User Manual
Hybrid encryption from rotor logic and AES‑256
RotorCrypt X · Step-by-Step Guide

## 00Change Language

RotorCrypt X supports 10 languages, reaching approximately 36 % of the world's population in their native language – around 2.9 billion people.

🇩🇪🇬🇧🇫🇷🇪🇸🇹🇷🇯🇵🇨🇳🇸🇦🇷🇺🇵🇹

Flag | Language | Native Speakers | Code
--- | --- | --- | ---
🇨🇳 | Chinese | ~ 940 M | ZH
🇪🇸 | Spanish | ~ 485 M | ES
🇬🇧 | English | ~ 380 M | EN
🇸🇦 | Arabic | ~ 360 M | AR
🇵🇹 | Portuguese | ~ 240 M | PT
🇷🇺 | Russian | ~ 150 M | RU
🇫🇷 | French | ~ 80 M | FR
🇹🇷 | Turkish | ~ 80 M | TR
🇩🇪 | German | ~ 75 M | DE
🇯🇵 | Japanese | ~ 125 M | JA

Total: ~ 2,915 million native speakers ≈ 36 % of world population (8.1 billion).

### How to change the language

Click the flag of your current language in the top-right of the program window.
A menu opens showing all 10 available languages, each with its flag.
Select the desired language – the interface switches immediately, no restart needed.
The manual will automatically open in the new language next time.
Note: The language setting is saved locally and persists after restart.

## 01Create a Contact

Before you can send an encrypted message, a contact must be created. The program stores no plain names – the contact's identity is stored internally in encrypted form. No one who opens the files on your hard drive can draw any conclusions about your contacts.

Click the contact button at the top of the program window.
Select "New Contact" and enter a name (max. 25 characters). This name is only a local identifier – only you see it on your device.
The program automatically creates an encrypted `*.key` file and an entry in `contact.json`. No readable name is stored in these files.
Select the newly created contact from the dropdown menu.
Note: If the same contact name is entered again, the program detects the conflict and reports it. Each contact name may only be used once.

## 02Red Banner & Handshake Requirement

⛔ NO HANDSHAKE WITH THIS CONTACT ⛔ Do not send sensitive information!

When the banner is red, no handshake has yet been performed with this contact. The highest security level is only active after the handshake.

Warning: Do not send confidential information while the banner is red. Only after a successful mutual handshake is the communication fully secured.

How to start the handshake:

Write any first message in the input field – e.g. simply "Hello".
Click "Encrypt".
Copy the encryption block from the output field and send it to your contact – by email, messenger, or any other means.

After sending, the banner changes to blue:

📤 HANDSHAKE SENT 📤 Please wait for a reply.

## 03Encrypt a Message

Select the desired contact from the dropdown.
Select the rotor count. Shareware version: max. 3 rotors; full version: significantly more – the more rotors, the more secure.
Enter your text in the input field. Directly above the field, top right, a character counter shows remaining characters – maximum 5,951 characters per message.
Click "Encrypt". After a short animation, the encryption block appears in the output field.
Note on processing time: Depends on rotor count, text length, and computer speed. Many rotors with a long text on an older machine may take a few seconds – this is normal.
Warning: If an encryption block is already in the input field, use the "Decrypt" button instead.

## 04Copy & Send Output

You can transmit the encryption block from the output field in two ways:

Method | Steps
--- | ---
Copy manually | Click "Copy Output". Paste it into any app – messenger, email, text file, or anywhere else.
Direct email | Click "Send Email". Your default email client opens with the block already in the message body.

Tip: The block consists only of standard text characters and can be pasted in any text field without problems.

## 05Decrypt a Message (Recipient)

Receive the encryption block from your contact.
Copy the complete block – from the first to the last character, without any extra spaces or line breaks at the beginning or end.
Even a single missing or extra character makes decryption impossible. The most common error is incomplete copying.
Paste the block into the input field of the program.
Select the correct contact from the dropdown – the one you received the message from.
Click "Decrypt". The plain text appears in the output field.
Authentication error? Either the wrong contact was selected, or the message was altered in transit. Check the contact selection and ask the sender to resend.

## 06Send a Reply & Complete the Handshake

After decrypting the first message, the banner changes to yellow:

⏳ HANDSHAKE RECEIVED FROM CONTACT ⏳ Please send a reply.

The handshake is not yet complete! Your contact is waiting for your reply to confirm the shared key on both sides.

Enter any reply in the input field.
Click "Encrypt".
Send the encryption block back to your contact.

Once the original sender decrypts your reply, the banner on both devices changes to green – the handshake is mutually complete.

## 07Green Banner – Secure Communication

✔ HANDSHAKE COMPLETE ✔ Communication is securely encrypted.

When the banner is permanently green, both parties are successfully authenticated. Every message is now protected by a unique session key that is automatically renewed after each exchange.

