Tradecraft: One-Time Pads
[Music] do [Music] hello again everyone and welcome back to the underground today we're going to introduce the topic of how to send encrypted messages from one person to another this is obviously a very large topic and could take years to cover however we're going to start simple with the one-time pad so what is a one-time pad in short a one-time pad is a way of encrypting messages so that they cannot be decrypted except by the person receiving the message it is one of the most secure ways to encrypt a message because mathematically the one-time pad is impossible to break so how does it work well much like every other encrypted form of sending messages this way is pretty simple let's say a spy station wants to send a message to their agents out in the field so what they do is they get their message they encrypt it using the one-time pad they then transmit it using a usually a shortwave radio where the recipient turns on their shortwave radio and receives the message they then decrypt the message and we're done the communication is complete in this example this is a one-way communication i.e one person transmitting another person receiving but the one-time pad most certainly is capable and is frequently used in two-way communication as in two people exchanging encrypted messages back and forth this is of course an oversimplified explanation of how the whole thing works but that's the beauty of it it's simple so let's dig into the meat and potatoes of what you actually need to make a one-time pad the first thing you need to get started with a one-time pad message is a friend that's right you need someone to send the message to a trusted individual who you're going to be sure is going to keep their uh their stuff secure on their end and you're going to keep your stuff secure on your end so that you can have communication securely between the two of you the next thing you need is obviously a message something to say something of importance that warrants using a one-time pad this is not as simple as picking up your cell phone and texting someone this is going to be for communication that you need to be absolutely secure again between two people you also need a conversion table to convert normal letters to numbers you also need obviously your one-time pad you need something to write with usually the most common form for people using one time pads is just a simple piece of paper and a pencil and if you wanted to go the extra mile you would also need a code book which i think is extremely extremely vital although technically for the one time pad process you do not need one but we'll talk more about that in just a second and then also if you're wanting to generate your one-time pad you will also need at least five ten-sided dice so speaking of the one-time pad what exactly is this well the one-time pad itself is really simple all it is is randomized numbers in groups of five characters usually it looks something like this now the very important part about a one-time pad is that these numbers are truly randomized not pseudo random meaning meaning that you typing numbers out on your keyboard that that's not going to be random that is pseudorandom believe it or not human beings are not particularly original when it comes to picking numbers randomly so people tend to usually have lots of patterns develop when they're trying to pick numbers randomly that's where the ten sided dice come in and though this is kind of an old school way of doing things using five or as many as you want ten sided dice so that you can throw them out on a table somewhere and then get five numbers at random to start building this table that's how the whole thing is made but we'll talk more about that at the end another critical part of a one-time pad that i wanted to mention now but again we'll mention at the end is to never store this on a computerized device nothing that takes a battery nothing that plugs into any kind of electronic device whatsoever and again be very very cautious in using a computerized random number generators there are plenty of of software packages and platforms out on the internet that will tell you that they can generate one-time pads for you you just google one-time pad generator and you'll find five or six right off the bat uh this is not preferred for extreme extreme security and as we get as we'll get to it at the end this can present a lot of vulnerabilities that you might not know about until it's too late but just for brevity and expediency this one-time pad which we will continue to use today was generated using an online one-time pad generator up next is the conversion chart now this seems like it's quite simple but there is a lot of math that actually goes into this a conversion table is simply a table that converts letters to numbers that's all it is however there is a method to the madness technically a conversion table could be completely randomized meaning you completely randomly assign numbers to letters using either your dice or some other method you could do that if you want however that's not really necessary this entire table does not have to be secure it does not have to be hidden away you could print it out and keep it with you laminated at all times it's not really necessary to keep this secure and this particular table you'll find oftentimes rotating around the internet from various sources i'm sorry i don't know exactly who came up with this particular table my guess is it probably goes back to the original days of the cold war or post-world war ii when one-time pads really came into very common use with spy agencies but in any case this particular table has been engineered from the ground up to be extremely extremely efficient and also make it easier to detect errors so again we'll come back to this at the end because once we go through a couple of examples you'll see why this particular table is very very handy to have and finally a code book is very handy to have with this process it saves you a lot of time and it conserves a lot of your one-time pad resources this will make a lot of sense as we start going through this exam through the examples a code book is nothing more than a book of common