Tradecraft: One-Time Pads

[@tidypog3272]

One thing that i must point out - any adversary worth using OTP against will remember all your communications. If you follow this method and they recover your pad, they will decode all old messages and learn a lot about you and your friends Burn the pad after. They come in little books for this reason

[@MoreEvilThanYahweh]

It's even in the name.

[@VilmaHallikas]

They can't decode your messages with only the OTP pad. They would need to know your conversion table and codebook too.

[@georgiishmakov9588]

the books tend to even be made of flash paper for this very reason. Tear the page out and burn it.

[@tidypog3272]

@@VilmaHallikas most networks standardize on the same stuff. If any part of your network was ever compromised, they probably have all your stuff. the codebooks or conversion tables are extremely vulnerable to decryption anyway

[@costakeith9048]

@@VilmaHallikas Those things are easy enough to crack even with pen and paper, they're trivial to decrypt with a computer, the conversion table and code book are just for putting the message in the correct format and minimizing the message length, they offer basically zero security against a even an amateur cryptanalyst, never rely on that alone.

[@christopherrobin8134]

This is some real “on a list” shit, and I’m all for it.

[@chuckfinley3152]

If you watch s2, you're definitely in a list already lol

[@kaosumaru]

If you have an American flag, you're on the list.

[@hogandonahue9598]

A skill too cool and useful to pass up! Got worried when this video went down!

[@Witnessretire]

Same!

[@leandroalbero]

Same!

[@motorboat3478]

Same!

[@sotcrco1016]

Same!

[@northernpartisan7370]

They don't want trade secrets revealed lol

[@tomjefferson6588]

Thank you for the time, labor and effort you and your team put in to these videos. The knowledge you guys spread is invaluable.

[@YasilTorvanna]

ITS ONE GUY DONT BE DUMB.

[@bernardhossmoto]

Finally a video that really explains how encryption and decryption works with these old paper sheets.

[@benabusthethird9751]

This has come at a great time as I am just getting into listening to number stations regularly.

[@willbass2869]

@Hydrogen car dooms R e t a r d e d RUS & GER junta Chinese should just broadcast number sequence over loudspeakers all over metro D.C. area. Pretty sure majority of their "servants" are there.

[@willbass2869]

@Hydrogen car dooms R e t a r d e d RUS & GER junta dude, please.....seriously, you're recommending George Webb !!! Yikes! (& trying to 'disguise' your response). Thanks for the chuckle 🤭

[@nathanwhouston]

The grid location you used as an example was a very nice touch.

[@sammiller98]

The scenario you described at 29:55 is exactly why you throw away the entire page once it is used. Even if you only use two sets of numbers. That way there is absolutely no chance of overlap.

[@RwerD]

Came here to say this. 💯

[@Josh-of-all-Trades]

Remember: a cypher message could be as easy as "one if by land, two if by sea." As long as the message recipient already has knowledge of what the message means, for example I can tell my wife "I'm going to get eggs from the store." But she already knows that I never buy eggs and that if I ever say that I actually mean that I'm going to the pot shop and I don't want the kids to know. An OTP is a great way to encode a message, and very flexible since you only use it once and throw the key away. But remember, any code is worthless if your intended recipient has no idea what to do with it, so make sure your intended recipient HAS the key!

[@rdsmith334]

Throw the key away? Might think twice on that one.

[@kekistanimememan170]

Symmetric encryption is ez.

[@tonylu2471]

@RuDuffEnough WellRu I just say I'm going for a walk. I don't buy pot but I do go on walks. It could mean anything though from I'm taking money and buying myself lunch to I'm going to deposit the 200 dollars in ones I've been saving in my savings account.

[@monabale8263]

not doing things you feel compelled to hide would be simpler.. jusayin.

[@Mis73rRand0m]

"if you have nothing to hide then you don't have to worry about someone spying," is some dumb cope.

[@cmdrcorvuscoraxnevermore3354]

Excellent description of the OTP. A great skill to have while "Fighting in the Shade". Be well and stay safe.

[@heartlights]

If anyone here is interested in learning more about the history and frontiers of codes and codebreaking, there's a great book on the subject called "Codebreakers" that came out in the 70s. There's only one truly unbreakable code, and it's compromised as soon as you share it with another person. The art of coding and hacking is very interesting and will probably still be useful for the foreseeable future. Great video!

[@michaelfranciotti3900]

Isn't a code useless unless you share it with another person? :p

[@bhoward9378]

Great book.

[@noblast1967]

The chair is against the wall. John has a long mustache. Great info, and a needed skill to have “just because”.

[@reubenpatience9977]

Oh lordy i missed this intro music. More tradecraft vids please

[@stoyanbalev184]

First time I found out about OTP was when I was a kid about 25 years ago on Discovery channel and I couldn't find anything about it since. Thanks for the great video!

