It is well known that during the WW2 America employed native American, namely Navajo people, to "encrypt" their radio communications. I read some time ago (I don't remember where) that their language was super effective and was considered very secure at the time of its deployment. And indeed it was, given that the Japanese never cracked it.

On the other hand I was reading this page on wikipedia that states

In addition many more Navajo served as code talkers for the military in the Pacific. The code they made, although cryptologically very simple, was never cracked by the Japanese.

Which got me wondering: Is it true that their code was "cryptologically" very simple? And if so, why didn't the Japanese crack it?

I mean I guess that there must be some weakness to this approach to cryptography, otherwise we would just invent a new language (which is fairly easy, albeit a little complex) instead of bothering with RSA, AES and whatnot.

Can you shed some light on this?

  • It may be of interest to note in this context that Nigeria has 527 languages, see ethnologue.com/country/NG. Further, in classical crypto there were (artificially constructed) codebooks, giving mapping of codes to words or phrases or sentences. Jan 28, 2016 at 15:32

2 Answers 2


Good question.

I'm a Native American, and this is pretty well-known to us. I also have experience with Chinese language and dialects. I'll explain why I'm mentioning the Chinese part later.

This is a very good example of security through obscurity. It works until it's figured out. However, there are so few Navajo speakers compared to English speakers, that it would've been incredibly difficult to find native speakers to learn from at the time. How would they know it's the Navajo language to begin with? It sounded alien to them.

While the code may have been simple, it's hard to find people to teach you that code. During WW2, Japanese in America were rounded up and placed in internment camps. Anyone caught sympathizing with them may have been likewise punished. The chances of finding a Navajo turncoat were extremely low.

Why is Encryption stronger than Languages and Dialects?

Regarding encryption, other people such as Thomas Pornin can explain this better than me, but I'll try to show you similarities:

  1. Encryption is like a language. It's sort of like a conversion of one word (or character) to another set of highly different characters. With proper encryption, you can't convert A -> Z then Z -> A unless you have the key. With languages, you can compare words with similar meanings in other languages, and translate accordingly. With languages, your key is knowing the languages.

    With proper encryption, you cannot do this. You cannot put properly-encrypted text into a decryption routine and get the results back. Not without the key. You need the key to decrypt it. With a hash, you can never get the message back, only verify whether or not it's genuine, but those can be vulnerable to collision attacks.

    Here are some examples:

    Pretend this is Encryption. The "key" to decrypting the 
    hidden message is to understand both languages. There is
    a second hidden message which requires deeper understanding.  
    [English]        [Chinese]
    Hello       ->   你好
    Alpaca      ->   草泥马

    In the case of a hash (one-way), it could act like this:

    Bring potter to Naria. The Death Star is ready for our war against the Time Lords.

    With a hash, you would have to verify the contents against the message to see if they match. This is not really a method of encryption because you can't return the original message. You may eventually cause collisions as well.

    In the case of AES 256 bit (two-way):

    [English with key]
    Find Potter and bring him to Narnia. The Death Star is ready for our war against the Time Lords.
    [AES 256 encryption result]

    How are you going to crack these? The same way as languages, actually. The difference is it's much, much harder to crack real encryption. Firstly, mapping a language and creating a translator is much, much easier than mapping an encryption database.

    • With one-way hashing, you would have to match every single combination of letters for every single encrypted character, to "crack" it, but that isn't going to return the message to you: it's only going to verify that the hash matches the message. With many hashing algorithms, collisions become a problem after a while.

    • With two-way encryption, you can get the original message back provided you have the key. Kind of like languages. Larger keys will very likely prevent brute force attacks, as with current technology, it would take longer than the estimated life of the universe to crack them. With languages, the "key" is understanding both languages.

    This is why the Navajo "code" was cryptographically, "very simple" in comparison. The security through obscurity of the times made it very difficult to crack, but it would be easily very crackable today with current machines.

  2. Having obscure dialects or languages can add an additional layer of "encryption," (note that the quotes indicate it's not really encryption) but, again, this is security through obscurity, and shouldn't be relied on by itself. In the case of encryption, these algorithms have been tested to be secure by well-educated researchers for a long time. Languages on the other hand, are much easier to learn.

