The Unbreakable
Where classical cryptography reached its limits — and mathematics drew the line
Many historical ciphers succumbed to cryptanalysis; others were exposed by operational mistakes, became obsolete, or remain unresolved. Claude Shannon proved perfect secrecy for a correctly used one-time pad: a secret, uniformly random, independent message-length key used once. Its demanding key-distribution requirements limit its use. This hall examines that guarantee and how pad reuse undermined it.
What came next — AES, RSA, Diffie-Hellman, and the systems that protect the digital world — lives in the Modern Cryptography wing.
A one-time pad offers perfect secrecy with a secret, uniform, independent message-length key used once. Try ciphertext tampering to see why secrecy is not authentication.
Key: XMCKL (illustrative pad)
Cipher: EQNVZ
Vernam’s teleprinter system combines text with a key stream. XOR supplies perfect secrecy only when the pad is uniformly random, independent, secret, long enough and never reused.
Key: Q (10001)
XOR: Y (11001)
VENONA analysed intercepted Soviet messages, chiefly from the 1940s, by exploiting duplicated pad material. The project ran from 1943 to 1980.
Failure mode: Key page reuse
Lesson: Math stayed sound; operations failed
Bruce Schneier’s 54-card Solitaire cipher (1999) was designed for Neal Stephenson’s novel Cryptonomicon (1999 edition). Crowley measured a bias in consecutive keystream outputs; this is a study exhibit, not a security recommendation.
Bias: 1/22.5 vs 1/26 ideal (Crowley 1999)
Claude Shannon and Perfect Secrecy
Perfect secrecy means observing ciphertext does not change the prior probability of any plaintext: P(M=m | C=c) = P(M=m), for ciphertexts with nonzero probability. Plaintexts need not be equally likely beforehand. An independently uniform one-time pad meets this definition; it is not the only possible perfectly secret construction. Encryption alone does not authenticate a message.
For example, if a message was more likely before interception, it remains more likely afterwards. The ciphertext does not improve that prior guess. This guarantee concerns message content within the defined message space; length and other traffic metadata may still be visible.
Source: Claude E. Shannon, Communication Theory of Secrecy Systems (1949), §10, pp. 679–682. Shannon also describes perfectly secret systems using Latin squares.
A one-time pad has demanding operational requirements:
- The key must be as long as the message — a 1GB file needs a 1GB key
- The key must be truly random — not pseudorandom
- Key distribution must be perfectly secure — if the key channel isn't secure, neither is the cipher
- Every key used once means you can never reuse, recycle, or re-derive it
VENONA: US Army analysts, and later successor organizations including NSA, exploited reused Soviet additive key material. The historical traffic used decimal subtraction without borrowing, not binary XOR; the exhibit shows both the principle and a decimal teaching exercise.
Shannon's Two Principles — and How Modern Crypto Achieves Them
Confusion complicates the relationship between the key and ciphertext statistics. For a Caesar shift, C = P + k mod 26, one aligned plaintext–ciphertext letter pair reveals k. Shannon’s term is a design principle, not a universal numerical score.
Modern solution: AES uses a fixed, public nonlinear S-box together with key addition and diffusion over multiple rounds. The S-box alone is a known byte substitution; its output determines its input. Security belongs to the complete construction, not secrecy of that table.
Spreading the influence of each plaintext bit across many ciphertext bits. Caesar does not spread changes between letters — changing one letter changes exactly one ciphertext letter. Frequency analysis exploits this directly.
Modern comparison: AES combines nonlinear substitution, key mixing and linear diffusion. A full-cipher avalanche measurement describes behavior across inputs, not a promise that every change flips exactly half the bits.
From Caesar to AES — What Each Generation Taught the Next
| Classical Cipher Type | Fatal Weakness | Modern Solution | Modern Example |
|---|---|---|---|
| Caesar / Substitution | Frequency analysis — letter mapping preserved | Repeated substitution, diffusion and key mixing | AES SubBytes |
| Monoalphabetic | 26! keys but relabel the same frequency counts | Fixed public S-box combined with round-key addition | AES with round keys |
| Polyalphabetic / Vigenère | Repeating key creates detectable periodicity | Pseudorandom keystreams with unique nonce/counter inputs under a key; output bytes can repeat | ChaCha20, AES-CTR |
| Transposition | Letters preserved, just rearranged — anagram attacks work | Substitution and linear diffusion across rounds | AES ShiftRows + MixColumns |
| Playfair / Hill (block) | Small blocks leak digraph statistics; linear algebra solvable | 128-bit blocks, non-linear operations, key mixing | AES (128-bit block) |
| Military layered (ADFGVX) | Substitution + transposition — each layer still attackable | AES uses 10, 12 or 14 rounds; the final round omits MixColumns. Inversion with the key is efficient | AES |
| One-Time Pad | Impractical key management — reuse is catastrophic | Computational security with short keys under stated assumptions; not perfect secrecy | AES modes; authenticated X25519-based protocols |
The museum’s lesson: State the security goal and assumptions explicitly. Perfect secrecy, computational security, authenticity and implementation resistance are different claims. Real systems need appropriate parameters, secure key handling and careful implementation; they do not invariably fail loudly when misused.