[@Akinius]

Regarding numerals, most sources say to write each individual number out three times, not two, which would remove the possible confusion of, say, "99" being the number 99, or a space. Also, I think you're supposed to put a "90" before and after each string of numbers to indicate that you're listing numbers (or "figures", as the conversion tables list). Great video though! You put a lot of effort into this, and it's appreciated!

[@maxtorque9591]

Yes, yes and yes.

[@renealamo899]

Thank you for explaining this powerful tool and it's weaknesses.

[@waylonk2453]

Fabulous content from S2 here. I was delighted to have the chance to decrypt a message.

[@derstoffausdemderjoghurtis]

That intro wakes some memories :'-) Love to see more tradecraft.

[@DJTheMetalheadMercenary]

Very complex but extremely useful skillset and video, thanks for teaching us yet again S2 crew.

[@jacksnyder7318]

Perfect, thank you for this video. This is the necessary trade craft for today's defense against an adversary that is dependent on high tech.

[@waylonk2453]

Well said

[@chuckfinley3152]

Key words, "dependent on high tech" if they don't know the old ways they'll never know to look, they are used to snatching stuff out of thin air, the old ways are king lost

[@24680kong]

A lot of people are mentioning using two of copies of a book to encrypt/decrypt messages. While this worked well in the past and is less suspicious than having a one-time pad on your person, they aren't random, only pseudorandom. In the past, to decrypt a message from a book code, you would need a huge library of millions of books and then painstakingly transcribe them into a database to compare every possible set of words or characters that could plausibly be used as a code. Nowadays we have that. For new books, these will all be written and printed using computers, and it would be trivial to get copies from publishers. For old books, Google has a library of millions of them (and growing), scanned to pdf and transcribed with AI. And they publicize that they've scanned countless rare and old books, meaning if you have it, they probably do, too. Who knows how many books other big tech companies have stored away and are selling to nation states, not to mention how many are in government archives already. To be clear, the likelyhood of any one transmission being decrypted this way is very low. Especially for someone not under surveillance already. But with modern supercomputers and data storage abilities, you should NOT count on this as being secure. It's like using pseudorandom numbers or euphemisms to transmit information: sure it might be okay, but why risk it? Just use a one-time pad instead.

[@syberphish]

The other problem is that any AI with access the the library of congress can just try every book that has any line or section that would match and run it. Books are CONVENIENT, they aren't secure. Books let you get around having to have new pads disseminated to people. But whenever you pick up an element of ease you lose security. There are many ways to do it, he gave us the one that's mathematically impossible to break if followed correctly.

[@jonathangardner4475]

Agreed but such a method would be a fairly secure emergency method. While there are supercomputers available for a lot of this, are they being used for something more important is the question.

[@chuckfinley3152]

You make your own, he says it in the video

[@costakeith9048]

That might have been viable before computers, not so much these days. Even if you have some original text you wrote yourself and you know nobody has access to it except you and the person decoding the message, there is a fairly regular structure to language which can be modeled and analyzed. There has even been considerable success in cracking software generated pseudorandom numbers, which is a much harder to predict than natural language; use the dice method suggested or an open source hardware random number generator that you understand and can confirm is truly random (they usually work by generating random numbers out of local background radiation levels, which is completely random best we can tell).

[@lanceheckerman6183]

Brings back memories tapping out code while on patrol and sending it burst. One note, however, it is illegal per FCC regulations to send any encrypted communications over radio. Only federal government and approved local government agencies and our military can send encrypted communications. If you do so, there are literally 10's of thousands of Karen ham operators looking for their good citizen badge to report you or DF your station. I recommend using digital radio on private channels, and only while mobile or at way points that you will not be occupying for longer than a day or two. Although the FCC and NSA monitor all spectrum communications and if they are super paranoid as they are right now after the 1/6 protest, they are vigilant for any encrypted comms that may be coming from targets they have designated as extremist nationalist groups. I could not believe the number of HAM operators that just live to rat out folks that are unlicensed or are violating FCC regs. I carried a radio on my back for many years and I have these guys going ballistic on the radio channels when I use my own published SOI with callsigns and frequencies. I have a HAM license, but there will come a day when I will not want to be identified.

[@Eluderatnight]

I'd start sending out jibberish en mass to tax their system.

[@thatkajunguy8029]

I agree, the HAM community as a whole are a big group of Karens

[@rdsmith334]

@@thatkajunguy8029 agreed. Try building an unlicensed crossband repeater on itinerant business frequencies. It took them a while to figure that one out. But their panties were twisted TIGHT. Lol

[@ephjaymusic]

@@rdsmith334 daisy chain a few baofengs as a repeater on VHF, leave them as far away from you as possible and feed it a recording of UVB76 lol!

[@TheCommissarIsDead]

Welp there goes me getting into anything like that😭 just wanna look for number stations ect ect like a weirdo

[@glenndavis4452]

Transmitting anything like this on a scannable frequency or modern internet communication system would sure attract attention, even without understanding of what’s said.

