Print PDF
Favorite
Email
I work as a sysadmin and have way too many passwords to keep track of. I used to use one of those password dongles made for the military, but between flat batteries, the size of the thing and various other annoyances, I decided to make my own that would fit in my wallet -- out of paper.
You can also read about my enigma machine here where I have some more photos of it as well.
I've also made some other spy gadgets, including famously making the worlds first real working and wearable Shoe Phone.
PS: If you enjoy this instructible, perhaps consider making a donation to the campaign to preserve the Bletchley Park complex where the Enigma code was broken, shortening world war two, and saving lots of lives in the process. Their web site is at www.savebletchleypark.com
You can also read about my enigma machine here where I have some more photos of it as well.
I've also made some other spy gadgets, including famously making the worlds first real working and wearable Shoe Phone.
PS: If you enjoy this instructible, perhaps consider making a donation to the campaign to preserve the Bletchley Park complex where the Enigma code was broken, shortening world war two, and saving lots of lives in the process. Their web site is at www.savebletchleypark.com
Remove these ads by
Signing UpStep 1Cryptoanalytic Discussion
Before we get any further, lets just work through the cryptographic context, and make sure that we aren't raving mad.
Don't worry if the following all sounds like gobbledy-gook, because it probably is. The bottom line is that because the intended use of the device is to generate passwords, and you only ever transmit those password securely, then it is easier to capture the passwords than it is to break the cipher.
You can now safely skip to the next step.
But if you would like some more detailed cryptoanaylsis on the use of this device, read on.
First up, the device is intended to be a generator of passwords. That is, by taking something much easier to remember, we encipher it and use the cipher text as the password. This means that the plain text is never revealed to anyone. It also means that we never need to write anything down.
Further, since the device does not actually store any passwords, it should not breach any of the usual military password dongle guidelines, which generally expressly forbid the storage of any sensitive password in any device, electronic, paper or otherwise. That is to say, my paper Enigma(tm)-like machine should be capable of approval for military use! If anyone would like to fund the certification, I'd love to hear from you :)
Also, the cipher text is only conveyed on the kind of channels that you would use to carry a password, we have a further protection. Add to that the generally short length of passwords, especially when they are composed of pseudo-random characters, and the usual Enigma attacks that were used so successfully during the second world war become impossible: (a) there is no (or at worst, little) capturable traffic to analyse; and (b) even if the traffic were captured, the message length is too short compared with the cycle length to undertake any extensive analysis.
In particular, because the cipher text is only sent on channels that are ordinarily depended upon as being secure, compromising the cipher requires first obtaining the passwords that it is protecting, even if it the cipher was only ROT13!
Thus, the security is predicated on the secrecy of the plain text, and the security of the transmission channels, rather on the operation of the enciphering device itself. What the device offers is a means of transforming a low-quality password into a high-quality password, plus a fair bit of geek cred along the way.
But let's move onto the operation of the device itself, and protocols of operation, to assure ourselves that the cipher is a sensible one, and offers some security in and of itself.
The device consists of two fixed rotors and a reflector, plus an outer index ring. This is somewhat simpler than the real Enigma machines that used three or four rotors which could be rearranged and selected from a selection, and generally featured a plug-board as well. However, we do use an alphabet with n=72 instead of n=26, so that we can generate better quality passwords.
The end result is that the key space is 72^3 = 373,248. While not huge, it is probably sufficient given that the cipher texts and plain texts are not ever revealed. Thus it is imperative that the plain texts you use to generate your passwords are kept secret, and that you don't use this device to drive a one-time-pad style login system where the cipher texts can be readily intercepted, especially given that the wiring can be observed when the device is being used.
If you could conceal the wiring of the device, then the security is improved, because the huge number of wiring combinations, (72!)^3 = lots, offers a fair degree of resilience, especially if short cipher texts are used to limit the quantity of traffic that could be captured. Calculating how much traffic you would need to mount this kind of attack is beyond the scope of this instructible.
Don't worry if the following all sounds like gobbledy-gook, because it probably is. The bottom line is that because the intended use of the device is to generate passwords, and you only ever transmit those password securely, then it is easier to capture the passwords than it is to break the cipher.
