Peter Samson joins the Tech Model Railroad Club. The TX-0 arrives; "vulturing time" begins; the word hack is born in the S&P subcommittee.
James Ellis of GCHQ conceives Non-Secret Encryption from a buried WWII Bell memo. "Unfortunately, I can't see anything wrong with this." No implementation exists. The idea is shelved.
Clifford Cocks, 22, implements Ellis's theory — multiply two large primes. Functionally RSA, three years early. Nobody much cares. The next year Malcolm Williamson tries to break it and invents Diffie-Hellman instead. GCHQ classifies everything and does nothing with it for 24 years.
Horst Feistel's Lucifer becomes DES — after the NSA cuts the key from 128 to 56 bits. Hellman's law: a small key is a guarantee of insecurity.
Whit Diffie's eureka: split the key. Public key + digital signature conceived in an afternoon. He nearly forgets it reaching for a Coke — and won't write it down, because his computer isn't secure.
Hellman cracks the implementation: discrete exponentiation. The Diffie-Hellman key exchange — two strangers, open channel, shared secret.
"We stand today on the brink of a revolution in cryptography." The NSA's 27-year monopoly is broken in print.
After months of invent-and-Adleman-breaks, Rivest strips factoring to essentials: RSA. Adleman asks his name off the paper, keeps it last, and calls it "the least important paper my name would ever appear on." Alice and Bob are born.
NSA's Joseph Meyer cites ITAR: crypto is a munition, publishing about it could mean jail. (He had earlier invented the ankle monitor.) The war on mathematicians goes official.
Scientific American prints RSA and the RSA-129 challenge ($100, estimated 40 quadrillion years). Thousands of SASEs flood MIT; the pizza-and-envelope-stuffing party follows in December. Poe's "no cipher is unbreakable" declared void.
US Justice Dept. secretly rules ITAR's crypto restrictions unconstitutional. The NSA knows; nobody is told for two years. Inman begins the charm offensive — first public speech in NSA history: "My concern is that the government has too little" control.
First Crypto conference at UCSB, organized by grad student David Chaum (notices printed at the shop that did Covert Information Bulletin). The rump session becomes a tradition. Chaum invents blind signatures — anonymous digital cash.
Adleman cracks Merkle's knapsack on an Apple II at Crypto '82 — "the theory first, the public humiliation later." Merkle: "It didn't work." The outsiders now do cryptanalysis too.
Patent bought from MIT for $150K; chip fails in silicon; CEO drifts toward Scientology. Jim Bidzos walks in, takes over on "Black Friday," lands Lotus Notes — the first mass-market public key deployment. The Obscene Crypto Caller becomes a regular.
Ozzie at Fort Meade: "We could stop your shipments of 1-2-3 tomorrow." The 32-bit export cap is born — two-tier crypto, Americans strong / foreigners breakable. Shamir's zero-knowledge patent briefly declared a US state secret.
S.266 language: providers "shall ensure the government can obtain the plaintext." Phil Zimmermann — six years of nights on PGP, mortgage in arrears — ships it as freeware in June. Kelly Goen drives the Bay Area uploading from payphones. PGP crosses the ocean instantly. Biden withdraws the clause; the copies can't be recalled.
Hughes, May, Gilmore's Berkeley meeting. Both manifestos read aloud; a key-signing party; the list goes up on toad.com. PGP 2.0 posts from Amsterdam and Auckland — imported into the US.
The Clinton administration endorses key escrow: Skipjack in a tamperproof chip, keys split to NIST + Treasury, wiretap data in the LEAF. Brooks wanted national debate; the FBI wanted speed. Public comment: 320 responses, 2 in favor. "Big Brother Inside" stickers circulate. ACLU and Rush Limbaugh agree for once.
April 24: RSA-129 factored by 1,600 machines in 8 months — THE MAGIC WORDS ARE SQUEAMISH OSSIFRAGE. Summer: Matt Blaze kills the LEAF checksum in 42 minutes at Bell Labs. NYT, above the fold. The Gore letter blinks at Rep. Cantwell. Clipper is dead in everything but name.
Netscape's 40-bit SSL broken — first by Doligez's borrowed cycles (free), then by two Berkeley grad students in under a minute (RNG seeded from time + PIDs). The Scientologists kill Julf's Penet remailer via Finnish courts. Zimmermann's 3-year grand jury ends: case dropped, "Phil Got Off the Hook" party.
