cryptography
krɪpˈtɒgrəfi/
noun
noun: cryptography

1.
the art of writing or solving codes.

Basically, again our favorite subject of math.

I wrote about this subject in Finnish for the online publication of Eru a few years back. There’ll probably be a lot of overlap here (actually, this is almost a direct translation of that), both in the readership and content, but who cares. Repetition is important or something like that. Or I just enjoy writing about subjects like these. I used to teach this stuff back in the day, although pretty basic stuff, as it wasn’t a big part of our curriculum. Interesting nonetheless.

Cryptography has become an increasing important and ubiquitous part of our lives. Everything we do on the Internet has a cryptographic component in it. Not always to hide information, but often to ensure the integrity of the packages being sent (meaning that the sequence of zeroes and ones doesn’t get corrupted on the way), and to ensure accountability (meaning that we can’t deny what we have done later on).

However, although cryptography hasn’t been nearly as sophisticated it is today, it has been around for millenia. We know Caesar had a cryptographic method named after him and there have probably been even older methods then that. Typically, in an RPG, cryptography is a way for the GM to give the players something different to mull over. They are a puzzle, which is pretty easy to make and insert into your game, although it does require some preparation. However, I do believe cryptography can be used as much more than that. It can be a unique way to bring story elements into the game.

The aforementioned integrity and accountability can be as important to the story as confidentiality. Lets say your players want to change a message for whatever reason. Maybe they want to mess with a meeting by giving one of the parties the false information. Now, say this information is moved by a messenger on paper. The recipient doesn’t know the messenger, but he does know that the message will be encrypted in a specific way. And if that method is known only to the two parties involved, the recipient will assume any message encrypted in that way is from that specific spender.

Now, on top of being confidential, there is accountability, as only these two people are supposed to know the system. If you want to bring in integrity, just have there be several messengers with the same message. Also, if you want to do the work, make their messages not work without the messages of the other messengers, but that’s probably too much.

There is a lot of room for variation. The GM can emphasize the importance of the encryption as much as he wants. Maybe its just a little spice in the game or maybe the whole session can be about it (and it doesn’t have to be about the decryption either, but also other things as above). Of course, many GMs will overdo this. Its highly unlikely that if the GM has an idea that the players will get the same idea unless there’s plenty of hints, which are hard to balance too.

Classic Methods

As I mentioned before, there is an algorithm named after Caesar. Its the oldest known method and it was apparently used by Caesar when communicating with his generals. Understandably, its very, very simple. Its a replacement algorithm that just changes each character into another character by moving a set number of steps in the alphabet. For example, lets use a Caesar’s algorithm with one step with this simple message:

message
NFTTBHF

As I said, simple. In fact so simple that its main use today is to obscure spoilers from people, who don’t want to read them. Decrypting is (of course) simply moving the characters back the same number of steps.

This can be made much more complicated in a number of ways. For example, we can divide the string into blocks of certain length and then have a key with the same length as a block. The key is comprised of numbers which are the steps for each of the characters in the block. For example key (1, 3, 2) would mean that the string is divided into blocks of three characters and first of them is moved by one step, the second one by three and the third one by two. In this case:

message
NHUTDIF

This is already pretty hard to decrypt without doing mathematical analysis and requires plenty of time, if you are doing it by guesswork, no matter how educated those guesses are. The major problem is that if you don’t know the method in use, its hard to identify. Of course, the GM can give hints in some way and maybe mask things such as block size.

However, a more common, actually most common in casual cryptography, method is replacing each character with another one in the alphabet, such as:

abcdefghijklmnopqrstuvwxyz
OUVWYXADFGECBLNKMIJPHQTZSR

which would result in

message
IGZZOCG

This can be complicated pretty easily, if it feels too easy (which it isn’t for most people). Taking out or encoding spaces makes any analysis much more complicated, but it is historically accurate, as for a long, long time spaces weren’t used. With spaces, certain characters can be very easy to find, depending on the language and how long the message is.

