] What does it say about the Central Intelligence Agency
] that its agents can crack the secret codes of enemy
] nations but can't unravel a coded sculpture sitting
] outside their cafeteria window?

] This is good news to Elonka Dunin, an executive producer
] and manager at Missouri gaming company Simutronics, who
] is obsessed with cracking Kryptos and thinks that the
] more people who work on the puzzle the quicker they'll
] solve it.
]
] "We have lots of different theories that we're chasing
] down," Dunin said of her band of sleuths, which includes
] some CIA employees. "But there's no way we'll know
] whether we're on the right track until something comes
] loose."

Elonka and Kryptos is currently featured in a front page story in Wired.

Wired News: Solving the Enigma of Kryptos

] Eli Biham announced new results in cryptanalyzing SHA-1,
] including a collision in a reduced-round version of
] SHA-1. The full SHA-1 algorithm does 80 rounds of
] scrambling. At present, Biham and Chen can break
] versions of SHA-1 that use up to about 40 rounds, and
] they seem confident that their attacks can be extended to
] more rounds. This is a significant advance, but it's
] well short of the dramatic full break that was rumored.
]
] Where does this leave us? MD5 is fatally wounded; its
] use will be phased out. SHA-1 is still alive but the
] vultures are circling. A gradual transition away from
] SHA-1 will now start. The first stage will be a debate
] about alternatives, leading (I hope) to a consensus among
] practicing cryptographers about what the substitute will
] be.

Answer, not a 5 alarm fire, but if you write or maintain cryptography code you can still expect some work coming up.

Followup on SHA-1 break

My last PGP key has expired. Here is one for the next two years.

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.2.4 (Darwin)

mQGiBEEhs+8RBADAuzizH2FwBHAntd2SFGgeiKGLJWVgUj4cJCbwNuHfHC7k1Li+
IJd+uu54ygzeuWh6otsvn8gFjPF3FAH53RRKoiCpK2bJfP0/gEEuZchGSWiKULfx
6Q9XoHoj8stebo3kyLBE5tqHnkQfzj1MM+o+Vb83HQcbWbVrgxRwP0649wCg7RVL
R4sAHqKdGUGSflKI3GCjPJEEAL7FigF3mJDeN2/JcbFH7szdLI15NKmckeJbl4Hi
iogb6+EpOfbdYhdOYzT5fnD1WmfchL076LDCkyDD6ioDS2SRf2d6QutTujDE599M
kDzXGNUoNxcKzbXJyC05CIVBA9ligXqi7hbkeyF6hV3gyOM8brSxBo8dF/8PzkAl
nYMLBACJCYotrXGvPEBWfUZ1YRMKzs0g4ZgJNdV9NYWK1VP06s56HjNOaDKTYrur
ZtFOjVBqBr0MHcp13E/WeH/3YuCFI+7kNpVlKmJbjfrfQa2Rqw/LCrjC79DEyPD5
MoJ2xbLBE7V6q50PBr6d0R8g1Xxc6gHEnhUM4NiScUb8WYobFbQfTmljayBMZXZh
eSA8bmlja0BuaWNrbGV2YXkubmV0PohkBBMRAgAkBQJBIbPvAhsDBQkDwmcABgsJ
CAcDAgMVAgMDFgIBAh4BAheAAAoJEAgBPcAwXdg7UlAAoNxlP2xC3Z2ZjmjWZ9j6
fAt6nzSNAJ9RYI+EFolKYBWOOcOEy72Nbu+niLkBDQRBIbP5EAQAuH81k6q9t6R/
LofmqVtxUGShFw/oSo4qEjzU/AX85Zpo9wztCs8pGdoYY7qLgULISbkAhokkzToX
NxGSuFGeGAamammmerexKnfsABuqZz9C0KgqMITutyIYg3RjPhi4pUxvdGHAW6ZA
9sBpnJKnrm3S3+CeDVc80CPSiTmRh4cABA0D/2cYq4m7prCE2z6FSLjXpiHSr4dw
rEpIqDbreB8cWog/mSHiXXqbzZKAWKETXPXGaQ4iDcsd9KErkDq6FvLi3ZCMSPkA
sHBew0gNrBoUqoLnHfRKyo3Jmn87KFzRWE2fqUBM+sn1fPzo0hulL4ycb+ewH5Do
5vqsHpVdCfJHL9qZiE8EGBECAA8FAkEhs/kCGwwFCQPCZwAACgkQCAE9wDBd2DvG
bQCff5/eiqtoee1atxxCj45JqFPleLkAoOsXTNLNgIIrRp/NIEoGVkWE1bQf
=yxTQ
-----END PGP PUBLIC KEY BLOCK-----

] For some little girls, it's a favorite doll; for others, it's a
] dress-up set. But when Elonka Dunin of St. Charles, Missouri,
] was little, her favorite toys were puzzles.

Elonka in the press again.