words and phrases that are condensed into numbers this conserves the one-time pad which makes it last longer if you're using a radio to transmit these messages it makes it a lot easier and a lot shorter and a lot quicker to transmit three characters instead of the entire operation word right and finally using a code book adds in yet another layer of complexity to an already complex system right so if someone is able to actually decrypt your one-time pad message either you get compromised or you're the person you're communicating with gets compromised or one of you gets sloppy and makes a mistake somewhere even if your adversarial force is able to decrypt your one-time pad message they're still gonna have to have the code book to know what you're talking about this will make a lot of sense as we start composing our message which is the first step obviously the very first step in encoding a message is to write the message so for today's example we're going to write the message mission begins at dawn period travel to coordinates colon 3-0 uniform x-ray charlie 5510-6318 period that's going to be the message that we're going to send to our person that we're trying to communicate to the first step in the encryption process is to convert that message to numbers using our conversion table and as we can see this is where our code book is already starting to get really really helpful because we've got a lot of long words here that we can use our code book to help us shorten down quite a bit so for instance the word mission if we were to write that without the code book it would look like the numbers 79 3 83 83 3 5 4. that's the word mission converted using our conversion table now if we were just to go to our code book we could clearly see that the word that the code in our code book for mission the word mission is zero seven eight so it saves us quite a bit of effort and quite a bit of decoding and again it makes it harder for someone to understand if they don't have the code book if someone were able to decrypt this message they would just simply get the numbers 0 7 8 instead of the word mission spelled out for them so we can convert the rest of the message using our conversion table including things like punctuation and spaces now some of you might notice at the bottom of the conversion table there are a couple of duplicates as we can see the uh the key the the terminology for space is the number 99 well 99 is also the way that you delineate the number nine this can get a little confusing at some sometimes that's why it's not a really good idea to have duplicates however this works in this case because we can clearly see nines are very easy to see with the eye and you can clearly see when someone's trying to communicate a space versus the letter nine it's all about context right so if you have to reuse some numbers for common letters as happens with other cryptographic methods that's okay just make sure that the context remains the same for those of you who are wondering where did this terminology come from where did the the practice of using double digits to delineate a number where did that come from well it came from the stasi that's right the east german secret police who used this method exclusively in fact here's a conversion table that was used by the east german secret police the stasi during the cold war to communicate with their agents in western europe this is what they used and as you can clearly see they preferred using double digits to delineate numbers this makes it a lot more secure because the americans at the time at least some sources claim that the americans at the time in other western powers used triplicate so they would use triple uh the number so if you were trying to write the letter one it would be one one one or two would be two two two and so on these germans were very cognizant that a triplicate would develop a pattern so they kept it as two digits so one the number one became one one and as we can see when we're trying to convert our coordinates it's simply doubled up just for ease of use and to make sure that it's as secure as possible and it conserves numbers and letters on your one-time pad as well so hopefully this isn't too confusing so far so far all we have done is written our message and converted that message to numbers using our conversion table and if possible our code book and if we were to use a code book we can clearly see the string of text along the bottom there that is our fully uh converted message it's still not encrypted yet that's the next step but this is what we need to start using our one time pad so the next step is to stay organized and arrange the numbers in groups of five characters this is very important for pretty much any cryptographic method this is very common to basically group all of these numbers together right so as we can see here i've done it very very clearly so that everyone can see exactly how this is done all you're doing is squishing all the numbers together and then separating them into groups of five so instead of having zero seven eight space 99 it becomes zero seven eight nine nine space zero four five nine nine space and so on it is always a good idea to stay as organized as physically possible when trying to deal with any kind of code breaking or cryptographic communication right the slightest error can mean that your entire message gets basically turned into gibberish and we don't want that so once we have our groups of five letters what i'm going to do just for the example i'm showing you today we're going to convert that font to courier new right i know nobody really likes talking about fonts but this is very important that we'll we'll talk about later but just know that i'm switching it to courier new so that we can easily have a nice grid of numbers and to make things a little bit easier to show on the slide i'm simply going to arrange them in columns of three groups of five letters that makes a nice little square rectangular box that's easy for us to look at so that's all i've done is just squish everything together and made it really nice and easy to understand and now we can begin to encrypt our message next we bring in our one time pad and get to work so