Kahn Moscow Cipher

7/28/2019 Kahn Moscow Cipher

1/14

r

F -

J-11-1

Intricacies of a remarkableSoviet spy cipher.

NUMBER ONE FROM MOSCOW 1David Kahn

At the trial in 1957 of Colonel Rudolf Abel for espionagebehalf of the Soviet Union, one of the exhibits in evidence wa bi t of microfilm carrying ten columns, 21 rows, of five-figugroups. This cipher message, found inside a hollow nickel1953 and tumed over to the FBI, had proved impregnablesolution until its key was made available four years laterth e defection of Re4'to Hayhanen, Abel's erstwhile assistato whom the message had been add.ressed.2 The inability government cryptanalysts to read it was no reftection uptheir competence, for the cryptographic system used in thmessage was the finest and most advanced mnemonic ciphever made public. Although not theoretically insoluble, iteffectually unbreakable without prior knowledge of the systeand on the basis of a single message.

At the trial, although prosecuting attorney KeVin Marondid a masterful job of leading Hayhanen, as state's witnes. through the intricacies of th e system, th e cipher was so complicated that it s description bored the jurors and the procecould not be followed even by a cryptographer without thwritten program furnished the jury. A better look at itleisure will be rewarding to anyone with an interest in crytography.The Message

I f the cipher were to be given a technical name, it would bknown as a "straddling bipartite monoalphabetic substitutiosuperenciphered by modified double transposition." Foumnemonic keys--the Russian word for "snowfall," a snatcof popular song, the date of the Soviet V-J Day, and the agentpersonal number-were used to derive the arrangement of th' This article ls based on the author's booklet Two Sov1et Spy Ciphe(Great Neck, N. Y.: D a V i ~ Kahn. 1980. L/C Card No. 80-16799.)

. For the full dramatic story of th e Hayhanen/Abel case see W. WRoca.fort's "Colonel Abel's Assistant,' ' Intelligence Articles i ll 4, p. 1

A1


2/14

DECLASSIFIED Authority NND 947003

Number One From Moscow

alphabet for the substitution and the order for the two transpositions. The system can most easily be illustrated by following through the enciphennent of the exhibited message, Moscow's firnt to Hayhanen after his arrival in New York, muchas some Soviet cipher clerk did it in a weU-gtmrded. office ofthe KG B on a wintry third of December, 1952. Translated,the message read:

1. We congratulate you on [your] safe arrival. We con1lrm thereceipt of your letter to the address "V" and the reading of (your]letter No. 1. .2. Fo r organization of cover we have given Instructions to transmit to yo u three thousand 1n local (currency) . Consult with usprior to In vesting lt 1n an y kind of business, advt.slng the characterof th e business.3. According to your reque:st, we w1ll transmit the formula for th epreparation of soft 1llm and the news separately, together with[your] mother 's letter.4. [It Is tool early to send you 'the gammM .' Encipher short letters, but do th e longer ones with Insertions. All th e data aboutyourself, place of work, addre.sa, etc., must not be transmitted Inone cipher message. Transmit lnsertlozu separately.5. The package was delivered to (your] wife personally. EverythingIs al l right with [your] family. We wish [you} success. Greetingsfrom th e comrades.No. 1, 3 December.

The Russian text was as follows:1. l l o a ~ p a B n . R e M c 6naroDOJJY'IHt.lM nps6LITileM. I I o n - r B e p m ~ a e Mnonyqease samero IIBCbM& B a ~ p e c "B" a npo'lTeRBe IIBCbM& N ~ l .2. }ln.R opraRBsaqsu npBKPl>ITBR ) (Lf ~ a n u YJ B&M paRO. KopoTKBe DBCbM& nmcllpyftTe, &n o 6 o n ~ > m e - - ~ e n a A T e co BCT&BK&IOI. Bee ~ & R R L l e 0 ceoe, MeCTOpa6on.I, a ~ p e c a T.,A. B o ~ a o a nmcllpoBKe n e p e ~ a B a T a . uena.aR.BCT&BKH n e p e ~ a B a f t T e O T ~ e n L H O .5. I I o c t . ~ n K Y mexe nepe,Aans JXBqBo. C ceMa.ea Bee 6narononyqao .lKenaeM ycnexa. llpHBeT OT TOBapam.ea.N2I/03 . l ( e ~ t a 6 p R

Probably one-time pad cipher keys.'The genitive ca.se is apparently an error.

