ELEMENTARY CRYPTANALYSIS
Helen Fouché Gaines
Originally published in 1939 by American Photographic Publishing Co.
PREFACE
The word _cryptography_, properly speaking, embraces the entire field
of secret writing, while that branch of the subject dealing with the
solution and reading of cryptic messages is generally referred to as
_cryptanalysis_.
Works on the subject of secret writing are comparatively numerous,
if not always easily available, but works devoted purely to the
analysis of such writing and the solving of its cryptograms have,
until recently, been so rare as to be almost non-existent for the
general reader.
Today we have two particularly excellent works, but both in foreign
languages: _Cours de cryptographie_, by General Marcel Givierge, and
_Manuale di crittografia_, by General Luigi Sacco. In English, we
find a more elementary work, _The Solution of Codes and Ciphers_,
by Louis C. S. Mansfield (Maclehose, London), which, the writer has
been told, is to be a first volume. As to America’s contribution, we
seem to find only small books such as Colonel Parker Hitt’s
_A B C of Secret Writing_, covering three ciphers, or Colonel H. O.
Yardley’s _Yardleygrams_.
There are, however, many works which deal most interestingly with the
analysis and decryptment of some one particular cipher. Most of these
are short works, published in magazines or incorporated into books of
a general nature, and nearly always the one cipher dealt with is that
type of simple substitution which appears with separated words in the
puzzle section of our current magazines and newspapers.
One well-known gem of cryptanalysis, equal to any modern specimen,
can be found in the story, _The Gold-Bug_, by Edgar Allan Poe. This,
too, deals with the simple substitution cipher just referred to, but
covers a case in which word-divisions are absent. Poe has also left
us an essay called _Cryptography_.
Rosario Candela’s recent book, _The Military Cipher of Commandant
Bazeries_, shows the unraveling of one particular cryptogram which,
for many years, had baffled the best efforts of all amateurs, and,
it is rather suspected, of some few who were not amateurs. The book
contains a chapter on general cryptanalysis, and also some
cryptograms for solution.
_Secret and Urgent_, by Fletcher Pratt, is primarily a history of
secret writing (a most interesting one, by the way), but contains
also a number of examples of cryptanalysis; it also shows a table
which the writer has never before seen in published form: a list of
English trigrams (three-letter sequences) and the frequency with
which they are used in the language. Other examples of decryptment
may be found in the Macbeth translation of Langie’s genial little
book, _De la cryptographie_; the appendix to this translation
contains the coveted Playfair demonstration, prepared by Lieutenant
Commander W. W. Smith of the United States Navy.
Just why so absorbing a subject has been so neglected in a world
full of puzzle lovers is hard to understand, especially since the
analytic writer, in addition to entertainment, has something to
offer of a more serious nature. It is true that trained cryptanalysts
are not greatly in demand in peacetime, and that our present corps
of cryptographers has a personnel more than ample for providing
necessary codes and ciphers, scientifically selected to fit their
individual purposes, and safeguarded with suitable protective devices.
Yet of what value is the most excellent of ciphers if, at the time
of direst need, this cipher, with all of its safeguards, must be
placed in the hands of even one man who cannot appreciate its
intrinsic value or imagine a need for extra precautions? At any rate,
we make our feeble attempt to reach this “one man.” May he learn, at
least, that there are reasons for his instructions!
In the planning of the present treatise, all purely historical
aspects of secret writing were neglected, and many well-known ciphers
whose interest is chiefly historical or literary have either been
omitted or given but cursory treatment. Certain other ciphers,
representative of types, have been treated at whatever length seemed
advisable for bringing out principles; and, with each type discussed,
a generous number of cryptograms has been provided, on which the
student will be able to test his skill as he learns. The student who
masters these fundamentals will be acquainted with the principal
forms of cipher, and will be able to solve cryptograms prepared by
means of these ciphers provided the cryptograms are of adequate
length and based on a language which he understands, or of which he
is able to secure understandable specimens. Within limits, he should
also be able to analyze and solve such cryptograms without being told
in advance what the cipher is. This, we believe, is the kind of
text-book desired by the many who desire information about “ciphers.”
Its material, compiled by members of the American Cryptogram
Association, has had to be gathered from a great many sources, both
within the organization and elsewhere, making it impossible, at times,
to give credit where credit is due. Our chief indebtedness, however,
is to M. E. Ohaver for a series of articles published during the years
1924 to 1928 in the former Flynn’s Magazine and most unfortunately no
longer obtainable from the publishers. Further acknowledgment should
be made to Colonel Parker Hitt, whose _Manual for the Solution of
Military Ciphers_, though not available for general distribution,
can usually be consulted in large public libraries. We have also
borrowed liberally from foreign sources, and members of the
association have most generously contributed the results of their
original research. For this collaboration and co-operation, the
writer is particularly grateful.