what i'm going to do again is take our yellow block of text over here on the left remember that is just our simple plain text unencrypted message that's just converted to numbers using the conversion table right i'm going to spread that out a bit so that we can have some room to work because we're going to have to do this number by number letter by letter line by line and this will make a lot of sense as we start putting this stuff together so once we spread our message out so that we can easily and clearly see what we're doing we can now begin to encrypt the message and the first thing that we need to do is take our one time pad and select a random five number group in this case i'm just going to randomly put my finger on the number group 92046 doesn't matter where it is on the page it could be anywhere but i'm just going to randomly pick that one that's going to tell the recipient where to start using their pad this is very very important and this is kind of like a hey start over here message right it doesn't need to be encrypted of any kind it's just a hey start here in your one-time pad book so what we're going to do is keep that in mind and we're going to put it in front of our message that's sort of like the message prefix really what it's called is the key indicator it indicates which key we are using without the key indicator it is going to be impossible to find out where to start on the one time pad once you have your key indicator all figured out then you can start copying down the numbers that come after that directly underneath your plain text message just like i've done here as you can see i took the numbers zero six seven four four and put them directly underneath zero seven eight nine nine the first few numbers in our message we continue this all the way down using up as much of our one-time pad as we need to get the message across we can start seeing here the downsides of the one-time pad because you need to have a one-time pad that is long enough to send your entire message again highlighting the importance of a code book to keep things as short as possible once we've done this we can now encrypt our message so we can take our one-time pad and get it out of the way we don't need it anymore because we've already copied it down to our worksheet here the first step is of course to move down our key indicator so 92046 in this case just moves down and it becomes the first part of our message next we go number by number and subtract the bottom number from the top number so we'll go through each one of these until the entire sheet is done for the first ones there we can clearly see that 0 minus 0 is 0. the next number set is seven minus six is one very clearly right so far so good eight minus seven is one nine minus four is five again nine minus four is five zero minus zero zero four minus two is two but ah here now we come to this group of numbers here five minus seven is a negative number is it not so what we're going to have to do is in in a case like this where the top number is smaller than the bottom number we're simply going to add a little imaginary 1 in front of that number so 5 becomes 15 and 15 minus 7 is 8. and we continue this throughout the entire message doing this all the way down to the very end so just to keep everyone on the same page let's recap the red text on your screen in this case the numbers 92046 that's our key indicator it has nothing to do with the message it's not a conversion of anything it's just to let us know or let the recipient know where to start in the book the yellow text on your screen is of course our plain text message it is unencrypted the only thing that that is is letters converted to numbers using our conversion table that's all that is our purple text well that's our one-time pad those are the numbers that come after our key indicator in our one-time pad so as we read our one-time pad we should see nine two zero four six zero six seven four four and so on all the way down just like i showed you and our white text at the bottom of that that's the result of our simple math our simple subtraction to get what is now our encrypted message so we are actually done our message is now encrypted and as you can see on the left hand side of your screen now in all white text that is our final message this message has now been encrypted using the one time pad that is on the right hand side of your screen now the final step for the person encrypting the message is to strike out the the parts of the one-time pad that they used this is absolutely mandatory it is one of the most crucial steps in this entire thing whatever you use take a pencil and one line strike through all of the number groups that you used if you only used like part of a group like if your message was slightly short and you didn't end up having a perfect group of five that's okay just go ahead and strike through the rest of that five number group it just makes it a little bit easier for the person to find where to start next time so there we go the sender of the message is done this message has now been encrypted and is now ready to send now before we send this message we have a couple of things that we can do when it comes to transmitting these kinds of messages which are usually done via shortwave radio historically that's what's been used by spy agencies there's a lot of different things that are done usually the first thing that's done is to in front of the entire message add in a call sign usually it can be any kind of thing it can be actual letters it can be numbers in many cases it's simply just a three or another five number combination that's the call sign so so someone who is sitting in their headquarters they're waiting desperately for the next message to come from their units in the field or vice versa if someone's out in the field waiting for the next message from their headquarters uh they can sit there and listen for their call sign they can ignore every other message that comes over that frequency but when they hear in this case the call sign is zero five six when they hear those numbers they know to pick up their pencil and start copying down so in that case it's very helpful for making sure that a person has