··----.....,-····· ......... .,.a_-, ..... 

. ~ . 

-~ ... . . ~ : . 

: ~ 

' .. ~· 

!/." 

REF ID:A522921 

0 

CoBy No. / , ,,. 

ii{j' )(S/Report (Final) ·h · ovem"ber, 1953. 

UKJUS COMMUNICATIONS· SECURITY CONFERENCE 1953 4 I . 

REFORr OF THE SECURITY: SUB...COMMITTEE 

to the 

EXECUTIVE COMMITTEE 

vtc. 

1. Th~ Security Sub-Committee has made security asseosments qf U .K. and U .s •. 

aystem8 which are attached at .A.ppendix A.. It should be· no~ed that the phrase 

"further study required" as applied to an equipment· still.under developnent 

means th.at information is insufficient for a final assessment but that 

continued development is justified. · . 

2 •.. Recommendations on transmission security are att~ched at Appendix B •. 

,3. An agreed method of expressing security· a~ses·smenfa~ . .-has: been -issued 

separately as Appendix C to this report, together with propo~1a·t.or the 

·information which ·should be· provided by·users in stating. their ·requirements · from the security point of view. Because of ·the nature of the discussion in 

this paper the Security Sub-Committee recommends that only the following 

statement be included in_ the maih report of the Conference& 

~'During the Conference the U.K. and U.S. security advisers 

prepared an agreed ·method for the teclmical statement of . security assessments~" · 

'+•: · In, addition the Security Committee has the following general recommendations to make: -

a. A high priority should be given to a thorough investigation of: 

(1) the properties of quantised speech; 

(2) :'the practicability of intercepting, reoording and 

counting the output of ma.ny- or· the sp'eech equipments 

under consideration. 

b. Steps should be taken to replace as soon as. po~sible equipments employing an additive system in such a way.that .. there is· a 

significant· danger of producing a readable depth of ·two •. 

o. Only one-time key tape which has been produced and checked in 

accordance wi'\h agreed bx/US standards should be employed with one~time tape .equipments, 

d.. .All equipments should be rendered sec\lre against spurious 

emissions which endanger camnuni~tions security. 

e. The design of' on-line equipnents should be such that it is 

impossible to transmit plain text inadvertently in place of 

cypher text. 

f. Further study should be made of keyboard ".>peration with stax't/stop 

on-line teleprinter cyphering systems to analyse the dangers · arising from operator and machine idiosy:"lcracies, 

'FOP SEmET /g. 

Declassified and approved for release by NSA on 05-27-2014 pursuantto E.O. 1352a 

;• 
. ; '• '~ 

.· . ~ 

:·. · ... 

. 

".·:.' 

• .. 

' . . ·:r~.-~> ~. -_ 

. ~ .. 

.. · 

' .. 

REF ID:A522921 

8'1.· • ·'1 ...... 

2 .. ·-

S• The cypher signal transmitted from an· on-line cypher system must 

be a pure cypher signa.l not containing any· el_ements recognisable· 

as plain text or cypher key. 

h. The cognisant authorities should be infnrmed of the UK/US views on 

the security of the S.I.F. with I,F.F. Mark x. Ii' a solutiQn to 

this problem is to be found it is essential that the users should 

state their· overall securi·ty requirements for a.n I .F .F. system. 

5. The Security Sub-Committee also offers the following recommendations to 

improve conununico.:tions security liaison be_"t!ween. U .K •. · and U ,s.· 

a. There shot4d be an exchange of workipg cryptanalysts between N.s • .A.._ 4-i 

and G.C.H.Q. I I the details tp·'be worked out between N,S.A. and 

G.C.H.Q. In additionto this ~xchange o'f personnel, there should be 

visits· independent of formal conferences between U,K, and U.S. for 

technical discussions of communications security. 

b, 

o. 

A more rapid interchange of nevi info~tion and. iae·as affecting 

systems- under assessment and. qtiestions ·of .tran~mission seouri ty. 

The preparation of an agreed programine.of cryptographic 

assessments for the coming yearJ· this programme to include 

both U.K. and v.s. systems which require assessment; N.S.A" 41· 

to prepare a draft programme of this kind and. :forward ·i;o the 

c·.P.B. for agreement • 

PL 86-36/50 USC 3605 

Chairman 

Security Sub-CO'Jllllittee (Phase i) 

' 

i1~~~~t~ ~ ~ >.'. . ~ ;~ .. JOP SECRH . , 
-- ' 

- .-~-.. ~~· . _'.. 

, .. i .... ~ ·: ~-

' 4 .r 

· .. •: 

I ·'· 

·; .· .. ~ 

.- -· 

• 

. :·,:·.:-. 

~ ~ . ·. : " 

:.!··.· 

: ~.,.. ~ . 

j. ~ ._.;. . . 

. ; -.·.: .. 

,, ,! • 

- i:><-

i .· 

~ f .• 

'.: .. 

.• 

·.: 

/ 

REF ID:A522921 .· 

c tOP SEalll ··~ 

-1 

Copy N'). 

APPENDIX 'A' to LCS(53)/S/Report(Final) 

dated 6th Novel!lber 1 1953, 

UK/US COMMUNICATIONS SECURITY CONFERENCE 1953 

SECURITY ASSESSMENT OF CRYFTOGRAPHIC EQU!P.MENTS 

IN USE AND UNDER DEVELOP-MENT -

Off-line :Equipments including T_eletypewri ter -Equ:i,pment 

used of'f'-line. 

?t On-line Teletypewriter Systems 

-'~• Speech and Cifax Equipments. 

!+.. Special Purpose and Band S7atems_ 

5r Cryptographic Production Equipments~ 

TOP SE<Nt 
-------···. ·-· .. ·--....... 

·• ~ .. 

. . 1. 

. a. 

. ·. 

.· '·.: 

u.s . 

( 1) 

(2) 

"' \., -

EguiJ2ments 

.. 1FSAM D.17 

(a) The U.K. 

(b) The tr. s. 

is secure 

~Sri.M D. 21 

REF ID:A522921 

,fl 

- 1 -

Jewriter E ui··ment usea. Off-lino: 

require further study. 

consider that with clear indicators 

for low echelon traffic. 

the system 

The U.K. and U.S. consiaer that· tI'-e equi~ment is secure subject 

to aaequate checks of che standa.rd of the one-time k~'Y tapes. 

