Semaphore Publicly Solved

The Adobe Semaphore riddle, subject of many previous posts and community speculation, has been solved by a non-Adobe person as reported today here. Thank you to everyone who contributed ideas back to this blog previously and read the hints and clues.

MAX 2006 - Shantanu and Blue Men

During the morning keynote we were treated to a performance by the Blue Man Group. Think heavy metal music with magic tricks, art and paint. Lots of paint. Mostly blue paint.

Shantanu is giving a great keynote speech right now. He also issued a challenge to everyone here to try and solve the Semaphore puzzle on the roof of the Adobe building in San Jose. No one has solved it yet. There are several observations on this blog for anyone interested.

Shantanu also re-iterated Adobe’s aim to bring the internet to more than 1 billion people in China and India via cell phones. Kevin Lynch then kicked off a series of demos including new integration between Dreamweaver and Photoshop. As a former web head, this is a huge improvement in the workflow most webmasters go through. The workflow also includes the Spry Framework for AJAX (very cool). Spry makes AJAX easier for website designers.

More to come...

Semaphore - earlier analysis is wrong (read this)

Earlier, a group of us reported seeing two unique concurrent streams coming from Semaphore. Apparently, this was not an accurate observation. Semaphore's broadcast is via Flash and when you load up the simulcast page, it sends your browser a flash object (*.swf) file within an HTML page. If you open another one, it should send you the same Flash object but may start playing it from a different reference point. If you take the time to analyze both streams, you will note that they are in fact the same.

This may also poke holes in the theory that Semaphore uses two or more rounds of encryption. It may be true but more likely that the rounds are linear rather than non-linear and generated on the fly.

Another topic that no one has mentioned before is the rotation of the glyphs. Some of them rotate clockwise and some rotate counter clockwise. Sometimes some go each way. I would be interested in any theories arising out of this.

San Jose Semaphore Solution Theory

After reviewing the posts from Jo, Kelly, Ben and Joann, I think I have a theory that might solve the cryptogram. The critical piece of information is that there is no repeatable pattern of both glyphs and alpha-numeric content that are synchronized (other than short term repeats) and repeated and that two people can observe totally different streams simultaneously. If two people are seeing different broadcasts, then there must be a dynamic key. There are also mechanisms that can force a pattern to break (reloading a web page or a plane flying overhead).

Here is the theory:

Assuming the 16 by 16 grid concept is legitimate, each repeatable block of string-integer points at a coordinate. However, that coordinate is only a partial solution. The glyphs modify the partial solution by stating a path that the solver should take on the grid from that place. I suspect that the glyphs point in sequential order to a path that you would map. For example, if the sequence Kilo 02 is stated with the glyphs - - / \, you might go the grid position of k2, then go one square to the left or right, another square to the left or right, one square immediately to the right and above and another move to the right and below. That would land you on the correct answer.

This theory is supported by Kelly’s observation that “While both listening, we each got completely different combinations of letters, glyphs, etc”. This probably indicates that the observable signals are computer generated and random and combine two or more keys with the cyphertext. This would be a good cryptographic technique because it avoids anyone seeing patterns and/or potentially introduces patterns that might mislead someone trying to solve it. Given Ben pointed out that the creators have cryptographic experience, I suspect they would not use linear keys (too easy to break).

The questions to test this theory:

Given the glyphs are ambiguous as to direction, I suspect that there is another key in the voice or music tones. For example, if the woman’s voice “sings” the number, perhaps that signals that all horizontal moves and left to right, rather than right to left. The tones might also come into play. If the tone is higher than the previous tone, the vertical moves are from bottom to top, if lower than previous, top to bottom.

Also the question remains as to the characters in the grid itself. Is it simply the alphabet repeated over and over? Is it the ASCII table? There might be two grids as well. One with the alphabet vertically laid out and one with it horizontal.

So far I have put about 5 hours into solving this (perhaps a bit more given I think about it sometimes). I suspect that it could not be this easy given the statement that it should take about two years to solve. Either that or Ben, Joann, Kelly, Jo and myself are a good team.

I probably won’t have time to test the theory this week given I have to write several presentations for Adobe Developer Days (Yes - I am Adobe's security technical evangelist) in London the week after next, but I’ll try to map this out and test the theory.