    Almost any idiot can learn a language. I'm living proof. Well-educated cryptographers and mathematicians can't crack many strong forms of encryption. What hope does the average layperson have?

Language and Dialect Usefulness

Regarding obscure dialects mentioned in #2, you can still see such things today. In fact, this isn't the only example of the Japanese getting owned by security through obscurity.

For example, the Chinese military relies on another layer of "encryption" (mind the quotes) -- which is really just security through obscurity -- with their dialects. During the last war with China, Japan wasn't able to "crack" the Wenzhou dialect because they didn't understand the implementation, and it was used against them.

Side note: considerable effort has been made by organizations such as Phonemica to demask obscure Chinese dialects.

Part of the problem with relying on dialects and languages today is that hacks are everywhere, so chances are high that someone will find your teaching manuals. Computers are at a good point where demasking a language or dialect could be automated in a very short time. On the other hand, real encryption is nigh unbreakable.

Once someone quickly learns your language or dialect, your security through obscurity would disappear very rapidly. This was used for thousands of years, but in modern times, it's not going to be that effective.

Is Security Through Obscurity Completely Invalid?

Despite what I've said, this does add another layer of obfuscation that is technically difficult to break. Even if your encrypted messages are broken, your attacker would still have to spend considerable time mapping it out. While it's child's played compared to proper encryption, security through obscurity does have it's uses, but you shouldn't rely on it entirely anymore.

  • 2
    @NeilSmithline You're missing the point. What the Chinese military did with their dialect was a form of encryption to them. What the USA did with the Navajo code talkers was a form of encryption as well. These were very powerful at the time, but aren't anymore. However, as I've stated numerous times, it's security through obscurity. Jan 16, 2016 at 0:25
  • 1
    @NeilSmithline I believe I've fixed the issues (sorry, was not able to edit my mistakes for a long time), but I still view encryption to be similar to a language. I'm merely trying to point out the similarities. Jan 16, 2016 at 0:57
  • 1
    Changing Encryption is a language to Encryption is _like_ a language was a huge improvement. Jan 16, 2016 at 1:32
  • 1
    I've also been looking up encryption definitions. Perhaps I was being a bit overly-technical on the definition. Jan 16, 2016 at 1:34
  • 5
    Is Security Through Obscurity Completely Invalid? - no, it's great! Like winning the lottery is great. It helps you when you have it, it helps you when you gain it on an existing plan. The only bad bit is that it's unwise to plan on winning the lottery for a retirement fund. Diversify your security investments to more reliable, less fragile funds. If you also get security through obscurity as well - bonus. Jan 16, 2016 at 1:49

In addition to @Mark Buffalo's excellent response, there's another aspect -

For some communications it is sufficient to delay the adversary's access to the data, rather than to deny it. The 'Security through Obscurity' nature of Code Talking is sufficient to this limited goal.

Code Talkers, like the Navajo in the Pacific Theater, and more recently the Welch Fusiliers in Bosnia, have been used in tactical roles where the information being transmitted is only valuable for a narrow window of time. To quote (the fiction book) Cryptonomicon, where Daniel Waterhouse and Rod cCmndhd are talking about the use of Qwghlmians as Code Talkers:

"No, you confused the mid-glottal with the frontal glottal," Rod says.

"Honestly," Waterhouse says, "can you tell them apart over a noisy radio?"

"No," Rod says. "On the radio, we stick to the basics: 'Get in there and take out that pillbox or I'll kill you.' And that sort of thing."

The successes breaking cryptography in World War II involved months or weeks of work near the beginning of the war. Even by the end of the war, cracking the keys for a day's codes might not happen until hours or days had passed. When you're predicting something like the attack on Midway, which took months to plan and coordinate among large numbers of participants, that's fine (actually, at the time, it was still an astounding feat). But even if the equivalent techniques had been brought to bear on Code Talkers, the information transmitted would have been useless by the time it was 'decrypted' - the unit being told to move to Hill XYZ would have arrived and announced themselves long before the intercept was translated.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .