Magical Encryption in the Medieval Era [3.5]

[lost_my_NHL]

I wanted to add some verisimilitude to an adventure I'm running in 3.5. I'm wondering what magical and non magical tricks political correspondents would use for the purposes of encryption, authentication, and non-repudiation.

So far I've used a seal with a hidden arcane mark mark and I've arcane-marked seemingly-random but key portions of a letter. What else is out there, especially to hide an arcane mark from an outright detect magic? Is Sending susceptible to scrying? And keep in mind, aiming for lower level spells that would be economical for a government to use, but mid-level could be justified for extremely sensitive info. It also gives the PCs some fairness and interest in being able to interact with otherwise-banal documents(but who knows?).

Also wondering what magical methods might decrypt an otherwise non-magically encrypted document.

I suppose Complete Scoundrel might have some ideas, but I don't have it available right now. Not too worried if my PCs see this, because my primary motivation is verisimilitude.

[Gildedragon]

I wanted to add some verisimilitude to an adventure I'm running in 3.5. I'm wondering what magical and non magical tricks political correspondents would use for the purposes of encryption, authentication, and non-repudiation.

So far I've used a seal with a hidden arcane mark mark and I've arcane-marked seemingly-random but key portions of a letter. What else is out there, especially to hide an arcane mark from an outright detect magic? Magic Aura, secret page, snake sigil

Is Sending susceptible to scrying? I don't believe it is

Also wondering what magical methods might decrypt an otherwise non-magically encrypted document. Comprehend Languages

On that note: cyphers, allusions to obscure texts, and writing in a different language or alphabet is a good way to hide information

[Jack_Simth]

Magic Aura, secret page, snake sigil
I don't believe it is
Comprehend Languages

On that note: cyphers, allusions to obscure texts, and writing in a different language or alphabet is a good way to hide information

Per Comprehend Languages (http://www.d20srd.org/srd/spells/comprehendLanguages.htm): "It does not decipher codes or reveal messages concealed in otherwise normal text."

Depending on how much info you need to send, one of the more fun ways is an idiot code.

Let's make a hypothetical example:
Suppose I'm planning something nefarious, will be quietly feeling out a large number of people to see whether they'll be assets or liabilities, and I need to be able to signal an assassin to take out some of them after I've felt them out... but I don't know when sending the assassin which targets will need to be killed, and once I'm in the field figuring out who I'll need to have offed, communications will be monitored.

Before I go, I give my assassin a list of numbers and names, and walk him through how I plan on doing this. The names are the people who I plan to feel out, plus a few 'just in case they get in my way' types. The numbers are identifiers.

As part of my cover, I'm a merchant. Among other things, I sell some item that's normally worth more than 1 gp. I put some of them up 'for sale' at X gp, Y sp, and Z cp. The sp and cp are mathed together in some manner arranged beforehand to produce a number (the most likely case being "YZ" - so 3 sp and 5 cp would be 35). The assassin checks my sign on some set schedule, and references the list. If there's a match, he kills that target. If I don't want him killing anyone this timeframe, I simply set the Y and Z to something not on his list, or don't advertise that specific item as being on sale.

This can be made more complex. I can make a list of actions as well. Agents, too, or maybe places. Assign each category to a different product, and use the same method. So if Empty wine bottles (agent) are on sale for 1.89 , chain (action) is on sale for 29.56, and fishing nets (location/target) are on sale for 3.75, that means agent number 89 needs to take action 56 on target 75. That one happens to be dropping a 1,000 gp bribe into the trash bin at the north-east corner of the palace this evening shortly after sunset. Each agent can have a unique list of actions and locations/targets (and/or be watching for sales on different products, at different merchant proxies if I expect to need to give them multiple orders simultaneously).