A16


3/14

Number One From. Moscow

The Substitution'The first major step in the enciphennent of this text is sub-stitution of one- and two-digit numbers for the Russian plaintext letters. For thiS purpose a table or "checkerboard" of40 cells-ten across and four down-is set up as illustratedbelow. 5 0 7 3 8 9 4 6 2c H E r 0 n A

6 s m R Ng p 41 q hi IOB 3 . Jt BID, T X m b Jl

2 .Il H tll/Jt M H/T y n Dl 3 IIBTThe ftrst seven letters, CHEI'OIIA, of the Russian word for"snowfall" are inscribed in the first row, leaving th e last threecells blank. The remaining 23 letters of the modem Russianalphabet, omitting diacritical marks, are inscribed in sequencevertically in the other three rows, skipping the third andfifth columns, which, with the last cell remaining in the lastcolumn, are then fllled by seven symbols. These are a. period,a comma, the symbol ll/JI, whose meaning is undetermined,the abbreviation the letter-number switch sign H/U, the"message starts" sign H/T, and the abbreviation llBT for "repeat." Along the top of the checkerboard are written the tendigits in a. mixed sequence determined by a process to be described later. The last three digits in the sequence, whichstand over the blank cells at the end of the first row, are repeated at the left of the second, third and fourth rows. Thesedigits are known as coordinates.Each plaintext letter in the first row of the checkerboard isenciphered by substituting the single coordinate above itEach letter and symbol in th e other rows is enciphered bysubstituting the coordinate at the end of its row followed bythe coordinate at "he top of its column. Numbers are enciphered by placing them within a pair of the letter-numbeswitch signs and repeating them three times.Before these substitutions are made, however, th e plaintexis bisected-chopped at random into two parts-and the truestart of the message is tacked onto the true end. This truestart is indicated by the "message starts" sign H/T. In thisencipherment, as illustrated below, the sign stands seventh inthe fourth line from the bottom of page A19.

A17


4/14


5/14

DEC LAS ND 947003

Number One From Mosco

17 4 9 8 65 8 13 11 16 7 19 20 69 7A II 0 E 0 B b i ll E T n P E25 7 13 4 20 19 7 5 8 15 5 19 4 1E B A H T E C 0 B C T A B63 4 23 20 67 15 5 7 25 4 0 0 61 7K A M H B C E ~ A H H hi E8 5 7 65 7 17 23 7 5 19 8 69 4 650 C E E E M E C T 0 P A E8 19 61 17 4 25 69 7 5 20 19 67 25 670 T hi A ~ P E C H T ~15 8 25 0 8 20 16 20 64 69 8 15 63 7B 0 ~ H 0 H m H ~ P 0 B K E9 7 69 7 25 4 15 4 19 11 0 7 13 11II E P E ~ A B A T b H E n b10 12 67 15 5 19 4 t5 63 20 9 7 69 73 JI B C T A B K H II E P E25 4 15 4 20 19 7 8 19 25 7 13 11 0n A B A H T E 0 T ~ E B b H8 67 18 555 18 67 9 8 5 61 13 63 29 600 H/n 555 II 0 C LI JI K Y iK7 0 7 9 7 69 7 25 4 13 20 13 20 66E H E II E P E ~ A n H n H q0 8 67 5 5 7 23 11 7 20 15 5 7 65H 0 C C E M o E H B C E E13 4 3 8 9 8 13 29 66 0 8 67 60 7JI A r 0 II 0 JI Y q H 0 iK E13 4 7 23 29 5 9 7 14 4 67 9 69 20n A EM Y C II EX A II PH15 7 19 8 19 19 8 15 4 69 20 26 7 20B E T . 0 T T 0 B A P H ~ E H68 18 111 18 25 69 8 65 11 8 18 333 18 25H/Il 111 Htn ~ P 0 B b 0 ' H/ I l 333 Htn .D:i 63 4 65 69 12 28 18 I l l 18 67 9 8 10E K A B P JI H/T Htn 111 H/Il II 0 325 69 4 15 13 12 7 23 5 65 13 4 3 8

~ P A B JI JI E M C B Jl A r 09 8 13 29 66 0 61 23 9 69 20 65 61 19II 0 n Y q H hi M II P H S hi T20 7 23 67 9 8 25 19 15 i 69 60 25 4HEM II 0 .II T BE P i K ~ A Appart.Dtl)' enelphend u a letter b) ' UTOr.