enough time to get ready to copy the message you don't want to start off by just transmitting 92046 because a person might not be ready they might not be ready to copy down the message they might be indisposed or something else you want to make sure that they have just a few seconds to get ready and to pay very close attention because if you get one of these numbers wrong or slightly out of sequence the message is not going to be readable over the years some spy agencies have also been known to triple each number group too so in in this case you would hear the transmission of zero five six usually repeated three times and then you would hear each num each group of five numbers repeated three times as well so you would hear over the radio nine two zero four six nine two zero four six nine two zero four six then they would move on to the next one zero one one five five zero one one five five zero one one five five and so on and so forth until the whole message has been completed since one time pads are mostly used over shortwave radio for spy agencies it makes it a lot easier for people to understand if they're in the middle of a you know it's in the middle of the night they're in some kind of public location they can't quite hear it very well this makes it a lot easier and just in case they miss a digit they don't have to go back to the whole message to very to the very front of the message they can just listen for the next group of five letters or sorry five numbers and they will be able to get uh that number that they missed makes it a lot easier especially under harsh conditions so the message has been sent and the recipient has got it and now what do we do how do we decrypt the message well it's very very simple and it's basically the reverse of what we did to encrypt it so the very first step is to gather the materials together you're going to need the numbers that you heard either transmitted over a radio or handed to you on a slip of paper or found in a dead drop however whatever transmission or handoff method is used you need that message you need those numbers right you also need your one-time pad that's the minimum you need to get this started right you just need the one-time pad and the message you also need your conversion table if you haven't memorized it already or you know if you're not using one that's this kind of standardized you're going to need whatever number table or whatever conversion table you're using and you're also going to need your code book again if you choose to use one so to decrypt the message the very first step is to find the key indicator as we can see here our very first string of five numbers in the message is 92046 that triggers the person the recipient to go flip through their one-time pad and find the numbers 92046 which they did as you can see here so there we go we found it it's marked there in red nine two zero four six is our key indicator once we found our key indicator what we need to do is again copy down the one time pad the numbers on the one time pad directly underneath our message just like we did before in reverse you can probably see where this is going right so once we've kept everything nice and neat we've we've kind of put our key indicator off to the side because we know that was not really used for anything but to let us know where to start right we push that off to the side and we start copying down our numbers once we do that the next step is quite simple and we just start adding them together so zero plus zero becomes zero six plus one becomes seven seven plus one becomes eight five plus four equals nine five plus four equals nine again and so on and so forth if there is a number that becomes greater than ten we simply leave that one uh we leave that first digit off and we use just the last digit right so as we can see just a little bit of a ways down there we have five plus seven well five plus seven does not equal two it equals twelve but we leave the one off from the twelve so that we keep all of our digits nice and straight and there we go now we have our decrypted text in yellow again the final step before moving on to using our conversion table is to strike out the one-time pad this is very very important everyone must strike out exactly the same portions from their one-time pad both the transmitter and the receiver must have identical one-time pads they must have exactly the same sections crossed out and as we can see here if we have incredibly efficient communication between two people you should be able to pull both of their pads and look at their one-time pads together and they should have exactly the same sections crossed out if they don't have the same sections crossed out something has gone very very wrong and we will talk about that at the end the next step is to use our conversion table to convert that plain text into plain english as we can see here we get the message 078 space zero four five space dawn period one one seven space two space zero six one colon three zero uniform x-ray charlie five five one zero six three one eight period now we use our codebook to finally decrypt this message fully we can exchange those numbers from our codebook for actual words and terminology in this case the message becomes mission begins at dawn period travel to coordinates colon 3-0 uniform x-ray charlie 5510 6318 period so there we go we've completely decrypted the message and completed this communication so before we go on let's go ahead and try to do another one here i've made up another practice example using the same one-time pad as before so here is everything you need to decrypt this message you have your one-time pad again that's already been used right because we're not we're going to keep this as realistic as possible so this one time pad has been used but that's okay because we're going to use some other parts of it so there's the one time pad there's your encrypted message on the left your conversion table and your code book so you can now pause the video to try to decrypt this for yourself and see if your answer lines up with what we've got here so here is my work and decrypting my own message that i put together there as you can see the last group of characters