( 3) AF&i.M 36 

(a) The U.K. consiJ.er that with e.:lequn.tc precautions in the 

choice of ma.chine set-up, with bisection a.na .. with message 

lengths restricte'1. to 250 letters the system ~-s aaoqua..tely 

secure f·:Jr low echelon use. 

(b) The U.S. consLl:er, that with the limitations already 

placed on it 1 the rr"'ichine is adequ:l. tely secure as a low 

ecelon system but they will examine the U.K. limitations 

in detail. 

(4) .AFS.i!i.M 7 

(a) 

(b) 

l?OLLUX 

--· 

(i) The U.K. are not in favour of clear indicat':>rs beca.us·~· 

of the possibility of recognising an"l ex-J?loi ting 

tailing mos sages am'.. messages in depth. Further s·tUt\:: 

requirqd when mor9 is · knovm about traffic loads a.ncl th•' 

.likelihood of o~erators' errors. 

( ii-j The U. s. c·:>nsider the system adequately secure f ::>r low 

echelon use .but they will keep traffic un-ler review. 

If dangerous insecurities a1,pear they feel tha:I.:: they 

can modify the ~rocelures sufficiently to overcome them • 

.il>ONIS 

--

(i) The U. K. consi·~er that /..DONIS is secure for all 

oh.ssif'ications of traffic f·:>r at least the next ten 

yenrs vr~vided that a good standard of operating is 

maintained but require further study in view of tho 

recen~ increase irt the number of elements. 

/(ii) 

TOP SECRET 
------:·•· ·=--··11·--• .... •;.:•· 

.... 

-··':. «!°" 

... · .. ·:, ':·. 

:· ~ '- ' 

... .. , 

.. . ;:- ~ > . ·.•. ·-· .•· ~ · .. ·. ~ .. ,: . , .. ·• 

. :;~ -· _;; ·. - . 

.. · ... ; ;.· 

; ... . ~- . ~ . 

0 

REF ID:A522921 

~ 

- 2 -

(ii) The U.S. consider that 1.J)ONIS is secure for all 

classifications of tr.:-.ffic for the next twenty years 

provi 1fo:i that a good stand.are of operating is · maintained • 

. ( 5) ~\FSI~ 4. 7 (BRUTUS) 

The U.K. and U.S. consider that the system is secure for all 

classifications of traffic for at least.the next five years · j_Jrovi(led that a good. standard of operating is maintained. 

(6) CSF 688/889 (HE:RCULES) 

The U.K. and u.s. ag~ee that the HERCULES system is secure for 

all classifications of traffic f'or t~e next five years provided a 

good stan:la.ra of operating is maintained.. 

(7) c,c.M. (LUCIFER) 

"(a) The U.K, and u.s. agree that LUCIFER gives adequate security 

for all olassificatiqns of traffic for not more than three 

years provided thn.t a good standard of o~era.tion is maintained, 

but consiG.er that the c. c_M. must be replaced c.s soon as 

pqssible 111 

(b) For Meteror~logioal traffic~ the U.K. and u.s~ ~gree 

(i) that it is not essential to have separate rotors for 

meteorological messages provided tha.t there are 

separate key lists. 

(ii) that in shi~-to-shore systems short meteor~logical 

messages can be incorporated in ordinary messages. 

(8) SIGTOT (Off-line use~ 

The u.x. and' u.s. agree that the· system is secure f.Jr all 

olassif'ications of t_ra.ffic subject to adequate ch~cks of the 

standard'of the one-time key tape a.n:!. provided that effective 

pl':\Ysioal methods are employed to prevent the re-use of key tape~ 

( 9) .\SAM 2•1 ( ORCUS) 

(a) The U.K, believe that the indicator system may be vulnerable 

and. if this is so the·maahine set-up for each link using the 

same key pad can be reoovcrea. Further study is required 

when det:lils: of traffic volume an".. message lengths are 

available·, 

(b) The U,S. believe that the volume of traffic encyphered on 

ono machine is too little to make this a serious shortcoming 

but also requires f'urther stuay. 

/(o) 

1'0P SEERET 
· .. 11,.U 

.··" 

.. ;·· .. 

. . ·.- ~ 

..... 

.·· .• , ~: 

·. ·-· .· 

' .. ·. ~· 

~ ~--·.. -: .. 

.• -~ . 'l . 

.; .. ,.= •· 

~ . . ·' .. 

··~. : .. ·,'i. 

>)<;·,. 

·>':t->:::· · .. ·.}. 

REF ID:A522921 

~ 

-J -

(c) Tho u.K. and U.S. are concerned however at the insecurities 

which may arise as. a result of. operator's errors and agree 

thc"l.t the proce·:,_ure,· being"one which pe:rmits of a 

significant (;anger of producing n read~ble depth of two, 

shouLl be replaced. · 

(a) The U.X. and U.S. agree that the machine should be re~lacea as s~on as .possible. 

b. u. K. Equipments 

(1) ?ORTEX 

(a) The U.K. regard the syst(,ID) as aiequately secure for.low 

echelon use for the next ·fift~en yea.rs pro~dea that 

(i) the ~umber o"F groups encyp_hered. at each indicator 

is limited to 50 groups, 

a.n•i (ii) indicators are ~~tro.cteil fron:i·· specially constructed 

key lists. · · · · 

For hi~her level .use.inaicators ml,lst be disguised. 

(enoypheredJ and messages limited to ~ groups. Even so, if, 

it· is necessary to legislate for the undis~plined opera.tor 

FOR.TEX onnnot be guaranteed as adequate for TOP SECRET 

trnffic for more than the next five years. I~ the rules are 

observc"l.-and assuming·an a::t.equate indicator system, the 

ma.chine may be regarded .as secure for the next twenty years. 

The u.~. consider I'ORTEX to be a Category-'~' cr,yptosystem. 

(b) The u.s. require further study. 

(2) T!l~X II. (SIMPLEX) 

The u. K. an•l U.S. -agree that the system can be regarded as 

adequately secure' for tlie next five yea~s for all classifications 

of traffic proviaed that-

(a) a.. 3ood. sta.ndar<! of operating is mainta~ned, 

(b) bisection procedure is used, 

(o) the variable spacing used is of the 1, 2, 3 type. 

