Rune encryption

Rune encryption (RE) is a form of magical rune obfuscation. Though originally done by hand, modern RE relies on additional runes to conceal the function of runes or scripts in the spiral. Runes that disguise meaning are called lock runes and those that reveal the meaning (which is necessary for any spiromancer who wishes to grow more than a few encrypted runes at a time) are called key runes. Generally, each lock rune has one corresponding key rune, though a single key rune may work on many locks.

## Principles

RE functions because certain mathematical operations do not change the effect of a script or rune but do greatly change their appearance. Encryption can take place on the script side, disguising a script's syntax, or rune side, disguising invocations to make it unclear which scripts are being referenced. Once written, scripts cannot be edited, which means encrypting them is time intensive and, once broken, an encrypted script is essentially unusable. Rune-side encryption is thus generally favored, though most encryption efforts make use of both enciphered runes and scripts.

Mathematically, scripts and runes are robust to many functions: multiplication, division, exponents, logs, etc. That means multiplying each character in a script or pathway from invocation to script by the same number does not affect how either script or rune functions. Scripts show intriguing properties when manipulated by prime numbers, and especially 2, 3, and 5. The number 36 (2x2x3x3) also shows up frequently, for unknown reasons.

### Useful Encrypting Functions

Broadly speaking, there are two types of functions: one-way functions and two-way functions. Two-way functions involve rune lock-key pairs, one to encrypt, one to decrypt. If a mage ever wants to be able to read a plaintext version of the script or pathway, they must rely on a two-way function. One-way functions, on the other hand, cannot be reversed. While initially unintuitive, these functions are vital for enabling passcode runes.

#### Passcodes and One-Way Functions

For instance, consider the chests Seprum census workers use to keep confidential or sensitive information. They are magically protected from fire, water, and blunt trauma, which makes them difficult to break open. When a census worker needs to access the files inside, they speak a special passcode and the chest opens. This passcode is saved as a unique script in the spiral.

Obviously, either the passcode or route to the passcode must be obscured or someone could simply enter the spiral and see what the passcode is. The path is initially obscured because the rune that protects the chest is already cast at the time a thief tries to break in, but it must be re-grown and re-cast every decan or so. A thief could wait for the rune to be planted and trace back to the passcode, so the script must also be encrypted.

Two-way encryption has a key rune. A clever thief could try to crack the script by trying common keys. A one-way function has no key. It is impossible to reverse engineer the passcode from the script. However, critically, the same passcode always results in the same encrypted hash. The only possible method of cracking the passcode, besides regular kidnap and torture, is to try every possible word or phrase in the one-way function until finding a direct match. This is time intensive. The possibility of rune self-cycling and salting could make even this method impossible.

## Famous Ciphers

### Emperor's Cipher

Emperor Tacitus' silver hand, Blandak Timi, created what, at the time, was a revolutionary cipher and has since become obsolete after meeting with Mauzji cryptanalysts. They noticed a critically important feature characters in scripting syntax, namely, that they loop. There are thirty-six unique scripting characters and when 1 is added to the final, it loops to the first rather than producing an error. Blandak shifted every character three places up, creating what appeared to be a jumbled mess. Even had Blandak changed the shift number, which they never did, this cipher is now obsolete. Shift key runes can test all thirty-five possibilities, plus thirty-five mirror possibilities, in a few minutes.

### Tsetsteg's Separation Cipher

By itself, Tsetsteg's cipher was not revolutionary: it was a simple substitution cipher. More important was his discovery that the spiral remembers connections that it does not obviously store. Previously, scripts were entered into the spiral in their encrypted form. This limited the number of possible operations that didn't cause the script to stop working. Tsetsteg discovered he could cast a lock rune on an existing script and, if designed correctly, create a new, encrypted script that did not call back to the original at all. Critically, using the encrypted script in a rune worked exactly the same as using the plaintext one.

Though almost two hundred years have passed since that discovery, no one has determined a surefire way to find the plaintext script of an encrypted one. The vastly expanded library of possible operations resulted in an explosion of popular cipher techniques.

### Box Cipher

A box cipher uses a repeated string of digits to swap characters with one another in the ciphertext. The two-dimensional aspect means that the same character in ciphertext can represent multiple characters in plaintext, depending on its position in the script.

In this simplified box cipher (normally, boxes have thirty-six rows, one for each column), the phrase @@&[\>/0 is encrypted as ><!/@:\*∆. Unlike in a simple substitution cipher, @ is encoded as two different symbols each time it is used.

### Spiral-Hedge Lock-Key Encryption

Generally, key runes are cast to take effect on another rune in the spiral, changing its appearance to everyone. However, hedge magic can allow a single mage to see a decrypted version of a rune without showing it to anyone else, though these key runes are often slow-growing and draining. A spiral-hedge cipher uses spiromancy to encrypt the rune and hedge magic to decrypt it, meaning only one, specific person is able to do the decryption. This is considered the most secure method of rune encryption, though few hedge witches alive are able to make any but the most rudimentary hedge key runes.