You can now safely skip to the next step.
But if you would like some more detailed cryptoanaylsis on the use of this device, read on.
First up, the device is intended to be a generator of passwords. That is, by taking something much easier to remember, we encipher it and use the cipher text as the password. This means that the plain text is never revealed to anyone. It also means that we never need to write anything down.
Further, since the device does not actually store any passwords, it should not breach any of the usual military password dongle guidelines, which generally expressly forbid the storage of any sensitive password in any device, electronic, paper or otherwise. That is to say, my paper Enigma(tm)-like machine should be capable of approval for military use! If anyone would like to fund the certification, I'd love to hear from you :)
Also, the cipher text is only conveyed on the kind of channels that you would use to carry a password, we have a further protection. Add to that the generally short length of passwords, especially when they are composed of pseudo-random characters, and the usual Enigma attacks that were used so successfully during the second world war become impossible: (a) there is no (or at worst, little) capturable traffic to analyse; and (b) even if the traffic were captured, the message length is too short compared with the cycle length to undertake any extensive analysis.
In particular, because the cipher text is only sent on channels that are ordinarily depended upon as being secure, compromising the cipher requires first obtaining the passwords that it is protecting, even if it the cipher was only ROT13!
Thus, the security is predicated on the secrecy of the plain text, and the security of the transmission channels, rather on the operation of the enciphering device itself. What the device offers is a means of transforming a low-quality password into a high-quality password, plus a fair bit of geek cred along the way.
But let's move onto the operation of the device itself, and protocols of operation, to assure ourselves that the cipher is a sensible one, and offers some security in and of itself.
The device consists of two fixed rotors and a reflector, plus an outer index ring. This is somewhat simpler than the real Enigma machines that used three or four rotors which could be rearranged and selected from a selection, and generally featured a plug-board as well. However, we do use an alphabet with n=72 instead of n=26, so that we can generate better quality passwords.
The end result is that the key space is 72^3 = 373,248. While not huge, it is probably sufficient given that the cipher texts and plain texts are not ever revealed. Thus it is imperative that the plain texts you use to generate your passwords are kept secret, and that you don't use this device to drive a one-time-pad style login system where the cipher texts can be readily intercepted, especially given that the wiring can be observed when the device is being used.
If you could conceal the wiring of the device, then the security is improved, because the huge number of wiring combinations, (72!)^3 = lots, offers a fair degree of resilience, especially if short cipher texts are used to limit the quantity of traffic that could be captured. Calculating how much traffic you would need to mount this kind of attack is beyond the scope of this instructible.
| « Previous Step | Download PDFView All Steps | Next Step » |
Thanks in advance.
This is all kinds of awesome :)
So, am I right in thinking that to make a new wiring, I would just need to reproduce the middle disk, with different pairs of points reflected?
pix
Paul.
Paul.
I tried doing it, but got tired of trying to get our laser printers to actually be reliable in their placement on the reverse side. Instead I just did two single-sided prints. you could make a single double sided rotor (still a bit fiddly), or as I did, just make extra rotors and have a double sided machine.
Doing it this way lets you do double-enigma which squares the key space and avoids the usual problem with enigma not being able to encrypt a letter to itself.
Please explain how this wonderous invention works, because seriously, I can't figure it out!
As for how it works, is there a particular aspect that doesn't make sense, or just all of it?
The one that throws me off is the first picture of the explanation, I can't see how you've set it to read CAT, or maybe I just can't see it because it works in a different way than I think it does...
My head hurts.
thanks for that, bro :)
...i want more crypto-tools for my wallet !!
I think you can relax. the "third reich" is in no position to enforce it's "trademarks..."
Interesting trivia about Enigma. Seems the original inventor sold the patents to the ChiffriermaschinenAktien-Gesellschaft (Cipher Machines Stock Corporation) in 1923. Is the your Enigma(tm) the owner of the patents, I wonder? Or is this a McDonalds(tm) issue? ;-)
As for the status of the Enigma trademark, sadly I don't recall where I read about the company still existing in some form. Anyway, I suspect their trademark was never valid here in Australia.
Paul.
lol nice movie reference.