(3) Tn~X Mi~ 22 

(a) The U.K. consic1er the equi1Jincnt is secure for all classifications of traffic for at least the next five years. 

(b) T:Q.e u.s. know: nothing against the system hut require further 

stuey. 

/(4) 

TOP.SECRET 
------····, -·~•" ·---·-··· 

....... . ,_.: :·.' .· . . •.. :. ... ~~~::> . 

., 

~ ,. ' . . . 

',; 

' .. 

··::~-' t ;· ... 

· .. ·•;···· 

~.: . . ·;; · .. 

:: =.. . ~ . : 

REF ID:A522921 

11 

- 4 -

(4) SINGLET/PENDRAGON/COPPERFIELD (UPSTART) 

. . (5) 

The U.K. and u.s. know nothing against the system but 

require further study • 

ROCKEX 

The U.K. and U.S. agree that the system 'vhen used correctly· 

is secure for all classifications of traffic subject' to adequate 

checks of the standard of one-time key .tape and to further s1udy · of spurious emissions which endanger communications security. 

Ce.· Miscellaneous Eq\lipp.ents 

(1) French Mpdified :M.209 

EO 3.3(h)(2) 

PL 86-36/50 USC 3605 

(2) 

(a >.1 .............-----.-----:-:-----=---=-----:---'.:------:-:--:---'\ . ~-____ _,I Adequate security for low echelon use could be 

achieved by the use r>t a codebook provided that no spaces 

are encrypted between·groups. 

(b) The U.S •. require further study as· a matter of urgency in 

view: of i;he U •. K •. atatement. 

CX-52'and CX-52H 

The U.K •. anq U.S. require.further study as a matter of 

urgency but there seems little doubt that it will give a very 

high degree of security it properly used: 

.' On19lipe · ~eletxpe~i ter ·Systems 

a-. • U.S. Eg,ui:enents 

( 1 ) · · .AD'S.AM · 9/ AFSAz D7315 

(a) ATHENA 

The U.K •. are not in favour of the use of clear 

iJJdica.tors. 

The U.S. require fur:ther study as to the extent to 

which clear indicators can be used on higher level nets but 

consider that clear indicat~rs are probably acceptable on 

low echelon nets. 

The U .K. would approve the use of .AFSAM 9 with AFB.AM 109 

with encyphered indicators for all classifications of traffic 

tor the next f i\re years provided a reasonable standard ot 

operating is maintained. During the period a very careful 

inves.tigation should be made of the occurrence of operators' 

errors. If operators' mistakes are such that any of the 

attacks appear dangerous the U .K. suggewts that the machine 

be modified by the addition of a plugboard. 

/(b) 

tOP SEatEt9 
-------·-····-·--···· 

llM-. 

. .. .... 

REF ID:A522921 

~ 

.. 5 -

(b) AENEAS 

- . Th~ U.K. and U.S. agree that the system is secure for . 

all classifications of traffic subject to adequate checks of 

the ~tandard of the one-time key tape. 

. · ( o) PYGMALION/IRIS 

(i)· The U.K. view is the same as in the case of AFSAM 9 with 

.AFSAM 1-09 with cncyphered indicator~ but they are also 

concerned about the loss of traffic flaw security if 

indicators are chosen at random. 

(ii) The U.S. consider the systems will be secure for all 

classifications of' traffic if properly used, but after 

experience of the machine under operational conditions 

they may have to revise the procedures. They consider 

that operators' errors can prejudice su.O"Uritf but they do 

not expect them to occur sufficiently frequently for 

there to be any danger of compromise. 

(2) ASAM 2-1 (DAPHNE) . 

i: .. 

·, 

.... ~ . . , 

:~ . -:~~~<~· :.: . ,.' • • •. 1;~ . : '. • 

. .. :;>> f::P.~ . 

. • 

·.' .· ·. ,: ··: ~ .". 

I~ :~f.;! 

(3) 

(a) The U-.K. am U.S. agree that DAPHNE procedure is adequate for 

on-line or off-line use. The achievement of security of 

traffic passed by D.APHNE procedure requires the modification 

of the associated equipment, where necessary, to eliminate 

the possibility ·of operators' faults which may cause 

inadvertent transmission of piain text; 

(b) U.K. and U.S. agree that the machine should be replaced as 

soon as possible. 

.APSAM 4A (CENTAUR and IXION) 

{a) U.K. require further· study • 

(b) , . U.S. accept CENTAUR and IXION procedures but will review the 

indioator procedure for certain uses. .... 

U.K. and U.S. agree that the system is secure for all 

classifications of traffic subject to adequate checks of the 

standard of the one-time key tape. 

(5) . SIG!l10T 

. '.:. 

·1·'' ·i ·::r: · ·· . 

. j J! ,··: . .•. \.. ;o,,J .,. . '. . :~. .. ... 

U.K. and U.S. agree that the system is secure .for all 

classifications of traffic subject to adequate checks of the 

standard of.the one-time key tape and subject to a modificati~n 

of the associated equipment to pJ.'levent inadvertent transmission 

. of the plain text • 

/(6) . : 
.... (·:. 

' 

•: · .. 

. - ~ 

.'· : 

···: r •• 

. ~ . -~.-~:~~· _.,. ;· . 

J,h; 

·.::.·~f:l.·:::r 

: ·.,Ziff:~:; . ·~·. :;·· ,;. . . . 

rfr .• . . (.~;:'.!· .' . ·.' .::~·:·,., ..... 

> :.: ... :. ~.-· .. : ..... :·.·· ... . . ,.,._ .. 

, ~·:.- ' . 

I . 

b. 

.. 

}_,·.· 

REF ID:A522921 

0 I) 

- 6 -

(a) The U.S. consider the ma.chine secure for all classifications 

of traffic. • 

(b) The U.K. require :further study. Nothing known against. 

·( 7) .:\.FSJLM D. 26 

(8) 

U.K. 

( 1) 

U.K. ana U.S. require further study. 

.ii.Fs.L~I D. 3 7 

U.K. and U.S. require further study. 

Eg,uil!!:!enta 

MINSTER 

u. K. and u. s. noted that the u. K. Services Lio not intend 

to use this equipment. 

