Security and Encryption. Really, the only way to be relatively certain that a communication has not been altered or tampered with is to encrypt it. If an encrypted message is tampered with, it can no longer be decrypted by the recipient, so he will know that sabotage has occurred. There are various options for encrypting a message. The best, by far, is to use a modern encryption program, like PGP, which stands for Pretty Good Privacy, now available as GnuPG and Gpg4win. However, this requires that the sender and recipient (or Postmasters on both ends) have the software and the knowledge of how to use it. It’s not highly technical; you just have to learn a few operations. Encryption in general is a large subject, which is covered elsewhere by others, so I won’t try to explain how it works. This article is really about the medium for sending messages, not the content or how to encrypt, but I’ll provide some tips.
One huge advantage of using PGP is that it allows one person to send a secure message to another person without those two people having agreed on a password in advance. If a person wants to send an encrypted message to someone, all they need to know is that person’s “public key”, and he can send a message that only the intended recipient (with his secret “private key”) can decrypt.
This same technology also allows messages to be “signed”, which is basically just a special use of encryption. A signed message, though not necessarily secret, can be verified as actually originating from a particular person. If a message has been signed, all you need is the “public key” of the person who purports to have sent it, and you can verify that it really was them. This can be used to solve the problem of verifying blog entries, as mentioned before. If Joe Blogger has a blog at www.JoeBlog.com, he posts a message with a name of, for example, “www.JoeBlog.com 2015-01-15-YREU”, (YREU being random) adding a digital signature at the bottom of the message, which he generates with PGP, using his private key. Anyone interested in the blog can find it in a pouch the same way he would find his your own messages. If it is signed and the “public key” is known, PGP can be used to verify that the message is authentic.
A public key is quite long and random; it’s definitely not something any normal person is going to be able to remember, but it can be sent in a message, and it can be saved on a USB key or SD card. Each postmaster will eventually have a large “address book” of them. They look something like this:
mQENBFUMZJoBCACIqaSs9NZegeCYbL7QNQY9hJs3BSy/JcYgf3coy5mXDXDC+L95
x/w4TGBT9jSbwQQD3esYa8eUIAdDAuvHpFipJ+5D4hY0vynkXvWeKzMztMqj3jYR
QkcpNOL28M9ezrRMp/X4fN2Yy9k+BkBgmo7M78bYJdH1IsaJ1foOQFqYxC5YSUyY
s0bwCKb9tmqEhvpwj2/LnOhlQ/R/H/3th09rc2x6/0tPzYI6j9j9d/X6pzPh1kv6
9cV4yki0/zk5VJtrK5kyasTmjDj7pdc2O9iduJkCxD0f+RKsyziEOaBDOzFSpC99
8kBnr9ccwBMAMiJBy1tUomP+0unkvgdClhenABEBAAG0GXJpY2tAa25vd3dhcmVz
b2Z0d2FyZS5jb22JARwEEAECAAYFAlUMZJoACgkQQoRmLC8SB0DaRQf/RwktmFK8
WJSSOj/8h0iouMZj/GACytI/qVZu3pC07av64xjVGREaoBjTQ4AmYTM31ePgHKx7
B6qAGTRVNp/vgsWeu7Nnfu8CEeqgjXvQRKqAcrlH/QmF/0F0vAfYP1YboeVrQCxe
trkcSP4XPlRR/Kk3DiwY6nqim4eeEnYTwPKmrMnaMwITt7AzCvvGNYDJyjKvZnDz
/BQotUd0ritrJLpMRhFTPd/t/fO+qLBT75WxuarofwHI6ED8Z0jip1hiL/E9f2TO
oAbRgo0Dx9KNSCsW7SFExsujN4BPDz+8XM5ctMHSJ4kUl63xAtJAGnBHTjmAMFLe
5wR6KcVIHLNPXQ==
=EZ4C
Another less technical option, other than PGP, is to use the “zip” file format, which can also do encryption. There are free programs, such as 7zip, that will allow you to create an encrypted file that requires a password to open it. It will also shrink a message file in size considerably. This method, though less secure, has the advantage that all you need is a simple, human-readable password to encrypt and decrypt. Large messages or long blog entries can also be “zipped” without a password, just to shrink the file down to a smaller size.