CONTENTS
Preface
I. General Information
II. Concealment Devices
III. Transposition Types
IV. Geometrical Types — The Nihilist Transposition
V. Geometrical Types — The Turning Grille
VI. Irregular Types — Columnar Transposition
VII. General Methods — Multiple Anagramming, Etc.
VIII. Substitution Types
IX. Simple Substitution — Fundamentals
X. The Consonant-Line Short Cut
A Method for Attacking Difficult Cases
(by George C. Lamb)
XI. Simple Substitution with Complexities
XII. Multiple-Alphabet Ciphers — The Vigenère
XIII. The Gronsfeld, Porta, and Beaufort Ciphers
XIV. The Kasiski Method for Periodic Ciphers
XV. Miscellaneous Phases of Vigenère Decryptment
XVI. Auto-Encipherment
XVII. Some Periodic Number-Ciphers
XVIII. Periodic Ciphers with Mixed Alphabets
XIX. Polyalphabetical Encipherment Applied by Groups
XX. Vigenère with Key-Progression
XXI. Polygram Substitution — The Playfair Cipher
XXII. Highlights of Fractional Substitution
XXIII. Investigating the Unknown Cipher
Appendix
English Frequency and Sequence Data
Comparative Table of Single-Letter Frequencies
Chart Showing Normal Contact Percentages (by F. R. Carter)
Chart Showing Frequencies of English Digrams (by O. Phelps Meaker)
Some Foreign Language Data
Bibliography (by W. D. Witt)
The Commonest English Words (by Frank R. Fraprie)
English Trigrams (by Frank R. Fraprie)
English Digrams (by Frank R. Fraprie)
Index
CHAPTER I
General Information
The subject which we are about to study is the analysis and solution
of _cipher_, though not including _code_, which is a very special
form of cipher demanding something more than elementary knowledge;
nor shall we enter at all into the subject of _invisible inks_,
certainly a most important aspect of secret writing, but belonging
to the province of chemistry rather than to that of cryptanalysis.
_Cipher machines_, also, are not within our present scope.
The term _cipher_ implies a _method_, or _system_, of secret
writing which, generally speaking, is unlimited in scope; it should
be possible, using any one given cipher, to transform any _plaintext_
whatever, regardless of its length and the language in which it is
written, into a _cryptogram_, or single enciphered message. The
process of accomplishing this transformation is called _encipherment_;
the opposite process, that of transforming the cryptogram into a
plaintext, is called _decipherment_.
The word _decrypt_, with its various derivatives, is being used here
to signify the process of _solving_ and reading cryptograms without
any previous knowledge as to their _keys_, or secret formulas; thus
the word _decipher_ has been left to convey only its one meaning, as
mentioned above: the mechanical process of applying a known key. Our
word _decrypt_, however, is an innovation borrowed from the modern
French and Italian writers, and is somewhat frowned upon by leading
cryptologists.
The word _digram_ is being used to indicate a two-letter sequence;
similarly, we have _trigrams_, _tetragrams_, _pentagrams_, etc., to
indicate sequences of three, four, five, etc. letters.
* * *
Ciphers, in general, fall into three major classifications:
1. Concealment Cipher
2. Transposition Cipher
3. Substitution Cipher
Minor types, such as “abbreviation,” are sometimes included, though,
to the writer, these have never seemed to be truly of a cryptographic
nature.
In _concealment cipher_, the true letters of the secret message are
hidden, or disguised, by any device whatever; and this type of
cipher, as a general rule, is intended to pass without being
suspected as the conveyor of a secret communication.
In _transposition cipher_, the true letters of the secret message
are taken out of their text-order, and are rearranged according to
any pattern, or _key_, agreed upon by the correspondents.
In _substitution cipher_, these original text-letters are replaced
with substitutes, or cipher-symbols, and these symbols are arranged
in the same order as their originals. There may, of course, be
combinations of types, or combinations of several forms belonging to
a single type.
* * *
The aristocrat of the cipher family is _code_. This is a form of
the substitution cipher which requires the preparation, in advance,
of a _code book_. A series of terms likely to be used in future
correspondence (that is, words, phrases, and even sentences) is first
gathered into a vocabulary, or “dictionary”; and beside each of these
terms is placed a substitute known as a _code group_, or _code word_.
These substitutes may be groups of letters, or groups of digits, or
actual words selected from ordinary language. Very common words or
expressions are usually provided with more than one substitute; and
nearly always there are substitutes provided for syllables and single
letters, so as to take care of all words not originally included in
the vocabulary.
No code presents any real security unless the code symbols have been
assigned in a thoroughly haphazard manner. This means that any really
good code would have to be printed in two separate sections. In one
of these, the vocabulary terms would be arranged in alphabetical
order, so that they could be readily found when enciphering (_encoding_)
messages; but the code groups would be in mixed order and hard to
find. In the other section, the code groups would be rearranged in
straight alphabetical (or numerical) order, so as to be readily found
when deciphering (_decoding_), and the vocabulary terms would be
in mixed order. Just what is meant can be seen in Fig. 1, showing
fragments from an imaginary code book.
Figure 1
ENCIPHERMENT SECTION DECIPHERMENT SECTION
Vocabulary Term Code Symbol Code Symbol Vocabulary Term
A 9001, 2114, 3000* 1120 Assenting to your
Aachen 8463 1121 Horse
About 1119, 0034* 1122 Meet me
About time for 5434 1123* Come; Paris
Armored car 1125 1124 Th-
Assenting to your 1120 1125 Armored car
*) When a plaintext term has more than one symbol, these are called
homophones. Polyphones are symbols which may have more than one meaning.
The terms _encoding_, _decoding_ are usually preferred to _enciphering_, _deciphering_.
A code of this kind, with symbols assigned _absolutely at random_,
provided it is carefully used (never without re-encipherment) and a
close guard kept over the code books, represents perhaps the maximum
of security to be attained in cryptographic correspondence; and
security, of course, is of prime importance in the selection of a
cipher for any practical purpose.