[@Eluderatnight]

Send as much jibberish as possible to tax system

[@RavemastaJ]

@@Eluderatnight Negative. Just use noise that is already there. You could probably encrypt messages in plaintext on 4chan, and as long as you had a definitive way of spotting your own people, you could say anything you wanted via already existing copypasta, and get it to any of your agents.

[@PrebleStreetRecords]

@ravemastaj bingo. Using stenography like that is a great way to hide secure communication in publicly visible channels.

[@chuckfinley3152]

Do both

[@BBDragon66]

This is a great thing for people to see and store the idea of encrypting their messages. We may need our one time pads for future KZbin videos, LOL. I can see an encrypted test video really confusing the youtube scanners and algorithm.

[@noblast1967]

While using the OTP 90 fig. must be added prior to any numbers. Additionally, if you have unused portions at the end of a number group always fill the letter X. It will assist in preventing an accurate character count.

[@maxtorque9591]

Two very good points omitted from this video. 👍

[@stefanadamcik8221]

This is very cool tradecraft. The OTP reminds me of the army CEOIs we used to use for sending encrypted radio messages.

[@DB-yj3qc]

Or for us old timers that started with SOI that later became CEOI, KIK 13, 19 followed with ANCD

[@YorkshirePirate]

It was known as BATCO to us Brits. Barely used or taught nowadays. Too much reliance on the machines.

[@moparty4409]

I can't express this enough but thank you for your mission in spreading information. Ironic considering this video is about how to limit its spread.

[@alvexaerial]

I hear that Bletchley Park is beautiful this time of year.

[@josuearielariasv.8041]

I wondered in the internet for a video like this, that explains the otp encryption method and here is. Thanks

[@gerryorlandostagehand3705]

Wow, very interesting. I always wanted to know OTP and how it worked. Thank you for the explanation .

[@handledhandlehandlinghandler]

What if PowerBall was just a way to set plans in motion and not a lottery?

[@shanemcdowell3628]

Hush!

[@tubeguy4066]

I heard the lottery is actually just a way for the gov to give people huge amounts of money without raising suspicion. Look up all the Sandy Hook parents who "won" the lottery.

[@tonylu2471]

The deep state would like to know your location.

[@mil3k]

Search for radio number stations if you want to learn what is down in rabbit hole. :)

[@unclebenny9028]

LOL 🤣

[@Ezael]

Great video, I would love to see a follow-up video with tips for creating a good codebook without adding 'noise' to the communications

[@mattfleming86]

Shjt.. got everything I need but a friend.. Jokes aside, good stuff. Thank you

[@tshirley05015]

In the Practice Example 4 2 2 72 was (NEED), But it also could be 4 22 72 (N2D) and that is why I prefer 222=2, 333=3 & 444=4 ect. Thanks for the great videos...

[@libbyd1001]

When sending numbers, use the “90 FIG” conversion preceding and after the number(s). That way, 4 2 2 7 2 can only mean NEED. To send N2D, prior to encryption would be: 4 9 0 2 2 9 0 7 2 Almost like: /numbers on /numbers off

[@tshirley05015]

@@libbyd1001 Thank you. I agree I was wrong.

[@hungrypear6425]

Glad its back, handnt finished.

[@LaLaLand.Germany]

Now would You look at that: Number Stations were the first to cross my mind. I live in Germany and grew up near the border in the Western Sector. When I got my first own radio it was still the 70´s, Cold War etc. and there was A LOT of activity on short wave. I actually wrote down the numbers sometimes and asked my parents my Dad once said those are spy messages. I thought he was kidding, that he just said that to me so i stop nagging about that. I loved my radio, we had way less interference creating devices then so receiving far away lands was a breeze, I had so much fun, there were so many stations... You have a nice thing going on here, good job, Mate! I still love the air waves, I still listen mainly to analogue FM and I hate that the Enteties break down analogue radio around here. Maybe I sometimes start my own Pirate Station. The Pirate Radio stories fascinate me. Some lads with a car battery, some old AM transmitter and a cassette recorder doing the thing (sigh).

[@rudeboysims]

37:58 monospace is the term for those fixed-width typefaces. it's a good note for people who might not consider it

[@hogarthman3605]

Thank you making these videos, very good info for people to know

[@YouveBeenMiddled]

This man has a long mustache. Pay attention folks, and transmit those messages quickly from an undisclosed location.

[@timewave02012]

This should only be considered for historic or hobby interest. It's way too easy to make mistakes that compromise the security. If you need to do anything serious, get an electronic device that will always remain offline, and use GPG on it. Modern ciphers used by GPG have the highly desirable property of being asymmetric. In a two user example, asymmetry means if either user gets compromised, only messages the compromised user received get revealed. Messages the compromised user sent to the non-compromised user remain secure. This is in stark contrast to symmetric systems like OTP, where one user getting compromised compromises messages in both directions. S2 made this point about OTP, but it's worth repeating, with a reminder that crypto doesn't have to work that way. Modern systems used by GPG also employ message authentication, so there's no need to guess whether a strange message is legitimate.