A1


6/14



7 23 9 8 13 29 66 7 0 20 7 15 4 16E M n 0 JI q E H n E B A m7 3 8 9 20 5 11 23 4 15 4 25 69 7E r 0 n 1l c b M A B A .z:t p E5 17 17 15 22 15 17 17 20 9 69 8 66 19c B UBT B 1l n p 0 q T7 0 20 7 9 20 5 11 23 4 68 18 111 18E H B E n B c F. M A N2 HID; 111 HJn

67 18 222 18 67 25 13 12 8 69 3 4 0 20H/D; 222 H/D; .z:t JI H 0 p r A H H10 4 24 20 20 2 1 43 A D; n H NULLS

T-ranspositionsThe sequence o! coordinates resulting from the substitution-which by itsel! affords virtually no security-is thenthoroughly jumbled by passing it through two transpositiontableaux. The first tableau (Fig. 1) is a standard columnartransposition. The substituted coordinates are written inhort;ontally under a se t of keynumbers (the second of thetwo rows heading Figure 1) whose derivation will be givenpresently. They are taken out vertically, the column underkeynumber 1 first and the others following in key order.~ new sequence of digits 1s then inscribed into the second tableau (Fig. 2) which, however, has a complication. This

consists of a series of step-like disruption (D) areas determined as follows. The first D area begins in the top row underkeynumber 1 and runs to the right side of that row. In eachof the following rows, it begins one column to the right. Whenthe colUDlllS are exhausted, one row is skipped and anotherD area ~ started in the following row with the column underkeynumber 2, and so forth for ~ many rows as are neededto accommodate al l the cipher digits. -

The cipher digits taken vertically from the first tableau areinscribed horizontally from left to right' Into the rows of thesecond tableau, but leaving the D areas blank. When thenon-D portions of all rows have been ftlled, the remainingdigits are written in from left to right in the D areas, starting with the top row. From the completed tableau the digitsare then taken out vertically in the order indicated by theA20


7/14

r Number One From Mosc' 0 I I 6 6 6 9 08 " 2 I I) 9 10 S II IS 17 6 116

l l l 6It6 I

l l6 '

9 0 I l9 ) It I0 It 0 z 0 I S I t I2 0 I 9 6 IS It Z ) I 9

I' 6"6 2 0 l'7St SlI 0 I I I l I 9 0 6 I It9 7 2 6 "1601019I I I S 6 ) I o 6 ) 1 7 I 1 0 68 S 7 1 ) 1 t i S S I 1 I t 19 0 97 l iS lo I ) Z 0 IS I lo lo 6 t ' s 1 ' z 0lo 6 l I t 1 6 9 Z 0 ' 2 0 ' )ztzl ,a ,azs I l " 6~ ) ) .. . s .. '096 116S ' 9 2 ..t I t l t 6 t l t l 0 1 )701016 I t l7D6 020081 I 197109 6t71SIt t 1 ) I tl 71 II

I

'I I S 1 5 9 1 t 1 0 S Il l 81 )1 )1o t 76 t106a to " to 1 8 ' 1 1t z 1 z , 66 I 5 6 I lo t I I I6 9 lo 0 6 6 I 6 t I I

)1079105111 ~ ~ 2 0 6 lo 6 t t 0 I t 1 I 1 lo tI 6 S I l I 6 7 9 1 0 671 )lo10 t S l l

9 ~ 1 6)1o2 106711Sio006171S76S711)7 1 9 1 6 t l o 6 S I I t 6 1

171t S6t 20196 256 7 I I 2 S 0 I 2 0 I 6 1 0 6 It6 t I I 6 7 t 7 6 t 7 l 5 IS l o t 10 J l 10 16

