HomeOperations LogIntelAssetsInventoryForumsCalendarFeedback

Game Aids


Codes and Ciphers
  - One Time Pad
NATO Alphabet

One-Time Pad

   (There are several variations of the One-Time Pad cipher, but this simple version is from “Spycraft: the Secret History of the CIA’s Spytechs, from Communism to Al-Qaeda” by Robert Wallace and H. Keith Melton.)

   This variant of the One-Time Pad utilizes randomly-generated numbers to construct a key, which is then used to decipher a matched encoded message. This cipher uses only numerals 0 – 9 arranged into sets of 5 digits for both keys and messages:

Message OTP Key
26126 70689 84730 51167 17915 10171 75670 61658

   The message cipher is placed over the One-Time Pad Key, and the OTP is “subtracted” from the message cipher using non-carrying math to achieve the solution. The resulting difference is grouped into two-digit numbers that are then converted into letters. A-Z are numbered 01 to 26 (A=01, B=02, C=03, etc.)

Alphabet-Numeric Conversion Table

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26
63 70 23 79 23 17 86 65 24 39 Message Cipher
62 78 20 75 28 11 89 67 25 29 OTP Key
01 02 03 04 05 06 07 08 09 10 Grouped Difference
 A  B  C  D  E  F  G  H  I  J Solution or “Clear Text”

   If the message cipher’s number is lower than the OTP Key’s number, then it is assumed a virtual “carrying 1” exists before the cipher number. This virtual “carrying 1” never appears in the non-carrying mathematical code.

   The strength of its code lies in the fact that a message can only be correctly decoded with its unique and randomly-generated key that cannot be re-used without reducing its security below 100%:

26126 70689 84730 51167 Message Cipher
17915 10171 75670 61658 OTP Key
19211 60518 19160 90519 Difference



   The greatest strength of this style of cipher is that it will always resist any cryptographer’s brute-force tactics for “guessing”. Without the exactly-matching key, the message is useless. For example, let’s assume the cryptographer has the message cipher, but doesn’t have the OTP key:

26126 70689 84730 51167 Message Cipher
23115 51464 82721 30958 “Brute-Forcing”
23011 21225 02011 21219 Difference


Incorrect Solution

   Anyone who attempts to use “brute-force” attacks against an enciphered OTP message without its corresponding key can fit any message into the cipher’s length. The ten letter-long solution, “SUPERSPIES”, can be assumed to be “WALLYBALLS”, “BAMBOOZLED”, “NARCOLEPSY”, etc., without the key. A loyal minion may send the message, “THE SUPERSPIES ARE ATTACKING” to the mastermind; but if the mastermind lacks the key, the message could be any of these variations: “THE WALLYBALLS ARE ATTACKING”, “THE VEGETABLES ARE ATTACKING”, “THE SCHNOZZLES ARE ATTACKING”, “THE CHIHUAHUAS ARE ATTACKING”, or any amusing variation thereof. Also, that minion is probably going to be executed, or worse: fired.

   The One-Time Pad ciphers face a few weaknesses.
  -If the key to an urgent message is lost, then the message will never be decoded without the cipher-creating agent.
  -In order for the OTP to be effective, the agent and his or her intended recipient must possess a unique OTP Key. Agency cannot decipher truly random OTP cipher without the corresponding key. This also means the keys must be exchanged between Agency and the agent in advance in order to be truly effective.
  -If One-Time Pads are ever re-used, then computers may be used to immediately find “hits” among repeating patterns, instantly breaking the security on an agent’s communication.
  -In order for a OTP key to be effective, its numeral-generation must be totally random and unpredictable. The prudent spy would never use common PC programs to generate random numbers for a key, as such programs use common seeds (based on time, process IDs, etc.) that will leave an identifiable pattern in the ciphers. Even basic cryptography programs will identify the use of common seeds in the pattern of random numbers, thus compromising security instantly.

   Additional Rules
  1) An “X” may be used to separate sentences. " O N E X T W O X" translates to: “ONE. TWO.” The cryptographer’s judgement is used to determine if “X” is the end of a sentence or a part of a word.
  2) The message cipher must always be grouped into 5 digits, except for the end. If a message’s length does not fully extend to 5 digits at the end, then the message is simply shortened. Example: “COVERT” enciphered using the OTP would look like: “65747 69684 94”.



(As seen in the core rulebook)

Abort: to terminate a mission before it is completed, usually abruptly
Access: an agent’s ability to obtain sensitive information through government channels
Agency: slang for the CIA; also the term used to describe the organization most agents work for in Spycraft (which may or may not be the CIA, per the GC’s discretion)
Agent: an operative; a spy
Agent of influence: an agent with political power in a nation of interest to his agency
Agent provocateur: a spy who generates social and political turmoil
Alimony: compensation paid to a long-term undercoveragent when his assignment is complete
Angel: slang for a spy of an opposing agency
Apparatus: a spy ring; also called a “cell”
Asset: any resource — human, information, technical, etc .— that an intelligence organ can use to its benefit
Attaché: a military officer assigned to a foreign capital as a liaison and to gather data
Babysitter: spy slang for a bodyguard
Bag job: breaking and entering to steal or photograph intelligence material
Bigot list: the names of people who know of a certain clandestine activity, and who must therefore be safeguarded, or prevented from speaking about the projects to outsiders
Bird watcher: British slang for a spy
Black: term used in specific phrases to signify something is covert or illegal in nature
Blind Date: meeting someone at their choice of place and time, with all the associate risks
Blowback: false rumors spread in enemy territory that are reported by their news agencies as the truth
Bodywash: a mundane explanation for an agent’s death, to prevent outside suspicion
Bogie: an unidentified agent or organization
Broken: a term applied to an agent who has become a liability; also known as “going bad”
Burn: to publically uncover an agent’s true identity; also used by agencies, meaning to cut off from Control an agent who has become a liability
Clandestine: unseen and unheard
Classified: sensitive material shown only on a need-to-know basis. Classifications include confidential, secret, and top secret, in ascending order of security
Clearance: approval to read or handle classified material
Clean: to make secure; also known as “pacify”
Clear (or plain) text: a decoded message
Cobbler: Russian slang for a forger; also called a “shoe-maker”; Russians call fake passports “shoes”
Cold: the mental state of a spy working in hostile territory, often for months or years at a time; to get out is called “coming in from the cold”
Consumer: the final user of intelligence data
Control: the person in charge of an agent, operation, or organization; also known as a “case officer” or “handler”
Cooking the books: slang for skewing intelligence to support political aims
Counterespionage: the protection of domestic or allied personnel, installations, and intelligence from hostile foreign agencies
Cousins: British spy slang for the CIA
Cover: a false ID; also called a “cryptonym”
Covert: seen but not noticed
Cryptanalysis: the study of ciphers and codes with the intent of decoding them without the original keys
Cryptography: the use of codes and ciphers to render intelligence secure
Customer: an agency receiving intelligence
Cutout: middleman between agent and agency
Dead drop: a location where an agent can safely leave intelligence data or reserves; also known as a “dead letter box”
Decode: interpreting a coded message into comprehensible form
Deep cover: long-term insertion into hostile territory under an assumed identity
Defector: someone who voluntarily shifts his allegiance from one nation or organization to another; defectors are said to have “turned”
Dirty: treacherous
Disposable: a term applied to anything that can be sacrificed to ensure a mission’s success
Doctor: Russian term for police; agents arrested are said to have an “illness”; agents in jail are said to be at the “hospital”
Double agent: someone openly working for one intelligence agency and secretly working for another; also called a “double”
Ears only: data that is too sensitive to be committed to paper
ECM: electronic countermeasures; the use of electronic devices to secure information
Encode: the process of coding a message
Eyes only: data that should not be discussed without explicit permission
False drop: a place where an agent pretends to leave messages, or where messages are left in spoof code
Fence: Russian slang for a national border
Firm, The: British spy slang for MI6
Flaps and Seals: spy term for mail tampering
Floater: someone used for a one-time or occasional operation, often unwittingly
Fumigate: to sweep for bugs
The (Great) Game: the intelligence and counterintelligence profession
Go over: to shift loyalty between agencies
Go private: to retire from the Game
Go to ground: to hide; to run
Handler: a spy who trains and directs other spies
Headquarters: the place where an agent, agent team, or spy cell operates from; usually also where Control is located. Also known as “the home office”
Home office: see headquarters
HUMINT: human intelligence; data gathered by agents, rather than satellites or computers
Illegal: a spy working in enemy territory with no diplomatic protection, usually with a legend
IMINT: imagery intelligence; data gathered by aerial and satellite photography
Institute: Israeli slang for the Mossad
Key: the means to decipher a coded message
Lamplighters: British support operatives
Legal: an agent protected by diplomatic immunity
Legend: an artificial identity and history, usually employed by deep cover operatives
Letter box: a cutout serving in the same capacity as a dead drop (a third party who passes innocuous-looking messages between spies).
Liquidate: used by agencies, meaning to eliminate wayward agents in their employ
Load: to leave something at a dead drop
Make: to recognize someone
MICE (Money, Ideology, Compromise, and Ego): the four most common motivations exploited by agent recruiters
Mischief, Incorporated: derogatory slang for the British spy agencies (MI5 and MI6)
Mobile agent: a spy not restricted to a single zone of operation
Mole: an agent working in another country’s intelligence agency; also known as a “plant”
Mule: a covert courier
Noise: slang for collateral attention agents draw to themselves or their mission while in the field. Noise is nearly always discouraged
Operational climate: a description of a locale and the chance of a mission succeeding there
Overt: both seen and heard
Padding: extra characters added to the beginning and end of encrypted data to help prevent it from being deciphered
Peeps: photographs used for blackmail
Plausible deniability: the valuable ability to effectively refute involvement with an operation
Plumbing: plugging leaks within an agency
Poacher: British slang for a spy in the field
Proprietary company: a business owned by an intelligence agency to assist its operations
Puzzle palace: slang for the NSA
Safe house: location that involves low risk of discovery; also a well-known contact point in Milwaukee, Wisconsin
Salesman: slang term for an agent
Sanitize: to eliminate all evidence of an agency’s involvement
Scalp hunter: British slang for agent specializing in recruiting defectors and doubles
Shopped: British slang for someone who has been assassinated
SIGINT: signals intelligence; data gathered through eavesdropping on electronic signals
Sleeper: an agent established in a target area who does nothing beyond his cover until activated
Smudger: spy slang for a photographer
Sponsor: slang for an agency that finances, controls, or carries out an operation
Spoof code: letters jumbled up to look like a real code to fool enemy spies
Spook: slang for an intelligence operative, with both positive and negative connotations
Stringer: a freelance agent
Target: the purpose of a mission
Task: to give an order (i.e. “to task with”)
Tradecraft: the tools and practices of spies
Walk-in: someone who approaches an intelligence agency without being prompted
Wetwork: assassination (also known as “closing a contract,” “neutralizing,” “sanctioning,” “terminating with extreme prejudice,” or “demoting maximally”)
White: slang for a known covert operation


NATO Phonetic Alphabet




Classic Spycraft Downloads
Lots of downloadable freebies, including missions, aides, etc.

Army Field Manuals
100% free collection of expired field manuals ready to read or download, and they include a wide variety of topics ranging from quartermaster operation to intelligence to counterinsurgency and MUCH MUCH more. An excellent resource for any player!

InfoSec Island
An information security community online with various tools and very interesting blog posts in regards to hackers, cyber security, criminal / terrorist events, etc.

Jester’s Court
th3j35t3r is a white-hat hacktivist who works against terrorists, criminals, etc. The site is safe to browse. Even if your character is not a snoop, this will provide you a rather interesting read, and hopefully lend some insight into the world of cyberterrorism, cyberwarfare, and the people who try to crush it digital misdeeds.

PandaLabs Blog
PandaLabs is one of the blogs run by Panda Security, a global anti-virus corporation. PandaLabs specifically discusses issues in regards to cyberterrorism and the like.


No Tomorrow MedullaOblongata