[@n88986]

That was a fun exercise in code breaking with OTP. Thanks!

[@madjackblack5892]

Another way to send this kind of traffic is two users having access to the same email address. Sender writes message and saves it as a draft. Receiver reads the draft. This method can work for both scheduled reports and for immediate traffic if paired with an alert method like a text, etc.

[@rm-gh1co]

isn't that how FBI Peter Strzok communicated with his coworker lover?

[@blankreganon5395]

Unless you use a true end to end encryption email service this is not a good idea. Too many people have been caught doing this. Most email services use logs that record IP address, etc., and are monitored by several agencies that you probably don't them to know what you are sending.

[@Protocol_17]

@@blankreganon5395 I know for an absolute hard fact they know the IP address.

[@blankreganon5395]

From what I have heard, they were not the only ones in that group that were using draft emails. And the "good guys" knew everything they were saying to each other. They were also using chat facilities of online games and many more things. But "they (the good guys) got it all".

[@jimwagner6260]

I like open messages to set alerts. And alternative system for code with real.

[@paulgrogan8032]

This channel is incredible, thank you for your briefings.Facinating and priceless for a SHTF cinario.

[@navyman8903]

Great information as always. Thanks for putting this together.

[@georgiishmakov9588]

Slight correction - it's not that the OTPs are "uncrackable", it's that, assuming all of the security practices have been adhered to, the OTPs are ambiguous - given a fixed ciphertext, for each plaintext that fits the character limit there exists an OTP that would decrypt the ciphertext into the plaintext. The "fits the character limit" thing is an actual vulnerability (although one that is hard to exploit given a codebook extensive enough - that's another reason to use them), one that you solve by adding some (truly) random numbers at the end of your ciphertext before transmission, the more of them the merrier.

[@JenEssitBroughman]

A question: at 27:02 in your video, there is the sequence of '4 2 2 79 99'. I can understand the context of the space character 99 not being mistaken for the number '9'; however, what would differentiate the '2 2' for being understood as two 'e' characters and not the number '2'? I figure it would be better to have non-duplicating codes that are unique for every single character, letter, number, or word. As a note, the Consolas font is also a good choice (we computer programmers use it as well), and the capitol letter 'I', lower case letter 'l', and number '1' are all disstinctive from one another. Also, being a D&D junkie, I have plenty of d10's.

[@libbyd1001]

He didn’t mention it in this video, but the conversion book “90 FIG” stands for “figure”. You could precede any number(s) with 90 and also conclude a number or string of numbers with 90. So the plaintext numbers 2022 would look like this: 9 0 2 2 0 0 2 2 2 2 9 0 (If using the doubling of digits method) preceded by and concluded with 90

[@JenEssitBroughman]

@@libbyd1001 Thanks, I guess I missed that video. I did wonder if there was another code that might indicate the following characters would be numerical or non-numerical.

[@ARPine-bt9uo]

@@libbyd1001 thanks! That makes a lot of sense. Do you know what the REQ refers to on the table?

[@24680kong]

Regarding accidental duplicates caused by one person not receiving a message: a way to prevent this would be to use different codebook for sending and receiving. That would work even with more than 2 people. Ex: tim sends with this pad, john sends with this pad, mary sends this one, etc. Or for 2 people, have the spy only use codes from odd number pages (1,3,5...) and the handler only use codes from even number pages(2,4,6...). You will need more codebooks, but it would prevent accidents. If you don't want anyone knowing how long your codebook was if captured, you could just roll over the page number: 8,9,0,1,2,3... etc. and destroy all previously used pages, so you can't tell how many were used. Otherwise, they could estimate how many messages were sent by you previously. One thing I don't understand: why do you want to choose a random 5-digit code on the page? Why not just start off where you left off last time? It doesn't seem to add any randomness to an already random number series, and wastes random numbers.

[@ffoska]

That's a good question, deserves a like and comment, so someone who knows can see it and answer it :)

[@cmtptr]

Yep, I was also thinking of the even-odd page thing. I was thinking of computer cryptography where usually both ends have unique asymmetric keys. Also second the question of choosing a random starting point.

[@syberphish]

Same thought was looking to see if someone else posted it. That way if you miss a message, you can pick up from the next one as it's received and there's no issue. Could possibly use some kind of checksum to let the received realize if they've missed a message.

[@chrisn3119]

What I was thinking too, you could also let someone know you are comprised simply by sending a message from a specific page.

[@gaelc13]

I can think of a few reasons : 1) the sequence would leak some information (like : did we miss a few messages) if the pad is ever captured. 2) if messages are not received, there is a sequence alignment problem between sender and receiver.