5 tlol 6) Ot 6 tS lo loZOit I tZS

1)11016718 s 1167 t I S 6. I I ) 6 ) t 6 0 7 0 7976971S l t l )20 I) 2066 0 1 6 7 S S 7 1 l l 7 1 0157 6 S I l lo J I t I ) l t 6 6oi676071l l t7 lltS97 I lo 6 7 t 6 t l 0 S 7 I t II t t I S lo 6 t l 0 l 6 1 2 061 I 1 1 1 1 1 S 6 t i 6 S I1118 l)ll S76Jl i6S69111111 1 1116791101S6t lo iSI J 172)56 S I ) lo ) I t I I ) t 6 6 0 6I l ) t 6 t 0 6 S 6 I I 9 1 0 11 ) 6 t I l S I t I S 7 6 t 6 0l S lo 7 1 J t I I J l t 6 6 1 0 1o71 s 1 o 1 67J i t 10S 111J ~ l lo t 6975171715111 IJ 7 1 0 t 6 t l 6 6 1t 7 0 0 1 t 1 0 S I I 1 J lo 6 IIll I 167111111167 1 S I J I Z I 6 t ) l o 0 1 0 1 0lo 1 It 1 0 1 0 1 I lo

F'IGOU: 1. FIRST TRANSPOSITION TABI.L\0.

A


8/14


column keynumbers without any regard to D areas. Thisfinal sequence of digits, in the standard groups of five, com-prises the cipher text. A keygroup is inserted at a predeter-mined point before the message is sent. The result is shownin Figure 3.Key Derivation

We have seen that one of the four mnemonic keysCHErOnA--develops the alphabetic arrangement in the check-erboard. The other three--a phrase from a popular song, theV-J date, and Hayhanen's personal number, 13-interact togenerate a. series of virtually random numbers that in turnyield the keynumbers across the top of the checkerboard andthe two transposition tableaux.

In the derivation of these keys two devices are used re-peatedly-chain addition and conversion to sequential numbers. Chain addition produces a series of numbers of anylength from a few priming digits: the first two digits of thepriming series. are added together modulo 10 (without tensdigits) and the result placed at the end of th e series; then thesecond and third digits are added and the sum placed at theend; and so forth, using also the newly generated digits whenthe priming series is exhausted, untll the desired length isobtained. To illustrate : with th e prim1ng series 3 9 6 4, 3 and9 are added to ge t 2 (the 1 of the 12 being dropped), 9 and 6yield 5, 6 and 4 add to 0. The series so fa r is 3 9 6 4 2 50; ex-tended, it would run 3 9 6 4 2 5 0 6 7 5 6 3 2 1 . . . .

Conversion to sequential numbers, or the generation of asequential key, is an adaptation from the standard practiceof deriving a numerical key from a literal one by assigningconsecutive numbers to the letters or the key in their alphabetical order, numbering identical letters from left to right.The literal key BABY, for example, would generate thesequential numerical key 2 1 3 4. In the Hayhanen system aseries of digits is used as the breeder key, and consecutivenumbers are assigned to them in their numerical order (0 islast) , numbering identical digits from left to right. For ex-ample, i f th e breeder key is 3 9 6 4 6, the sequent ial key wouldbe 1 5 3 2 4.The derivation of the checkerboard and transposition keysfor this message begins with the date-September 3, 1945-

A22


9/14


I I I I , I III ID II l' ~ 1 J O t a 7S

I I I I t JII7 II 'I I

I II I I II ' .

I l ' I ' I ' '

' I '' I IIII I I I' ' ' IS I I t. '

I

I 6I I ''

II I' Is' . '

I 6 I' Ol l l l t7 7 .ll_l_ I I J II t I ~ I I 'I I f I J ~ lS7 .17111 t16'''711)111.