(2) :METROrOL"E 

u. K. and U.S. require further study • 

(3) I-HILOl'YlEL 

U.K. and U.S. require further study. 

(4-) OONVERTOR NO. 5 

u.i:. and U.S. agree that' the equipment, when used with 

.. Apparatus 5 u.o.o., pro'vides adequate security for all 

class~fications of traffic fo~ the next twenty years. It is 

believed that complete traf.fic flow security will be provided; 

:further study will be made to verify this. 

(5) .\.B.TICIICRE 

"U.K. and u.s. o.gree that the equipment provides adequate 

security·for all classifications of .traffic fo~ the next twenty 

years. It is believed that complete traffic flow security will 

be pro~rided; further study will be ma.de to verify this. 

( 6) Ji.?f'~WTUS 5 UCO 

u. K. and. u. S. agree that subject t-:i aclequate checks of the 

standard of one-time key tape the equipment is secure for all 

c1assifications of tra.:f'f'ic. 

( 7) cmoUIT :MERCURY 

.U.K. a.ml U. s. agree that the equipment is secure for all 

classif'ica:tions of traffic for a.t least the next twenty yea.rs • 

FOP SECREJ 

/(8) 
REF ID:A522921 

0 11 ,· -~. ·, -. -~ -... ~r·1: ... · ·. : . . ; ~ :· ;~ 

; ~-

. -

- 7 -

( 8) INCUBii.TOR 

u. K. and U. s. re,J.uire further stuey. 

3. Speech and Cifax 'E'.ij,ui+:iments 

. ·: ·. 

• . ' !; . ~ ; , .. 

;., · ... ~ 

. ;. ~-.. ;··-'t ,, 

. ;:,:;;.· 

.: :_.; 

- -~ \;-:_,_ -~~-r . .,, ': '' ,. 

-~ ; , • i r • 

.;: :: ~ -~ ~- ' 

-~~ .. ' . . 

~: ::'}--}_( 

··:· .. ·:;·_~·~·:f ;. ' 

~; ·'~ ' ; . 

. .~: ·. ·. ~- .· ..... 

.; 

... . ' ' .~ 

··'.· . ~~~-; ::· . 

... .. : ~- . 

.: . 

"11~::-1 r- ,.1 ,., .I : ]: . :~! .J .. 

a. U.S. E>ui-.;?ments 

("1 ) /i.FSAY D. 806 

(a) The U.S. consider the system is secure-for at least the next 

five years. 

(b) The U.K. require further s_tud;y, since the _number of variables 

:in the systettJ. has· been increased. 

(2) .1i.FSi:i.Y D. 809 

u. K. and u. S. re'-,).uire further stu:liY. 

(3) li.FSAY D. 807 

(a) U.K. consider that if._P. 807 transmissions can be inte~ce1Jted 

and recorded, the machine ca.nnJt be regarded a.s secure for 

S~CRET traffic. The technical aifficulties ~f interception 

and rec~rdi.ng are at present so great tlw.t they add 

considerably to the secU.rity ·:if the systera. 

(b) U.S. consider the machine seclire for all classifie~tions of 

traffic subject to further investigation of the possibility 

of intercepting anc recording or counting. 

(4) "~~y D.808 

u. K. an-l ·u. s. re ~uire further study • 

( 5) .. i.FSli.Y D. 810 

U.K. and U.S. require further study. 

. . 

( 6)_ i.FSAY D. 816 . 

-'(a.)- u.K. consider_ that if D.816 transmissionscan be interce:i,)ted 

and. counted, the equipments cannot be regarded as secure 

even fJr-Secret traffic. 

(b) U.S. re~uire further study of U.K. views. 

(7) AFSAY D.801 

U.K. and U.S. require further study • 

/(8) 

-TOP- SECRET· 
...... 

~ . ;~;;,_,r.-

; ~. I ·: : i.. I~ ; ' 

..... ·, :~ ' ' . ·.:· .. 

I • 

" .... ...... 

.. •;_ ....... 

. ' ~. ~ · .. 

REF 

- 8 

( 8) ~·6.Y D. 804. 

(a) The U.K. view is tha.t the.system Without random walk rings 

cannot be considered to l:'rovide tlie ctegree of security 

required.. Further study· of systems with random walk rings 

is required. · 

(b) "The U.S. ·consider that. the system without rand.am walk rings 

but with appro~riate alanns· is secure for low echelon use 

although they ~cognise the possibility of suooessf'ul high 

speed attack. The U.S. consider that the system with random 

walk rings and alarms.is secure for all classifications of 

traffic. 

. ( 9) ~U'8..'i.Y D. 830 . 

. ' . 

U. K. and U.S. agree that the system is not secure and d-:> 

not reconnnend its use for any puri>ose. 

( 1 0 >. .A.Fs.a.J' 700 

The U.K. and. U.S. agree that the .. equipment is secure f'or on-line 

encypherment of fa95imile or teletype f'or at.least the next twenty 

years. The U.S. will car.cy out experiments to verify that adequate 

traffic flow security will be provided in multi-channel 

teletypewriter use. 

( 11 ) .AFSi~ 503 

u. K. and U.S. agree that the equipment is secure f'or all 

classifications of traffic for the next twenty years. 

( 12) .AFS4X D. 505 

. u. K. and U.S. ;r-eo.:iuire further study. 

U.K. Rq;i.dpments 

. (1) Bl~L'E 

' 

·(a.) U.K.· and. u. S. ~gree that the ey_uipment is secure for all 

classifications. of tra.:f'f'ic subject to adequate checks of the 

key fi],m and. provision of satisfactory alanns. 

( 2) SORCEREli 

u.K. and u.s. acree that tha equipment is secure for all 

olassif'ioa.tio~ of traffic for the next twenty years. 

(3) BLUE BOY (D. 70) 

{a) The U.K. view is that because of practical difficulties 0£ 

intercepting and recording, the Apparatus -D. 70 which includes 

the key generator BLUE "BOY, may be considered as secure for 

a period of at least five'1ears. It is still .under study. 

/(b) 
.....,, 

. If, 

... {:,· .. '.!-~;~ .. ·. ;• . : .. -~.:·· 

• f:."ii~·:. .• .. . ~ .. 

. . :"' .. 

n ......... · 

REF ID·~ A52292:"f .. :.'.~· ·;;;~ 

~ 

- 9 -

(b) The U.S. re'~.iuire further study. 