Bernstein wins: source code is speech (9th Cir.). The NRC panel hears the secrets and rules them irrelevant. EFF's DES Cracker: $210K, 24 hours. Gore announces export liberalization for any key length. Baker: "It's over."
The Ellis, Cocks, and Williamson papers go public. James Ellis died a month earlier, never seeing it. His pub line to Diffie, 1982: "You did more with it than we did."
Bidzos toasts the NSA panel. Skipjack published. AES bakeoff open, half the contenders foreign. Windows 2000 ships 128-bit crypto with clearance. Clinton signs the digital signature bill — electronically. Bidzos in a choir robe: "We've found the problem to the solution, and it's e-commerce!"
Winter 1958. A freshman named Peter Samson wanders MIT's Building 26 at 2 a.m., opening doors he wasn't invited through, because things had meaning only if you found out how they worked — and how would you go about that if not by getting your hands on them? In the basement: unguarded IBM machines. Upstairs: the IBM 704, a multi-million-dollar "Hulking Giant" operated by a Priesthood. You handed your punch cards to the priests and waited days for output.
Then came the TX-0 — one of the first transistor computers, and it had no priesthood. You sat at the console. You could hear your program run through a speaker — the memory cycles played as fuzzy organ chords. The model-railroad kids restructured their lives around it, "vulturing time" on midnight stakeouts for no-shows on the sign-up sheet. From their jargon — munged, cruft, and a build done purely for the joy of involvement — came the word: hack. The most productive Signals & Power people called themselves hackers, with pride.
Access to computers — and anything which might teach you something about the way the world works — should be unlimited and total.
All information should be free. A computer is a free flow of information; jam any bus and the system collapses.
Promote decentralization. Bureaucracies cannot accommodate the exploratory impulse. IBM was the batch-processed world; the hackers refused it.
Not degrees, age, race, or position. A twelve-year-old (Peter Deutsch) who could hack was equal to a professor who couldn't.
The decimal print routine, ground to 50 instructions by the crowd — until silent Jenson posted 46 on the bulletin board. The hackers were quiet for days. "That was Nirvana."
"Once you fix a behavioral problem, it's fixed forever, and it is exactly an image of what you meant." — Samson
Diffie hits bottom — over 30, unpaid, weeping in John McCarthy's bedroom: a "broken-down old researcher." Mary Fischer tells him: "I know what I'm looking at, and I know you're a great man." Then, May 1975, house-sitting for McCarthy: he makes breakfast, sees the family off, and paces with the problem all day. Afternoon. Everything clicks.
The dogma since antiquity: one key scrambles and unscrambles. Diffie's inversion: a pair. Publish the public half to the world; keep the private half. No couriers, no key-distribution centers, and — run in reverse — the digital signature falls out for free: sign with your private key, and anyone can verify only you could have sent it. Alice and Bob make their first appearance here. So does Eve.
December 1976: a grad student drops "New Directions" on Ron Rivest's desk — "here's something interesting..." Rivest recruits Leonard Adleman (a pure-theory snob who changes the subject) and Adi Shamir (who learns all of algorithms from a library shelf in two weeks). The method: Rivest and Shamir invent a scheme, Adleman breaks it. Thirty-one straight kills. Then, April 3, 1977 — after a Passover seder, wine, midnight on the couch with the terminal deliberately off — Rivest strips factoring to naked essentials:
Crypto '82 — Adleman cracks Merkle's knapsack on an Apple II, live, at Diffie's rump-session panel. "The theory first, the public humiliation later." Merkle pays the $100, then $1,000 for the stronger version — collected two years later by Sandia's Ernie Brickell with a Cray. Merkle's post-mortem on his own scheme: "It didn't work." An NSA insider, glum: "It's not that we haven't seen this territory before, but you are covering it very quickly."
Then the comedy of errors: the inventors of RSA found RSA too much trouble to use — caught with their own chip-design secrets unencrypted ("Naaah, it's too much work to encrypt it"). The company nearly dies: a CEO who transfers to Scientology, loans from guys named Vinnie and Steve at Kaplan's Deli, an office the size of a soccer field for five employees. And then Jim Bidzos — Greek immigrant, ex-Marine, backgammon gambler — walks in and becomes crypto's first supersalesman.
