Editing Known-plaintext attack (section)

==History==
The usage "crib" was adapted from a [[slang]] term referring to cheating (e.g., "I cribbed my answer from your test paper"). A "crib" originally was a literal or interlinear [[translation]] of a foreign-language text—usually a [[Latin]] or [[Greek language|Greek]] text—that students might be assigned to translate from the original language.

The idea behind a crib is that cryptologists were looking at incomprehensible [[ciphertext]], but if they had a clue about some word or phrase that might be expected to be in the ciphertext, they would have a "wedge," a test to break into it. If their otherwise random attacks on the cipher managed to sometimes produce those words or (preferably) phrases, they would know they might be on the right track. When those words or phrases appeared, they would feed the settings they had used to reveal them back into the whole encrypted message to good effect.

In the case of [[Enigma machine|Enigma]], the German High Command was very meticulous about the overall security of the Enigma system and understood the possible problem of cribs. The day-to-day operators, on the other hand, were less careful. The [[Bletchley Park]] team would guess some of the plaintext based upon when the message was sent, and by recognizing routine operational messages. For instance, a daily weather report was transmitted by the Germans at the same time every day. Due to the regimented style of military reports, it would contain the word ''Wetter'' (German for "weather") at the same location in every message. (Knowing the local weather conditions helped Bletchley Park guess other parts of the plaintext as well.) Other operators, too, would send standard salutations or introductions. An officer stationed in the [[Qattara Depression]] consistently reported that he had nothing to report.<ref>{{cite book | title = World War II: Crucible of the Contemporary World: Commentary and Readings | publisher = M. E. Sharpe | location = New York | year = 1991 | isbn = 0-87332-731-4 | first = Loyd E. | last = Lee | page = 240}}</ref> ''"Heil Hitler,"'' occurring at the end of a message, is another well-known example.<ref>{{cite web |last1=Geggel |first1=Laura |title=Nazi Code-Making Enigma Machine Is Up for Auction |url=https://www.livescience.com/65591-enigma-machine-auction.html |website=Live Science |date=29 May 2019 |access-date=31 August 2020}}</ref>

At Bletchley Park in [[World War II]], strenuous efforts were made to use (and even force the Germans to produce) messages with known plaintext. For example, when cribs were lacking, Bletchley Park would sometimes ask the [[Royal Air Force]] to "seed" a particular area in the [[North Sea]] with [[naval mine|mines]] (a process that came to be known as [[Gardening (cryptanalysis)|gardening]], by obvious reference). The Enigma messages that were soon sent out would most likely contain the name of the area or the harbour threatened by the mines.<ref>{{cite book | title = [[The Code Book]] | publisher = Arrow | location = New York | year = 1999 | isbn = 0-385-49532-3 | first = Simon | last = Singh | author-link = Simon Singh | page = [https://archive.org/details/codebook00simo/page/184 184] }}</ref>

The Germans themselves could be very accommodating in this regard. Whenever any of the turned German [[Double-Cross System|Double-Cross]] agents sent a message (written by the British) to their respective handlers, they frequently obligingly re-encrypted the message word for word on Enigma for onward transmission to Berlin.

When a captured German revealed under interrogation that Enigma operators had been instructed to encode numbers by spelling them out, [[Alan Turing]] reviewed decrypted messages and determined that the number "''eins''" ("one") was the most common string in the plaintext ([[Benford's law]]). He automated the crib process, creating the ''Eins Catalogue'', which assumed that "''eins''" was encoded at all positions in the plaintext. The catalogue included every possible position of the various rotors, starting positions, and keysettings of the Enigma.<ref>{{cite book | title = Alan Turing : life and legacy of a great thinker | publisher = Springer | location = Berlin New York | year = 2004 | isbn = 3540200207 | first1 = D. | last1 = Hofstadter | first2 = Christof | last2 = Teuscher | page = 455}}</ref>

The Polish [[Biuro Szyfrów|Cipher Bureau]] had likewise exploited "cribs" in the "ANX method" before World War II (the Germans' use of "AN", German for "to", followed by "X" as a spacer to form the text "ANX").<ref>[[Marian Rejewski]], "Summary of Our Methods for Reconstructing ENIGMA and Reconstructing Daily Keys, and of German Efforts to Frustrate Those Methods," Appendix C to [[Władysław Kozaczuk]], ''Enigma'', 1984, pp. 243–44.</ref>

The United States and Britain used [[one-time tape]] systems, such as the [[5-UCO]], for their most sensitive traffic. These devices were immune to known-plaintext attack; however, they were point-to-point links and required massive supplies of one-time tapes. Networked cipher machines were considered vulnerable to cribs, and various techniques were used to disguise the beginning and ends of a message, including [[Russian copulation|cutting messages in half and sending the second part first]] and adding nonsense padding at both ends. The latter practice resulted in an infamous incident during World War II when the nonsense padding "[[the world wonders]]" was not nonsensical enough and was misinterpreted as part of the actual message, leading American admiral [[William Halsey Jr.]] to change his plans.

The [[KL-7]], introduced in the mid-1950s, was the first U.S. cipher machine that was considered safe against known-plaintext attack.<ref name=boaklectures>[https://www.governmentattic.org/18docs/Hist_US_COMSEC_Boak_NSA_1973u.pdf A History of U.S. Communications Security; the David G. Boak Lectures], National Security Agency (NSA), Volumes I, 1973, partially released 2008, additional portions declassified October 14, 2015, Quote: The KL-7 "was our first machine designed to serve very large nets which could stand matched plain and cipher text. For the first time, the man in the cryptocenter could take a message and simply type it into the machine as written, without changing the spacing between words, or cutting the message in half and sending the last part first. and without having to paraphrase the message text before it was released."</ref>{{rp| p.37}}

[[Classical cipher]]s are typically vulnerable to known-plaintext attack. For example, a [[Caesar cipher]] can be solved using a single letter of corresponding plaintext and ciphertext to decrypt entirely. A general [[monoalphabetic substitution cipher]] needs several character pairs and some guessing if there are fewer than 26 distinct pairs.