For software developers concerned with preventing software piracy or enforcing licensing policies, there is a great lesson to be learned from events that took place eighty years ago this month.
The Enigma cipher machine was invented by a German engineer (Arthur Scherbius) just as World War I was coming to an end. The machines were used for commercial purposes throughout the 1920s but as Germany began to re-build its military forces in the 1930s a secure form of communication was needed. The German government looked to the Enigma cipher machine as the answer.
German Military Intelligence relied on the mathematics of the Enigma machine for securing their sensitive military and diplomatic communications. Consider the design of the machine and the possibilities and combinations of this clever electro-mechanical device and you will come to understand why they were confident in its use.
An Enigma cipher machine consisted of five variable components:
- A telephone operator style plug board containing up to thirteen dual-wired cables.
- Three ordered (left to right) rotors which wired twenty-six input contact points to twenty-six output contact points positioned on the opposing faces of each rotor.
- The rotors also contained twenty-six serrations around the circumference of each rotor allowing the operator to specify an initial position for each rotor pair.
- A moveable ring on each rotor which controlled the rotational behavior of the rotor to the immediate left by means of a notch.
- A fourth half rotor that “reflected” the input and outputs to the same face of contact points.
Dr. A Ray Miller, PhD wrote a paper about Enigma (date unknown), which was published by the Center for Cryptologic History (part of NSA), located at Fort Meade, Maryland. In the paper he disclosed for the first time the mathematics behind the typical Enigma machine used by the German Army (the German Navy had added a fourth rotor to their machines enhancing the encryption). Considering all of the possible rotor positions, the possible plug board options and the position of the notched rings, Dr. Miller calculated that the total possibilities Allied cryptanalysts were typically faced with during most of the Second World War when attempting to “read” Enigma traffic was:
107,458,687,327,250,619,360,000 (approximately 1023) or… stated another way it is about one hundred thousand billion billion.
With such daunting odds on their side, it is not surprising that German cryptographers felt secure in using Enigma. They had on their side the strength of large numbers, numbers so vast they are really beyond comprehension. And in that misplaced confidence, the Germans of that era were absolutely, completely and fatally wrong as three Polish cryptanalysts proved eighty years ago this month.
Historians may continue to argue over the military value of the decrypted communications. What cannot be argued is the incredible engineering feat performed by Marian Rejewski , Jerzy Rozycki and Henryk Zygalski of the Polish Cipher Bureau when they first broke Germany's military Enigma ciphers in December, 1932. Then just five weeks before the outbreak of World War II, they presented their Enigma-decryption techniques and equipment to British military intelligence. Throughout WWII, Allied Intelligence used information decrypted from German military communications very sparingly. They wanted to prevent the Germans from learning that their codes had been compromised. The fact that Enigma had been broken was not generally disclosed until the 1970s.
The breaking of the Enigma Cipher machine is an object lesson for software developers today. And is one that has not been lost on the development team at Wibu-Systems. While the CodeMeter encryption system used by Wibu-Systems incorporates the AES algorithm and Elliptical Curve Cryptography coupled with RSA for asynchronous key exchange and should be mathematically impossible to crack using brute force; the software engineers and developers at Wibu-Systems constantly make improvements to the basic CodeMeter architecture and security algorithms. Because it is a fact of life that whatever can be engineered… can be reverse engineered.
CodeMeter SmartBind is Wibu-Systems' newest technology to determine whether a software activation is valid or not by using internal heuristics. With SmartBind, you don’t have to worry about the details of which hardware aspects of your customer’s computer might change. The algorithm takes care of it for you.
John Poulson has worked in the software protection industry since 1988 and has been with Wibu-Systems since 2000. He is an expert in license authentication best practices and deep powder skiing.