Even if an attacker could crack one message, it gives them no access to earlier or later messages. This principle is called Forward Secrecy.

From now on: All messages in both directions are fully secured. The green banner remains as long as the keyfile is unchanged and accessible.

## 08Damaged Files – What to Do?

The program works with two file types in the `Key/` subfolder:

File | Content
--- | ---
`*.key` | Encrypted session key – one file per contact
`contact.json` | Encrypted contact list – contains no readable names

If one of these files is damaged, deleted, or accidentally overwritten:

Delete the affected `*.key` file and / or `contact.json`.
The program automatically detects at next startup that no file is present and creates new empty files.
Important: Notify your contact that a completely new handshake is necessary.
Warning: After deletion, all previous messages to this contact can no longer be decrypted. Back up important `*.key` files on a USB stick – never in the cloud (see Terms of Use).

## 09Rotor Count & Tips for More Security

The number of rotors directly affects how many encryption layers the Enigma layer creates:

Version | Rotors | Use
--- | --- | ---
Shareware | Max. 3 | Good for initial tests and the handshake process
Full version | Significantly more | Recommended for all sensitive content – more rotors means a larger key space

Recommendation – vary the rotor count: Do not use the same count for every message. By changing it each time (e.g. 3, then 7, then 12 rotors), there will be no recognisable pattern in the sent blocks. This makes statistical analysis by third parties significantly harder.
On processing time: On a modern PC this is barely noticeable. On older hardware it may take a few seconds with many rotors and long texts – simply wait for the status indicator to disappear.

## 10Mobile Use – The Program on a USB Stick

RotorCrypt X is 100% portable. You can save the program with all key files on a USB stick and run it on any computer – without installation, without administrator rights, without leaving any traces on the foreign system.

How it works: Copy the complete program folder (program file + `Key/` folder) to your USB stick. On any Windows PC: plug in the stick, start the program directly from the stick. All key files remain on the stick – nothing is saved on the foreign computer.
Limitation: This only works as long as the USB port has not been blocked by the system administrator. In some corporate networks or government computers, USB ports are disabled for security reasons.
Important – protect your USB stick: Anyone who takes possession of the stick has access to your key files. Treat it as carefully as a house key – never leave it unattended.

## 11Technical Security – Why It Is So Secure

This section explains in plain language what lies behind the encryption – no prior knowledge required.

### The Encryption Has Multiple Independent Layers

The Enigma rotors are only one of several layers. A message passes through four mutually independent stages. Each stage alone already provides significant protection – together they are practically unbreakable:

① Enigma Rotor Layer (dynamic permutation through multiple rotors)
▼
② AES-256-GCM Encryption (worldwide military and government standard)
▼
③ HMAC Signature (cryptographic tamper protection)
▼
④ HKDF Key Derivation + automatic key rotation after every message

Even if an attacker attacked layer ② with the fastest computer in the world, they would still have to overcome the Enigma rotor layer. The combination multiplies security rather than merely adding it.

### What Each Component Does

Component | What it does | Why it matters
--- | --- | ---
RotorCrypt X | Every character passes through multiple rotating permutation stages. The wiring is dynamic – no fixed alphabet. | The most famous weakness of the historical Enigma (a letter could never encrypt to itself) is completely eliminated here.
Plugboard (65,530 positions) | All 65,530 positions are connected in pairs – like the historical Enigma, but with an astronomically larger key space. | The plugboard alone generates more possible configurations than atoms in the visible universe.
AES-256-GCM | Modern block cipher used worldwide by military and intelligence agencies. Each message receives a unique random value (nonce). | Even identical messages produce a completely different block every time – no statistical analysis possible.
HKDF (SHA-3-256) | From one master key, separate keys for content and authentication are derived. | Prevents a compromised partial key from endangering other areas.
HMAC Signature | Every message is cryptographically signed. | Any tampering – including changing a single character – is detected. Decryption is refused and the recipient is warned.
Key Rotation | After every message the key is automatically renewed. | A compromised key gives no access to past or future messages (Forward Secrecy).

### How Large Is the Key Space? – The Number That Explains Everything

The key space is the number of all possible key combinations. The larger this number, the longer an attacker would need to try all possibilities.

For context: The visible universe contains an estimated 1080 atoms. That sounds unimaginably large – but it is tiny compared to what RotorCrypt X generates.

The key space K results from the combination of rotors (50 rotors as example for the full version) and the plugboard:

// Plugboard: number of all possible pairings of 65,530 positions Plugboard combinations = 65,530! / (2^32,765 × 32,765!) // Total key space K with 50 rotors K = 50! × 65,530^50 × Plugboard combinations // Base-10 logarithm (= how many digits does the number have?) log₁₀(plugboard) ≈ 143,581 log₁₀(50! × 65,530^50) ≈ 305 ───────────────────────────── log₁₀(K) ≈ 143,886 // The number in short form: K ≈ 4 × 10^143,886 // That is a number with over 143,000 zeros after it. // Atoms in the universe: 10^80 → The key space is 10^143,806 times larger.
In plain words: Imagine searching for a specific needle. Only the haystack is not the Earth, not the galaxy, not the universe – but 10143,806 universes stacked on top of each other. That is the key space of RotorCrypt X.

