Severely weakening an encryption algorithm can have far-reaching consequences. One example is the espionage operation involving the Swiss manufacturer Crypto AG. In 2020, several international media outlets, VPRO’s Argos programme and the Crypto Museum in Eindhoven revealed new details about the case, which had been reported on for years. The story reads almost like a spy novel.
Starting in the 1970s, US and German intelligence agencies spent more than two decades reading the encrypted communications of governments in dozens of countries, including European allies. According to the agencies’ internal reports, this intelligence played an important role in the outcome of the Falklands War and provided insight into the development of Pakistan’s atomic bomb.
Operation Rubicon, as this eavesdropping operation was known, centred on the secret acquisition of the Swiss company Crypto AG (CAG) by US and German intelligence agencies. At the time, CAG held an 80–90 per cent share of the global market for encryption equipment. The agencies then ensured that the countries they wanted to eavesdrop on received equipment with severely weakened algorithms. This backdoor enabled them to decipher intercepted messages. In an internal report, the CIA described the successful operation as ‘the intelligence coup of the century’.
The role of Philips USFA
Philips USFA, a former Philips subsidiary that manufactured military equipment, also sold encryption devices at the time. These were intended, among other uses, for communication between NATO allies. At the request of the US National Security Agency (NSA), some of these devices were supplied with weakened algorithms.
‘The intelligence documents leaked in 2020 do not explain what these backdoors look like or which attacks their designers had in mind,’ says Stijn Maatje. ‘These are the gaps I want to fill.’
In search of the attack
For his master’s thesis, Maatje investigated the USFA UA-8295 with CWI researcher Marc Stevens of the Cryptology group. This device from the 1980s allowed users to send encrypted text messages over telephone and radio links. Maatje and Stevens set out to establish how the backdoor worked and which attack it was designed to enable. ‘Among the people I interviewed for my thesis was Cees Jansen, Philips USFA’s leading cryptographer in the 1980s. He confirmed that we had found the backdoor, but information about the attack remains secret.’
Maatje now considers it very likely that he has also identified the attack originally intended by the designers. ‘Several attacks were tested, but ours worked so well that we are 90 per cent sure it is the intended one. The speed at which we gained access to the system and our measurements of the amount of data used pointed in that direction.’
Establishing intent
With the Crypto Museum’s grant, Maatje is continuing his research. He is now examining the algorithms of the PX-1000Cr. Developed in the 1980s, this ‘pocket telex’ was a portable device that allowed users to send encrypted text messages over an ordinary telephone line. The small Amsterdam company Text Lite originally developed it as the PX-1000. Its encryption was so difficult to crack that the NSA wanted to prevent this strong encryption from becoming widely available. At the agency’s request, Philips USFA bought up the remaining stock for the equivalent of millions of euros before releasing a modified version, the PX-1000Cr. This used an algorithm supplied by the NSA that was four billion times weaker.
The Crypto Museum has lent Maatje a device for his research. ‘We have developed a methodology for finding such backdoors and the attacks they were designed to enable. How do you distinguish a deliberately introduced critical vulnerability from, say, a design mistake? To do that, you need to establish intent. That is difficult through algorithmic analysis alone.’
Traces in the algorithm
Maatje’s supervisor, Marc Stevens, calls this approach ‘forensic counter-cryptanalysis’. ‘You look for traces left in the algorithm. You ask questions such as: why did the designers make this design choice rather than another? Is that choice justifiable, or illogical in light of a particular attack? We want to reconstruct what the original attack might have been. That knowledge can help us recognize both old and future backdoors.’
Maatje says there is still little publicly available research into how such backdoors work, largely because so few old devices are available. ‘Fortunately, we can work with the Crypto Museum, which has a number of encryption devices in its collection. This allows us to analyse them in depth.’