uh was not used fully as you can see here on our one-time pad we used the number group 443 but the 2-1 on the end of that number group we didn't use technically you could use it again for a different message but we're not going to because this makes it a lot easier for the next person to find the next message so they're not going to be looking for just 2-1 you know they're going to be looking for 67276 as you can see in the the one-time pad that's that's up next so just wanted to kind of clarify that that again if you're going to be using just part just even just one number from a five uh number group that's okay but it's usually a best practice to if you use the part of a five-letter group just strike through the whole group and just dispose of it you're not going to be using that again even if you did not use some of those numbers and again at the bottom there in the gray box is the plain text message that you can then use uh your conversion table to start decrypting right and in this case you see i used quite a lot of words from the code book so we have 165 space 167 space zero seven eight space one two eight period that's just a that's a whole sentence using just the code book that's why having a code book is so important because you can get away with some some pretty complex ideas using still basically encoded language right if we follow the rest of the message and we use our code book we can determine that the message does in fact read unable to verify mission success period need new code book period so that was the message now to address a few questions that i know are going to pop up because when i started using one-time pads you know a few years ago or so i started noticing that i was having a few problems or a few difficulties so let's go ahead and take this group of of numbers here and let's talk about them separately so as we can see this group of numbers delineates the word need and then a space behind it right now how do i know that 4 equals n and 2 equals e how do i know it's 4 space 2 and not 42 so in other words why is this message broken out like this how did i do that and why is it not something like 42 27 29 9 right how do i know where to break out each letter well that's very very simple and it's very very ingenious and it goes back to our conversion table this is why you pick a conversion table like this one because mathematically as we can see the reason that this message gets broken out like this is because there is no 42 on this conversion table there is no 27 and there is no 29. the numbers have to be 4 because 4 means n there is no other number that that matches up right 2 has to be e another 2 has to be e so we know that it's not 22 because there is no 22 on the conversion table that's why if you can choose your conversion table wisely or just copy the one i have here which you can do if you want this makes it so that it is error detecting it allows you to more easily detect if you have made a mistake so when you're tired it's in the middle of the night you've had a long day you've got to get a communique in or something like that you can still make sure that you don't make any mistakes because the conversion table will not let you substitute incorrect letters and that's why the numbers are set up the way they are so i just wanted to point that out because this is something that doesn't get really talked about when it comes to one-time pads and it is something that you will come upon if you try to start doing this for yourself so now that we understand how the one-time pad works and some little quirks and tips to kind of make it work a little bit better and more efficiently let's talk about security more specifically the best practices you can take to make sure that your communications are truly unbreakable obviously one of the very first and most widely touted security practices of the one-time pad is to never use it more than once it's called a one-time pad for a reason after sending a message spies would strike through the the characters that they used and just tear that out of their book tear out the whole page of that book in most cases and just kind of dispose all of the randomized numbers that they didn't use that's inefficient uh so if you're trying to keep a one-time pad and use it as many times as possible it's probably not the best to kind of throw throughout the entire on you an entire unused sheet especially if you're just sending one or two words you don't want to throw away your whole sheet right but it's it's a good practice to make sure that you never use a one-time pad twice now this might seem very easy you might say oh okay cool i won't use it twice well here's here's how this can get really really complicated so let's bring back our one time pad example that we've already used with our explanation and the little practice example that i gave you so here's a one-time pad that has already been used now let's say that as you can see the 92046 section that message has been received by both parties and both parties both people who own each one time pad have stricken that through right so that's all good to go that's that's fantastic that's a perfectly fine and good example of how to do this now let's just say for instance that the person on the left is going to send the practice message that i created right that 39342 message and let's just say for instance that the second person the person on the right hand side of your screen did not get that message let's just say it was transmitted at a wrong at the wrong time of day or they weren't able to make it to their particular com window and they didn't get that message well if they were to send another message themselves and starting with as we can see right here one zero nine three three to the first person they're gonna overlap they're going to overlap and use up uh parts of their one-time pad that that the first person used and the second person did not know they used right because they never got the message this is why it is absolutely crucial to make sure that everyone gets the message because that little overlap those that overlap starting with three nine three four two uh and then going all the way down to four six seven nine two that overlap