[ExLibrisMortis]

Although it's not Earth-medieval, there's not much stopping you from justifying modern cryptography in D&D, if you are so enclined. I would definitely put some advanced theory behind some higher-levelled spells, so why not cryptography here? The Inevitables have probably hashed out most of the math anyways. Maybe the theory hasn't filtered down yet, but some planar wizard put it in a new spell, greater sending, and that's been sold to a less powerful wizard and so on, until it trickled down to the Third Honourable Ducal Message Service, Portside Division.

Actual medieval encryption is pretty weak, and easy to crack by hand with basic frequency tests*, let alone with magic and high-level skill use. A system like Jack_Simth describes is hard to crack just by looking at the message, but very vulnerable to compromised keys (infiltration, theft, even just misplaced keys). The size and complexity of the key mean that everyone in the network needs a copy in writing, and securely handing over all those keys is problematic.


*Non-standardized spelling makes this a bit harder, but D&D assumes a rather high degree of uniformity between languages. It can be explained by taking long-lived planar beings as 'reservoirs' of archaic languages, slowing down natural change (or rather, making it go in circles around the archaic form, if you'll permit the imagery).

[mabriss lethe]

I love using the autohypnosis skill for this. Use it like a form of steganography. The sender and receiver are both imprinted with the same pages using the skill. Innocous seeming messages are passed between them through any means that obliquely reference the individual pages and a particular word or phrase contained in it. The real message is then reconstructed.

[Fayd]

I feel like Secret (http://www.d20srd.org/srd/spells/secretPage.htm)Page (http://www.d20pfsrd.com/magic/all-spells/s/secret-page)was designed for this very situation. It's capable of being uncovered, but it takes 5th level spells to do so, not necessarily something that's very common. Combine that with some of the other tricks above, and it might be enough?

[Der_DWSage]

Jack has a pretty good way about it-short of a Detect Thoughts being thrown at you the moment you read that price, or a Divination to see if THIS particular guy is going to get assassinated, there's not a whole lot that's going to catch him in the act.

I would go a step further though-all it really requires is certain key phrases dropped in speech, letters, or other such things to make your intent obvious to someone that knows the code, and completely innocuous to those that don't.

For example, let's say our merchant friend has an assassin, a thief, and a slanderer all on his payroll to deal with his enemies, and they stop in at the shop. He's got three rivals-let's just call them A, B, and C.

Code words are key here. For example, if he offers one of them something silver, that means he needs his assassin to kill someone. If he offers gold, he means to contact the thief, because he needs something stolen. If he offers copper, he means to contact the slanderer, because he needs someone's reputation ruined. If he says he's out of stock, that means he needs to cancel a previous order given.

If he offers something cloth, that means it's towards A. If he offers a weapon, it's about B. If he offers leather, it's about C. So an easily-missed-in-plain-sight order set could very well be, "I have a gold-handled knife here, just 5 GP. Your copper-inlaid cloak, however, is out of stock, and I don't see it being in stock any time soon-my supplier's wife died, you see, and I don't want to bother him. Oh, but I do have the silver-trimmed leather boots;I'm so glad I was able to get them for you on short order."

This allows nuance (A's wife died, so he doesn't feel like slander's a good idea anymore, and he needs C killed quickly.) while being completely innocuous. There's the trouble that someone might need a playbook to keep track of things, and thus break the whole thing wide open if the book gets compromised, but there's always going to be a similar risk when you're working with multiple people.

[Gildedragon]

Bluff allows for creating of codes, so that would probably cover it.
and one needs to oppose it with sense motive if one is to intercept it; otherwise it is only legible by the intended target

a high bluff skill plus a guidance of the avatar spell, and other skill boosters make the code nearly undecipherable by anyone it isn't intended to AND if they can't get within 4 of the DC, they don't even know there's anything fishy with it

[Jack_Simth]

A system like Jack_Simth describes is hard to crack just by looking at the message, but very vulnerable to compromised keys (infiltration, theft, even just misplaced keys). The size and complexity of the key mean that everyone in the network needs a copy in writing, and securely handing over all those keys is problematic.
Yes, very vulnerable to lost keys. Most encryption is. Likewise, updating the codes once you're in the field is extremely painful (it means dropping new books off with the affected agents) which is why you need several sets of detailed plans before you ever deploy - which, of course, also implies a lot of inherent limits to that specific method.