(4) TRUM?ETER 

U.K. and U.S. require furt;her study. 

u. K. and. u. s. re.:1uire further s·tudy. More experimental 

data on the properties of speech in:·delta modulation systems are 

required before a final assessment 98-Il be made. 

(6) PICKWICK 

• 

u. K. an'i u. s. re'.iui:te further study •. 

( 7) MOUNTEBt~ , .. 

(a) u. K. consider the·. ~q~ipm~~t. i.s ~e.cilr~ for -_the next twenty 

years. . .. · .... 

(b) . . . .. 

u. S. reg,uire further study. Nothi.ng known against. . . . . . :.. ... 

~. $J>ecial .Purpose Systems 

·' 

. ·~ ... , .. 

· ... '• .. 

. :"·" .: ~ ~-

.' .. ·•· ... ~ ..; 

·-. .. 

~.:.~ ' 

~ .. .. . ·. 

}~~..;:r 

.. ·y:'· _:~: 

;.:~;:; -:~--· 

·~ . -~~ >: ~~··:·: 

:' .: : . ~- ·· ... 

. ·--~~:·:·:(~ . 

:.Ji:;,~·. 

~-. ', 

i: 

a. ~~499 

.U. K. and u. S~ require further study in the light of tha 

possibility of planned interr::>gn.~ion·by _an enemy~ 

b. · .1~SAM 4.98 · 

The U.K. and U.S. agree th.at the.ma.chine is theoretically not 

secure against :planned interrogation by ?-ri enemy • 

.i..FSJiM D. 31 

The U.K: and U.S • .'.l.gree that the .system is secure subjectto 

adequate checks of' the standard of the :Jne-time key ta:;.Je • 

(1) Security 

(a) The U.K. consider that with. the restrictions already 

suggested by them ·th~ N.:~TEX CTY?tosystem with underlying 

plain text is a.~e(,Luately secure ·for· all classifications. of 

traffic but there is s~me dan3er from cribs and opera.tors' 

errors. 

(b) The U.S. consider th.:1.t N: .. T'"ri:X with underlying plain text is 

secure as long as certain restrictions are imposed, but 

req,uire further study on the exact nature of the restrictions. 

/(c) 
···::. 

•I ~. 

• .. 

. ~- ; 

' .. ~ 

.· ·. ~~ . · .. ·. 

''·'~- ·. /'' .. ~· 

~-. . f. 

.: . t. ~ ... ;, . ... ·: .. : ~ ,. .. 

.. -~ . 

·' ... ~ 

(c) 

REF ID: 'A522 92 .. f .......... ~ ....... 

~ 

- 10 -

The U.K. and U.S. agree that the use of an underlying codebook 

would have considerable security advantages and make some of · the restrictions unnecessary. 

(2) Indicators 

(a) The U.K. and U.S. agree that for general NATEX use it is 

desirable to have a new five letter-indicator system which 

would enable the lLt:lSoc...ge -~v o ~a1·~ at o.ny .position on the line. 

(b) The U.K. and U.S. agree that the ·indibator system proposed by 

the U.S. be recommended for N~TEX 3rd level use with the 

following modif'ico.tions: .· . 

(i) 

(ii) 

. . . :· . 

identification of the indi~tor··page to be· from message 

externals only, 

operators to be forbid~en·to choose.the ·~ix letter 

indicators from tbe ir e.es18ned · page "iri _ _. regular order. 

e. Running Key C,ypher (U.S. :MERCURY) . 

(1) The U.K. consider that if plo.in_lan:guage_9asic text is used with 

R.K.C. in quantity or vd th any regularity ihe ·system is not secure. 

Provided, however, that a well·co:nStructed basic book is used, 

security is greatly improved, but it can~ot be gμaranteed that 

exploitation of an occasiono.l key table will ne"irer be possible. 

The U.K. con~ider R.K.C. to be a Ca~egory B system. 

(2) The U.S •. generally agree but require _to s·tuay.further the U.K • 

views.particularly on the Category. It i~ now in existence as 

a Category 'A' system. 

The U.K. and U.S. agree t~t the system is not secure and do not 

recommend its use for any purp~se. 

Double Subtraction on S.S. Frame 

The U.K. and U.S. agree that the system is secure f-or all 

classifications of tr~ffic provided that different k¢y . sheets _are used 

tor the two subtractions and tru;tt the agreed safe trn.ffic l~ad is not 

exceeded. 

I.F.F. System (High Security Identification) · 

. (1) 

: . (2) 

the U .K. require study • 

. The U.S. consider that the system is marginally secure but it can 

be improved by_ the addi~ion of another permutation. 

S.I,F •. with r".F.F. Mark X 

(1) , Mode 1 

The only cryptographic features of s .. I.F. with I.F.F. Mark X 

are the methods proposed for providing the changing codes in 

Mode 1 operation. Even if the meth·-Jds o:lf changing the code were 

/.cryptographiQall.y 
·r~ ; -------------- -. ... ... 

.... ;, ·=· ,r.~~i~ .:·.' . ' ... ·,, 

--;. ... 

.. 

REF ID:A522921 

0 tOP SECREI 

-11-

cryptographically secure, the U .K •. and U .s. agree that it is. not 

possible to change the code frequently enough to prevent the enemy 

from masquerading. In addition, the r~sk of physical compromise 

of the cryptographic element is·-great. The U.K. and U.S. ther~fore agree that the use of S.I.F. \rl.th I.F.F. Mark X on 

Mode 1 with or without o.ny code changer is a.n insecure method 

of proving an identity. 

(2) Modes 2 and 3 

No cryptographic security ~s propo~ed for Mode 2 and 3 use 

of S.I.F. with I.F.F. Mark X and the U.K. and U.S. agree that 

these functional and personal. identity modes could be a most 

valuable source of intelligence to the enemy. 

(3) For the reasons given above the U.K. and U.S. agree that the 

whole of the present programme for the use of S.I.F. with I.F.F. 

Mark X should be reconsidered • 

s. Cry;gtosraphic Production Equipments 

. a.. J.FSAW 7200 

. (~:-, i ·-~- ... .' •. :'i:. 

~ . ·. !-" 

t·::·.: :··' .. "C . 

