For all the back and forth here about what can and cannot be cracked eventually, I see no math with regard to magnitude. And without magnitude, we have no sense of scale.

For all intensive purposes SR4 has given an "infinite" amount of memory. In other words they looked at the insanity of megapulses, and the growth curve of memory over the last few decades and said "hell no, we're not doing that again."

We don't know a lot about what goes on with computers and radiowaves in SR. It isn't specified whether commlinks are quantum based, nor even how their operating systems work. (OS appears to work in a very alien way to how we look at them today.)

That said, I see no reason why dozens, hundreds, or thousands of hours spent by quantum processors utilizing all encryption algorithms, techniques, and methods known by 2070 cannot produce an OTP which is highly unlikely to be cracked within the time span of a single game mission. In terms of magnitude I don't find that concept unreasonable. Naturally it doesn't replace public keys, nor should it. But it would seem feasible for OTPs to be used for select circumstances.

If it doesn't fit the feel of somebody's game, so what? Nobody has the right answer here. Hell, nobody even has enough information to give an estimate between 30 seconds and 30 billion years. But if the team hacker is willing to strike a deal where X many hours of downtime results in Y many hours of OTP safe transmissions, I'd be cool with that. Just have OTP files sitting on team commlinks, and keep track of how many hours worth of lists are stacked here or there. And remember to mark it on your sheet in case your team is being hacked.

Run the idea by your GM and fellow players. Consider the consequences. Decide, and enjoy.

I am assuming that every implementation of encryption and decryption algorithms is flawed. The math may be perfect, but there are common exploits in the random number generators, the code, etc, etc, etc that make it POSSIBLE for a really complex program to defeat the encryption. Breaking encryption isn't attacking the math, it is attacking the reality.

I'm through debating this with you RvD. OTPs are unbreakable. Period. You're just making stuff up or omitting central parts of what people say. Claiming that there's enough of a pattern in numbers generated from measuring naturally random processes to predict what the next numbers are going to be just shows that we're up against pure stubborness. Using brute-force against something encoded with a cipher from naturally random events is just plain pointless, a pattern in the ciphers will just skew the statistical distribution making pattern matching if the same cipher is repeated easier. Trying to brute-force before the cipher is repeated is absolutely pointless, even if you know a lot about how the plaintext should look - check out Aaron's post 4 posts up to understand this.

Bah, your FlameFu is as weak as your knowledge of encryption.

Alright, let's look at some of your ideas:

Smokeskin, you don't need to use a PRNG. In fact, most modern encryption systems don't use them, because they're predictable. Michael Rabin came up with a clever way of getting random numbers without using a pseudo-random algorithm: he takes numbers out of a public data stream. If you pull numbers at pseudo-random intervals out of, say, the wireless traffic going by, you come up with truly random numbers. The interval is predictable, but the actual data going by is not, and that actual data is what is being used. You don't even need to decrypt the signal going by, you can just take n bits out of it and call that your number.

From a theoretical standpoint, anyone who wants to put a lot of effort into maintaining a secure network should be able to do it. For example, the use of OTPs to change out the 1048576 bit cipher block encryption keys via OTAR every few seconds.

But the number of people who really care enough to do this is small. It's a LOT of effort. Pretty much the only people who really do this in the real world are the military/DOE. And even then they don't do it for everything.

The commercial market for really secure encryption hardware is very small, for a good reason. Setting up a secure network and the required key distribution system is complex, painful and expensive, and is expensive to maintain.

Just operating in a secure mode is a pain. I knew someone at a DOD contractor that seemed to spend half his life reinitializing secure hardware that had a bit glitch and flushed the keys. I'm sure it's better now, but very few commercial organizations are wiling to do this sort of stuff. How many commercial companies have their buildings constructed and maintained as faraday cages to protect against electronic snooping, which is fairly well understood threat?

In the real world, outside of the military, people use 3DES VPN passwords that are 6 characters, which gives an effective password length of maybe 40 bits, because it's easy. They use AES encryption on wireless network with 12 character passphrases because it's easy and makes them feel secure.

So it's reasonable to say that a given organization has effectively unbreakable encryption for something that is very important to them and worth spending a lot of money on. These would be the same people who use run all their outside cables in pressurized rigid conduit, have mantraps on all the entrances and exits, construct their buildings as faraday cages, enforce multi-factor access control systems and, in Shadowrun, have 24x7 on-site magical security TEAMS and immediately responding reinforcements loaded for bear.

I think Shadowrun makes all encryption way to easy to break, but most people won't really lock their systems down like they should, so many to most systems will be compromisable with some to lots of effort. But it all depends on what you want the game to run like.


I once played Shadowrun with a guy, who in real life, was a USAF Pave Low pilot. He pointed out that he had hundreds of people in his unit who would spend days or weeks doing the prep work for a mission that, in a game, he'd accept from some guy in a bar and spend 20 minutes looking around before executing.