that is enough to decrypt this into this entire one-time pad right that is enough to um maybe not compromise the first message but it's definitely enough to compromise the second message that's the problem with one-time pads is that you say all right don't use it twice but it's a little bit more complicated than that in real world use that's why you absolutely must make certain that the other person is getting your message and is striking out from their one-time pad those parts of the message right and this gets even more complicated with the next security tip which is to always destroy the one-time pad after each use like i mentioned most spies over history have just torn out that page from their one-time pad and disposed of it after they send their message and that's all well and good but the reason that you have a lot of spies uh get caught is because they did not destroy their one-time pad and that one-time pad came into the possession of their adversary right they got caught with a notebook with their one-time pad written in it right that's a huge problem because once you destroy your one-time pad you can't confirm that you didn't make a mistake you cannot confirm that the other person has the same part of their book scratched out you can't really confirm anything you just kind of have to send it and just let it go right so that's kind of one of the frustrating uses is you might be tempted to save your one-time pad to make sure that the other person got your message and you're gonna wait for their reply before you uh send out the next message so that you can make sure that you actually both have the same parts of your book marked out this is a really bad security practice you don't need to do this and it's much much better to have to resend a message with a completely new sheet of paper a completely new one-time pad than it is to try to fix a mistake you made right so if the person cannot decrypt your message it's better to make sure that you just completely start from scratch choose a different part of your one-time pad and start over that's the best security practice you can do and when it comes to other security practices stuff that makes a lot of sense right if a one-time pad or or even your code book is outside of your control assume that both have been compromised right one-time pads again they only work if physical security is 100 guaranteed this is not easy to do um i would argue that it is easier to do in today's age of technology where roughly 99.9999 of communications are over completely open and crackable or surveilled networks right so someone walking around with a one-time pad in your pocket in today's society is a lot more secure than walking around with some kind of encrypted um digital communication device right that is that is intercepted and most likely surveilled right but with physical security comes a lot of responsibility meaning if you get compromised if you get grabbed or something like that before you can destroy your one-time pad or your code book you had better make sure that you can destroy it and if you can't your person who you're communicating with must also be very wary of your compromise and that leads to the final point which is do not reply to questionable messages the interesting thing about spies talking to one another or spies talking to their handlers or to their case officers or whoever is that they get to know the people that are in their world and if the person that you're communicating with uses non-standard language or phrasing that you're not familiar with or it just doesn't quite sound like it's the person you're talking to and even then if you know that you're talking to the right person if you know that you're talking to your either your source or your case office or your handler or or another person around the globe and they're talking and they're speaking using terminology and phrases that make it sound like someone else is listening into the conversation uh that's a huge clue that they might have been compromised right so when it comes to adding on layers of security we can do something else to make sure that these messages are in fact being sent genuinely and not under duress conditions so let's specifically talk about challenge codes or duress codes this is only done sometimes but i think that it's a pretty good thing to do and that is add in duress codes to each message sometimes agents will include in each message a special code word which if absent from the message indicates that they are in trouble or that they are sending this message against their will there have been a lot of cases where spies have gotten grabbed with their code book with their one time pad and they get forced at gunpoint to send a message to their handler for requesting like a physical meeting that can then be pounced on by their adversaries right so a lot of times you'll see people including specific code words in each message now the important thing to remember is to not put this duress code in the same spot every time uh it would be preferred to switch this duress code out periodically because once you start putting the same exact word in the same exact met in the same exact place in each message that starts developing a pattern right so again if you're super hyper paranoid about your messages being intercepted maybe move that message around somewhere just to put it at the beginning it put it at the end work it into a sentence somewhere who knows it's up to you i just wanted to kind of point out that you can put in duress codes into each message so in this particular message you know zero five six apple mission begins at dawn it traveled to coordinates and there's a coordinates in this example the code word is apple and there are two code words that the these agents have they're sending this message that have agreed upon if the word is apple in the message that means everything's okay right and that means that this message is being sent freely and everything's everything's good to go now if that word had been dream in this case the the example on the slide there that would have meant that the agent sending the message has been compromised and that uh the person receiving this message can now go