That said, keep in mind: Most agents only have their own set of codes. There's no actual need for repetition (however: It's useful for game purposes if all agents have the same list of names; see later). The master agent somewhere calling the shots has a full copy, yes, but nobody else needs one. The bloke minding the store need not actually know about the codes at all, just the guy who sets the prices.


Keep in mind, too, I'm giving suggestions for use in a game. Ultimately, the DM wants the players to crack things. The fact that there are methods of cracking it is useful to the actual goal of "Have harmless fun with your friends". So yes: They catch an assassin in the act and kill him after they're hired as bodyguards for a guy who was in a real hurry to get some extra guards because of a few unnerving notes left on his doorstop... and he's got a codebook in his own atrocious handwriting that has nothing but numbers and names (he wasn't able to commit it to memory, so wrote it down, contrary to his actual instructions). If they happen to later piece together that one of the stores in the marketplace had bananas for sale at a price that matched the name of a guy who is suddenly spending far more than his station and job indicates he has? Great! They can follow up and start tracing things through the system. If not, well, the next guy they 'randomly' catch in a vaguely-related situation was great with matching names to numbers, but not so good with directions ... he's got the name of a store on him. Maybe one of the guards in a tavern comments on how she's seeing a bunch of lowlifes skulking around a particular shop, not buying anything, but for no discernible reason the merchant seems to not worry about it. And so on. Adapt as seems good for other situations (remember, you just need some associations - numbers are easy to use to make big lists, but you can also do colors, gemstone types, specific combinations of poems at a regular recital, or really anything you can legitimately present publicly in many different combinations).

[Eisfalken]

Rules Compendium pg. 78 deals with cyphers and such. Basically it takes a week of work, and the DC to crack it is 10 + your original modifiers for it.

One of the best ways to further encode your message without magic is using languages only spoken by obscure creatures/races. This practically forces an additional spell or two to be cast if the reader doesn't know that language.

As far as magic getting involved, the sky's kind of the limit. Nystul's magic aura can be used not just to hide the presence of magic covering the cypher, but you could alter the magic aura as a further method of communicating certain things (i.e. a message with a necromancy aura on it means the writer is in deep trouble or already dead, enchantment means the message is fake, transmutation means to use a different cypher before passing the info along). Put magic mouth on one of the pages, and instead of a written cypher, just key it to a password that recites a verbal message. Explosive runes is the de facto spell for messages that need to self-destruct if the enemy tries reading them, while sepia snake sigil is for writings in your possession the enemy might try to steal (you capture that enemy so you can interrogate them for info). Illusory script is, of course, one of the better tricks, since an unwary reader can be commanded "hand this message to its owner and leave" (which might give captives a chance to escape). Secret page is one of the top ways of passing messages, since you can trap it as well.

Sending is okay, but message is almost better for practical use. Use it at parties (with a good caster level for duration and range) to set up an observation mission; even if there's only one spellcaster using it, they can be a "command-and-control" function, relaying messages to the whole team.

Speaking of 0-level spells, dancing lights is your go-to for light signalling. It lasts only a minute, but has amazing range, move as directed, and can be permanent if you really want it to be. Mixed with a cypher system, this lets you transmit broadcast messages to anyone in a fairly large location. Use them to signal for help or evac.

Minor creation is the spy's spell of choice, along with major creation. You can create paper, books, weapons, armor, clothing, etc. at will. You do need good Craft skills, though, but if you can swing the Craft DC, there are a lot of options available to you. The best part is that you can dismiss it at will, so once you assassinate everyone while dressed as a ninja, you dismiss those items and suddenly you're just some fop in a courtier's outfit with no weapons at all, nor even illusion magic hiding anything about you.