I

7

I. I 7 I l J 7 I I I ' I6 I J I I 7 t SI I I I I II I 6 1

S II I I I

't 0 6 II 6 II I II ' I I II I ' I' I I I '

II7

I . 1 I' ' II '7 'I I 1.! 'L!.1 ' II II I I

I II I

' '

''F!GUU 2. SECOND TRANSPOSinON TABLEAU, WITH DISRUP'TlONS

A


10/14



P'IG17U 3. Tl m CIPHD TaT AS Fotnm IN THE NICKEL.that Russia achieved victory over Japan in World Wa.r n. I tis written numerically in the Continental style: 3/9/1945. Its .last digit, 5, indicates the position from the end of the mes-sage of an inserted arbitrary keygroup, presumably a differ-ent one for each message. In this message it is 2 0 8 1 8. Thefirst five digits of th e date, in Line B following, are subtractedfrom this keygroup (Line A) by modular arithmetic (withoutborrowing th e tens digit). Theresu.It is Line C.

Line A 2 0 8 1 8Line B 3 9 1 9 4Line C 9 1 7 2 4

A24


11/14


Then th e first 20 letters ot a line from the Russian popular song "The Lone Accordion" 0 are divided, in Line D, inttwo sections of ten letters, and sequential keys are derivefo r each part in Line E. Under the key for the first part iwritten, in Line F, th e subtraction result of Line C, chainadded out to ten digits. Under the key for the second paris w r i t ~ n a standard numerical sequence, 1, 2, 3, . . . o. Thefirst parts of Lines E and F are added modulo 10 to yieldLine G.Line D T 0 JI b K 0 C JI :hi m H 0 H A Y JI H IJ; E rLine E 7 4 2 0 1 5 6 3 9 8 6 8 7 1 9 5 4 0 3 2Line F 9 1 7 2 4 0 8 9 6 4 1 2 3 4 5 6 7 8 9 0Line G 6 5 9 2 5 5 4 2 5 2

Then each digit of line G is located In the standard sequenceof Line F and replaced by the number in Line E directly oveit. The result of this substitution is Line H. which becomethe priming series for a chain addition that begins In Line Kand proceeds-In rows of ten digits each-through lines LM,N,andP.

LineB 5 9 3 8 9 9 1 8 9 8LineJ 3 7 2 4 8 9 1 5 0 6Line. K 4 2 1 7 8 0 9 7 7 2Line L 6 3 8 5 8 9 6 4 9 8 13+4-17 (tableau 1)Line M 9 1 3 3 7 5 0 3 7 7 13+1-14 (tableau 2)LineN 0 4 6 0 2 5 3 0 4 7LineP 4 0 6 2 7 8 3 4 1 1

The widths of the two transposition tableaU:X are found byadding respectively the eighth and ninth numbers--or perhaps the last two dissimilar numbers-in Line P to the agent'spersonal number, in this case 13. The first tableau will therefore have 17 columns and th e second 14.

The full phrase is th e following:Tont.KO cnt.ImHo ua yJIBrt,e r.I{e-ro0.I{BHOK&R 6po.I{HT rapMOHt.. .

A25


12/14



The sequential key derived in Line J from Line H indicatesthe colunm sequence for a vertical transcription from theblock formed by Lines K through P. The digits that resultfrom t h i ~ transcription, in Lines Q and R, become the breederkeys for the two transposition tableaux. They are repeatedat th e top of Figures 1 and 2 respectively, followed by thesequential keynumbers derived from them.Line Q 9 6 0 3 3 1 8 3 6 6 4 6 9 0 4 7 5Line R 3 0 2 7 4 3 0 4 2 8 7 7 1 2

Finally, a sequential key is derived in Line S from Line P.Line P 4 0 6 2 7 8 3 4 1 1Line S 5 0 7 3 8 9 4 6 1 2

This becomes the sequence of digits used as the coordinatesfor th e checkerboard.In 1956 Hayhanen's personal number was changed from 13to 20, so that the width of the transposition tableaux was increased and their reconstruction thereby made slightly moredifficult. In addition, the chain-added block was deepened by

one row to increase the randomness of the digits that becomethe breeder keys for the transposi tion tableaux.EvalUtztion

What can be said of the cryptographic merits of thiscipher? That it is eminently secure was demonstrated by th eFBI's inability to solve the nickel message. The system derives its great strength from complications introduced into acombination of two basically simple methods , monoalphabeticsubstitution and columnar transposition.Th e complication in the substitution is th e straddling de