[@BenMordecai]

A few questions and ideas: 1. Given that most dice are 6-sided, could you make a OTP using base-6, and convert to decimal later, then no longer requiring custom 10-sided dice? 2. To overcome the reuse risk from a message not received, could you have a very long pad and a policy to discard a page each day? Then in the event of a non-received message, both parties would be 95% likely to have discarded the cipher anyway? 3. With duress signals, if I were threatening a spy and forcing him to send a message, I would demand to know the full cipher and confirm the message he produced is the same message I could independently produce, and thus a word like Apple would be obvious. So I would want to have a clear policy that the safe word present is safe, omitted is distress. It would require you to always use the safe word or it is presumed distress. You could still designate a distress word for special cases where you are distressed and can still send a safe message, especially if you could use it to signal that only Pad #1 is compromised so move on to Pad #2.

[@Borme22]

This was too cool to learn about--thank you for sharing all of it!

[@RW-rt5nd]

You can also use two six-sided dice of different colors. This will give you 36 combinations: 26 letters of the alphabet and 10 digits. Certain combinations of characters in your plaintext could serve as control characters if needed.

[@mrwdpkr5851]

Even though I have absolutely no use for this ( or do I ? :) it was incredibly interesting ! Thanks for posting this ! 😀

[@76dg15]

I have to say this was unexpectedly useful

[@Version135]

I missed this intro a lot. I was wondering if it would come back. Yay

[@Francois_Dupont]

28:06 "there is no 22 on the conversion table" actually at the bottom, everything that is two number repeating is a [number], so 22 is 2. the 2 2 in that could could have been either [2] or [E E].

[@mkultra6664]

I love this! Thank you for enlightening me. Super cool!

[@tangle70]

Thanks, you explained this very well.

[@JoelStenberg]

Thank you so much for this educational video

[@cmtptr]

Seems like the key indicator should be a position rather than the value itself. Otherwise there could be confusion if that value appears in the one-time pad more than once however unlikely that may be.

[@ffoska]

you can always try each of the key indicators and if you get gibberish than it's the other one, so not a big deal. But interesting idea, maybe the keys should be numbered from the back ( can't index from the front if you're gonna tear out the page), feel like somehow it would make it less safe

[@jamesbrown99991]

​@@ffoska You could use the page number in the index, refer 32:15. Regarding probability of any number you choose being duplicated in 100 pages of 60 codes, it is 1-(1-1/10000)^60000 = 45%

[@larsmurdochkalsta8808]

I'm on the part talking about what happens if someone misses a message and pads get desynchronized. Assuming you're not throwing away pads, would there be utility in destroying all but the first and last block of a message. Then highlighting the blocks at the beginning and end of a message so you don't use them in future. The idea would be you would then send a message with two call signs, 1 for the person you're communicating with and 2 a call sign that looks normal but signals error correction. Followed by a message stating the perceived error and first and last of relevant blocked sections.

[@hussamgunter7381]

Trying to figure out if S2 picked those coords randomly or if he lives close to Beltchley Park in Milton Keynes, England.

[@cachecaver]

There are a couple of issues with using an unencrypted call sign. First it allows traffic flow analysis so though they might not know what the message but the adversary may glean other useful information. Also if all the agents aren't listening to every message there is no way to keep the one-time pads in sync for all agents which would mean that parts of the pad could be re-used accidentally.

[@James-C24]

Possibly as a way to burst transmit it. You could use an auto voice generator to say the numbers record it. Then speed the audio up transmit it. The the recipient can record the transmission slow it down listen and decrypt.

[@EugeneSan]

@S2 Underground At 27:00 you explained how the method is inheritly error correcting with 4227299 snippet. While I can see why it is not "42 27 29 9", I can't see why it can't be "4 22 72 99". Meaning decrypted snippet is "N2D9" and not "NEED ". Either I am too tired or that 100 years method is not 100% reliable ;-(

[@robertstephens1599]

I'm not sure, but I think that one would expect numbers to be preceded by "FIG".

[@ronlasiere4114]

Very interesting! Two questions: 1) Where would the callsign be placed in the message in relation to the key indicator? 2) How would the spies know which page of their booklet to look at when using the key indicator? Or is the whole booklet one long run-on OTP, and its assumed each page is destroyed after one message is sent from it?

[@jamesbrown99991]

You can see a page number at 32:15. For practicality, I would guess the page number and starting position would be used, rather than the code itself. Page number should be randomly chosen, otherwise you're broadcasting the quantity of messages sent.

[@PNWOverlander]

Great information! Thank you for uploading!

[@gunnersecuador7515]

Very interesting topic, thanks.

[@peebreezy5015]

Another great video. Keep up the great work. Thank you.