But in considering the relative merits of the various ciphers, it
is always necessary to take into account many factors other than
security, each cipher being evaluated in connection with the purpose
for which it is wanted: Under what conditions must the encipherment
and decipherment take place? How must the cryptograms be transmitted?
How much of the enciphered correspondence is likely to be intercepted?
What _degree_ of security, after all, is absolutely imperative?
A commercial, or other, firm, having a permanent base of operations,
and in little danger of being blown to bits by an enemy shell, would
not consider the first of these questions from the same angle as the
War Department, and the War Department, though considering all of
them from several different angles of its own, would still not
consider them from the same viewpoint as the State Department.
If messages are to be sent by mail, or by hand, or by telephone,
or pasted on a billboard, it is conceivable that a cipher which
doubles or trebles their length could still be a practical cipher.
For transmission by telephone, the presumption is that the cryptogram
must be pronounceable, or, certainly, audible. For written
communication, individual purposes have been served by means of
pictures.
But when the cryptograms are to be sent by wire or radio, it must
be possible to convert them into Morse symbols, either letters or
figures, but not intermingled letters and figures. Here, length
must be considered, involving questions of time, expense, and the
current telegraphic regulations. Moreover, it is conceded that a
meaningless text will not be transmitted with absolute accuracy,
and a cryptogram which is to be sent by this means must not be of
such a nature that ordinary errors of transmission will render it
unintelligible at the receiving office.
A factor of particularly grave importance in the selection of a
cipher to fit a given purpose is the probable amount of enciphered
material which is going to fall into the possession of unauthorized
persons. A criminal, who has had to send but one brief cryptogram
in a lifetime, might reasonably expect that it will remain forever
unread, no matter how weak the cipher. A commercial firm, transmitting
thousands of words over the air, is more vulnerable; and the diplomatic
office, or the newspaper office, which makes the mistake of publishing
almost verbatim the translations of cryptograms which have been
transmitted by radio, and thus has surely furnished the cipher
expert with a _cryptogram and its translation_, might just as well
have presented him with a copy of its code book.
As to just what constitutes the “perfect” cipher, perhaps it might
be said that this description fits any cipher whatever which provides
the degree of security wanted for an individual purpose, and which
is suited in other respects to that individual purpose. Even a
basically weak cipher, in the hands of an expert, can be made to
serve its purpose; and the strongest can be made useless when
improperly used.
In the present text, we are likely to be found looking at ciphers
largely from a military angle, which, apparently, has a more general
interest than any other. In time of war, the cryptographic service,
that is, the encipherment and transmitting service, is suddenly
expanded to include a large number of new men, many of whom know
nothing whatever of _cryptanalysis_, or the science of decryptment.
Many of these are criminally careless through ignorance, so that,
entirely aside from numerous other factors (including espionage),
it is conceded by the various War Departments that no matter what
system or apparatus is selected for cipher purposes, the enemy, soon
after the beginning of operations, will be in full possession of
details concerning this system, and will have secured a duplicate
of any apparatus or machine. For that reason, the secrecy of messages
must depend upon a changeable key added to a sound basic cipher.
Speed in encipherment and decipherment is desirable, and often urgent;
and the conditions under which these operations must often take place
are conducive to a maximum of error. The ideal cipher, under these
conditions, would be one which is simple in operation, preferably
requiring no written memoranda or apparatus which cannot be quickly
destroyed and reconstructed from memory, and having a key which is
readily changed, easily communicated, and easily remembered. Yet the
present tendency, in all armies, seems to be toward the use of small
changeable _codes_, which are written (printed) documents; and, for
certain purposes, small mechanical devices.
An enormous number of military cryptograms will be transmitted by
radio and taken down by enemy listeners, and even the ordinary wire
will be tapped. It is expected that the enemy will intercept dozens,
and even hundreds, of cryptograms in a single day, some of which will
inevitably be enciphered with the same key. With so much material,
knowing the general subject matter, and often exactly what words to
expect, or the personal expressions invariably used by individuals,
it is conceded that he will read the messages. All that is desired
of a cryptogram is that it will resist his efforts for a sufficient
length of time to render its contents valueless when he finally
discovers them. By that time, of course, the key will have been
changed, probably several times, and even the cipher.
With these general facts understood, we may first dispose hastily
of the concealment cipher, after which we will examine at greater
length the two legitimate types, the transpositions and the
substitutions.
CHAPTER II
Concealment Devices
Concealment writing may take a host of forms. Perhaps its oldest known
application is found in the ancient device of writing a secret message
on the shaved head of a slave and dispatching the slave with his
communication after his growing hair had covered the writing. Or, if
this appears a little incredible, the ancients have left us records
of another device considerably more practical: that of writing the
secret message on a wooden tablet, covering this with a wax coating,
and writing a second message on top of the first.
In the middle ages we meet a development called _puncture cipher_;
any piece of printed matter, such as a public proclamation, serves
as the vehicle, and the cipher consists simply in punching holes with
a pin under certain letters, so that these letters, read in regular
order, will convey the desired information. It is said that this kind
of concealment writing was resorted to in England at a comparatively
recent period, to avoid the payment of postage. Postage on letters
was very high, while newspapers were permitted to travel free, and
the correspondents sent their messages very handily by punching holes
under the letters printed in newspapers. Where the sender of a message
may also control the preparation of the printed vehicle, any desired
letters can be pointed out by the use of special type forms, misspelled
words, accidental gaps, and so on.