Ozzie at Fort Meade. Lotus Notes legally counts as a weapon of mass destruction. The NSA officer on DES: "You're not going to export DES, no way, under no circumstances... you will never export DES." Then the threat: "We could stop your shipments of 1-2-3 tomorrow if we felt like it." (1-2-3: the spreadsheet. Its "encryption": a password option.) Ozzie, direct: "Are you waiting for me to offer you a back door?" — "No, we don't want you to compromise the security of the product." Then what do you want? No answer. Three years of stalemate.
The "concession": 32-bit keys for export — which the NSA considered generous, having first offered 24. Each bit doubles the keyspace; the domestic 64-bit version wasn't twice as strong as export — it was doubling-the-difficulty-32-separate-times stronger. Days versus aeons. So Lotus ships two versions of reality. This is the origin of every "export-grade cipher" vulnerability — including Logjam and FREAK, decades later.
Phil Zimmermann. Fourth grade, Miami: decodes a TV club's cipher without buying the key. College: writes a FORTRAN cipher "not even the CIA could break" — later finds that same construction in a textbook as a trivially breakable example. 1977: cold-calls Ron Rivest; LISP machines cost $100K; "that's out of my reach." Then Ellsberg at a 1982 rally cancels his New Zealand emigration — he stays to fight. Arrested twice, once alongside Ellsberg and Carl Sagan.
A phone call from Charlie Merritt (RSA on a Z-80, already visited by the NSA) relights the fire. Six years of nights and weekends. Twelve-hour days in a bedroom, skipping mortgage payments. The program: Pretty Good Privacy — named after Garrison Keillor's "Ralph's Pretty Good Grocery." The bulk cipher he wrote himself: Bass-O-Matic, after the SNL fish-blender sketch.
January 24, 1991 — Senator Joseph Biden inserts FBI-written language into antiterrorism bill S.266: providers and manufacturers "shall ensure that communications systems permit the government to obtain the plaintext contents." Read that twice. A leaked warning spreads across the nets: "I suggest you begin to stock up on crypto gear while you can still get it."
Zimmermann's response: ship now, give up the money. Freeware. June 1991 — Kelly Goen drives the Bay Area with a laptop, acoustic coupler, and cellular phone, uploading from payphone to payphone, rushing off before an injunction could land. "Dandelion seeds." Zimmermann's legal theory: "There's no law against Americans having strong cryptography." PGP crosses the ocean instantly — on the Information Highway, borders are just speed bumps. Biden withdraws the clause in June, beaten. The withdrawal was irrelevant: the copies were unrecallable, "like words after they were uttered."
May 1992: Eric Hughes (Stetson) visits Tim May (outback hat, ex-Intel physicist) to look at houses. They talk for three days; zero houses viewed. Conclusion: build tools, not vibes. They recruit John Gilmore — Sun employee #5, EFF co-founder, who beat the US government over Friedman's reclassified library books and then asked a judge to rule the Espionage Act itself unconstitutional.
September 19, 1992, Hughes's Berkeley house, ~20 people. May's 57-page handout. The reading of manifestos. A key-signing party. And St. Jude, leather-clad Mondo 2000 writer, looking around the room: "Hey, you guys are cypherpunks!" The name sticks. The list goes up on toad.com — 100 members in weeks, 700 within a year, 150 messages a day.
Clint Brooks, NSA "Equities man" (balancing breaking everyone's codes against providing America's codes), opens his pitch to new general counsel Stewart Baker by setting a large bottle of Advil on the desk: "You're going to need this." His 1989 brainwave, after rejecting a secret trapdoor (if Congress found out, "the Church committee would look like a picnic"): key escrow. Strong crypto for everyone — duplicate keys split between two government escrow agents, retrievable with a warrant. And Brooks — the tragic figure — wanted open national debate. He told his superiors it couldn't be decided by the NSA: "It has to be decided by the president of the United States." They thought he'd lost his mind.
Matt Blaze, Bell Labs — ex-paramedic, comp-sci-plus-political-science degree, invited to Fort Meade as a friendly outside tester (camera-tracked, disembodied voices, NSA coffee mug). His question, the one Denning's panel didn't ask: not is Skipjack strong but can you use the crypto while defeating the escrow?