Similarly, fabricate is an amazingly versatile spell; it lets you convert an item into another item of the same material. Curtains become clothes, wood into paper (though this should take a relatively simple Craft check), etc. What makes fabricate useful in a different way from major/minor creation, though, is that you can warp and convert existing stuff into other stuff. For example, you could major creation a metal cage into existence, but you can also fabricate a guard's armor and weapons into manacles; now he's not just immobilized, he has no armaments to stop you with even if he does break loose.

Shadow conjuration and shadow evocation are basically more Swiss army spells: they can be or do all kinds of things you need, whenever you need them. Conjuration is slightly more useful for spies; evocation is mostly "blasting" spells that draw an awful lot of attention.

I won't even talk about alter self and the various polymorph cheese, other than to say, you don't really need a disguise if you're a monster of some kind when you attack them.

Stone shape is great if you're in a castle, dungeon, or other area with stone walls. You can't exactly do anything really fine-detailed with it, but it's a great way to screw up terrain so that enemies can't get to you, or for you to remove any obstacles they might be behind. Same with transmute rock to mud and transmute mud to rock. Use wall of stone with all of this, and really muck up the battlefield good with obstacles and bad terrain.

Spell Compendium just keeps adding to the fun. Amanuensis to copy documents fast. Stick as a quickie restraint (use it on enemy clothing or armor to stick them to the floor or wall or something). Launch item basically ensures a light-weight piece of paper lands at a distant spot, instantly, so you can hand off a message without even being physically next to the recipient, and no need for dead drops. Corrosive grasp can help destroy items you need to get rid of, or you can stick your finger in a lock and melt it. Dead end and remove scent for obvious reasons. I could go on, but that book is filled with neat tricks.

And all this is just the wizard/sorcerer side of things. Bards have their own list of ridiculous tricks, as do druids. Clerics not quite as much, but there's still some spells that can help out there.

[Fizban]

Rules Compendium draws from Complete Adventurer. I don't know anything about cryptography, but taking a week to make a code seems pretty ridiculous to me. Races of Destiny lets you make a code in a hour, with DC based on the complexity of the writing (because tradition), which is opposed by Decipher Script as a normal check. Of course this also means that as a standard check it only takes 1 minute to crack, unless they fail in which case they can never try again. A middle approach is probably best.

My personal favorite trick in terms of magical security is to abuse the fact that magic can apparently tell it's creator from the rest of the universe. Spells can tell who cast them, and magic items can be made to only work for one person. So you do a joint magic item creation and the item only functions for the people who created it, about as flawless as security can get. The item could be anything from a tiny trap that incinerates a document (or Bag of Holding) to a book that can only be written or read by it's owners.

As for Sending, I'm not aware of any spell that can divert or read it, which is about the only reason it's any good. At least until someone pulls out the False Sending spell and now you can't trust Sendings at all. Telepathy is normally pretty safe, until someone casts Telepathy Tap (from Book of Exalted Deeds oddly enough). For regular long distance communication I prefer Whispering Sand, which is only as secure as the location of your recipient, but also lets you converse normally for several minutes.

Mending and Make Whole are useful for repairing damage to hide breaking and entering and such. Depending on how liberally the DM chooses to read it, Make Whole might be able to restore a shredded document without actually reassembling the pieces, maybe even just Mending if you count wood pulp paper as wooden. There's also invisible and other alchemical inks in Tome and Blood (and I think a Forgotten Realms book, dunno which).

Speak with Animals is a 1st level spell: store your message in a particular animal or otherwise take advantage of a whole pool of entities that most people can't communicate with and don't count as a security risk. Continue through Speak with Plants and Stone Tell. Familiars can be useful, Speak with Master requires magic to crack, which can be difficult when there's a caster Detecting Magic present or you just weren't ready for it. Even a 1st level raven can talk, rather rare and unique enough as an identifier, and always knows it's master.

