Cryptonomicon

The first rule of an output-feedback mode stream cipher, any of them, is that you should never use the same key to encrypt two different messages. Repeat after me: NEVER USE THE SAME KEY TO ENCRYPT TWO DIFFERENT MESSAGES. If you do, you completely break the security of the system. Here's why: if you have two ciphertext streams, A + K and B + K, and you subtract one from the other, you get (A + K) – (B + K) = A + K – B – K = A – B. That's two plaintext streams combined with each other, and is very easy to break. Trust me on this one: you might not be able to recover A and B from A – B, but a professional cryptanalyst can. This is vitally important: never use the same key to encrypt two different messages.

Keep your messages short. This algorithm is designed to be used with small messages: a couple of thousand characters. If you have to encrypt a 100,000-word novel, use a computer algorithm. Use shorthand, abbreviations, and slang in your messages. Don't be chatty.

For maximum security, try to do everything in your head. If the secret police starts breaking down your door, just calmly shuffle the deck. (Don't throw it up in the air; you'd be surprised how much of the deck ordering is maintained during the game of 52-Pickup.) Remember to shuffle the backup deck, if you have one.

SECURITY ANALYSIS

There's quite a lot of it, but it's far too complicated to reproduce here. See http://www.counterpane.com, or write to

Counterpane Systems

1711 North Ave #16

Oak Park, IL 60302

LEARNING MORE

I recommend my own book, Applied Cryptography(John Wiley & Sons, 1996), as a good place to start. Then read The Codebreakers,by David Kahn (Scribner, 1996). After that, there are several books on computer cryptography, and a few others on manual cryptography. You can subscribe to my free e-mail newsletter at http://www.counterpane.com/cryptogram.html or by sending a blank e-mail message to crypto-gram-subscribe@ chaparraltree.com. It's a fun field; good luck.