The earliest known form of transposition encoding is the so called skytale (a Greek word the meaning of which I’m not familiar with, not English for story about the sky). Skytale was used in the Ancient Greece. Its based on having a wooden stick of a certain girth. You wrap a cloth around the whole length and write a message on it lengthwise after which the cloth is spread out again and the characters are in a new order. The key is simply the girth of the stick. Nothing more. The decoding is simply wrapping the cloth around a stick of the same girth again. Any cryptoanalysis is of course very easy, but not necessarily that intuitive.

(Sorry about the poor quality pictures, but you can find out what’s happening by clicking on them.)

A somewhat more complicated method is based on a password used as a key. The password should be chosen in such a way that it doesn’t have overlapping characters, so in our example we’ll go with PASWORD. The message to be encoded is divided into blocks of length equal to the length of the password. Those blocks are written in order below the password. Then each column is reordered based on the alphabetical order of the characters in the password (which was why we didn’t want multiple cases of the same character in it).

PASWORD
hereweh
aveames
sagewit
hnoreal
content

would become

ADOPRSW
ehwhere
vsmaeea
atwsige
nlehaor
otecnnt

To get each line to a correct length, just add some garbage characters in the end, if needed. That serves another purpose as it makes the encoded string harder to analyze.

Channels

There are two kinds of channels: messengers and broadcasting. Each can serve a purpose and have their own particular uses. The GM can do well to know how to use these. Messengers are more common in fiction, but there are situations where broadcasting can actually bring depth into the story, because it might bring certain otherwise elements into the situation. Why is the information broadcast anyway instead of using a messenger?

Messenger is a person or similar method, maybe a pigeon, that takes the message physically from the sender to the recipient. Benefits are that the messenger can control who can access the message as you need to get hold of the message physically to read it. Also, if someone else can access it, this is becomes known to the parties involved, because the messenger either knows about the situation or is rotting in a ditch somewhere. Historically the messenger has a much better range than broadcasting, but this can depend on the situation. The major problems with using a messenger is that it can be easily stopped and it can also be used to find out who the recipient is.

Broadcasting means sending the message without limiting the recipient through the channel. Radio is a good example of broadcasting. Historically this has meant using flags, semaphores and similar instruments. The benefit is that the message will reach the recipient and can not be intercepted as easily as a messenger (although enterprising individuals might find ways). Of course, the problem is that everyone can read the encrypted version of the message. Also, long messages might be out of the question. On the other hand, if you want to get a message out while encircled or under siege, broadcasting might be your only option.

The weaknesses of the channel can be diminished by using steganography. Steganography is the art and science of hiding messages instead of encoding them. There was a Sherlock Holmes story where instead of using characters, the criminal used stick figures in different positions. Only Holmes realized it was actual writing (of course).

Basically its just a substitution, but whoever sees the figures might not automatically think so.

According to legends, another steganographic method was to tattoo the message into a slaves bold head and let the hair grow enough to obscure it. If this was actually used, it must have been a very slow and impractical. Broadcasts can be obscured too. Maybe only the third flag from the left has any real meaning and the others are there to confuse. Maybe lights in certain windows have a meaning while other rooms are used as needed.

Cryptoanalysis

The first decision the GM should make is that are the players supposed to decrypt a certain encoded message or is it just a part of a bigger picture. You can begin with something other then the encoded message. Some things you can give your players:

• encoded message
• the method being used
• unencoded messages, with their encoded counterparts
• specific encoded messages

Of course, the encoded message is the important thing. Without it, there’s no problem. However, the number and length of encoded messages should be carefully controlled. Too little material may prove to be too hard to decrypt. On the other hand, too much material may overwhelm players and provide the GM with too much work for no benefit for anyone.

In general, when we design cryptographic methods, assume anyone wanting to break them will know the method. The method itself needs to be so strong that simply keeping the key hidden is enough. However, this assumption doesn’t need to be there in an RPG. Methods can be identified. Replacement often means that certain rare characters (like for example ‘x’) become very much more frequent. Transposition, on the other hand, generally leaves the frequencies very normal. In English, the most common characters (in order) are ETAOIN SHRDLU. A phrase you should know if you are going to do this.

Then again, maybe finding the method is part of the adventure. Who chose the method? Maybe his or her background can give some clues. Maybe he has books on the subject. Maybe he belongs to a society that uses certain method.