Patterns for solving the Adobe San Jose Semaphore cryptograph

After putting this down for a few days to work on a new session on Adobe’s Security Architecture for the upcoming Max 2006 show, I came back to the Semaphore Website and observed some patterns. This time, I have the benefit of actually being able to both see the semaphore as well as hearing the codes. For each 7.2 second change, I noted the position of each of the four glyphs and the string-integer code. There is a repeated pattern of both the visual and audio clues synchronized. The following characters are used to denote the glyph’s position: | - vertical; \ top left to bottom right; / bottom left to top right and – for horizontal.

-| \ - K02
\ --- M 14
-/// L09
\|// O10
|\\/ B01
-||| K8
-/-/ C10
\\|/ E2
/|-- N11
\//\ G8
|/|/ K2 (note that even though K2 repeats, glyphs are different)
/\\/ M14
|--| L (5 or 9 – was not sure)
//-/ O10
- ||| B1
|//\ K8
|-\| C10
/|/| N11
/--- G8
--/| K2
\||| M14
-\\\ L9
\-\| O10
|//\ B01
---- K08
-\|\ C10
\/-\ E2
/-|| N11
\\\/ G8
|\-\ K2
///\ M14
|||- L9
/\|\ O10
---- B1 (note the glyphs repeat but not the alpha-numeric)
|\\/ K8
||/- C10
/-\- E02
/||| G8
-|\- K02 (First in sequence of compelte repeat. Duplicate with first entry.)

From here is repeated the entire cycle over. Given it started repeating a third time in a row, I got an idea. Perhaps it repeats a certain section of the code specific to each client. Some aspect of the interaction between the client and the server for Semaphore “seeds” the semaphore to produce a specific set of codes. Being in the mood to test, I hit “reload” and low and behold, the alpha numerics were the same but the glyphs were different. CAVEAT: I did not go through the entire cycle to verify it.

Hypothesis:

If Semaphore reacts to it’s environment, it might use some unique aspect of web based interactions to seed the pattern to avoid pattern detection between multiple clients. Maybe this hypothesis is too nerdy and over-analytical but I would be very interested in the abilities of others to see this. I also would be interested to see if the real world live Semaphore is synchronized with the simulcast. If someone could go in front of the Adobe building with a laptop connected ot the internet and visually verify whether or not the Semaphore’s glyphs are the same as on their laptop screen, it would be useful information.

Anyone else get the same patterns online?

Semaphore's mystery: Background on Cypher Creation

So as Adobe's Technical Evangelist for Security , I should probably share some background to you Semaphore solvers. One of the things that seems more than likely is that the cryptograph is encrypted using sequential "rounds". The concept of rounds is used in most modern cryptographic techniques such as AES. In my earlier post explaining how to build AES cyphertext using Rinjdael's key algorithms, the process is explained. For those of you who don't want to understand the gobblety gook on that blog entry, here are the basics.

The first round takes your normal text and renders it as cypher text using a "key". An example of this might be to take the phrase

"I have solved the San Jose Semaphore"

and encrypt it by moving all the letters forward (+) 8 values on the ASC II text table using the digital reference as a guide. The resulting text would be now encrypted as:

"Q(pi~m(|wt~ml(}pm([i%20(Rw|m([muixpwzm"

You could now employ a second "round" whereby each cypher text character is substituted for another using some lookup table or algorithm. In fact, in many second rounds, the key for the first round is actually encrypted as part of the cypher. An example could be to take the string above and transpose the case from lower case to upper case or substitute characters on a querty keyboard two spaces to the left of the keys needed to re-create the text.

The advantage of using two rounds is an exponential gain in complexity for those trying to solve the equation. Adobe uses AES in most of its' Livecycle products which uses 4 separate rounds of encryption resulting in so many combinations that it is physically impossible to crack the code using a brute force method. In fact, assuming you could build a machine that could crack one DES key every second by brute force, it would take a billion trillion years to crack AES at the 128 bit strength. That is why I scoffed in my earlier blog entry on some people who were under a mistaken impression they could circumvent Adobe's PDF encryption techniques using Gmail. The idea is preposterous!!!