Vice in the checkerboard. Ordinary checkerboards, having nounkeyed rows, produce two-digit equivalents for al l plaintextletters. Here the irregular alternation of single and doublecoordinates makes it hard for a cryptanalyst to divide th erunning list of numbers into the proper pairs and singletons,a division which is of course prerequisite to the reduction topla.intext. A division entirely into pairs would straddle thecorrect equivalents (whence the term "straddling'' in thecipher's technical description). Furthermore, this irregu-A26


13/14


rf

iIIII!iIt!lii

Number One From Mosc

larity undoubtedly increases th e diffi.culty of reconstructthe transposition tableaux.The complication in the transposition is the disruptionsthe inscription of th e second tableau. Their purpose is to bloany attempt at reconstructing the first tableau. In the so

tion of ordinary double transposition, once the difficult jobreconstructing th e second tableau is completed, the cryanalyst can immediately proceed to the first with the premthat it s columns will be found in the rows of the second. Bthe D areas forestall this direct attack here by mixing a pof one such column with a part of another. The cryptanalmust sort ou t th e columns before he can reconstruct the fitableau, and this sorting is a formidable task.The keying method of this cipher adds to it s cryptanalyresistance. The long series of calculations performed in tkey derivation results in a series of virtually random nubers whose lack of pattern makes i t difficult for the cryanalyst to reconstruct the original keys and thus ge t clufor the solution of subsequent messages. Even more imptant is the arbitrary five-digit group introduced at the stof the key derivation. I t affects the derivation so stronthat keys with different groups would bear no apparent retion to one another. Since this group was apparently differfor each message, and since each agent presumably had a dferent set of mnemonic keys, no two messages of all thosent out from Moscow by this system to secret agents all othe world would ever be keyed th e same. Cryptanalysts, whowork becomes harder as they have less tra.mc in a single kwould have to attack each message separately.Finally, the bisection of the message makes it harderth e cryptanalyst to ftnd and exploit stereotyped beginninand endings.

The system also has a number of operational advantagFirst, the individual operations are easy and rapid, miniming the chance of garbled messages. Second, the cipher teruns only about half again as long as the plain, not twicelong, as it often does in high-security pencil-and-paper stems. This reduction from th e usual doubling is effected the use of single coordinates in the checkerboard for higfrequency letters, for which the keyword is specially chos

A


14/14



The keyword CHErGITA includes the most frequent letter inRussian (0, with 11 percent), !our other high-frequency letters (C, H, E, A) and two low-frequency letters. The sevenaccount for 40 percent of normal Russian text, so that thecipher text should average 60 percent longer than the plain.(The nickel message is 62 percent longer.) The relative reduction means briefer conunwucations, with consequent low-ered risk of detection.Third, the most important and unusual operational advantage of the cipher is the way an entire encipherment can be developed from four easily memorized items. The agent mustalso know, of course, the procedure for deriVing from thesethe final keys, but this does not appear very hard to remember. Each step seems to lead to the next in much the sameway that one portion of a piano piece leads to another. Nospy cipher of comparable security t ~ t achieves this feat ofmnemonics is known. To a spy, who lives in fear of suddenraids and searches, a cipher system that requires no betraying memorand& is a boon. Ironically, however, Hayhanenor his superiors-did no t trust his memory: when he arrivedin the United States he carried microfilm notes on his cipherin case he forgot what was so easy to remember!For al l the impressive security of this cipher, it is not theoretically impossible to reconstruct the second transpositiontableau in correct form for deriving a first tableau whose rowswould yield the required monoalphabetlc frequency distribution, and when this were done the monoalphabetic substitution could be solved with relative ease. Once the system wereknown and with a large volume of traftlc- in it, an electroniccomputer might be able to run through the billions of trialsneeded for a solution. But that a single message could ha.vebeen solved_while the system itself rem ained unknown is highly. unlikely. The weakening of frequency characteristics causedby the way it uses the numbers and the obliteration of repetitions by the thorough transpositions leave virtually no cluesfor the cryptanalyst.

A28

Kahn Moscow Cipher

Documents

Transcript of Kahn Moscow Cipher