The NSA confirms his result is technically correct (and fixes his grammar). AT&T declines to bury it. John Markoff puts it above the fold, page one, rightmost column: "FLAW DISCOVERED IN FEDERAL PLAN FOR WIRETAPPING." The flaw was fixable. The taint was permanent. A system built to manufacture public trust had been publicly demonstrated untrustworthy by its own audit trail.
Morris's koans (Crypto '95, from the recently retired NSA scientist): "Never underestimate the time and expense your opponent will take to break your code" — and, for codebreakers: "Look for plaintext." Humans are fallible; sometimes the unbreakable message is sitting there unencrypted.
The 1977 Gardner challenge — 40 quadrillion years estimated — factored by 1,600 machines in 8 months, 5,000 MIPS-years, 400MB shipped on tape via US Mail. The magic words: THE MAGIC WORDS ARE SQUEAMISH OSSIFRAGE. "A bunch of amateurs can get together and do this."
Damien Doligez (INRIA, ex-NATO base near Versailles) hunts from the end of the keyspace "because the cypherpunks would start from the start." Idle workstation cycles, 10,000 keys/sec, cost: free. Broken on a holiday weekend.
Berkeley grad students Goldberg & Wagner, following koan two: Netscape's RNG was seeded from time of day + Process ID + Parent ID. Not random. Key recovered on a vanilla Pentium in <60 seconds. "If Netscape did this wrong, what else did they do wrong?" — Schneier.
The EFF builds Deep Crack for $210,000. A cipher still classified a munition, broken in a day by hardware anyone can afford. Assume the NSA has plenty in the basement. It did.
RSA 2000 — Bidzos hands the Justice/NSA panelists a bottle of champagne. Zimmermann, whose indictment was dropped in 1996 ("Phil Got Off the Hook" party), publicly clicks a mouse to export commercial PGP abroad as a celebration. Skipjack is published. The AES bakeoff runs in total openness, half the contenders foreign. Windows 2000 ships 128-bit crypto with clearance. Clinton signs the digital signature bill electronically. Bidzos, in a choir robe, with the diagnosis of the whole 20-year war: "Public key cryptography was born too soon. It was a solution whose problem hadn't fully materialized... We've found the problem to the solution, and it's e-commerce!"
While Diffie wandered America's campuses and Merkle fought his professors, an Australian-born orphan named James Ellis — "classic English eccentric," pre-mixed instant coffee with sugar, the worst technical speaker his colleagues had ever seen, "half of them ridiculous, half could be brilliant" — worked blue-sky research at GCHQ. Given the key-distribution problem, he did his signature move: challenge the basic assumptions. Everyone knew secure communication without a pre-shared key was impossible. "It was obvious to everyone, including me."
Then a buried WWII memo surfaced: Bell's Project C43 — the recipient adds known noise; only he can subtract it. The principle: the recipient can participate in the encryption. One night in bed, minutes after posing the question, Ellis had the answer. He called it Non-Secret Encryption. The GCHQ chief mathematician's Christmas 1969 verdict: "Unfortunately, I can't see anything wrong with this." Unfortunately. But it was an existence proof, not a machine.
Teatime puzzle from his mentor; walks home to his rented room (legally forbidden to write anything down at home — "not even notes on wastepaper"); thinks; "happily, the first idea seemed to work just fine." Multiply two large primes. The formula: virtually identical to RSA — which took the MIT trio four months three years later. His mentor sprinted down the corridor shouting: "This is the most important cryptographic discovery of the century!" A minority opinion. "People said, 'Ha, ha, now here's a method.'"
Eight to twelve hours, late at night, unwritable (it became a state secret the instant it left his head). "When you've got a concept that is right, you can't forget it." He judged the whole theory too risky: "I feel that there should be a flaw in the security of the method. But I cannot find anything wrong with it and would be grateful if anyone else can."
Ellis reads "New Directions": "They're where I was in 1969." Cocks recognizes his own discovery in Gardner's column: "I was surprised." Williamson urges GCHQ to block the American patents. The advice from upstairs: "Don't bother."