Lantern Archons can be obtained in a number of ways, have continuous Tongues, at-will Teleport Without Error (and can carry 2-7lbs with it), and even have a little Sense Motive. You can all a particular outsider if you know their name, give them a message and some payment, and let them deliver the message to someone else who knows their name(not of course, but anything to muddy the waters, grab a telepathic one if you want, and hey technically nothing says you have to say the name in order to call them either). You could use the Summoning Individual Creatures variant (DMG sidebar) where Summon Monster spells always call the exact same creature every time, thus being able to summon Bob the imp proves you are Dave, and Bob can be given information that Dave doesn't know (keeping it safe from Detect Thoughts until Bob is summoned).

The only thing more ridiculous than that which I can think of is using Commune. Gods can hear you when you speak their name, and some more around that, and I think also get prayers directly. So you ask your god if person X has prayed for ridiculous thing Y which they would never do, and get a yes/no. Actually doesn't even have to be that awkward: if you pray that a person hears X and that person Communes the same god about the question it ought to get through.

[lost_my_NHL]

Appreciate all the responses! In fact, I can use almost all of them! Jack's code, like a Paul Revere "One dancing light if by land, two if by sea" code works great for a case agent running other contacts in a local area and sending a limited set of signals. He could use that method to arrange a message spell for greater volumes of information.

Small messages could be sent across large areas when ciphered non-magically as a part of other text. For large volumes of information, a ciphered secret page could be added to otherwise banal information. Ciphers could be updated simultaneously across oceans with sending spells from home. Any sensitive correspondence will have a hidden arcane mark, itself perhaps covered in a magic aura.

If an individual agent with spellcasting ability fails autohypnosis and has to write a cipher down, they could add a sepia snake sigil to guard it. I imagine most spies would be NPC experts, and contacts further down the spy chain may only have a good cha score and a few ranks in bluff. They may fail autohypnosis regularly and not have access to spells. That makes the lackeys most vulnerable to PCs, with senior agents difficult to trap.

Finally if I deem sending somehow vulnerable to scrying magic, a greater sending makes sense at some point as a plot development. Fizban's less-straightforward methods may be evolutions of the spy war throughout the campaign, as one side allied with druids begins to speak with animals and stone speak (and maybe even tap the extraplanar methods mentioned).

I needed espionage in an adventure that didn't initially call for it because I wanted to involve some backstories and create conflict in an otherwise good-aligned world. Next thing I know, players are throwing disguise, bluff, and perception checks all over the place. One cast detect magic on a letter that should, if the threat of espionage is to be taken seriously, have some sort of magical warding. At least now I have some idea of the way the world works around the PCs. I'm the kind of DM that needs to invent and understand five times the detail that the characters end up interacting with.:smalltongue:

The irony is that a lot of the campaign is motivated by my love of Jack Aubrey in Patrick O'Brian novels, but I hadn't given it a Steven Maturin edge until now. If you've read the Master and Commander series, you know what I'm talking about... :smallbiggrin:

[Gildedragon]

Letters could also be patsies; and the message is to be given by a contingent secret page or magic mouth or sending that's kept in the wax seal or the paper (veiled by a magic aura)
The contingency is touching with X materials under starlight or the like

There's also inks that only appear under moon or starlight

[Zaq]

Regarding Sending being vulnerable to Scrying, I would say that if someone Scries on the caster of Sending while it is being cast (and it has a 10 minute casting time, so there's a window there, though the long casting time on Scrying does kind of turn that into an arms race), the one using Scrying could make a Spellcraft check to notice that the target is casting Sending.