Yet another option is to use some manual coding method, such as found in children’s code books. However, if you use something as simple as some sort of A-Z substitution, don’t make it too simple and don’t separate words with spaces. It doesn’t take a rocket scientist to figure out that “J MPWF ZPV” means “I LOVE YOU”. Once he has figured that out, he’s well on his way to decrypting your entire message. Remember the Nazis’ mistake as covered in the movie The Imitation Game (I won’t give it away, in case you haven’t seen it yet.)
An effective, highly secure, yet low-tech method of encryption is called a book cipher. This requires that the sender and receiver have exact copies of the same book. It must be identical. For maximum security, it should be a book that does not exist in electronic form anywhere, but for practical purposes just about any book will do. An old paperback, a children’s book, a particular printing of the Bible, a textbook, any book will do, as long as both copies are identical, page for page and word for word. Then devise a scheme to build messages by pointing out words in the book, or if the desired word is not found in the book, letter by letter. This will take a prior understanding between the sender and receiver and some practice, but it has the advantage of not requiring special software. For example, “15.2.3,18.12.6,17.3.12” means page 15, row 2, word 3, then page 18, row 12, word 6, then page 17, row 3, word 12. You also may need a way to point out individual letters to spell out a word that you can’t find in the book. (Hopefully, you can do this without making it obvious to a cryptologist that you are doing so.)
At the very least, or in addition to encryption, use vague terms that you are sure will be understood only by the intended recipient. For example, instead of typing “The gold will be dropped off at 123 Pleasant Street, Boise, Idaho on 14 September 2017”, say “It will be at Ma’s place five months before her 60th birthday.”
There are endless possibilities, which are beyond the scope of this article. The point is that only an encrypted message is truly secure (and even then you have to be careful). That said, if all you are trying to do is let your sister know that Grandma and Grandpa are okay, a message with no encryption is much better than nothing, and it is likely to get through anyway.
If you want to send an encrypted message to someone but you have neglected to exchange passwords between you in advance, there are a couple of things you can do. If it’s a family member or close friend, you may be able to send an encrypted message along with a hint as to what the password is; something that only you and they would know. For example, at the top of your message, you could write “Password is Grandma’s first name”, which would let them know that the password is “Samantha”.
Another way is to split a message into two parts, both of which are required for full understanding. One of the messages could be encrypted, while the other one could contain the password. Or you could just write the two parts of the message in some way that required both parts to understand. This is one reason that you should provide multiple addresses to your contacts. If the addresses are completely different, it’s less likely that anyone will be able to match up the password with the message.
To exchange addresses with a group of people, create a master page of all of your addresses, print out two copies, and cut one of them up to give out to your contacts. If your name is William Smith and you have three contacts named Joe, Sam, and Bill, the master page looks like this:
——–
Joe:
William Smith
Primary Address: YRETYTG
Secondary Address: JH3E656
Password: UFFYDYERTE
———
Sam:
William Smith
Primary Address: YRETHGH
Secondary Address: JH3EYTY
Password: YERTWU
———
Bill:
William Smith
Primary Address: YRETTRM
Secondary Address: JH3EHGR
Password: HERTWR
———
Once everybody else in the group does the same, you’ve got your own network.
Given a list of names for any group of people, one person can make up random addresses for everyone in the group, print them, and pass them out. For a small group, this is simple enough that it doesn’t really require software, but a website or small application would be helpful for doing the same for large groups. I am not aware of any at this time, but it would not be a difficult task to create one.
If you are using PGP, you will also need to store public and private keys in addition to addresses, and storing them on paper will not be practical. Use a USB key or SD card for storing all of your keys, passwords, and addresses, and keep a backup. There is software available to help with this, often packaged with PGP, but it is beyond the scope of this article, as it has more to do with the content of messages than the medium itself.
All of this could be done after TEOTWAWKI, by postmasters establishing contacts using pre TEOTWAWKI email addresses, building up encryption networks and then helping others do the same by passing the addresses and keys back and forth in encrypted messages, but it would be a slow and laborious process. Anyone who has previously exchanged some basic information with his contacts will have the highest level of anonymity and security and will be able to start communicating immediately. It’s much better to do it now, while it’s easy.
Basically, if you want security (which you do), you need to take full responsibility for it yourself, which is as it should be. This is really a “wild frontier” sort of network, so it’s best not to just assume that everyone else will look out for your best interests and be nice. What this network does is to give you the possibility of getting a packet of information across vast distances to your intended recipient. The rest is up to you. If you are working in a group, assign a designated Postmaster who can help get the rest of the group set up.