Pairings of plain and encoded messages can be a very important combination, because if you are going to be breaking a large amount of messages encoded with the same method or key, that pair can be very important in finding the key, so that the rest can be decoded. Sometimes the players might know a certain word or a phrase can be found within the message, but they don’t know exactly where. This can be very helpful as well. Sometimes the players may be able to insert a word or a phrase into the message, sometimes by doing it by themselves, sometimes by provoking a message from someone else. This latter method is known as gardening.

For example, during WWII the Brits knew how to break the German codes. However, it took time, so they wanted to get a message early on in the day (the codes were of course changed daily). Generally this was actually pretty easy, because most Germans would be sending messages, like you are likely to do in a war. Those messages always had the phrase “Heil Hitler” within them, which helped the Brits immensely. However, the German navy did not do this. Therefore, the Brits would choose an area in which they would let the Germans see them and thus report it to their command, using their systems and thus planting the place they were seen into the message, which could then be used to hasten the analysis process.

It should also be noted that even if a message can’t be broken, other things can often be deduced, such as method with which it was encoded, it can be partly decoded (although this is rare), or maybe just figure out who sent it, when it was sent or similar information. Never underestimate what can be deduced from limited information.

A Few Words on Modern Cryptography

With the advent of the computer and the Internet, cryptography has become very important. However, now cryptography isn’t a nice little puzzle for the players, but the methods are so complicated they can’t be broken by people at all. You need fair programming skills and a lot of computation capacity. So, basically its out of the players hands, but that doesn’t mean they can’t be broken by the characters with a bit of technobabble and handwaving. Basically the GM decides how much time and capacity it will take and then the player rolls the dice, if there’s enough of both. However, this doesn’t have to mean that modern cryptography can’t bring interesting possibilities.

In modern cryptography, the role of the key has changed somewhat. We have hash codes, which are easy to encode, but (hopefully) impossible to decode, which are used to secure passwords and for integrity of the message. We have asymmetric keys, which work in pairs, one of which is secret and one of which is public. And we have symmetrical keys, which are like classic keys in that they can be used both to encode and decode, but are much faster to use then asymmetrical ones.

Asymmetric keys are based on mathematical functions which are simple for computers, but the their opposite function is complicated. For example, multiplication is very easy for a computer, but as for humans, division is much harder, especially when dealing with large prime numbers.

Asymmetric cryptography can be used in the following situations:

• Alice has a public key and broadcasts it on her webpage. Now anyone can use that key to encode messages which can only be decoded by Alice using her secret key that pairs with the public key.
• Alice has a public key and broadcasts it on her webpage again. Now she can encode messages with her secret key and anyone decoding those messages with the public key can be sure that Alice was the one behind the message. In this case, the secret key works as a signature of sorts.
• By using these keys as parts of different protocols, Alice and her contact Bob can decide upon a common symmetric methods and exchange keys for them.

Other ways of bringing cryptography in the game is to have information from the past, say from the 80s, when the methods weren’t as good as they are today. NSA has upgraded their methods a number of times over the years, but that doesn’t mean that every bit of information has been better protected. After all, their enemies will have massive libraries of stolen information waiting to be decoded.

Or maybe there is a bug in the protocols used by Alice and Bob. Maybe Eve has been able to interject herself. Of course, the messages between Alice and Bob move in real time and Eve can’t really make decisions on how to screw with them on the fly, but needs to carefully contruct rules on how messages are changed by her automated systems.

Final Words

Don’t overdo it and expect you players to figure things out, because they seem simple to you. Not everyone approaches things in the same way, so you may horribly misjudge the puzzles you form. Maybe they haven’t seen the films you saw just recently and used as inspiration. On the other hand, a few years ago I broke the code used by the GM by just glancing at it. The thing is, I had just seen something similar in a movie, so I just knew what it was about.

Be creative. Maybe test your puzzles with someone before using them, or forget about the puzzles completely and just let story or dice rolls dictate. That can work too. Who’s behind the message is generally much more interesting than decoding the message. At least for most of us.

Share:

• Click to share on Facebook (Opens in new window)
• Click to share on Tumblr (Opens in new window)
• Click to share on Twitter (Opens in new window)

Related