Diffie drives to Cheltenham, to a house called Dilkusha ("little delight"), where Ellis keeps bees. Getting in the car: "Tell me how you invented non-secret encryption." Ellis: "Who says I did?" Hard cider. Everything but the one subject. And then, the acknowledgment that says everything about the closed world vs. the open one: "You did more with it than we did." And thereafter kept his secret.
Ellis's 1985 history of the invention had stayed classified for twelve years — held, per Williamson, "until a certain person retired." James Ellis died a month before the release. Never saw his own history declassified. "Internal recognition is all you get."
Why did the closed world sit on the century's biggest idea? Elegance was a bug ("there absolutely may be a magic screw — some graduate student mathematician could really cause a disaster" — Williamson). It was impractical (minutes per key). It was, above all, the civil service: "Let's ignore it. Let's sweep it under the carpet." The cost of that caution: no digital signatures, no hybrid systems, none of the open-world flowering — and, bitterly, the agencies were gutted in the early 80s by key-material traitors (Prime, Walker, Boyce/Lee): the exact vulnerability public key would have eliminated. The problem Ellis set out to solve stayed unsolved because they had already solved it.
Split the key. Publish the lock. Diffie-Hellman-Merkle, independent of Cocks-Williamson-Ellis by two decades.
Factoring as the one-way function. Signatures + privacy in one primitive. Now in every handshake on earth.
Split a key into shadows; any k-of-n reconstruct. Missile silos, custodial keys, backups.
Prove you know the secret without revealing it. "A million trips to the Mafia-owned store." The basis of modern authentication research.
Chaum: a bank certifies money without learning who holds it. The Dining Cryptographers: provable untraceability. Bitcoin's direct ancestor.
Peer-to-peer trust, no CA. Email encryption for the people. Still the reference design for decentralized trust.
toad.com. Where the future was argued into existence: remailers, digital cash, onion routing, and eventually a little thing called Bitcoin.
Netscape + RSA license = the commercial web. Cracked twice (40-bit keyspace; RNG seeded from time+PIDs) before it was trusted. Now: every padlock icon.
| TERM | ORIGIN | MEANING |
|---|---|---|
| hack | TMRC, 1958 | A build done for the joy of involvement — innovation, style, technical virtuosity. The maker of it: a hacker. |
| cruft / munged | TMRC jargon | Garbage / Mash Until No Good. Still in every codebase. |
| Alice, Bob, Eve | RSA paper, 1977 | Rivest's casting. Later joined by Carol, Trent, Dave. Every crypto paper since. |
| one-way function | Diffie's quest | Easy forward, impossible reverse. "Like putting together a pulverized dinner plate." |
| key escrow | Brooks, 1989 | Duplicate keys held in trust for the state. The idea that would not die — see "lawful access," "client-side scanning." |
| LEAF | Clipper, 1993 | Law Enforcement Access Field. Originally "Exploitation." Killed by a 16-bit checksum in 42 minutes. |
| export-grade crypto | Lotus deal, 1989 | Deliberately weak crypto for foreigners. Its 512-bit ghosts (Logjam, FREAK) haunted the web for 25 years. |
| web of trust | PGP 2.0, 1992 | Trust as a peer-to-peer graph. "Paranoia levels" — Schneier. |
| cypherpunk | St. Jude, Sept 1992 | Punk + crypto. "Cypherpunks write code." |
| remailer / nym | Hughes, 1992-93 | Anonymous chains; persistent pseudonyms. Penet, mixmasters, Tor's grandparents. |
| look for plaintext | Morris's koan #2 | Before breaking the cipher, check if the message is already readable. Still the most durable sentence in security. |
| SQUEAMISH OSSIFRAGE | RSA-129, 1977/1994 | The magic words inside the "unbreakable" challenge. Proof that quadrillion-year estimates are opinions. |
Biden's S.266 clause ("providers shall ensure the government can obtain plaintext") is verbatim today's "lawful access" hearing. The answer is still the same: distribute the math faster than they can legislate it.
"A small key is a guarantee of insecurity" — Hellman. Every "just 40 bits for export" becomes someone's Logjam a generation later.
Kerckhoffs, 1881 → Diffie's open cipher → "nothing up our sleeve." Myhrvold's rule: why would the NSA fight it so hard unless it was actually strong?
GCHQ had public key for 20 years and produced nothing. The open world reinvented it and changed everything. Openness wasn't the delivery mechanism. It was the point.