[@MgtowRubicon]

Amazon sells printer-friendly water soluble sheets of paper that dissolve in 30 seconds. Observe security procedures when programmatically generating and printing the OTP. Have a big glass of water ready for dunking the water soluble paper pieces. On the sending side: Use the OTP to encrypt the clear message, dunk in the water your clear message, dunk the OTP, transmit the encrypted message, dunk the encrypted message. On the receiving side: Receive encrypted message, use the OTP to decrypt the encrypted message, dunk in the water the encrypted message, dunk the OTP. If you are interrupted at any time during the procedure, then immediately dunk all used paper.

[@MgtowRubicon]

An alternative to water-soluble paper is magician's flash paper that instantly burns when ignited. Keep a lit cigarette within reach or in your your mouth during the procedure. If you are interrupted any time during the procedure, touch the cigarette to all used paper. The down-side is that burning a cigarette or paper can trigger smoke alarms, or indicate to an observer that you are engaged in a secret communications task.

[@ARandomMonitor]

Had no idea there was such a thing as water dissolving printer paper. Thank you very much for that.

[@libbyd1001]

Just don’t use it in the rain. 😂

[@Akinius]

On the conversion table, what does “REQ” mean? Request? Require? Great video, thanks!

[@Real_Tim_S]

RE: the coversion table - it's all about the first character. Either you encode everything, or you make some concessions on your conversion table. If you limit yourself to the decimal number system (0-9), then you have to indicate your expansion decsision with a specific number - here you do 7, 8, 9 as character expansion indicators and 0 and 1 as word expansion indicators. If you took this conversion table to two characters and English letters (0-9 and A-Z) - now you have essentially a base-36 number system rather than base-10. Nice thing about a base-36 system is that a OTP can be generated with a 6-sided die rolled twice (6 * 6 = 36). With two characters per sent "symbol" (RF lexicon), you have a number system of 0-1295. For expediency, one could create a 0-9+A-Z conversion table for two characters per symbol, where any digit or letter doubled would be that digit or letter (I personally think that would be stupid - if you're required to send two characters per symbol, why not use some random distribution in that symbol space?). This simple concept leaves a codeword space of 1260 other words/phrases for brevity... With the goal being very short messages. Shorter messages allow for expansion of the transmitted symbols further in the same amount of airtime - for example the DRYAD system where two letters correlate to a OTP letter in a table, this would be two spoken letters for a OTP letter, meaning 4 spoken letters would be needed per code symbol. Something like "Alpha Golf Lima Lima" could translate to a symbol "E9" that decodes to something like "You are compromised, use secondary exfiltration plan, ASAP". It's entirely up the the table writer's imagination. There is an argument for OTP pages being somewhat aligned to time. This gets around the issue of accidentally reusing code streams, but puts a burden on sourcing and good length of OTP stream. There are examples in modern encryption schemes that guide how this could be done in practice. Imagine telling an "agent" to acquire a specific book by UPC, EAN, or ISBN. This is a short number and expands to a very large pool of characters which would be the same for anyone who bought that UPC, EAN or ISBN. Now you're saying "Ah gee, but I need a book with numbers in it!" Sudoku is a really popular game, and provides some obscurity cover... Just saying - threre are even games published in newspapers. A UPC is a very short number to memorize - for example I occasionally use a >12-digit PIN for some stuff. From security there are several ways to guarantee indentity: something you have, something you know, and something you are. OTP requires one of those, but needing two of those is also useful (two-factor) for hardening. You have to keep that something you know in your head. Only your communicating partner can also know the same thing. This is security by obscurity, but very importantly - unless they beat it out of you or your communication partner, it's pretty damn obscure what ever it is. If that something blends into your existing pattern of life, then it's very hard to separate out. The is why you see the FBI consistently suggest that persistent surveillance of all aspects of people's lives is something they desire. The hill is a hard one to climb without dystopian-level surveillance. One of the things about arranged time code transmissions is that you don't really need to be around for them in modern times. Any idiot with a radio and a tape recorder can capture audio for later processing decoding, and becasue of this it can be put away from where normal observation of that effort is possble. Voice recognition libraries getting better and more compact, I can envision a speech recognition stack running on an ESP32 with an RF tuner in the correct band and decoding the numbers/letters and storing them until someone logs in (rather than the audio itself being recorded offloading the capture of the spoken numbers/letters yeilds imense space savings). It's an SSL capable device that one could log into with a smartphone or laptop and get the numbers/letters captured at a given time stamp. Then act like they are studying for a test while they decode it... Really want to have deniablility? Give a gift of a device that has the unmentioned ESP32 embedded in it to someone who is in range of where you want to be when you do your reception - maybe bury the code number/letters in the webUI so that the webUI is part of something they know about, but not the specific command to fetch the codes? You get searched, it's not where you are, and the gift recipient won't suspect they are holding anything for you. This keeps expanding out. And this is why catching and then prosecuting the CCP assets in the US is so damn hard... Prolific technology is a lubricant for spycraft IMHO. Hell, an example I thought up of a steganographic medium: you could use the amount of window opening on a car to send a message. A comon 4 door car with 2-3 window opening states (closed, half, open) could convey up to 81 unique code-words/phrases (3^4), and the person(s) receving it wouldn't even need to be physically present - only needing access to a CCTV camera(s) along one's route to see the window positions (How can you tell if it's opened or closed? Reflections, dirty vehicles, etc...). Given that driving is damn near requred in the USA, and everyone is buying cheap Chinese cameras and other tech that calls home to the mainland, it's not that hard to imagine that slipping through.