But concealment cipher is not necessarily confined to written and
printed matter. Ohaver, in his “Solving Cipher Secrets,” demonstrated
the conveyance of messages in the shapes and sizes of stones in a
garden wall, or in the arrangement of colored candies in a box; and
we read, in fiction, of many similar devices, such as a series of
knots tied in a string, or beads strung in imitation of the rosary.
Again, we hear of cases in which the arrangement of stamps on
envelopes is made to represent the terms of a miniature code. All
such devices are, of course, combination-cipher rather than pure
concealment, since the stones, candies, and so on, must first be
made the substitutes for letters or code terms.
A method of pure concealment, said to have been used by Cardinal
Richelieu, involved the use of a _grille_. Grilles are made of
cardboard, sheet-metal, or other flat material, and are perforated
with any desired number, size, and arrangement of openings. The
Richelieu grille, of approximately the same size and shape as the
paper used for correspondence, could be laid over a sheet of paper
so as to reveal only certain portions, and the secret message was
written on these. The grille was then removed and the rest of the
sheet was filled in with extraneous matter in such a way as to present
a seemingly continuous text. The legitimate recipient of this message,
having a duplicate grille, simply laid this grille over the sheet
of paper, and read his message through the apertures.
Concealment cipher goes by various names, as _null cipher_,
_open-letter cipher_, _conventional writing_, _dissimulated writing_,
and so on, not always with a difference in meaning, though
“conventional writing” does convey somewhat the idea of a tiny
code. (In this, casual words have special meanings.)
The name “null cipher” derives from the fact that in any given
cryptogram the greater portion of the letters are null, a certain
few being significant, and perhaps a few others being significant
only in that they act as indicators for finding truly significant
letters. To illustrate what is usually meant: Say that your very
good friend, Smith, first complains about a radio which he has
bought from your neighbor, Johnson, then asks you to take Johnson
the following note: “Having trouble about loudspeaker. Believe
antenna connected improperly, but do whatever you can.” By reading
the final letter of each word, you will find out what Smith actually
had to say to Johnson: GET READY TO RUN.
That is the null cipher reduced to its elements, though naturally it
can be more skillfully applied. Significant letters may be concealed
in an infinite variety of ways. The key, as here, may be their
positions in words, or in the text as a whole. It may be their
distance from one another, expressed in letters or in inches, or
their distance to the left or right of certain other letters
(indicators) or of punctuation marks (indicators); and this distance,
or position, need not be constant, or regular. Sometimes it is
governed by an irregular series of numbers.
Similar devices are applied to whole words. We agree, say, that in
whatever communications we send to our accomplice, only the third
word of each sentence is to be significant. Desiring to send him the
order, STRIKE NOW, we write him as follows: “The building _strike_ is
worrying our friends quite a lot. It has _now_ extended to this part
of the city.”
A purely concealment cipher may be enveloped in apparent ciphers of
other types. The true message is concealed, as usual, in a dummy
message, and the whole is enciphered in one of the legitimate systems.
It is then hoped that the decryptor, satisfied with having solved the
dummy, will look no further. Even more effective would be the device
of concealing the message in what appears to be a cryptogram, but is
not. It is easy to string letters together in such a way as to make
them resemble most convincingly a transposition cryptogram, and in
this case it would be hoped that the investigator’s full attention
would be given to the hopeless task of decrypting the dummy.
Concerning the decryptment of concealment cipher, we regret to say
that cryptanalysis has little help to offer. Fortunately, most of
these ciphers depend absolutely on the belief that they will not be
recognized as cipher, and once they are so recognized, they present
no resistance. In those few cases where the secret message is not
at once obvious, it is sometimes useful to arrange the words (or
sentences) in columns, or in rows, for a closer inspection.
Figure 2
I N S P E C T
D E T A I L S
F O R
T R I G L E T H
A C K N O W L E D G E
T H E
B O N D S
F R O M
F E W E L L
We have, for instance, an apparent memorandum in which the
awkwardness of the wording, or some other factor, has drawn our
attention to the possibility of cipher: “Inspect details for
Trigleth — acknowledge the bonds from Fewell.” We arrange these
words in column form, aligned by their initials, as in Fig. 2, and
the third column promptly gives up the secret message STRIKE NOW.
The words of sentences can, of course, be treated in the same way,
and where the alignment from the left gives no results, letters or
words can be aligned from the right, or from the center. If columns
give no results, diagonals can be inspected, or a zig-zagging line
between one column and another.
Experience counts for most, and extensive reading is a vast help.
Having seen methods in use, or read the descriptions of methods,
we know of some definite thing to look for. Then, too, some of the
concealment ciphers have transposition characteristics. This would
be the case with the Legrand cipher, which is of the type called
“open letter.”
This cipher used a numerical key, which, in turn, was based on a
keyword in what seems today a rather odd manner: A keyword CAT, made
up of the 3d, 1st, and 20th letters of the alphabet, gives the key
3 1 2 0. Before concealment takes place, a series of word-positions
is marked off, and these vacant places are numbered (0 to 9, or 9 to
0), continuing to repeat the ten digits until there are enough of the
digits 3, 1, 2, and 0 to accommodate the words of the secret message.
This message is then written, word by word, below its digits,
beginning with the first digit 3, then going on to find a digit 1,
then a digit 2, then a digit 0, then another digit 3, and so on.
