One-time pads

Most ciphers can in principle be broken; the only question is how much traffic and effort it takes. The one-time pad is the exception. If the key is random, at least as long as the message, kept secret and used once only, the enciphered text carries no pattern for a codebreaker to work on. An NSA history puts it plainly: "properly used, a one-time pad is virtually unbreakable."¹ The catch lies in the word properly, and the most famous codebreaking story of the early Cold War is about what happened when it was not.

Origins

The idea grew out of telegraphy. In 1917 Gilbert Vernam, an engineer at AT&T, designed a teleprinter system that combined each character of a message electrically with a character punched on a key tape; his patent, "Secret Signaling System," was granted on 22 July 1919.^3,7 The Army Signal Corps officer Joseph Mauborgne saw that if the key tape were random and never reused, the system would resist analysis, and the two are usually credited together with the one-time tape.⁷ An earlier description of the same principle, in an 1882 telegraph codebook by Frank Miller, was identified only in 2011.⁷

The pencil-and-paper version came from Germany. In the early 1920s cryptographers at the German Foreign Office had pads printed with rows of random number groups, each page used once and then destroyed, and the system was in service by 1923.⁷ Claude Shannon proved mathematically in the 1940s that a correctly used one-time system offers perfect secrecy; his work was classified in 1945 and published in 1949.⁷

Soviet pads and their flaw

Soviet intelligence and diplomatic services adopted the one-time pad on a large scale. Their wartime cables were first turned into number groups using a codebook, then "superenciphered by adding a numeric key stream from a one-time pad," in NSA's description.¹ Because the pads were believed unbreakable, the US Army did not seriously study the intercepted cables, collected from American cable companies since 1939, until 1 February 1943, when the project later named Venona began at Arlington Hall.^1,2

The break came from a manufacturing failure. In October 1943 Lieutenant Richard Hallock's team found signs that some key had been used more than once, creating what codebreakers call a depth.¹ In November 1944 Genevieve Feinstein worked out how to spot messages encrypted with the same key from indicators sent in the clear.¹ The cause, as NSA later explained, was that the Soviet organization producing KGB pads had turned out about 35,000 pages of duplicate key under the pressure of the German advance on Moscow; the duplicates were sent to widely separated users in the hope of hiding the weakness.¹

Stripping the key was only the first step. The underlying code then had to be reconstructed, work led by the linguist Meredith Gardner. In December 1946 he read a 1944 New York KGB message listing scientists on the Manhattan Project.^1,2

Only about 3,000 messages were ever partly read, and coverage was uneven: 49 percent of New York KGB messages from 1944, 15 percent from 1943, 1.8 percent from 1942.^1,2 None were read in real time. Even so, the decrypts helped identify Klaus Fuchs, the Rosenbergs and others in atomic espionage, and corroborated Elizabeth Bentley's testimony.¹ The project ran until 1 October 1980, and NSA released the translations from July 1995.^1,2

Pads in the field

Agents carried pads too, and they turned up in arrests. When the FBI searched the New York rooms of Rudolf Abel in 1957, it found "cipher pads" among his radios and microdot equipment.⁴ In London, MI5 searched the safe-deposit box of the KGB illegal Gordon Lonsdale (Konon Molody (Gordon Lonsdale)) in 1960 and found one-time pads hidden in a cigarette lighter; according to published accounts, they were photographed and put back, and GCHQ used the copies to read his radio traffic to Moscow. More pads were found at the Ruislip bungalow of the Krogers after the arrests of January 1961 (see The Portland spy ring).⁸ The CIA used them as well: it trained the Soviet diplomat Aleksandr Ogorodnik (TRIGON) in "the use of one-time pads" before his return to Moscow in 1974, and in December 1982 Adolf Tolkachev handed back his radio equipment and one-time pad to his case officer.^5,6 Pads were also the natural partner of the shortwave Numbers stations used to send instructions to agents.

Why the system failed when it did

In the cases on record, the mathematics was never the weak point. The breaks came from people and procedures: duplicated pages, pads found and copied, or key used twice. NSA's overview stresses that Venona was read "without supercomputers, capture of keypads, or even a stolen codebook," entirely through the Soviet production error.¹

Read next

1 February 1943 – 1 October 1980 The Venona project The US Army codebreaking program that, from 1943 to 1980, read parts of some 2,900 wartime Soviet intelligence cables and exposed Fuchs, the Rosenbergs and Donald Maclean. 1950s–1990s Numbers stations Shortwave broadcasts of spoken or keyed number groups, heard by hobbyists for decades and rarely acknowledged by any government. A Miami spy trial and a declassified CIA case history show what they were for. 1915–1970s Cipher machines From Hebern's rotor to Enigma, Purple, Lorenz and SIGABA, the electromechanical machines that carried the secrets of the Second World War, and the codebreakers who read most of them. 1914–1990s Signals intelligence Intelligence from intercepted communications and electronic emissions, from Room 40 and the Zimmermann telegram to Ultra, Venona, the Berlin tunnel and NSA's domestic programs exposed by the Church Committee. 1951 – 22 March 1961 The Portland spy ring A Soviet network that took naval secrets from the Admiralty's underwater research establishment at Portland, run by the KGB illegal 'Gordon Lonsdale' and broken up by MI5 in January 1961. 22 June 1953 – 15 November 1957 The Hollow Nickel case A Brooklyn newsboy's trick nickel held a coded message the FBI could not read for four years, until a drunken KGB defector explained it and led agents to the illegal known as Rudolf Abel.