.• 1:· .' :-·: .. ··.: ~. : .. _.. ;,: .. · . 

. I,. ,·i",' 

.. •.· . 

·. ·;; .. 

:..-. ... t .•. · 

. :(' 

. : -~ ; ::. ' 

,, 

,, ,·~~~·. ·:·. 

·.r,· .. ~ •. ~~.l . , ,··:·~· ., . · ... :-") :_, .· 

~J(' 

The U.K. and u.s. agree that ·subject to. ~atisfactory results 

from zero increment counts and from all standard checks on individual 

tapes, the tapes produced by .AFSAW 7200 can be considered ad~quate 

.for all types of use. 

5 UCO Key Generator 

The U .K. and U .s. agree tho. t subject to. a.de qua te checks during 

and after ~roduction the tape produced by the equipment is secure • 

c. ROCKEX Key Generator 

. The U.K. and U.S. agree that subject to adequate checks during 

and after pro~uction the tape pr'>duced by the equipment.is secure. 

d. BANGLE Key Generator 

The U.K. and U.S. agree that the k~y film is probably secure 

but further stuqy is required because of a small bins which has been 

detected in·the key film genero.tor. 

TRIMMER' 

. The U.K. and U.S. agree that further study is required but, 

subject to adequate checks of the, output, the key pr'lduced is 

probably secure. 

/r •. 

' " 

TOP SEOE'f 
">· '. 

.. 

. . lfOTE: 

: ._ ... 

. •";,;. . ~-

·.· t.• .• : 

./."./:": 

. ~ ~ ---~ .. :: .. 

.. >i:{· .· . '.."i' : 

• ~ 1: 

: .. , ,.~ ... ;: .. ~.! ~-~- ···. •' 

. ), 

~f 

.~fj_', .. 

REF ID:A522921 

0 ·~ . _.. . 

· IUP SICREI 

- 12 

t. U.K. HOLLERITH Methods 

U.K. and U.S. agree that pads produced by this method are 

secure provided that adequate supervision is maintained during 

productir.m. 

g. U.S. Pad Production Method 

U.K. require study 

U.S. consider that pads prlJduced by this method are secure • 

A check of' a productitln equipment or its product is considered 

adequate if the check is designed ta meet agreed UK/US criteria. 

..... 

TOP SECRET 
·r: . 

·.~ ' . REF ID:A522921 

.... .. . '. · .. . . ·· .; ,. 

COJ?Y No • 

.APPENDIX. ·B :·to LCS (53 )/S/Re:port (Final) 

dated 6th Nov~ber, 1953. 

UK/US COMMUNICATIONS SECURITY CONFER!mCE 1953 

SECURITY SUB-COMMITTEE 

~!?T· ON TR .. ~N!::Y.ISSICN ~ECURITY 

... ~.-'!. Present Sd. tua tion 

·The U.K. and u.s. agree that British and·u.s. measures to maintain 

transmission security do not reach the same standard of efficacy es do those 

tw· the maiptenimce of cryptographic security •. Present prT:lctices are 

insuf'fic~e~t to deny a potential enemy intelligence derived from the study of elemen~e of transmission external to the cypher text. 

2. ·Contribytory Factors . ii. -

. There are a number of. inter-related communications pl'~otices and methods 

which contr~.bute to th::'...s state. of insecurity; these are discussed below: 

~he u,K. and U.S. fully realise that proper implementation of the above 

const~t~t~s a:::i j_deal, but agree that serious and urgent consideration be given 

to t~e q~termi.nation of the maximum.degree of transmission security which can 

be .:aqJiieved. 

ac The Uge of Plain LangUage 

· · .. : · '. The use of plain language for the transmission of messages, even 

· · · .. tho•e in thE:.fuselves unolassfi'ied, not only leads to revelation of . . .. . 

. ' ; . into~J.igence but tend a _.1,;o nullify the good that can be achieved oy otherwise:: ... . ·; >·'d·'· ·sound" security practices •. - This is true for two reasons: because oompi~ti.ons 

. . -· _of individual "unclassified items" often provide intelligence of Secret 6* · 

even Top SecT'et classification, ~.nd because plain.language messages, related 

externally tp cypher.messages, can jeopardize the security of the latter and of 

.. :': the add,::;ess proc~~ures c.;11:i:i::;,oyed Jiith them •. '.l.'he u.K. ~nd U.S. agree that as a 

~::,:·,;~ .- first step rad~o tranRmission of plain language messages originated by Service 

~· .(;.:· autnori ties should be f<>.rbidden, regardless of whether classified or not, except 

~(.-! ~ _ __, ~ ~ases covered by the. already agreed proviso, for tactical situations. 

. . ' 

?~!~'·i.>: .... ·. :;· ?• T!'le Use riot Plain Language Addressing on Encr,ypted .Messages . 

~.;~-;;::;.'.".~-. · . The .use of plain language e,ddressing on encrypted messages leads to 

'.\·:\\'; ·· p:rO'Vision of ~irect i'.ltelligence of the order of battle type and also to 

.~jJ·:: · .'·~aibii..ities ·of asBUm:!.ng with fair aoouracy the content of certain of the 

;;.;-+,'!-~ ,:'. enqrypted messages so headed., The U,K. and u.s. agree that the use of plain 

:<.'.: ·,'.:.: .· lan.gqage a.adressing on classified messages should be a bolishede 

f;JJ c, ~1 C~ :~. ': Call Sign Sy$tems used by all stations other than the l.a.rge fixed 

.· . ,, _ . ~nes which r.:us+. :i.n;;::~rt ta.bly be identifiable, must be secure against the enemy 

(:J.~.O::. tracing 'the contini;ii~i;y of' id.entity from day to day~ At present there. is no 

.:J.r'.>: unive:r."sal means for provial.ng this call sign secut,ity although there is· 

.::>r~ ;· ' asre~ment on the V..5d of i:aily changing o~ll signs in time r>f war. The u .K • 

. :. ;·' ... ana· U .• B. have examined the basic call sign systemi:i. and the "call sign encryption 

> · ;.· . · .plan" and e.gree the f'ollow'-ng : 

g: .. .. ·:. TOP SEatET ( 1) 

., 
REF ID: A522 92-1 

~-. 

·,~~'f.>::;'· . : ,-; · .. · 

...... ·:~· .. 