through their their procedures for for what to do with the compromise usually just destroy the one-time pad book destroy the code book and move to uh through the rest of their compromise plan right so this is a good way to make sure that you are actually communicating with the person that you're supposed to be communicating with and at the same time that person is not being forced to communicate with you to lure you into a trap and finally something random to consider as well and that is font like i mentioned earlier i switched things to the courier new font for a very specific reason courier new is basically the modernized version of typewriter font and typewriter fonts type faces have been used have been engineered very very specifically over the years and one of the interesting attributes of this particular kind of font is that when you type numbers and even letters in a grid pattern they stay in the grid pattern so as we can see here our one time pad is perfectly square and it has nice neat rows and columns of numbers if i were to take that exam that same exact text and convert it to impact the font that we're using for other other places around this this presentation you can clearly see that it is just a jumble it's it's really hard on the eyes it doesn't line up it's it's just not good right so when you're choosing the fonts to use for this kind of thing if you're the kind of person who likes to type up and print your one-time pads from a secure computer and a non-networked printer you might want to choose something like courier new that's the most common font that's used for this kind of thing because it's very very efficient very easy on the eye and makes it very easy to find the key indicator to start decrypting or encrypting messages so to wrap things up let's talk about a couple of the disadvantages of one-time pads now these are not all the disadvantages there are more but really these are the big ones that get people into trouble and they're they're the reason for spies getting nabbed all over the world and all throughout history and really the first disadvantage is that if you make the tiniest mistake with your one-time pad all of the benefits of this completely uncrackable system vanish remember the one-time pad is mathematically mathematically proven to be impossible to break it doesn't matter how big your super computer is it does not matter how how how awesome your your surveillance um agencies are it's uncrackable completely and totally mathematically impossible to crack with the biggest of computers right however if you make a mistake or if you reuse your key or if you let your key or your one-time pad be intercepted or if you let your code book be intercepted well then you it can be cracked very very easily your messages can be can be intercepted and cracked very easily not just not just the messages you sent you you sent like not just the last one you sent but pretty much all of them right they're in that one time pad so that's something to keep in mind and that's how a lot of spies have gotten caught they've reused their pads they've cycled through and reused their their one-time pads and that has been a huge downfall of many agents and cleverness and services over history and this directly is because of the next down downside which is that it requires a finite source of one-time pads you need to physically have a stack of papers which are your one time pad and those get used up every time you send a message and a and because they get used up they have to be replaced they have to be replenished you have to get new one-time pads you know once a week or once a month from like a case officer you know that's how spies kind of do it uh you have to meet face-to-face with someone and give them a new code book and give them a new stack of one-time pads or you have to do it via dead drop or something like that these present risks because if you get caught with a one-time pad in your hand that's pretty much the most damning evidence there is that you are in fact a spy or up to no good right so the spies that have been caught using a one-time pad they were not caught because their one-time pad failed or because it was cracked but because they made a mistake or they created a pattern reusing one-time pads is the number one way that people can get caught and as you can see from what i mentioned earlier it's not as simple as someone being lazy and reusing their one-time pads because they're out of one-time pads and they haven't been able to make it to the dead drops they kind of re-use one really quick to get an emergency message out it's not as simple as that you could simply miss a message and not be able to understand that that message was was sent and you could accidentally write over basically someone else's one-time pad and therefore you've used it twice and anyone listening can now crack it right another big downfall for people has been to not destroy their one-time pads not destroying their scrap paper just writing it down on a little pocket notebook and sticking it in that in their pocket and walking around because they forgot to destroy it that has been a huge huge reason for spies to get nabbed over the years another major reason for one-time pads being broken are not using truly random numbers or using number generators that have been intercepted by a spy a counterintelligence agency right so if you're using a software program to generate a one-time pad and there is a virus on that computer that you're using to do it your one-time pad is useless you you have the most false sense of security there is right because if somebody has your one-time pad you're completely compromised right and these last two are not really related to the one-time pad at all but really related to the human beings using it and these are poor attempts to camouflage genuine messages and developing patterns over time so to explain what i mean by this let's take a look at the real world example of what's called the missing nines back in 2007 amateur radio operators noticed a peculiarity with what are called the numbers stations particularly the atencion station now for those of you who are unfamiliar with number stations i'll rest assured we're