After the secret message is written into its place, all of the blank
positions are filled with connective matter, as in the case of
Cardinal Richelieu’s grille-writing. Our later study of
transpositions will show approximately how we should go about
reading this, once we suspect its use.
So far, we have been considering pure concealment. Many of the
classic ciphers, fundamentally of the concealment type, are also
substitution ciphers, and their decryptment would follow substitution
methods. Of these, perhaps the best known is Bacon’s biliteral
cipher, summed up in Fig. 3.
Figure 3
BACON'S BI-LITERAL ALPHABET
A aaaaa IJ abaaa R baaaa
B aaaab K abaab S baaab
C aaaba L ababa T baaba
D aaabb M ababb UV baabb
E aabaa N abbaa W babaa
F aabab O abbab X babab
G aabba P abbba Y babba
H aabbb Q abbbb Z babbb
S T R I K E
baaab baaba baaaa abaaa abaab aabaa
N O W
abbaa abbab babaa
Hold OFf uNtIl you hEar frOm mE agAin. wE
May cOMpROmIse.
Lord Bacon’s cipher presupposes that the encipherer may so control
the preparation of his published work that he may prescribe the type
to be used for each printed letter, and it is claimed that he
actually used his cipher for the preservation of historical secrets,
including that of his own parentage. Two fonts of type are required,
the letters of one font differing (very slightly) from those of the
other font. These we may speak of as the _A_-font and the _B_-font,
and each letter of the alphabet is given a substitute composed of
_A_’s and _B_’s, as shown in full in the figure. Before a message,
as STRIKE NOW, can be concealed, it must be expressed in _A_’s and
_B_’s, five of these for each of its letters, as shown, so that a
message of 9 letters attains a length of 45. For its concealment, we
may use any text whatever whose length is 45 letters, for instance,
one whose obvious meaning is the contrary of the secret one: “Hold
off until you hear from me again. We may compromise.” The first five
letters, _HOLDO_, are to represent _S_, the next five, _FFUNT_, are
to represent _T_, and so on; and the sole purpose of the _A_’s and
_B_’s is to point out the kind of type which must be used in printing
the corresponding letters. In the encipherment of the figure, letters
taken from the _A_-font are indicated by lower-case and those of
the _B_-font by capitals, though it is understood that no such
emphatic difference is contemplated in the cipher.
While the average modern person would have no opportunity for
employing Lord Bacon’s cipher as described, he has access to an
unlimited number of vehicles other than type-difference. Anything,
in fact, may serve the purpose, so long as the material is available
in two distinguishable forms and in sufficient quantity. Our message
of 29 _A_’s and 16 _B_’s could be expressed with a deck of playing
cards if aces and face-cards are considered to represent _B_’s. It
could assume the form of a fence with 45 palings, in which the
_B_-palings are crooked, damaged, or missing. Ohaver once made use
of a cartridge belt in which the _A_-loops contained cartridges and
the _B_-loops were empty. There is an excellent opportunity here,
too, for the compiling of “fake” cryptograms, with _A_-letters and
_B_-letters distinguished as vowels and consonants, or by the part
of the normal alphabet from which they have been taken.
With a biliteral or binumeral alphabet which requires 26 groups, we
cannot have fewer than five characters to the group without making
groups of different lengths. But another well-known cipher alphabet,
devised by the Abbé Trithème for use in much the same way, is
triformed, and thus permits that the group-length be reduced to
three. The Trithème (Trithemius; Trittemius) alphabet, expressed in
digits 1-2-3, was approximately that shown in Fig. 4.
Figure 4
A TRI-NUMERAL ALPHABET
A 111 J 211 S 311
B 112 K 212 T 312
C 113 L 213 U 313
D 121 M 221 V 321
E 122 N 222 W 322
F 123 O 223 X 323
G 131 P 231 Y 331
H 132 Q 232 Z 332
I 133 R 233 & 333
This alphabet has had many applications, including the use of colored
candy previously mentioned. One contributor to Ohaver’s column
submitted a cryptogram of the open-letter type in which the digits
1, 2, 3, were indicated in the _number of syllables_ of the
successive words. A sentence, “Can you be sure of sufficient
assistance from Mayberry?” indicates the digits 1 1 1, 1 1 3, 3 1 3;
and, if the alphabet of Fig. 4 is the one in use, represents the
letters _A C U_. This is of particular interest in that it is easily
done without involving the awkward turns of language that so often
betray the concealment cipher. (This same contributor, a Mr. Levine,
evolved another cipher, accomplished by an arithmetical process, by
which it was possible to make a cryptogram convey two separate
messages!)
Many writers have shown alphabets of the biform and triform types
applied to open-letter communications by making the significant
factor the _number of vowels_ contained in successive words. Thus,
the sentence given above yields a series 1, 3, 1, 2, 1, 4, 4, 1, 4.
Using a biform alphabet, these are usually considered simply as odd
and even; with a triform alphabet, some disposition must be made
of numbers larger than 3.
The subject is fascinating, and the literature of cryptography is
rich with examples. However, we need not delve further into what,
after all, is only the stepchild of a legitimate science. The matter
of telegraphic transmission alone will bar these ciphers for most
general purposes, or the fact that a cipher once betrayed will never
serve again. Then, too, the censorship combats it by cutting out or
rearranging or changing words, causing the open letter (or telegram)
to convey only the information which it purports to convey.