Elonka in 'Woman's World' magazine

] This is an unofficial list of well-known unsolved codes
] and ciphers. A couple of the better-known unsolved
] ancient historical scripts are also thrown in, since they
] tend to come up during any discussion of unsolved codes.
] There has also been an attempt to sort this list by
] "fame", as defined by a loose formula involving the
] number of times that a particular cipher has been written
] about, and/or how many hits it pulls up on a
] moderately-sorted Google search.

A list of unsolved codes and ciphers from Elonka. If anyone can think of anything she missed, she wants to know.

Elonka's List of Famous Unsolved Codes and Ciphers

] An international group of cryptographers, the Kryptos
] Group, announced this week that the decade-old Cyrillic
] Projector Code has been cracked, and that it deciphers to
] some classified KGB instructions and correspondence.
]
] The Cyrillic Projector is an encrypted sculpture at the
] University of North Carolina in Charlotte, that was
] created by Washington DC artist James Sanborn in the
] early 1990s. It was inspired by the encrypted Kryptos
] sculpture that Sanborn created two years earlier for CIA
] Headquarters.
]
] The message on the Cyrillic Projector has turned out to
] be in two parts. The decrypted first part is a Russian
] text encouraging secret agents to psychologically control
] potential sources of information. The second part appears
] to be a partial quote from classified KGB correspondence
] about the Soviet dissident Sakharov, with concerns that
] his report to the Pugwash conference was being used by
] the Americans for an anti-Soviet agenda.

Kudos to Elonka and crew!

Press Release: The Cyrillic Projector Code Has Been Solved

Elonka Sanborn research update: Various photographers (some who wish to remain anonymous) have been sending me pictures of the Antipodes sculpture at the Hirshhorn.

For those who have been following the story in my blog, this sculpture was particularly intriguing because it appeared to have the complete text of the Kryptos sculpture upon it, *and* the complete text of the Cyrillic Projector, and an additional 20% or so of other ciphertext in both languages.

It was my hope that perhaps there was extra text on the English side which would shed a clue towards cracking Kryptos. As it turned out, there *is* some additional ciphertext on the Cyrillic side, which does not appear anywhere on the Cyrillic Projector. On the English side though, it is just a mix and repeat of the code sections that are already on the Kryptos sculpture.

It's still useful though, because it is reassuring to see that Part IV is exactly the same length on Antipodes, as it is on Kryptos. There'd been some speculation that Kryptos part IV might only be the first part of a lengthier code, with the rest of the ciphertext "sucked into the whirlpool", but Antipodes seems to show that this is not the case.

Pics are now online, along with some additional info about the sculpture. Big hugs and thanks to all you anonymous photographers out there! :)

Sanborn's Antipodes Sculpture

The design and strength of all key lengths of the AES algorithm (i.e., 128, 192 and 256) are sufficient to protect classified information up to the SECRET level. TOP SECRET information will require use of either the 192 or 256 key lengths.

This essentially means that AES as at least as good as the algorithms the NSA develops for this purpose. Very impressive.

Policy Says AES OK for National Security Info

Rerecommending with some changes to Elonka's text:

The Kryptos sculpture at CIA Headquarters has 4 sections of code on it. The first three have been solved. In 1999 there was a big media splash as Jim Gillogly announced his solution, which had been obtained via a computer attack. Part 4 (the last 97 characters) is as yet unsolved.

I wish I could say that I'd solved Part 4, but I haven't (yet). What I *did* do this week though, was come up with a new solution technique for part 3 which I believe to be the "pencil and paper" method that the original authors of the sculpture intended to be used. It's a way of eyeballing the code, such that anyone with access to the ciphertext ( http://www.washingtonpost.com/wp-srv/national/daily/july99/kryptoscode19.htm ) could quickly make a grid and check the letters off to get the entire message. -- no elaborate mathematical formulae or number-crunchers required.

I've written to Gillogly and a couple other cryptographers to check my work. If anyone else would like to take a look in the meantime, I've got a page describing the technique which is posted at my Kryptos site:

Elonka's Solution to Part 3 of Kryptos

] A piece of debris classified "top secret" is somewhere
] among the thousands of shards of the space shuttle
] Columbia spread across Texas.
]
] The communications device handles encrypted messages
] between the shuttle and the ground. According to its
] serial number, it is in a class of equipment labeled
] "TSEC" -- telecommunications security -- that must be
] handled with strict chain-of-command documentation.
]
] Experts differed on the importance to national security
] of recovering the device, which was "keyed," or prepared
] for use with mathematical algorithms.

There are many good reasons for them not wanting anyone to know the details of the equipment they use for secure communications, but I think its unlikely that the discovery of the equipment would not give someone the ability to decrypt any communications using similar equipment. The importance of the keys on this device are likely minimal. Its a big deal if you can get a private key, and that key is in use.. But this key is no longer in use. And its safe to assume it was specific to that particular shuttle. At least, it would be a major oversight if it wasn't specific to that shuttle.

HoustonChronicle.com - Top secret part among the shuttle debris