' .. ' 

·.· .. ·.; 

. ... ·.;:.: 

.· .... . . . •. 

. ,• 

·.~:. • ~ I 

: , .. 

. ':~· ',I . 

.~ .: ... 

·'. 

. :: . . . ; ~ . . ~ ... 

.... 

. , 

(1) Daily changing calla Bhould be instituted in time of peace. 

Their value lies not only in the intelligence they deny the 

enemy but in making harder or impossible his task.of 

maintaining continuity of identificatit>n from peace to war. 

(2) New baaic bi:>oks should be produced and should _be compiled 

with properly hatted var_iants •.. 

(3) The use of a common call sign encryption key list for all 

Services world-wide has considerable security disndvantages •. 

(4) The overall adeqtia.cy of the current system f ~r the encryption 

of call signs should be reinvestig~ted ~nd if necessary a ne~ 

one devised. Any new system for call.sign encrY:,)tion, in 

addition to being secure,. even with tl:ie basic bt>ok compr,,mised, 

must be easy to use and . to pr,o~~ce~ 

de Frequency Chanain.g 

The U .K. and U .s .· agree a·. means must be foUnd to change 

frequencies at a rapid rate and with wide .variations;." that failure to 

ao.tnl• :wJ.11 tend to diminish the security achievable by the other practices uad~r "4tacussion. · . · 

e. External Characteristics of Crypt(>"systems 

The :U•K• and U.S. agree that the fact that cryptosystems can be 

.sorted into general type~ by external characteristics, and.into specific types 

by system indicators (discriminants) is a source of insecurity that should be 

el~inated • 

f, • Authentication 

The U.K. and U.S. agree that the currently approved systems aDd 

methods tor authentication, although secure in many respects, do not in fact 

attord a guarantee of the authenticity of transmissi~rsor a positive safeguard against intrusion • 

. g. Message Externals in Tape Relay 

;·:.'.:f:"r ; Present tape relay systems carinot operate without undisguised 

· {':'.))/: .routing-_ indicators. The U.K • ..and U.S. agree that undisguised routing 

-:'.:. L<. · i~ica tors provide valuable intelligence and that· their transmission over 

-.:~::f::."· · __ .radio and sensitive line circuits must be eliminated. The U.K. and u.s. agree 

··~>}( ~t· an effective method appears to be the adoption of total link encryption . 

. ::~tI>> on: radio and sensitive landline ciz.cuits 1,lsing cryptosystems capable of .. ;,j'.'.f-::, prOvid~ "automatic traffic flow security". The U.K. and U.S. have agreed the 

f · ·" :;,.::;>_ · r-u_.. . ...,; vn.wi,es ..... d e.i. "'' l.nl. ·t· l.On 0 r th' l.S t erm: 

:J~}1r:t.L:· "Automatic traffic f+ow security is the condition achieved by 

.-·.~·>}::>; automatic means, in which an enemy is denied knowledge ·,,r the volume 

.,:::. ~-; ·· and routing of traffic passed over a,circuit". 

· If~./ ~· ~~i!\=i~c.!!fy.:.°:!~ :t ~:!i ~~~·~ m::: ·~== but 

-~~Fl.':>" ·: 

:;: .. 

lleconmenda tions 

. a. · The U.K. and U.S. accordi:r;igly recommend that small Working Gl'oups 

consisting of security advi~ers and ·users should be aet up on both sides of the 

A~tio to· study the problems and p~_ose ·a solution. The results should be 

eXchanged between tne U.K. and U.S. and, .~the basis of these,. Combined plans 

,_··made~ Although no· limit should be placed r:m the terms of reference of these 

TOP SEatEJ /groups 
841+ f • 

' 

REF ID:A522921 

- R>P SB<:REf 

- 3 

groups in the field of transmission security, it is felt that the following 

list includes those items on which immediate ~c;:ti'Jn is possible: 

( 1) New· basic call sign b o~s shr:mld be prepared using variants 

compiled in accordance with criteria providt:d by NSA (U .s. action). 

(2) Agreement should be reached on the practicability of using a 

number of call sign encryption key lists in lieu of a single 

world wide key. 

(3) Study of and recommendations regardi~ replacement of the 

current call sign encryption system, based at least in part 

on the evidence produced by Exercise MARINER. 

(4) The provision of the following data with regard to authentication: 

(1) Types of authentication for which systems are required. 

(2) Degree of protection needed. 

(3) Chances and scope of planned interrogation by an enemy. 

ba The aforementioned working groups should consider the remaining 

questions of plain language, plain 18.Ilguage headings, frequency changing, 

message externals in tape relay, together with any other associated items 

as rapidly as possible. 

c. The U.K• and U.S. should evaluate methods for providing all crypto• 

systems within a class with identical external characteristics. Special 

attention should be given to a means for eliminating the use Df undisguised 

system indicators in messages passed in the CCM and in the cryptosystem 

chosen to replace it. · 

TOP SE<RET 

" 
't 

:i 

' 

.. 

I 

I 

I 

I 

I 

I 

I 

I 

... 

' 

I 

lj ,, 

Ii 

Ii 

I! 

ii 1: 

,; 

··-·· 

EO 3.3(h)(2) 

PL\.86-36/50 USC 36 5 
:;#' _____ ,,--.-----·· 

EO 3.3(h)(2) 

PL 86-36/50 USC 360 
. ··,: 

~-~ 

1:. 

' ~. ,· . 

. . .... 

. , . 

' '."· 

:; ·.'. 

.:. l . 

. ,. 

"}. 

.... 

EO 3.3(h)(2) 

PL 86-36/50 USC 3( 05 . 
-----·~··--···--·•·.·········· 

.... 

EO 3.3(h)(2) 

PL\.86-36/50 USC 3605 
r· ---------:--~--~ ........ 

EO 3.3(h)(2) 

PL 86-36/50 USC 3E 05 

~ .: 

.......... 

I 'A ·~ 

: ·~··L----------------------------------------------1 

·-. 
.. ------,---·---·-· .. 

EO 3.3(h)(2) 

PL \86-36/50 USC 3 305 

.L. 

::?~ .... 

. :; 
REF ID:A522921 

EO 3.3(h)(2) 

PL \86-36/50 USC 36 lS 
.,._ 

... l

.• ' ·. i 

. . ~' 

, .. ' -~. 