Concealment cipher has, of course, the unique virtue of being able
to convey messages under circumstances which make it seem that no
communication has passed, and we have hardly touched upon the fact
that the short message, prior to its concealment, may have been a
well-enciphered one. But we rather suspect that, for the end desired,
invisible inks are more convenient and practical.
1. By PICCOLA.
On peut être Napoleon sans être son ami, mes enfants!
2. By B. NATURAL.
FOR SALE: Spring coats. All fine Scotch serge, for ensembles. Stoat
trimmed, fashioned right. Black shirred lining, striped. Effective for
brides. Act quickly. - Abraham Batz, 522 Broad, Telephone Exchange 7104-R.
3. By TITOGI.
How about releasing Tony, the gang chief? He don't lie, and is not the
true slayer either. Let us be friends. I am all right. Ed Lehr.
4. By TRYIT.
To those friends considering, it is always news, but all filled ciphers
disturb happiness with varied answers!
5. By PICCOLA.
Do not send for any supplies before Monday, at earliest. Order once only,
as men in charge are feeling sore about your threat to encourage the
mutiny at Ford's. - Wilson.
6. By PICCOLA. (Why not, indeed?)
A W I T H A N Y S E N D F O R I T Y O U M U S T B E F E A R
T H E C A N H I T T R Y A B O U R E O U T I S E C H I Y O U
A N D M Y T I O N C U P C R E A S K T O C A N D Q.
CHAPTER III
Transposition Types
Transposition has already been explained as a form of cipher in which
the letters of a message are disarranged from their natural order in
accordance with any pattern, or key, agreeable to the correspondents.
The fact that _any_ plan may be followed will suggest the possible
ramifications as to detail. Transpositions are, in fact, found in
every conceivable degree of complexity. They are not even unanimous
in their demand that there be two separate operations in the
preparation of a cryptogram: (1) the writing down of the plaintext
letters, and (2) the taking off of these letters.
Generally speaking, these ciphers follow two types, the regular
(geometrical, symmetrical), and the irregular. The strictly
geometrical type, sometimes called _complete-unit_ transposition,
is based on one comparatively small _unit_, or _cycle_, repeated
over and over, every unit having exactly the same number of letters
and exactly the same disarrangement as the rest. This type always
demands an exact number of units, and when a plaintext message is
not evenly divisible into units, it must either be cut down to fit,
or lengthened by the addition of extra letters called _nulls_. Some
of these keys are actual geometrical figures, such as triangles,
diamonds, hexagons, etc., or conventional designs like crosses. Any
figure of this kind provides a number of cells, or points, for the
_writing in_ of letters, and thus will serve as a mnemonic device,
or key.
Figure 5
A D E H I L M P
X X X X
B C F G J K N O
Plaintext message: A B C D E F G H I J K L M N O P.
Cryptogram (a) A D B C E H F G I L J K M P N O.
Cryptogram (b) A D E H I L M P B C F G J K N O.
The two operations of writing-in and taking off may be governed by
any agreed ruling, though the second of these must be made to result
in five-letter groups if the cryptogram is to be transmitted by wire
or radio. Fig. 5, in which an imaginary message has been represented
as _A B C D E_ . . . . . , shows only one of the many ways in which a
simple cross could be used as the key for the writing-in operation,
together with only two of the many cryptograms which could be taken
off from this one arrangement. This figure shows also, in its two
cryptograms (a) and (b), two fundamentally different plans for the
taking off of transpositions. The unit here is 4, the first unit
containing the letters _A B C D_, the next unit _E F G H_, and so
on. In cryptogram (a), the letters of every unit are still standing
together in a group, while in cryptogram (b), the letters of any one
unit have been mixed with letters of other units. In this latter
case, the two correspondents will have to agree upon a certain
number of crosses per line; otherwise, they run the risk of having
to decrypt each other’s cryptograms.
The most popular of the geometrical figures appears to be the square,
with or without a series of numbers 1 to 25, 1 to 36, and so on. Any
device or game, which will provide a square, is likely to be seized
upon as the source of a transposition key. We find two widely-known
examples of this in the “magic square” and the “knight’s tour.”
A _magic square_, as most of us understand this term, is made up of
a series of numbers, such as 1 to 25, 1 to 36, which are so arranged
in their cells (positions) that the added numbers of any row, column,
or diagonal, will always give the same total. A square of given size
will provide more than one magic square arrangement; and these
numbers, being a series, constitute an _order_, which, once it can
be remembered or reconstructed, will serve either for writing in or
for taking off a unit of 25, 36, etc., letters.
The _knight’s tour_ is based on the chessboard, a unit of 64 cells.
In the game of chess, where each piece has certain prescribed moves,
the piece called the knight must move diagonally across a 2 x 3
oblong. The “tour” consists in starting the knight at one corner and
carrying him completely over the 64 cells of the chessboard, causing
him to touch every square exactly once without having made any other
move than the one allotted to him. Fig. 6 will show one of the many
such tours which have been published. Such designs will serve either
for writing in or for taking out. In either case, the text is made to
contain exactly 64 letters or a multiple thereof. For writing in, the
first letter is placed in the cell corresponding to No. 1, the next
letter in the cell numbered 2, and so on. For puzzle purposes, the 64
letters are usually left standing in the form of a square. As cipher,
they would be taken off, by rows, or by columns, or otherwise. Or the
64 letters may first be written in simple order into the form of a
square, and then taken out one by one following the route of the
knight.