The rules don't say if you have to actually speak the message that you're feeding into the Sending spell (Message, in contrast, specifies that you "whisper" the message), and I feel like Scrying on the target of Sending wouldn't reveal the message, so it's a GM call whether someone eavesdropping on the caster of Sending could determine the message being put into the Sending spell. (OotS depicts the caster of Sending as speaking the words, but that's likely just for ease of depiction rather than because of what the rules actually say.) Sending does have a verbal component, but that doesn't mean that the verbal component is necessarily the message. I might consider allowing a difficult Spellcraft check to allow the eavesdropper to figure out the message, but that would be a houserule, and I'm not saying it's automatically a good idea, since that might open up other abuses I haven't thought of yet.

Incidentally, for magical means of transmitting secret messages, the Wu Jen spell Secret Signs (Complete Arcane, pg. 121) is basically custom-made for that sort of thing, with the downside being that it only works over short distances (and the fact that it's only on a weird spell list). It's still neat for being an arcane spell with no components other than a focus, and you don't actually have to do anything with a focus (or with a material component, believe it or not) other than have it on your person (and in a component pouch is good enough).

[King of Nowhere]

The problem with magical encryption is that magic can always be counteracted by other magic. Sometimes, it's just safer to do things the old way. I would not use magic to encrypt messages, but rather math. If I were using magic, I'd rely on ways to telepatically commmunicate, like sending; but those are expensive, so they can't be used too widely.

I had houseruled a minor magic item in the form of two small bells such that when one is ringed, the other rings as well, with a radius of a few tens of kilometers. They should not be too expensive to make, and they can be used to communicate at a distance with the morse code. such a message would also be difficult to intercept.

[MilleniaAntares]

I believe the 3.5 Eberron books also had stuff on espionage, but I cannot recall anything specific.

Though, there may have been a decoder ring?

[SwordChucks]

Building off of Jack_Smith's idea, you could pass out new code keys using sales flyers. That way everyone in the city would have the key but think nothing of it. If an agent lost thier key they could get one out of the trash or off the street.

[Chronikoce]

Building off of Jack_Smith's idea, you could pass out new code keys using sales flyers. That way everyone in the city would have the key but think nothing of it. If an agent lost thier key they could get one out of the trash or off the street.

But then you would need some sort of key or agreed way of decoding the flyers and if that ever fell into the wrong hands then your coded messages would be spread across the city.

[SwordChucks]

But then you would need some sort of key or agreed way of decoding the flyers and if that ever fell into the wrong hands then your coded messages would be spread across the city.

I was thinking along the lines of a DM that wants the players to eventually figure out the code. Then when the PC realize that the flyers that have been flooding their mail are actually necessary to figuring out the connection between different assassination targets, they'll realize it wasn't just a running joke and that you're actually kinda awesome.

[King of Nowhere]

I was thinking along the lines of a DM that wants the players to eventually figure out the code. Then when the PC realize that the flyers that have been flooding their mail are actually necessary to figuring out the connection between different assassination targets, they'll realize it wasn't just a running joke and that you're actually kinda awesome.

Very difficult to pull out as a DM. You normally do not describe stuff like advertising, so if you do, the players will get suspicious. unless you are one of those DM that can describe everything with detail, in which case your group is lucky. But most people can't get creative enough. The only realistic way to pull it out, as you said, would be to mask it as a running gag.

[mabriss lethe]

I'm also reminded of something I pulled in game a few years ago. The officers of the enemy army had a corp of Binder communications specialists. Someone would set up battle maps in agreed upon locations. Every com officer would bind Malphas and send a bird to their location. The summoned birds (all crows) would then update the map with troop movements and developing circumstances, moving figures on the map or playing a sort of bingo- like game where units relayed requests, messages and orders up and down the chain by placing tokens marked with unique designations on a board inscribed with various phrases. There would also be at least one dove present. That one was controlled by an aide to one of the generals and was the channel by which changes in orders could be communicated.

The downside was that everyone reporting to a given location had to be within a few hours flight from the "map room" but that could be overcome by creating an information pyramid to handle larger areas.

Anyway.... Using Malphas' birds to relay real-time information from a remote location would also be a viable tactic for espionage.