COMSEC: One Time Pad Generation, by B.R.

While re-reading the ‘Radio Ranch’ chapter in JWR’s novel “Patriots“, I started thinking about the Book Code method versus a One-Time Pad. I went through the books on my shelf, and noticed the lack of duplicate books; the number of ‘common’ books; and how many of my books I figured would be in the Uncle Sam’s cracked book repository. At that point I thought I’d be SOL when trying to setup a secure method of communication.

Being an ex-Army Infantry turned computer geek and prepper, I figured it would be much easier to write some code to generate pages of random word lists (a.k.a. One-Time Pad or OTP). Besides, creating one from hand would be brutal.

My attitude towards prepping is to start with a grid-down, post-EMP or Solar Storm, condition. Unless I get a Faraday cage up soon which will protect all of my electronics, I’ll assume I only have the technology that is secure in large grounded ammo-cans. (Portable communications gear, solar battery rechargers, and lots of batteries).

The code examples, under these conditions, will not be useful unless the output has been printed, in duplicate, and ahead of time.

Since not all of us are computer geeks, I thought I’d cover the following and share with our community.

I’ve broken them down into the following sections

  1. When One-Time Pads are appropriate
  2. Getting Started: what is needed, how to get it.
  3. OTP Generation: The Code to generate up to 99,999 pages of OTP output
  4. OTP Decryption: The Code to decrypt messages using the OTP method – assuming the computers are still working. Hey, prepare for the worst, hope for the best.
  5. Examples of over the air communication using OTP.

 

When One-Time Pads are appropriate:

The best use of OTPs are when you need to communicate securely between two or more groups. These groups can be just over the hill or over great distances.  Even if you only have a small retreat and do not expect to use one, it cannot hurt to have two or three printed copies of an OTP ready should SHTF.

This is especially true since we can not predict group expansion, and re-organization (including splitting into smaller groups) due to changes in conditions, numbers, and personality conflicts. Therefore, in my opinion even if you are currently on your own, you should generate multiple printed copies and keep them safe.  Finding multiple copies of an out of print book in a post-SHTF situation will be far from easy.

Because the OTP has to be referenced to de-code the messages, it’s best to keep them in a secure location rather than attempting to use them as a means to communicate with patrols, or individuals on the move.

Getting Started: what is needed, how to get it.

The code, covered later, uses something called Perl (a computer language common on Unix/Linux and sometimes Windows systems). I’ve based the code on the Solaris – aka Unix/Linux operating system.  If you have group to group communications, hopefully there is someone in the group that has a basic understanding of Unix/Linux.  If this is the case, the easiest method it to direct them at this article. A Perl geek will be able to skip most of this article and have you up and running in about five minutes. 

The code is setup to cut-n-paste. There are no additional Perl-modules or fancy install procedures.

Installing Perl (on windows):

UNIX/Linux/MAC operating systems have Perl pre-installed. Perl for windows can be installed via: http://www.perl.org/get.html

Select windows -> download -> Strawberry Perl

Once installed, it is a matter of cut-n-past of code into a text file for execution. Normally the code files have a extension of ‘.pl’, but we will get to the running of code when we cover the included scripts.

A Note on Word Lists

In my case, UNIX keeps a list of words in a file called /usr/dict/words. To improve possible communications I’ve updated my file to include acronyms from the SurvivalBlog Glossary in addition a number of my own expected terms, local USGS map grid coordinates, expected rally/extraction point codes, and feel free to add in junk – it just helps to confuse any decryption.

The word list is one word per line, example here:

# tail /usr/dict/words
zoology
zoom
Zorn
Zoroaster
Zoroastrian
zounds
z’s
zucchini
Zurich
zygote

OTP Generation

To use this script cut-n-paste the section between, but not including <CODE>, into a text file. Call that file generate-otp.pl

There are enough comments included in the code to walk a Perl knowledgeable person through the steps, but for others, it’s just a matter of cut-n-paste.

<CODE>
#!/usr/bin/perl -w

# ONE-TIME PAD Generation.

# This perl code generates a random list of words,
# 10 per line, 59 per page. Created from a text file
# containing a source list of words. Every word
# in the list is used.

# The initial word list is one word per line.
# To help simplify the process, the script uses a
# UNIX word dictionary, supplemented by words
# and acronyms added manually.

# Output is collected where $output_directory is defined as
# words-00001.txt is page 1.  The code currently supports
# up to 99,999 pages.

# Every time the script is run, there is a different order
# of words.

# The number of passes through the word list is defined by
# $cycle_count

# The default settings run through the word list 5 times
# Each time the script is executed it will overwrite any
# existing words-#####.txt file, so move them some where safe
# before re-running the script.

# set how many lines per page to output
$lines_per_page=59;

# set starting page number. Useful if running many
# cycles of this program.
$page_count=00001;

# Number of times to run against the word list.
$cycle_count=5;

# Where the word list is.
$word_list=’/usr/dict/words’;

# Where to put the results
$output_directory=’/tmp’;

$count=0;
@line=();
@page=();
$line_count=0;

 

# Main Processing Starts Here

for (1..$cycle_count) {
srand(time|$$);

open(WD,”<$word_list”);
@file = <WD>;

while ( @file ) {
  $choice = splice(@file, rand @file, 1);
  chomp($choice);
  push(@line, $choice) ;
  $count++;

  # Check if there are 10 words in the array – done to print 10 words per line
  # of output. If you want more than 10 words per line, adjust here.

  if ($count eq 10) {
    chomp(@line);
    s/ ^\s+//gx for @line;
    push(@page, “@line “);
    # reset count for 10 words per line starting at 0
    # zero out the line array.
    $count=0;
    @line=();
    $line_count++;
  }