Figure 6
1 4 53 18 55 6 43 20
52 17 2 5 38 19 56 7
3 64 15 54 31 42 21 44
16 51 28 39 34 37 8 57
63 14 35 32 41 30 45 22
50 27 40 29 36 33 58 9
13 62 25 48 11 60 23 46
26 49 12 61 24 47 10 59
Other ciphers of the regular type merely employ a unit of so many
letters, to be arranged in some specified order, generally in
accordance with a numerical key. If, say, the unit has a length of
six letters, which we will represent as _A B C D E F_, and the
specified order for these is 6 2 1 4 3 5, this unit may be transposed
to read _F B A D C E_. Each unit will be transposed to have exactly
this pattern, except that semi-occasionally we find a final unit
slightly different from the others, owing to the fact that nulls
were not added to complete its length (Accurately speaking, this
transfers the cipher to the “irregular” class). Units, once transposed
in this way, may continue to stand intact, one after another; or they
may remain intact, merely exchanging places with one another; or the
cipher may be so planned that they do not remain intact, as was the
case with our cryptogram (b) of Fig. 5.
Often, two ciphers will differ from each other only in the method
by which their cryptograms are produced; oftener, there will be an
actual difference, but one which is purely superficial. For instance,
we have just mentioned a plaintext unit _A B C D E F_ as having been
transposed with a key 6 2 1 4 3 5 to result in the order _F B A D C E_.
Identically the same numerical key, used in another way, will
transpose this unit in the order _C B E D F A_. The two resulting
cryptograms would be different, but the _kind_ of cryptogram would not.
An extremely common form of complete-unit transposition is that
indicated in Fig. 7, where a short message, LET US HEAR FROM YOU AT
ONCE CONCERNING JEWELS QQ (38 letters plus 2 _nulls_), has been
written into an oblong, or _block_, in one order and taken off in
another. Both the writing in and the taking off follow a _route_,
rather than a key and, for that reason, the cipher is often spoken
of as _route transposition_, rather than _rectangular transposition_.
Three of the many possible _routes_ are shown in the three (partial)
cryptograms of the figure. In this connection, the American popular
terminology seems to favor _horizontals_ and _verticals_, rather than
“rows” and “columns.” The writing in or the taking out of a text is
said to be done by _straight horizontals_, or by _reversed horizontals_
(backward), or by _alternate_ (or _alternating_) _horizontals_
(written alternately in both directions). Similarly, we find ascending,
or descending, or _alternate verticals_; and again the _diagonal_
routes will be described as _ascending_, _descending_, or _alternate_.
The route may also be a _spiral_ one, and in this case it is said to
be _clockwise_ or _counter-clockwise_.
Figure 7
L E T U S Cryptograms:
H E A R F
R O M Y O (a) By descending verticals, from the left: L H R U C
U A T O N
C E C O N C N E E E O A E E G L T A M T C R J S U, etc.
C E R N I
N G J E W (b) By alternating verticals from the right, top:
E L S Q Q
S F O N N I W Q Q E N O O Y R U T A M T, etc.
(c) By diagonals: L H E R E T U O A U C A M R S C E T Y F N E C O O, etc.
For all of these routes, the point of beginning is nearly always one
of the four corners, except in the case of the two _spiral_ routes,
which are just as likely to begin with a central letter, particularly
when the rectangle is a square. Colonel Parker Hitt, in his _Manual
for the Solution of Military Ciphers_, shows the same series of
letters written into forty different blocks, always beginning at one
of the four corners.
Rectangular transposition, when used as cipher and not simply as a
puzzle, requires that one dimension of the oblong be fixed, the other
dimension being entirely dependent on the length of the message to be
conveyed. In the figure, the pre-arranged width of the block, called
its _key-length_, was 5, and the filling of the block required 8
complete units. These were written one by one as simple bits of
plaintext, and were then broken up in the method of taking off.
Occasionally it will be the vertical dimension of the block which is
fixed, and the plaintext will be written in by columns, beginning at
the left or at the right. But there is so little difference in the
results of the two procedures that a decryptor may solve and read a
cryptogram without learning which of the two was actually followed.
Ordinarily, it is the simple operation which comes first, the writing
in of intact units one after another. Sometimes the opposite is true,
the operation of writing in being made very complex, so that the
whole block is the unit, the taking off being done by simple rows
or columns. Frequently both operations are complex. This kind of
transposition belongs rather to the category of puzzles than to
cipher; any reasonably intelligent person can decrypt it, knowing
what it is. However, it has not infrequently been applied to serious
purposes, and a decryptor, encountering an unknown transposition,
would not overlook the possibility of simple rectangular encipherment.
Decryptment, here, is merely a matter of trying out the known routes,
and it would never be actually necessary to write out the entire
forty-plus blocks, or even half of these, for any one rectangle.
The decryptor begins by counting the letters of his cryptogram and
factoring the number of these, to find out what oblongs are possible.
A 36-letter cryptogram, for instance, might mean dimensions 6 x 6,
or dimensions 4 x 9. It could, conceivably, represent dimensions
3 x 12, or 2 x 18. But key-lengths are hardly ever shorter than 5,
or as long as 18. He would seize upon the square as the object of
his first investigation, writing the cryptogram into that block by
various known routes, and also _reading_ by various known routes,
diagonally, horizontally, vertically, backward, or upside down,
until he begins to find words. As a rule, this does not take him
very long; often the very efforts of an encipherer to achieve
complexity will result in an easier task for the decryptor. However,
a spiral will sometimes give trouble.
