From Analog Scramblers to Digital Encryption

▶ Watch (3:12)

The A-3 scrambler used frequency inversion, not encryption. Bell Labs said any high school boy could unscramble it. Churchill and FDR used it anyway. The Green Hornet (SIGSALY) was built with Alan Turing’s help. It used a vocoder to digitize voice, then encrypted with one-time vinyl records. The system weighed over 50 tons. Only 12 units existed. It was used to discuss the bombing of Hiroshima and was never cracked.

The Vietnam War Forces a New Architecture

▶ Watch (8:39)

The AUTOSEVOCOM network required every phone to store keys for every other phone, which scaled poorly. The NSA’s Operation Purple Dragon found the Vietnamese were listening to unencrypted radio communications. Bell Field introduced a central server holding all device keys. When a call started, the server authenticated the device by decrypting its key, generated a one-time session key, and distributed it to both phones. This was the first single sign-on system: authenticate once at the central server, then call any device.

Kerberos and the Birth of Network SSO

SSO

▶ Watch (12:23)

Jerome Saltzer saw Bell Field while consulting for the NSA but could not disclose it. After an NSA member gave a vague talk, Saltzer directed Needham and Schroeder to research it. They created the Needham-Schroeder protocol. Kerberos implemented that protocol as a direct clone of Bell Field. Project Athena at MIT used Kerberos to let students authenticate once and access any campus computer, remote file storage, and early internet services like Zephyr messaging and DNS.

From SAML to OIDC: The Internet Standardizes SSO

▶ Watch (15:29)

SAML was the first SSO protocol designed for the internet. It relied on XML and pre-configured trust between identity providers and service providers. The browser wars pushed Microsoft to create XMLHttpRequest, which enabled dynamic web apps. Developers abandoned XML for JSON. OpenID started as a blog verification system. It evolved into OAuth and OpenID Connect, which use JSON Web Tokens and are now the dominant SSO standard.

Q&A

How did users authenticate with Bellfield? Authentication was based on the device key being recognized by the central server. ▶ Watch (25:31)

What will replace OIDC? We need to see a problem that OIDC does not solve well enough first. ▶ Watch (26:03)

Have you reviewed weaknesses in these systems? Not deeply, but many IDPs neglect SAML spec, causing bugs and insecure implementations. ▶ Watch (26:52)

Notable Quotes

the US cannot figure out why it keeps losing battles at the rate it is Connor Peshek · ▶ Watch (7:22)

we have a central location on the network that has every key of every device Connor Peshek · ▶ Watch (8:44)

Kerberos is the first implementation of that protocol, and it is a clone of the Bell Field system from the Vietnam war phone systems. Connor Peshek · ▶ Watch (12:28)

there’s no known record of the there’s no known record of it ever being cracked. Connor Peshek · ▶ Watch (5:11)

ended up birthing modern web apps Connor Peshek · ▶ Watch (18:26)

Key Takeaways

  • Bell Field, a Vietnam War phone encryption system, was the first single sign-on architecture.
  • Kerberos directly cloned Bell Field, enabling campus-wide SSO at MIT Project Athena.
  • OIDC replaced SAML’s XML with JSON, becoming the dominant internet SSO protocol.