ciphers are at least consequential as a great story about Americana.

15) What about the Fenn Treasure?

KS: The treasure was supposedly found shortly before Fenn died, but there are people who think that the whole story was made up and that the treasure didn’t exist.

16) Can you say how hard an uncracked code is? Let’s stipulate that there’s a real message and that it’s not gibberish.

KS: It’s impossible to predict—sometimes a lot of people will fail to crack a code and then someone will come along and find a solution in five minutes.

17) Didn’t that couple solve the Zodiac 408 pretty quickly?

KS: They had to work hard on it for a few days, but it was solvable without a computer.

18) What are the hardest cracked codes in history?

KS: The Zodiac 340 was really tough, it’s no wonder that it took 51 years to crack, and this codebreaking success amazes me so much that I actually called it the “greatest non-military deciphering success in history”.

The Zodiac Killer used two different encryption systems at once—a homophonic encryption system and a transposition cipher—so that meant that you needed special computer programs, a lot of trial and error, and really ingenious codebreaking.

In 2013, I created and published the DCT challenge. I thought that it was unbreakable, and others also thought that it was unbreakable. And nobody broke it.

But then one day I got an email from a guy in Israel who said that he’d solved the challenge. And honestly, I assumed that it was nonsense, so it went to the lower part of my stack.

But then three weeks later a friend contacted me and asked me to look at the solution that the Israeli guy had put forward. And then I checked it, and it was correct—absolutely fantastic.

He used a very interesting method to exploit weaknesses that had never been discovered in the literature.

His name is George Lasry. He’s an absolute cipherbrain—the prototype of a cipherbrain. He and I are friends now, and he’s solved other stuff too.

But he specializes in finding the key when the encryption method is known, so the famous uncracked codes are outside his specialty.

Google hired him in part because he solved my challenge, so that makes me a little bit proud.

But it doesn’t make me proud that it took me three weeks to confirm that he’d solved the challenge and that he’d done so before anybody else. He told me that he had sleepless nights waiting for my reply—and I wasn’t even looking at his solution during this time.

19) What codes do you find most exciting/mysterious/fascinating?

KS: I find it fascinating when the story is an unsolved crime, but you never know whether the message will help to solve the crime.

The Voynich manuscript is the most exciting one for me, and the Rohonc Codex is exciting too.

20) Which uncracked codes would you most love to crack? The Voynich manuscript and the Rohonc Codex?

KS: Yes, of course.

I really would love to crack the Voynich manuscript and the Rohonc Codex. 

ED: For me, Kryptos and the Dorabella Cipher.