  # If we have reached the max lines per page, generate a new page
  # of words.
  if ($line_count eq $lines_per_page ) {
$page_write = sprintf(“%05d”, $page_count);
open(FW, “>$output_directory/words-$page_write.txt”);
print FW “@page “;
$line_count=0;
@page=();
$page_count++;
close(FW);
  }
}
# There’s almost always some words that didn’t fill up the line or page
# arrays. Dump them to the last page written.
$page_write = sprintf(“%05d”, $page_count);
open(FW, “>>$output_directory/words-$page_write.txt”);
print FW “@page “;
close (FW);
close(WD);
}
<CODE>

Next make the script executable:

UNIX/Linux: chmod +x generate-otp.pl

WINDOWS NOTE: Right click and have it run as Perl. Note that the directory paths will need to be changed, and possibly some of the code updated.

If you want the output placed somewhere other than /tmp, see the section of code where it can be adjusted (comments are clear). You can also adjust the number of times it cycles through the word list.

OTP Decoding

To create the decode script, cut-n-paste all code between, but not including <CODE> into a text file called decode-otp.pl. 

<CODE>
#!/usr/bin/perl

sub _help {
print “USAGE: decode-otp.pl filename “;
exit;
}

if (@ARGV != 1 ) {
_help();
}

$filename=”$ARGV[$1]”;

if ( -e $filename) {
   _process_file();
} else {
   print “$filename does not exist “;
   _help();
}

sub _decode {
$count=1;
 open(PG,”</tmp/words-$page.txt”);
 while(<PG>) {
  if (sprintf(“%03d”, $count) eq $line ) {
@myword = split;
$found_word = @myword[$word-1];
chomp $found_word;
print  “$found_word ” ;
  }
  $count++;
 }
 close(PG);
}

sub _process_file {
 open(DC, “<$filename”);
 while(<DC>) {
($page, $line, $word) = split;
_decode($page, $line, $word);
 }
 print ” “;
 close(DC);
 $page=();
 $line=();
 $word=();
}
<CODE>

The decode script will expect a text file as an argument. You add the OTP codes into it that you want to decode. One word per line.

Example of this would be as follows

decodeme.txt:
001 019 001
999 059 010
023 043 009
006 012 002
863 001 006

To run the decoding use the following command:

./decode-otp.pl ./decodeme.txt
meet me at the house

Examples of over the air communication using OTP.

The first item to take care of are ‘call-signs’. These should never be something that indicates location, or the group/person sending or receiving. They should be as randomly selected as possible.

For this case, lets say that first group’s call sign is C19 (Charley One Niner), and the second group is DFX (Delta Foxtrot Xray).

In addition, let’s assume they have a run-book of challenge/response codes.  This is a list of items to ask, and answers expect as a response. Each challenge/response code should only be used once, then scratched off, and never used again. If the wrong response is given, all communication is stopped by the challenger. Best not to even give a reason, or a ‘keyed’ mike. Just stop listening, and if possible turn off the receiver. Make sure not to send any outgoing signal that could be used for Direction Finding equipment.

Remember, they may send you junk to keep your mike keyed for direction finding to have enough time to track your location.

As an example, let’s assume that Blue 16 is the challenge and Alpha- November is the expected answer.  Side note: you could have a specific signal change as part of the authentication.

Using the example decode text above, a radio or phone communications would go as follows. (Please forgive any mistakes, the last time I used this Baghdad Bob was on CNN), after all – OTPs aren’t exactly military communications methods anyway. Make up your own SOP.

C19: Delta Foxtrot Xray, this is Charley One Niner, come in over.

DFX: Charley One Niner, this is Delta Foxtrot Xray, authenticate Blue One Six, over.

C19: Authenticate Alpha-November. Over.

DFX: Authentication received, send message over.

C19: message as follows, break.

C19: Zero, Zero, One, break, Niner, Niner, Niner, break, Zero Two Tree, break, Zero, Four, Tree, break, Zero, Zero, Niner,  how copy over?

DFX:  Say again after Zero, Four, Tree, over.

C19: Zero, Zero, Niner, over.

DFX: Copy over.

C19: Copy out.

Bad Rambo Mistakes

Remember there are many ‘movie’ based terms that are not a part of the Phonetic alphabet, nor the normal military radio-telephone procedure. Some of these may have nasty consequences.

The one that comes to mind is ‘repeat’ repeat has a specific military usage. It means to resend the same artillery barrage that was last requested. If you want someone to ‘repeat’ what they just said, use ‘say again’.

Another common movie term is ‘actual’ as in: ‘request to speak to Charley One Niner actual.’  I’d strongly recommend not using this at all. It tells Traffic Analysts (TAs) that someone in charge is talking. Then with Direction Finding (DF), they will learn where should target their artillery fire..

These examples could go on for a while, so I recommend reading Army Field Manuals (FMs) that cover calling for artillery. Best not to have an ‘oops there it is’ moment.

Use common sense, and keep the message short by using pre-determined keywords. 

On a side note, if both groups have someone that speaks an uncommon language, leverage that. Include those terms in the word dictionary. This will help prevent any compromised communications.

For a departing comment, if you ever expect an attack of the Tidy Bowl men, I’d recommend an extensive use of slang. Slang is not usually covered in English classes run in other countries. Use this to your advantage, and include these terms in your communications and word lists. I still remember, years ago in college when I used the word “awesome” in a sentence and an English as a Second Language student thought I meant ‘very very bad’. It seems that their dictionary only had the formal definition. I guess the same could be said for breaking out the old Oxford dictionary and using hundred dollar words.