Trying to follow all that was one hell of a mental exercise, but I think I understood enough to at least comment a little.

Its argued that most encryption in the game would be Public encryption (breakable) and the really tough stuff would be OTP (unbreakable for all intents and purposes of a run). No problems there.

Forgetting all the assumed or imagined realism in 2070, what does that all mean to the game? So as a GM I look at what is the impact on the game and players. Would every hacker/rigger use an OTP, unique to every item on his subscription list and perfectly set-up with random numbers to be unbreakable (doubt it). Would even a security rigger (spider) have em (probably not).

Considering decrypt is a hacking program and has a much higher availability and is restricted, it makes sense that average encryption is plenty of security for basically everyone.

My windows OS has encryption capability (in the game a common computer program), but I don't have anything on my PC that will decrypt even the combo to my briefcase, without searching warez or writing my own.

So when does this come into play, when is encryption unbreakable. When the GM needs it to be I guess. In the published "On the Run" adventure, the players are asked to decrypt a disk, but they can only decrypt a little of the information, not the whole disk. No matter what they try they can't decrypt it all. Now, no reason is given as to the mechanics of why, but for plot purposes, the adventure doesn't want them to fully decrypt it, so it can't be done.

Unbreakable encryption does exist (or at leasts exists in the timeframe that players are usually forced to operate in). Would requiring the runners break into some military facility to download some currently used OTP's so they can spoof commands at the door of a nuclear test facility rather than let them crack the door, edit the camera feeds, and turn off the auto-turret drones in 2 minutes be desirable for a GM? Damn right it would, and it would make them feel that they are dealing with the more than average security of 2070.

I don't see any problem with the "unbreakable/perfect" OTP lists when used sparringly and on very important items/data/etc, and only when it furthers plot by making the players think a little more outside the box than toss a handful of dice.

But, I wouldn't allow every rigger/player to set up unbreakable encryption though, as it would just slow down the game for only the benefit of realism. If I wanted to do that, I'd require characters to run out of breath, go to the bathroom regularly or suffer cramp distraction penalties, eat nutrious food or suffer junk food addiction and weight gain (eventually requiring strength tests to move), or give them a penalty to charisma/social skills for not brushing their teeth enough.

What this whole post amounted to (for me anyways) was a good bit of knowledge on how to explain why they can't just crack the Atlantean Foundation's data disk on the location of that super wiz artifact gate-stone and the instructions on how to utilize the markings on its side to call back Ghost Dragons or what not, rather than just saying "because you can't" or "its unbreakable".

There really isn't any arguement for realism in any RPG. It simulates reality only to the extent that it needs to for imagination to latch onto something. Mechanics exist only to give a basic structure to build that fantasy in terms/definitions everyone can agree on.

So thanks for some good learning for my brain and a nice trump card justification for when the players want to do something in the matrix that I don't want to be that easy that one time. Other than that, I don't get the point.

You have two problems here:

First, the encryption featured by 'On the Run' is a symmetric key combined with stenography, including a reactive component, based on ten year old algorythms.
Neither is it possible for it to be unbreakable, nor to act as a Databomb for a read-only media.
Basically, OTR features a typical Deus Ex Machina.

Second, OTPs are valid for any pairing application as the transimissen of the OTP is secure and used for later communication. Given usual attack scenarios, it would be perfectly reasonable to use it for any critical component.
On the other hand, given the TL of SR4, it would be more efficient to use quantum channels for drones.

I mean your right, and you definitely understand more about encryption than I ever will.

However my point is: whats it mean to the game? see to me discussing rules and would-be's without the context of players in the actual game is just a lot of wind and words.

I don't want players with unbreakable encryption on their commlinks anymore than I want the bad guys to. With the exception of a few special cases, not being able to do something isn't fun, as you point out with OTR.

My only reason for bringing up OTR is to say that the OTP sounded like a far better reason than the ones they gave which amounted to "no you can't do this".

I haven't run the OTR adventure however, I bought it as a template or guide to see how the designers think its done. So I couldn't tell you how satisfying or unsatisfying it was.

I can't really argue why they don't use OTP or how it would be better, its not in the game. Its neat info for those "well I want the bad guys after the player's disc but I don't want the players to read it" scenerios, but any good game would be built on them cracking the contents open and deciding what to do next.

Seriously though, alot of interesting thoughts in this thread, but mostly just for the behind the scenes background stuff than actual game mechanics.

I'm coming in late to this conversation. But, to be honest, the notion of any sort of realistic encryption being broken in a few combat turns is incredibly ridiculous.

As a representative of the cryptographic field, specialized cryptography takes years to decipher at the most unsecured level, short of user error.

It's purely as a gameplay facet. So. You're going to need to accept Shadowrun Cryptology works different than real life, and suspend disbelief.