[@CaptZenPetabyte]

Great video, love this topic. Idea: replace the numbers station with twitter

[@joefield8078]

Would Benford's law analysis be useful in analyzing these number sets? The example of the #9 hints that it may- though it's not stated in the video where in these number set the #9 appeared.

[@Francois_Dupont]

i have a minecraft server and i would like to generate a One Thyme Paddington to use in our block building, somebody find a good secure way to make one?

[@mikebrian3380]

Thanks for all your work really appreciate the videos

[@tomroot6013]

I was a Communicator in our Corps, and we used way more sophisticated methods, but can and do see how this would work. Again, once you send it over any Radio frequency you have broken a Law, period. But at one point the FCC outlawed any foreign Language even on the Citizens Band (CB) Radio, within our borders. That Law is either long, gone, or simply ignored, I see! I'd like to mention something that I always had with my son, as a code, that would allow anyone he was unfamiliar with to obey what they told him, as he knew it came from me, or his Mother. At about age 5, he was taught to never trust anyone who approached him with a message from us parents. He's in his 30's now, and uses his own code with his son, so I can divulge what it was. If someone said the Code Word "Infinity", in a sentence, drew a "Lazy 8" on a piece of paper (Nowadays a TEXT of course), or just traced it out with their finger, in the air, he knew it was from us. It meant our "Infinite Love" we had with each other, of course, so he would remember it! It was used in several situations, and all I can say, came in handy! Without writing a book on how and when we used that "Code" to authenticate it was from us. One particular time was actually a Life-or-Death situation, that turned out just fine, BTW! He was instructed to alert authorities if someone did not Authenticate, if they wanted them to come with them, or even believe a message came from us! You can dismiss all this as well, but I strongly urge every parent to teach their children any "Code" they chose, as Child Abductions, etc. are way worse these days!

[@suzz1776]

My mom and dad had a code also. It was mamma bear. Cuz when I was little I had a little stuffed bear called mama bear. Thankfully we never had to use it. Glad to hear other people do it but I wish more would cuz it could save alot of kids lives, esp in the tines we r living in. 😀

[@jjones503]

Absurd laws are meant to be broken

[@costakeith9048]

There are plenty of other encryption methods that have advantages, like both parties not having to have the same pad, but the one time pad is the only method that is theoretically impossible to crack (provided it's used correctly). Everything else, including things like RSA encryption, can theoretically be broken (granted, you'd probably have to have a quantum computer to crack RSA cryptography with a long enough key, but don't bet on the NSA not having that capability...or at least one day getting that capability and being able to go back and decrypt your message). For highly sensitive messages, such as diplomatic messages between the home country and an embassy, one-time pads are still the standard. They're less common in the military because the military tends to prioritize convenience over security, at least on the tactical level, with the idea being that by the time its decrypted it will no longer be useful information; but diplomatic issues can still be sensitive even decades later and you don't want to bet your adversary won't invent a functional quantum computer or that standard computing technology won't improve to the point cracking it is practical in the mean time.

[@securemindsetofficial]

Keep it up and coming guys!

[@itiswhatitis8179]

Don't know if anyone will read this on a video posted so long ago but here goes any way. The author states that the section of code "4227299" in the second example can be converted only to "NEED(SPC)" because there is no "22" in the table, but there is. The number 2 has a code of 22. So the phrase could be converted as "N2D(SPC)". Here it is easy to see what it should be but what if a car license number was to be communicated like "TYK1234". This could be converted back to "T871234" because "77" and "88" can be 7 or K and 8 or Y respectively. So, how does one handle this with the conversion table provided. Perhaps I missed something?

[@itiswhatitis8179]

I found an explanation somewhere else online and I was missing something. Numbers are preceded and followed by the Fig(90) character to differentiate them from letters. K, I'm good😂

[@AlanSmithandgambit]

Spycraft meets fun dice. I'm in!

[@jero37]

I rather like that the meeting coordinates are at Bletchley Park in England.

[@Bergerons_Review]

33:00 date the pages. Only use the page on the given date. No message came, just tear that page. Edit: better yet, have a send and receive otp.

[@begrackled]

One of the mysteries of north American dialects is why New Orleans got the northern city vowel shift. There's nothing nearly as mysterious here, but there is a well-known connection between Tennesee and Central Texas, particularly the way they front the OU dipthong. My dude has an urban southern accent.

