Signal authentication proves that a message came from your own post, and it has to assume that outsiders can see or hear every signal: a daily code word that every watcher uses openly is copied the first time it is used. Use a challenge that changes each time or a list of one-use replies struck off as they are used, authenticate an all-clear more strictly than an alarm, and treat an alarm that fails the check as an alarm anyway, because a false all-clear can cost lives where a false alarm usually costs only hours.
Part of Signal Systems and Communication
Authentication is the set of rules that lets a receiver trust a flag, flash or blast, and it is separate from secrecy: signals are public, so the aim is to stop false and replayed messages, not to hide the message.
Secrecy Is Gone, So Aim At False Messages
A flag, a fire and a horn are broadcast to everyone in range. The enemy can read your alarm. What matters is that the enemy cannot send one of their own that you believe, and cannot resend one of yours at a time they choose. The parent article’s two ideas, a daily code word or prefix pattern known only to the community, and an under-duress variation, address this, but each has a weakness the arithmetic shows.
Worked Example: Guessing And Replay
Treat a secret as a pattern of short and long signals.
- A 5-signal secret has 2^5 = 32 possibilities. A blind guess is right 1 time in 32, 3.1%. Ten blind guesses succeed with probability 1 - (31/32)^10 = 1 - 0.73 = 0.27, about 27%.
- An 8-signal secret has 2^8 = 256 possibilities. One guess: 1 in 256, 0.39%. Ten guesses: 1 - (255/256)^10 = 0.038, about 3.8%.
- A daily secret is not guessed, it is watched. If the post flashes the day’s pattern every time it signals, any observer who sees it once knows it, and can send it until midnight. The guess arithmetic applies only to a secret that is never shown.
The security of a shown secret is therefore zero for the rest of the day. The answer is not a longer pattern but a secret that changes with each use.
Tools, From Weakest To Strongest
- A daily code word. Cheap, and stops a stranger who has never watched you. Fails against anyone who has seen it used once.
- A challenge and reply. The receiver sends a challenge (a number, a word, a count of flashes) and the sender must return the matching reply. A simple rule such as “reply with the number that adds to ten” is learned from two overheard exchanges.
- A one-use list. A sheet of paired challenges and replies, shared by runner. Each pair is used once and struck off. A watcher who sees a reply cannot reuse it, because the receiver has crossed that line out. A list of 30 pairs lasts 15 days at two checks a day.
- A runner’s confirmation. For a message that matters, a runner with a verbal token follows. Slow, but not spoofable by light alone.
Asymmetric Rules: Strict For Relaxing, Loose For Alarming
- An all-clear, a visitors-friendly signal or any message that lowers the guard is authenticated strictly. A false all-clear can lure the community out. Require a correct reply from the one-use list.
- An alarm is accepted, then checked. A false alarm costs hours; a rejected true alarm may cost lives. The response to an alarm should also be reversible: assemble inside the defended area and confirm by runner, rather than send people out toward the signal.
- Two failed checks within a short time mark the sender as suspect. Stop replying, tell the other posts, and treat the station as if captured until a runner confirms.
The Duress Signal Has A Narrow Use
The parent suggests adding one extra flash to an all-clear to mean “I am signalling under duress”. That works only if the coercer has not seen your signals long enough to learn the normal pattern, and does not hold the code book. An observer who has watched many all-clears can spot the one with an extra flash. A captured sentry who is made to hand over the book defeats it entirely. Treat it as protection against a casual coercer, not a determined one, and change it after any use.
Method: Setting Up Authentication
Step 1: Decide what needs authenticating. All-clears and any message that opens the gate; not the alarm itself.
Step 2: Produce the lists. Pairs of word and reply, an equal number per post, written on paper kept by the post chief and a copy at the centre. See Paper Making for materials.
Step 3: Carry the list by trusted runner. See Runner Systems.
Step 4: Strike each pair after use and issue a new list before the last pair is used.
Step 5: Rehearse the failure. Drill what each post does if a reply fails.
Diagnosing Failures
- True alarms rejected. The check was applied to an alarm; apply it to relaxing messages only.
- List exhausted early. Checks are too frequent; reduce to the minimum.
- Replies wrong from true posts. The pair was copied wrongly; reprint with fewer errors and a check line.
- An outsider answered a challenge correctly. The list was seen; replace it at once.
Common Mistakes
- Treating the code word as a secret. It stops being one the first time it is shown.
- Complex ciphers. A tired operator makes errors; simple and changed beats clever and kept.
- No list rotation. An old list is a known list.
What’s Next
- Learn next: Relay Networks — authentication along a chain of posts
- Combine with: Priority and Urgency Codes — the tiers the checks apply to