The linear substituion demonstrated above is of course is a very poor encryption algorithm. For starters, it is linear so any patterns that are used in the original text are present in the cyphertext. For example, all spaces in the original text are displayed as "(" characters. This leads to easy recognition of patterns for things like double characters in words (example:" two "t"'s in "pattern").

A much better approach is called "non-linear substitution" whereby each character is substituted with its’ cipher text character using a dynamic map rather than a static linear map (such as Shift+8 characters on the ASCII chart). There are many ways to build this that avoid patterns being recognized from the original text and even introduce confusing patterns to those who want to crack the cipher. In the Semaphore broadcast, the tone of the woman's voice could be a key that acts as a "shift" and the tone could act as an offset on a chromatic scale. A great example of this might be to create a 16 by 16 grid and have multiple allowances of the assessors for each cipher substitute. The chart could look like this:


Now imagine you wanted to substitute the same phrase "I have solved the San Jose Semaphore". You could take it into the first cypher round and transmit it as a tied hash (ignoring space characters for now):

Alpha 9
Delta 13
Lima 7
Lima 2
Delta 9
Oscar 15
Kilo 15
Foxtrot 10
Juliet 8
Kilo 5
...etc...

Notice that patterns that may have existed before can be dissolved. For example, the "e" in have and the "e" in solved can be keyed to two completed different coordinates (both Kilo 5 and Oscar 15 correspond with "e"). I have additionally introduced what appears to be a pattern by using two Lima coordinates side by side.

The text above is very similar to what comes out of Semaphore if you listen to the live broadcast. I mapped the above grid to the broadcast from Semaphore earlier today and found there are now some astounding patterns present. By "astounding", I really mean statistically abnormal. Here is what I decrypted:

Lhsvezh vbdktppbtk vbdktppbtk lbpelsxhsllbpelsxhilhbl tnfddnnhbl tnfddln

Note that the repetition of the characters "vbdktppbtk" is statistically abnormal and probably deserves more attention. I am not 100% sure this map is correct as I was on a conference call during the time and may have misheard a character or two but this is substantially accurate.

So what should the table contain? If Semaphore is in fact a 16 by 16 grid for one round of encryption, it probably doesn't just contain A-Z repeated. Extended ASCII itself has 255 characters which is one shy of 16 times 16 (256). Could that be the answer? If someone cares to take the ASCII table and overlay it on the grid and map out some of the broadcast, I would love to see the results although I suspect the results are going to be in cyhper still. One thing that *could* be gained by such an exercise is to find out the finite length of the broadcast. If you think I should do it, please leave a comment on this blog.

So what are the second rounds? I picked up my guitar last night and played the notes as they are broadcast and found a lot of them are middle "C". Perhaps the offset on the chromatic scale from C is a second round key? What part does the airplane detection play? Why are the patterns broadcast at exactly 7.2 seconds apart? Why am I writing on this?

More to ponder.... Back to the drawing board.

I think I'm getting hooked on this project.

More Semaphore clues - cracking the Adobe Semaphore Cryptograph

In response to a questions I received from a woman on my earlier blog entry, I have made an incorrect statement (although I did say it was a guess). Joann asked if "semaphore's discs spun faster when an airplane flew overhead". I replied it was probably coincidental however have since been corrected.

Siri (no last name) who worked on the project internally at Adobe emailed me and stated " I saw in the last blog you were discussing the reactions of the semaphore when planes flew by - there actually is an antenna on the roof that registers when a plane goes by and causes the semaphores to spin wildly". I stand corrected. The only thing that comes to mind is what does it have to do with the cryptogram? Theories anyone?

Stay tuned for another blog post with some new theories on the subject.

Ciao!

Semaphore Solution? A 16 by 16 grid?

After thinking about cracking the Semaphore cryptograph a bit more, I noticed that the string-integer codes both use values that seem to range from 1-16. No numeric value I have encountered is over 16 and neither are the letters using a=1, b=2 etc.