### How Long Would an Attack Take?

Let us assume completely unrealistic computing power – far beyond what is possible today:

// Assumed speed: 10^18 key tests per second // (millions of times faster than all supercomputers in the world combined) Required time = K ÷ 10^18 ≈ 4 × 10^143,868 seconds // 1 year ≈ 3.15 × 10^7 seconds Required time ≈ 1.3 × 10^143,861 years // Age of the universe ≈ 1.4 × 10^10 years // The attack would take 10^143,851 times longer than the universe has existed.
Conclusion: A classical brute-force attack is physically impossible. Not "very difficult" – physically impossible. The universe would arise and pass away many times before even a fraction of combinations were tried.

### What About Quantum Computers?

Quantum computers are considered the greatest future threat to encryption. The most effective quantum attack on symmetric encryption is called the Grover algorithm. It is faster than classical computers – but its advantage is often greatly overestimated.

Grover's algorithm halves the exponent – the number of zeros. That sounds dramatic. But look at the numbers:

// Grover algorithm: halves the key space (square root of K) Effective quantum key space = √K ≈ 2 × 10^71,943 // Assumed quantum speed: 10^18 evaluations per second (extremely optimistic) Quantum attack time ≈ 2 × 10^71,943 ÷ 10^18 = 2 × 10^71,925 seconds Quantum attack time ≈ 6 × 10^71,917 years // Age of the universe ≈ 10^10 years → the attack is still 10^71,907 times longer.
Direct conclusion: The exponent is halved from 143,886 to 71,943. Both numbers are so astronomically large that the halving makes no practical difference. An idealized quantum computer would still need 1071,907 times longer than the age of the universe. RotorCrypt X is secure against quantum computers for all foreseeable time periods.
Why the combination of layers is decisive: A quantum computer might attack one layer faster. But it then still has to overcome the Enigma rotor layer – with its own independent key space of 10143,886. The four layers together make every conceivable attack, whether classical or quantum, impossible for all practical purposes.

## 12New Security Features

### Bootstrap Protection – K_current Never in Plaintext

The session key K_current is never transmitted unprotected during the first message exchange. A mathematically elegant circular HMAC dependency protects it:

How it works: K_current is XOR-encrypted with a mask (HKDF of the block HMAC). Since the HMAC itself depends on K_current, a circular dependency is created – an attacker would need K_current to compute the HMAC, and the HMAC to unmask K_current. This circle is mathematically unsolvable.

After the handshake is complete (green banner), K_PERM additionally protects – a permanent local key that never leaves your device.

### Replay Protection – Each Message Only Once

Each message can only be decrypted once. If someone tries to open an already decrypted message again, a clear warning appears:

🔒 THIS MESSAGE HAS ALREADY BEEN DECRYPTED 🔒 For security reasons, each message may only be decrypted once.

### More Capacity – 5,951 Characters Instead of 1,947

Through optimization of the internal block structure, a message now holds 5,951 characters – significantly more than before. The block size of 13,600 bytes remains identical.

### Additional Improvements

Feature | Description
--- | ---
Alphabetical Contact List | Contacts are now always displayed alphabetically – even after restarting the program.
Empty Contact at Top | An empty entry at the top of the list ensures no contact name is visible to bystanders.
Rotor Count Reset | After decryption, the rotor count is automatically cleared – so you consciously choose a new count for each reply.
Improved Synchronisation | For synchronisation issues, the reset process now runs fully automatically on both sides.

## 13Registration & Full Version

RotorCrypt X is available as shareware. The free version allows up to 3 rotors. The full version unlocks all 50 rotors.

### Shareware Version

On first launch, a `license.key` file is automatically created in the `Key/` folder. This file marks the shareware version. As long as no full version license is activated, a notice window appears when selecting more than 3 rotors.

### Purchasing the Full Version

The full version is available via the built-in purchase option. Go to the menu Help → Registration and click "Buy". After purchase, you will receive a license key by email.

### Activating Your License

Open Help → Registration.
Enter your name in the "Registered for:" field.
Enter the license key from the email.
Click "Activate". The program verifies the key and unlocks the full version.
Offline operation: Activation requires a one-time internet connection for key verification. After successful activation, the program runs completely offline – no further online checks.
Reinstallation: When reinstalling, simply enter your saved license key again. The full version is immediately restored – without contacting the manufacturer.

### Registration Window

Status | Display in window
--- | ---
Shareware | ⚠ Not activated – input fields visible, "Buy" button active
Full version | ✔ Full version activated – name and key displayed, fields locked