29 futhorc runes → Latin letters → the first 29 primes. Write English in runes; sum the primes for a checksum. Digraphs (TH, EO, NG, OE, AE, IA, EA) are single runes. C/K and S/Z share a rune. No Q or V — spell around them.
Keys are derived, never sent (keyschedule.mjs — master + clock → HKDF). Log the day-sign + prime-sum; two ends compare them out loud to confirm the same key (authentication, legal even on HF). Match the KCV before you trust traffic.
| Date / period (UTC) | KCV (hex) | Day-sign (runes) | Prime-sum | Init. |
|---|---|---|---|---|
Sign / countersign: challenge with the day-sign word, answer with the prime-sum (or a pre-agreed duress number that silently signals coercion). Never speak the PSK or KCV in full over an open channel — only confirm they match.
Copy pad groups from comms-harden.sh output into the KEY row. Convert letters to numbers with the prime index above or A=0…Z=25; add mod 26 (or XOR the bytes) to get CIPHER; subtract to decrypt. Cross out each group as it's used.
| PLAIN | ||||||||
|---|---|---|---|---|---|---|---|---|
| KEY | ||||||||
| CIPHER | ||||||||
| PLAIN | ||||||||
| KEY | ||||||||
| CIPHER | ||||||||
Rules that keep it unbreakable: key truly random, key ≥ message, used exactly once, destroyed after use. Reuse a pad even once and it collapses (the mistake that gave up VENONA). Pads are distributed in person — never transmitted.
Short agreed words (write the rune-word) → meaning. Compresses traffic and speeds voice; on HF it is brevity, not encryption. This sheet is a capture liability — account for it.
| Rune-word | Means |
|---|---|
| Rune-word | Means |
|---|---|
Challenge with the day's rune-word; the valid answer is its prime-sum. A duress answer is a pre-agreed different number that reads as correct to a captor but silently means "I am compromised — comply outwardly, trust nothing I send." Authentication, not encryption — legal on any band.
| Fixed setup | Value (fill in, memorise, then cut off) |
|---|---|
| Duress number | |
| Running password advance one each contact | |
| No-duress "all clear" |
Rules: the duress number is fixed and never written near the log. If either side answers with it — or fails the running password — treat the link as compromised. Never acknowledge duress on the air.
| Date/period | Challenge (rune-word) | Valid | OK? |
|---|---|---|---|
Civilian, observation-only. Encryption on ISM (915 MHz) only — never amateur bands. Cap TX power to the NZ GURL limit. This sheet holds secrets: store and destroy it like key material.