FREQUENTLY ASKED QUESTIONS
1-WHY IS THIS SYSTEM CALLED "the project cuckoo bird"?
2-For whom this software had been prepared for?
3-Why should someone have to use this, while there are simpler-to-use programs like PGP etc.?
4-Isn't it insecure to use some web addresses in the net? I can reach all of them by trial and error
5-Is it politically correct to use some web addresses in the net for encryption?
6-Why don't you tell the math-algorithm used in manufacturing of random OTP?
7-Can you give a very short description of four-web-address-encryption?
9-I can't completely understand the concept of synchronization, tell me step by step
13-I am a Lithuanian, can I receive the special characters of my alphabet in encryption/decryption?.
14-Do you have some other software and/or mathematical studies published on the net?
15-Using four keys in a set, is too much complicated, Why not use a single key?
17-Does "four address" system completely eliminates the patterns existing in written documents?
18-Can we use a hardware device to be sure that, the output is TRNG ?
Q- WHY IS THIS SYSTEM CALLED "the project cuckoo bird"?
A- Metaphorically speaking, the principles used in this project resembles the cuckoo birds nesting habits, these birds are known for laying their eggs into the nests of other bird species including pipits, warblers, and robins to grow cuckoo chicks.
By using other links for mathematical information to construct OTP files, you are just acting as a cuckoo bird and the used site owner can never know that his/hers txt based link is used for a secret communication between some parties......
Sometimes it so happens that one of the sites in the keyset, is updated or deleted by the site owner, while you are uninformed (very natural). In that case nothing can be done to recover the message. However the probability of such an incident is not so high within relatively short periods of time; there are some text files in internet which are older than five years, anyhow to prevent such a situation, stop acting as a cuckoo bird and start being a webmaster; construct your own nests (websites) about some unsuspected topic like "The strange nesting habits of cuckoo birds" and publish them in some paid/free web hosting sites. Provide links for keysets which will be under your control.
Q-For whom this software had been prepared for?
A- This program/system is designed for the requirements of the undercover agents working in foreign countries, but may be extended to be used for the personnel of embassies and consulates. Instead of exchanging messy OTP's, some neatly prepared simple and short tables are exchanged by the teams. These simple tables, tell the mathematical algorithm of the program how to construct an OTP. The exchanging of the tabled keysets which are used for constructing the master (OTP) are done by the agreement between the communicating parties. These are generally unsuspected links in the net. You benefit from any suitable txt link that may be found by some search engine (eg; Google). The most striking fact with the system is that; the site owner doesn't know that his/her txt based links are used for secret communication purposes.
Q-Why should someone have to use this, while there are simpler-to-use programs like PGP etc.?
A- OTP is a system which is theoretically accepted as unbreakable, on the other hand, PGP is constructed on the difficulty of factoring a composite number into its two prime factors. It is well known that such a factoring is very difficult when the composite number grows too large, but nobody has proved that, it is impossible to find an algorithm which will factor a large composite, within a relatively short time. On the other hand, the reluctance of using OTP was because of the fact that the messy pads were difficult to distribute. NOW this difficulty is overcomed by practicalOTP.
Find four discrete web addresses and a proper eight digit ISN, immediately you have the OTP in you hands. If you change the last digit of ISN one unit ( from 4 to 5 ) OR change one of the addresses in the set, then immediately you'll have another set of OTP which is completely different from the former (Try and see !)
Have you heard something about Quantum computers which will work with qubits instead of bits, now they are on your doors. Within ten to fifteen years from now, they will be available to most of the agencies, now what does that mean? The RSA system and its extension PGP, will be broken within one week after the first Quantum computer operates. We even know the name of the algorithm that it will operate, "Shor's algorithm for quantum factorization". Under such circumstances somebody should have to work on OTP to make it enough Practical to be used in the near future. That's why we have begin such a work; the PracticalOTP.
On the other hand, if programs like PGP is just enough for their secure transmissions, why on earth the spies hide at the back of a system called spy numbers ?
Q-Isn't it insecure to use some web addresses in the net? I can reach all of them by trial and error
A- That's NOT so easy sir !; according to the algorithms used in the project, you have quadrillions times quadrillions of probabilities to guess a key (don't forget the role of ISN). However if you feel that it is unreliable to use this method as it is, you may use double encrypting instead. Then you may attack this simple double encrypted document. It is a practical exercise for such claimers.
Q-Is it politically correct to use some web addresses in the net for encryption?
A- If it isn't politically correct, then don't use this kind of encryption in your works, instead try the other kinds stated in the encryption section as "how to provide or hunt for text files". But if you are working in an IA and asking this question, then somebody should ask you some other question "what are you doing there, if you are so much politically correct?" go and find another job in a charity organization or something like that.
On the other hand if you mean the web addresses stated in this site, they are only given for educational purposes and nothing more.
Q-Why don't you tell the math-algorithm used in manufacturing of random OTP?
A- We should and we are disclosing the algorithm used in the program, we may assure you one thing "there is NO randomize or random statements" in the source lines. First, all the empty spaces and empty lines are screened off (deleted) in a keyfile. The keyfiles are converted to blocks of characters without spaces. Then the necessary operations begin on these blocks.
There are lots of Bitwise XORing. The main key which is created by the contribution of Bitwise* XORing four subkeys, is additionally Bitwise XORed by the message file and the resultant file is translated from Bits to hexadecimal characters.
* There's a further operation on this Bitwise reading. The given attribute always changes in the text. Once reading this attribute MAY give "0" as a result, while at the middle of a line reading the same attribute MAY result as "1" and at the end of the line MAY return to the previous state (or not). There's no way of telling which reads which first at where and when.
Q-Can you give a very short description of four-web-address-encryption?
A- Imagine two partners, one in Peking (Bob), the other in London (Alice). If they use the same browser / version (IE6.0), have synchronized their browsers and open same web address and use the same "encoding" choice during their savings; they will obtain exactly identical text files after each saving operation. Some specific attributes of these four identical text files are XORed two by two Bitwise, now there is an identical Main Key on each side, which is obtained not by exchange of BULKY PADS, but with relatively simple, short KEYFILE TABLES like the ones you see in our examples (they should also exchange their ISN's).
The same thing may be thought, in case of scanning some specific pages of certain books from the libraries of two partners by excellent quality scanners and converting the gif image to text files by some high quality, sophisticated OCR software. The typical equation may be expressed as;
(A unique ISN) + (A set of four Internet Keys) => (A single OTP)
Summary:
Saving operations on web addresses provides us exactly identical results under identical conditions, their outputs may be used for obtaining specific OTP's . One should not forget the effect of Internal Security Number (ISN) in all these cases.
A- No ! , On the contrary, this is an Advantage. Think the most famous habits of IA's; they always record the secret coded communications of the embassies and similar institutions, even they cannot be able to decode them immediately; because there is always have a hope to decode them in the future. (Example; The Venona project). In this system there is no such a hope, because sooner or later it is inevitable that one of the web addresses will be updated or deleted by the site owner and you cannot be able to find the addresses by trial and error. The time needed for such a condition varies according to the laws of probability. The best thing relating this event is that, the update or delete operation is done without the consent of the contributing parties.
If such a condition occurs during decoding of a message, then there is always a possibility to ask for a new keyset.
Q-I can't completely understand the concept of synchronization, tell me step by step
A
1-Use the same browser on all terminals.
Example: If one terminal uses "Internet Explorer" as the browser, the other ones should also use the same.
2-Use the same version on all terminals.
Example: If one terminal uses Internet Explorer "version 6.0" as the version, the other ones should also use the same.
3-make the following checks and alignment on all terminals
A -Control: Help > About Internet Explorer > read the version number. If it is NOT 6.0, then don't commence.
B -Align: Tools > Internet Options > Advanced > Restore Defaults > Apply > OK.
C -Align: View > Encoding > check "Western European (ISO)". ("Auto Select" option should be UNchecked)
4-Use the "Western European (ISO)" option during all the savings, and state this condition on all of the tables.
5-Saving type of files are always text (.txt) type on all terminals. Because this software works with text (.txt) type of files.
A- Probably you are suffering from a synchronization problem OR one of the keys in the keyset had been updated OR you have problem with the fonts of the alphabet you use (If you cannot write with your own language on your notepad then don't attempt to start any operation on the software, because it doesn't WORK)
A- Open the Microsoft Word program > from open menu at files of type section, click text files > choose your text file and load it > make the necessary formatting as you wish > save this file as Word Document in some directory. Use this document to print or read.
A- There is no such a concept as "believing to everything you read or heard" in these matters, so keep disbelieving in everybody. Only believe in science, technology and yourself. We have provided four large random text files on our site in hexadecimal characters (click here). If you don't trust these, then make your own random files by using practicalOTP program, and find some other discrete testing algorithms from net to test the randomness of the set, and be convinced (if you can?). On the other hand, we do not completely neglect the opinions of persons such as you. If you want extra security then why not try double encrypting.?
Q-I am a Lithuanian, can I receive the special characters of my alphabet in encryption/decryption?
A- You can use Non-English western alphabets as well, provided that you have installed their fonts on your computer. Make some few trials. Play by fonts and/or language choices in the NOTEPAD programs edit menu. Open the Message into Microsoft Word of Lithuanian version and save it as Word Document. You'll get all of your special Lithuanian characters.
Q-Do you have some other software and/or mathematical studies published on the net?
A- All our activities on internet may be summarized as the following;
1- PracticalOTP (Encryption/Decryption/TRNG) Made By: Oktay & Bahar Haracci
2- Benfordwiz (Benford subset generator, used by auditors) Made By: Oktay & Bahar Haracci
3- Tiletris (Geometrical tiling game) Made By: Oktay Haracci
4- More than sixteen theorems on numbers theory and other fields of math are listed, on an anonymous site without the name of the founder, (That's me). My name is NOT pronounced on that site, because of some reasons you may not be able to understand if I had explained, so you cannot be able to find its address by normal methods. However, if you paid a little attention to this site, then you may quickly apprehend the address, just click and scrutinize.
Q-Using four keys in a set is too much complicated, Why not use a single key?
A- Never use a single web address for random file generation, because in such a case the state of ideal randomness is never achieved. There are patterns in written documents, using four addresses will reduce this pattern existing to a negligible amount. We have made the following studies to show the dramatic change in (FOUR file) and (SINGLE file) entropy reports. You may compare the results in the following tables. Passing all the tests does not mean that the generated set is perfectly random.
Entropy report: OTP, created by Xoring specific attributes of FOUR text files |
Entropy report: OTP, created by specific attribute of a SINGLE text file. |
entropy = 7.999983 bits per byte.Optimum
compression would reduce the size
|
entropy = 7.828408 bits per byte.Optimum
compression would reduce the size
|
Comment: The entropy report is excellent, Diehard battery tests are also excellent. FOUR text file system: quite good (but NOT perfect) for OTP generation. Do double encrypting for a better level. |
Comment: From the entropy report, it is obvious that this set is NOT random, Diehard battery tests are also a failure. SINGLE files: strictly speaking, NOT suitable for OTP generation |
A- At the end of an OTP session concluded by this system, there's nothing to destroy; UNLESS you are the webmaster of the site, in which case you can deliberately remove the related links after decryption. But this may reveal the fact that they were used for something in the past (attention, you are deleting four links from your site). Then, It is better NOT to update/change anything from your site.
Q-Does "four address" system completely eliminates the patterns existing in written documents?
A- No, but it greatly reduces the amount to very negligible values. (look for comparison). After all, the name of the software is NOT perfectOTP, but practicalOTP. Passing all the necessary tests does not mean that the set generated is perfectly random. If you want a more secure way to communicate, you should try double encryption
Q-Can we use a hardware device to be sure that, the output is TRNG ?
A- Yes you can, but please read the following lines from Prof. MARSAGLIA RANDOM NUMBER CDROM.
Prof. Marsaglia writes;
I have an elaborate brochure from a company that uses
"a proprietary technology to create truly random numbers. Since the [device] is based on a naturally occurring random
phenomenon (Johnson Noise) rather than a digital logic circuit
or computer program, it requires no initial starting value and
each new value is independent of all previous values." For those who want to try them with the DIEHARD battery.
I have used output from these devices in forming the random bit files in this
CDROM, but in combination with some of the most promising deterministic
RNG's, described next. The latter pass all tests in DIEHARD, and I view them
as the more important part of the combination the x's of the above discussion. |
We have Xored, one of our huge rnd files named otphex1.rnd and canada.bit (stated above). The resultant file passed all the diehard tests, while as a single file, canada.bit failed spectacularly as told above.
You see, the hardware devices which are bought for hundreds of dollars are failing spectacularly !! .At least, you are not paying any price to this practicalOTP software and the RNG's it produces DO NOT fail spectacularly, but pass all the tests. (While we do not even accept this positive condition as a guarantee for randomness and do something extra to improve the situation )
The second important thing is; if you use such a device, then how are you going to synchronize the other partner for getting the same number set?