This may imply a 16 by 16 grid. The changes in tones of the voice could be markers for new words or other punctuation, case etc. The lighted glyphs could eassily be used to demark a 16 * 16 grid too, given each of the four glyphs can indicate 4 positions (vertical, horizontal, slanted right, slanted left). This is consistent with the Semaphore flaggin system. I would presume that this gives each of the four glyphs the ability to communicate either A-P or 1-16. How does this sync up with the broadcast message?

I have made a 16 * 16 grid and used letters of the alphabet laid out in a number of ways on the grid to reference the targets but the message is still cypher text. Perhaps there is a dual stage to the encryption. This leaves the tones of the music and the ladies voice to use as clues. The tones that begin each segment seem to be rather limited to only a few notes as does the ladies voice.

More later. Anyone have any theories?

Semaphore - Clues to cracking the Cypher: is Slashdot smart enough?

For those of you who love a challenge, Adobe has sponsored a whopper. The Semaphore art project in San Jose is where art meets technology. Four large round glyphs rotate their position every 7.2 seconds while a simultaneous low power radio broadcast emits a coded message. Artist Ben Rubin’s mind shred’s message seems to follow a pattern. Each broadcast segment contains an audible analog tone, an audible analog pattern, followed by a string-integer hash. Several items vary during the broadcast including the tone of the woman’s voice as she speaks the integers. The tones also change.

Here is a pattern:

Tone, dot pattern, click(ping), string, integer, ping

Here are some general observations that might help those trying to decode it. I also want to state that while I do work for Adobe, I have in no way had any internal knowledge of this project nor do I have any keys to the answer.

Background:

Semaphore is an ancient flag based signaling system. A person holds two flags and uses one rotational angle to act as a key while using a second flag to indicate a specific value. The comparison to the rotating glyphs cannot be ignored.

1. What is the significance of the glyphs changing position every 7.2 seconds? This could be a key or it could be incidental to the entire exercise. I would suspect that due to its’ precise timing, it is a key.

2. Ben Rubin’s education should probably be factored in. There are no details of him ever studying cryptographic techniques. Accordingly, I would presume the cypher’s key to be less complex than Rinjdael’s (AES) et al. I did find his master’s thesis entitled “Constraint based cinematic editing” which may be a clue into his mind.

3.What possible significance does the tone of the woman’s voice have? It seems to speak in two tones – one about one octave higher than the other. It this significant of some kind of logic gate?

4. What are the string-integer pairs. Here is an example:
India 02
Kilo 08
Echo 06
Delta 01
Charlie 05
Mike 03
Mike 14
Echo 06
Delta 04
Delta 04 (note repeat)
India 02
Kilo 08
Echo 06
Delta 01
Charlie 05
Mike 03
India 02
Delta 15
Delta 04
Mike 14
Alpha 10
Delta 04
Delta 04
Alpha 10
Charlie 16
Delta 15
India 02
Delta 15
Delta 04
Mike 14
Alpha 10
Delta 04
Delta 04
Alpha 10
Charlie 16
Delta 15
Delta 01
Pumpkin 02 ??
Kilo 03
November 04
Charlie 11
Charlie 16
Lima 03
Echo 06
…..

Note the pattern repeats certain characters (Delta 04’s seem popular). There are alsio patterns of repetition that seem to repeat above a statistically normal basis. Based on this I would aver that the answer is a value of text. The same values suggest double letter combinations in the resulting text (example = Challenge has two “ll”’s)

While the Semaphore Flag code uses only 9 positions, note that the numeric values scale much higher. Could this be a revision of the code based on some key (7.2) to reflect the glyphs ability to provide a more precise rotational index? I did not encounter any numeric value over 16 while listening.

The Semaphore art uses the NATO phonetic alphabet.

A: Alpha
B: Bravo
C: Charlie
D: Delta
E: Echo
F: Foxtrot
G: Golf
H: Hotel
I: India
J: Juliet
K: Kilo
L: Lima
M: Mike
N: November
O: Oscar
P: Papa
Q: Quebec
R: Romeo
S: Sierra
T: Tango
U: Uniform
V: Victor
W: Whiskey
X: X-ray
Y: Yankee
Z: Zulu

Note that “Pumpkin” is not actually part of the phonetic alphabet. Perhaps I heard it wrong.

Good luck - anyone with Theories, please post them back to this blog. Maybe we can get lucky....