·; '•' 

"•.·. i ··. :l: 

•'! . ! 

r- . ")" 

.i 

: l.;. 

t 

: f.{: 

lr 

: ~j 

: ~ 1:1 .. l :1 

EO 3.3(h)(2) 

PL 86-36/50 USC 361 5 

1!' 

j' j i:ll: .. :~.t""''.~-~-:.:"""':· ...... ,.... """ ...... · ________________________________________ ___. 

.•. :jil· ., : ~ i : . • 

. >:1 

· 1.1 
EO 3.3(h)(2) 

PL 86-36/50 USC 36 5 
82 REF ID:A522921 

Tut> SECRET · 

TO BE HANDl. f [! IN A("C'llRDANCE WITH IRSIG 

~ 

Some Det'.li::...::o. Suggestions on Work Factors 

1. Special .1.ttacks 

Where tht; attack rarely e..rises - say once in 3 r:~onths <Jr less - it is 

extrern.::ly unlikely that the on0my will build a special rr..achine to carry it 

out. In those ca.st~s it will be safe to co..lculnte the- work factor on the 

assumption thD.t h0 is using a mo~lifica.tion of equipment :1e alr~aa.y possesses. 

This will either be 3eneralised P,AH or s:)echliscd equipment built for a 

feasibl~ g0n~ral attack. 

2. Cribbin;:.: 

Who::r;3 variable spacing ancl/or bisection is in fcrce, an add.i tion..'"'.l factor 

should b0 add.erl to the work factor of a cribbing attack. This factor is 0£.sily 

calculated. accord.int; to the d.ot?.ils of the postulatod attack. How.::var, the 

factor must -o~ modified to '.:'..llow for the fact th-1t <;. prc:r;ortion of OJ?0rators 

may fail to sp2.cc vr.triably and th.:; fact thnt choice of bisection point may not 

te r~ndom. 

3. Rotor .iillalogs 

It seems th'3.t analogs of r:itor mo.chinos •.-ill tend to be slov-:er ::1.nd 

costlier than analogs of electronic devices. It is extremely difficult 

however to say how much slower and costlier, sine.;; operations vary widely, rmd 

unexpected short cuts often turn up. It is suggested th:·.t we work on the 

asswnption of' c::i:r.;m.r11tively che'.':.p .-::m.log unchinas (as in para. 2 of the main 

paper), anrl qw.~stion the assumptior: only in the case of :x'..rticular borJ.ur-line 

cases. 

4. Ch'-'.nce of Success 

11'.:'1.ny a tt'lcks ·will succ.:.::.;;d., •.)n th-: :". v0r~,i3C;;, half-,.:'1.y through. l•'iany work 

fttctor.s th1Jn r,iny legitinmtely be mlvci. 

TOP SECRET B 
·"f' 

• 

.,. 

. . 

.'l' .. 

·. '·. 

• • : r 

•• REF ID:A522921 

0 

·SECRET. 

ANNEX B to ~~pendix C to ws(53.)/s/Re ort (Final) 

dt'.ted 6th November, 1953. 

EXf>ression of Security Requirements 

Considerations Relevant to the Problem 

1. In order to make an assessment the security advisers require to know 

at least:-

a. the degree of confidence to be placed in the system 

(the ConfidcncG Factor) 

b. the proposed level of use 

e,; the expected traffic load 

d.. the minimum acceptable message length 

e. details of any special traffic peculiarities. 

2~ Provision of the info~tion required. under 1b to 1e ab~ve presents 

little difficulty but determination of the Confidence Fnctor is not so 

straightforward;; The Confidence Factor may be defined as the tolerable 

expected proportion of unreadable messages to rendnble messages within a 

stated period of time. In calculating tho acc~ptablc Confidence Factor it 

will be necessary to take the follo,ving factors into account:- · 

a. the classification of traffic to be passed in the system 

b. the Intelligence importance of the traffic to the enemy 

o. the time factor 

d. the wlume of traffic 

e. the echelon of use 

f. the number of holders in a cryptonct 

g. the· cryptoperiod 

h. the physical security conditions. 

3. In ma.king an assessment the security advisers will tn.ke into account the 

normal incidence of ma.chine faililres and operators' errors appropriate to the 

echelon and system ~n question. 

SECRET . 
. • 

84 

.. RlfF ID:A52292. 

SECRET. 

TITLE 

U. K. ORYPfOGRAP.HIO REQUIREMENTS PRO-FORMA 

1. Title or Codename of equipment 

2. Equipment to be used by: 

(a) Navy 

(b) 1."i.rrrry 

( c) .Air Force 

(d) 'Nli.TO 

(e) Other 

3. Level at which equipment is to 

be used 

( <>.) Navy 

(b) liX!'fl.Y' 

( c) .Air Force 

(d) N.l!.TO 

(e) Misc. 

(a) Type of Traffic to_be 

passed on the equipment 

(1) Strategic 

(2) Tactical 

(b) Estilmted proportion of 

higher classification 

(1) Top Secret 

(2) Secret and belqw 

5. Volume per key 

(a) Desirable Maximum 

(b) ii.cceptable minimum 

6. Number of holders 

SECR~ET. 
- -· -· - - --------------------------------

84 

> 

7. 

8. 

9. 

1 o. 

REF ID:A522921 • ••• SECRET. 

- 2 -

Message length 

(a) Desirable minimum 

(b) Estimated average 

Traffic peculiaritios 

(Stereotyped;- pro-forma, etc.) 

Procedure 

(a) D:lsguised inJ.icators 

( 1) .Acceptable 

(2) Unacceptable 

(b) Bisection 

(1) Acceptable 

(2) Unacceptable 

( c) Vari.'.l.blc spacing 

( 1) .li.cccptn.blo 

(2) Unacceptable 

(d) Continuation procedure 

( 1 ) ll-ccoptable 

. (2) Unacceptable 

Catc8ory 

(a) Requirement for 

Public-'1tion 

_ (b) P/L Replies 

11. Risk of physical compromise 

12.. Type of Operator 

(a) career 

(b) cn.sun.l 

-13, /.i.ssociated st.'lff rey_uiremcnt 

SECRE+. 

. 

--------·- - ---·------ - - .... -