[@maxtorque9591]

RE font explanation: the important point to make is that Impact is _proportionally-spaced_ whereas Courier New is not. It is fixed spaced. Use a _fixed-spaced_ font for tables.

[@GerbyMcGerbs]

You have no idea the jollies I just got decoding that....

[@ianxtreem]

Very motivating. Thank you

[@Damitsall]

Still having an issue fully understanding the encryption part. The part where you have the 3 colored number sets, I guess I don't understand which are the actual message and where the numbers you subtract come from.

[@machinemaker2248]

How do you pick the 3 digit shortcuts to avoid errors in deciphering?

[@ArcanusLibero]

fun. wish i had a friend.

[@phl_knives]

Awesome breakdown of the OTP. Very detailed and informative. Better than I've heard anywhere else. Between trade craft and briefs this is one of my favorite channels. I tell everyone like-minded to check out S2underground

[@Eluderatnight]

What do you mean 42069 isn't secure?

[@Snozzelquaf]

Lmao

[@dieselstruck]

Recently attended a hacking convention where they discussed Ads on news papers from the 1800's where the messages where encrypted. There is a small group of people that are actively decrypting those ads. Encryption has been around for a long time.

[@ncrshane1919]

Do you have any reccomended resources on making a codebook? Looking to get into this stuff but need a starting point. Also, don't forget that typewriters can still be bought for use in these exact type of off grid communication.

[@elconquistador932]

I'm at a cross roads here as well. I want to get matching OTP for me and a buddy, something small but many pages worth of numbers. I don't want to do them by hand but yet anything done on a computer or via a printer is saved. So how do you get around that? If you do it by hand or a typewriter, it would take a long time but more importantly there would be mistakes between the two codebooks, almost guaranteed mistakes.

[@ncrshane1919]

@@elconquistador932 I'm doing the OTP by hand for now, just taking it slow 5 digits at a time and verifying after I write them. Its slow, but I'm willing to trade speed for accuracy. Even with one or 2 digits here or there being off, the bulk of the message should be understandable.

[@elconquistador932]

@@ncrshane1919 that sounds good! I did some looking too. I think a printer calculator might do the trick (58 mm paper rolls) Most have a copy mode so no mistakes between the two copies. And no cell service. No internet. I'll let you know what I find.

[@ncrshane1919]

​@@elconquistador932 Another thought i just had was a 5 digit number stamp, just dial in your number, and stamp each OTP. no chance for mismatch. Probably slower than your method, but very budget friendly. One of those stamps runs like 10 to 20 bucks online. The benefit to those calculators is the use of thermal paper, very easy to destroy the numbers unrecoverably. A bit of heat instantly destroys it, and since its not a layer of ink on top of the paper, no chance forensics could read it.

[@elconquistador932]

@@ncrshane1919 interesting idea! I like that. What kinda stamp is that?

[@ephjaymusic]

What an amazing video! ❤️

[@RabbitxRabbit]

There IS a 22 on the conversion table, though. It stands in for the number 2. Which is probably why English speakers used three digits to determine numbers. A lot of English words have words with two of the same letters next to each other. So if it said 222 rather than 22, then you’d know it meant the number 2 and not “EE.” Same thing with 55 in this example “book” would be 70557 7****. With only two letters to represent numbers, it could read B57.

[@diomedes39]

Couldn’t you get around that by agreeing to not use double letters? Book becomes bok, battle becomes batle, wood to wod. It wouldn’t be hard to get the message

[@RabbitxRabbit]

@@diomedes39 that’s a good idea. Or a “god” idea! Lol

[@qaz120120]

How can a one time pad be cracked easily as you told if it is used twice or more?

[@roflchopter11]

Can't believe you didn't advise destroying used OTP pad instead of striking though. At least for field agents.

[@mr.miller2828]

Take notes on all of these hard skills. The day will come when these videos are unavailable and/or the electronics are unavailable for use.

[@TheAnimal191]

More things like this, please! Perhaps other sources like the website cited in the OTP book earlier. Also, what software do you use to put these presentations together?

[@Ist_Geheim]

Min: 27:40 There is no 42 on the conversion table -> correct There is no 27 on the conversion table -> correct But: There is a 22 on the conversion table. If you don't seperate the numbers in "42" "27", but in ".4" "22" "7.", there is room for mistakes. A possible solution that comes spontaneous to my mind would be to use a conversion table on which EVERY digit and EVERY letter is converted into a double-digit. So when decoding, you'd always know which digits belong together, because all of them would come in pairs. Please tell me if I'm wrong or if my solution would lead to other problems I don't see at the moment.

[@INshadow08]

sinlge digits shift patterns?

[@njabulon5924]

What number is the space button on the east German secret police one time pad?

[@matthew2596]

Awesome info. Thank you