going to be covering these specifically in due time but number stations are shortwave radio stations that are historically that have been historically used by spy agencies around the globe to send messages to their spies wherever they're at using the one time pad system so quite literally even to this day you can get a shortwave radio and listen uh only a lot of times that the uh allotted frequencies which are of course listed due to the ham radio guys who've kind of cataloged these number stations you can get a radio and listen in and you will literally hear in a lot of cases voice a voice comes over the radio and they start reading out numbers thus number stations right there's a very long history with regards to this there's been several documentaries made about number stations many books written about them as well and they're sort of a very fascinating part of the ham radio world people listening to these uh messages but back in 2007 the ham radio community noticed something very very interesting about one number station in particular and that is the atencion station that people generally think comes from cuba most people think that this is a number station that originates from probably the radio havana headquarters in cuba uh and it is used and still to this day used by russian agents in the united states as a way of getting messages to those agents wherever they are in the continental united states obviously shortwave radio can be used for global communications but it's a little bit easier if your radio site is closer than say moscow to the united states right so the numbers stationed out of cuba has been operating for wow many many decades now and in 2007 the ham radio operator community noticed that some of the transmissions that were originating from this station did not contain the number nine and this is very interesting and this is how this actually directly resulted in the arrest of at least 10 uh russian spies in the united states so here's what was happening the number station down in cuba was doing exactly like i mentioned in the beginning they were taking messages that were given to them usually most likely encoded already and they were transmitting them over their shortwave radio to agents in the united states who were then decrypting these one these messages using the one-time pad system and there we go it was a receive only thing uh for for agents to get basically one-way orders from their spy handlers back in russia well here's the thing though they thought they were being a little bit clever and what they would do is they would broadcast every hour on the hour but some of these messages were completely fake they were not you they were not useful at all uh they weren't in the one time pad system they they were just completely randomized numbers that that the agents were creating that they thought would kind of fool anyone who might be listening so so you've got this analyst right listening here listening in at fort meade or wherever they're at and they're and they're picking up all of these transmissions right they pick up all the ones here in purple on your screen and even the genuine transmission there in red well the russians again thought they were clever and they were disguising the real genuine messages with the fake messages so what they forgot though for whatever reason either there was a bug or it was some kind of stuxnet type thing there's really no indication as to why or how this happened but it turns out that all of the fake messages the messages that were just gibberish had no meaning whatsoever uh the decoy messages never had the number nine in them and even the ham radio guys noticed this and were kind of confused as to why do a lot of these messages don't have the number nine in them well this was very very useful in the arrest of russian spies on u.s soil so there were a lot of messages without number nines in them well this was very very handy because even though you this might seem on the surface to be quite a a very clever way of making it so that anyone listening into the conversation to these messages which obviously any anyone with a radio could listen in either the nsa or you with the short word radio could hear these messages right if they were to put out all this fake traffic that's a lot of effort for the cryptographers to go through to kind of work on this right but here's the thing by leaving out the number nine they kind of expose themselves to these messages being fake ones and since u.s agencies often work together with um sort of you know counterintelligence taskings right there were agents that had under surveillance various russians uh in the united states or some in new york some in uh seattle places like that you can look them up and kind of read about the history of operation ghost stories if you're looking if you're looking for some light reading but at the end of the day the interesting part is that the surveillance teams noticed that the people who they were surveilling were only home only available to listen during the times where the genuine messages were being sent a person who they were under surveillance for suspected of you know being a russian spy they were only able to get to their radio when a fake message was being sent otherwise they were either on the road or on you know flying somewhere or at work or something when all these other fake messages were sent so basically the russians even through their own efforts to kind of camouflage their their messages they made it very very clear as to which ones were genuine by a very simple mistake so that's where we'll leave it today so remember no one is above making mistakes with this kind of system even the russian federation which arguably has been doing intelligence just as long as the united states has and is equally as good at it if a nation state like russia can make mistakes like this so can you so be careful and make sure that you're taking the appropriate procedures to make sure that none of your codes are compromised you never repeat at one time pad and all of the other security practices that are best for you so hopefully this is a good introduction to the one-time pad system we will be covering several other enc