Figure 8
A E I
B D F H J
C G K........etc.
Taken off: A E I & B D F H J & C G K...
The examples appended to this chapter are all of the complete-unit
type, and require little knowledge of cryptanalysis for their
solution.
Passing on to irregular types, we find these in all degrees of
difficulty, from the very simple “rail fence” to the formidable
“U. S. Army” double transposition.
The “rail fence” family is outlined sketchily in Fig. 8. The writing
in of the plaintext follows a zig-zag route, downward by so many
letters, then upward to the line of beginning, as indicated by the
series _A B C_ . . . . . , and the taking off of the cryptogram is
done by straight lines. In explanation of the character _&_,
this has been used here as a signal to show the ends of the straight
lines. No such signal is needed if a proper understanding exists
between correspondents as to the construction of the “fence” and the
length of it which may occupy one line of writing; and in some cases
the straight lines are all equal in length.
In Fig. 9, we have a suggested _grille-transposition_, of a kind
described by Mario Zanotti as “indefinite.” This kind of grille, we
believe, is the invention of General Sacco. To picture it complete,
we may imagine a flat surface, such as a piece of cardboard, marked
off into squares, having dimensions 12 x 6, and turned sidewise.
Assuming this to be shown in full, we are looking at 12 _columns_,
and each column has 6 of the small squares, or cells. To convert this
piece of cardboard into an encipherment grille, we clip out three
squares from each one of its 12 columns, always in the most haphazard
manner possible. The resulting grille will thus have 36 openings,
and, if placed over a sheet of paper (preferably also marked into
cells), enables us to transpose the first 36 letters of a message by
writing them one at a time into the 36 apertures in some one order
and taking them off in another. The original plan was the reverse of
the usual: write the letters by columns and take them off by rows.
Figure 9
[ (N) ...
[(S) (O) ( ) ...
[(T)(I) ( )( ) ...
[ (K) ...
[(R)(E) ( ) ...
[ (W)( )( ) ...
Cryptogram: N S O T I K R E W.
In the figure, a 9-letter message, STRIKE NOW, has been written into
the first three columns of such a grille, and, taken off by rows,
comes out in the order _N_, _SO_, _TI_, _K_, _RE_, _W_. While the
figure shows this cryptogram regrouped in the usual fives, the
original method, as prescribed with the device, would have grouped
it in threes, that is, to correspond with the number of apertures per
column. This would facilitate the operation of decipherment, which is
as follows: Count the number of letters in the cryptogram _and divide
this number by 3_, in order to find how many columns were used. Cover
(or ignore) the unused portion of the grille, write the cryptogram by
straight horizontals into the uncovered portion, then read, or copy,
by descending verticals. The recipient of the present cryptogram,
for instance, finds nine letters, divides this number by 3, thus
ascertaining that three columns were used, covers up the other nine
columns, then, proceeding by straight horizontals, places one
cryptogram-letter wherever he sees a hole. Having thus restored all
letters to their proper columns, he has the plaintext message before
him. It will be noticed that an encipherer uses only the number of
columns that he needs. His last column does not have to be completed
with nulls, as in the case of complete-unit ciphers.
As this grille has just been described, its full capacity is 36
letters, and it has a repeating cycle of that length, presuming
that, after the transposition of the first 36 letters, another
36-letter unit is to be transposed by the same grille standing in
the same position. But this grille, reversed, provides a new pattern;
and the opposite side of the grille provides two additional patterns.
These positions may be numbered, thus providing for the encipherment
of 144 letters, even assuming that the positions are to be used in
1, 2, 3, 4 order and without varying the method of use. Add to this
that the cryptographic offices may have provided half-a-dozen
different grilles to be used interchangeably and not always in
exactly the same way, and it becomes plain that such an encipherment,
in the hands of an operator who knows his business, could be made
to furnish a very effective form of transposition.
Figure 10
2 1 L E T U S H E A R
5 4 3 2 1 F R O M Y O
0 9 8 7 6 5 4 3 2 1 U
7 6 5 4 3 2 1 A T O N
3 2 1 C E C O N C E R
4 3 2 1 N I N G J E W
7 6 5 4 3 2 1 E L S Q
Zanotti, and others, have also described mechanical devices of a
patentable type for accomplishing very involved transpositions. The
principle on which most of these operate can be seen in Fig. 10. A
certain number of pointers, or narrow sliding rulers, all carrying
the same progression of numbers, are so attached to a framework that
they can be set, by means of a numerical key, to project at irregular
lengths over a sheet of quadrille paper cut to fit into the frame.
Thus, each pointer indicates a certain number of empty cells, as
nine on the first line, six on the next, and so on. In the example
of the figure, presuming that each pointer carries only ten numbers,
and that the full number of these pointers is seven, the numerical
key would be the column of numbers at the extreme left:
2-5-0-7-3-4-7. The message here is written in the usual horizontals,
with a null (not strictly necessary) completing the last line. It
could be taken off by columns: _L_, _EC_, _TEN_, _UFCI_, etc. The
decipherer, having a duplicate apparatus, would set this according
to the pre-arranged key, copy the cryptogram by columns, and read
it by rows. The exact method, of course, can be varied.
Some attempt has been made, too, to evolve cipher machines which will
produce effective transpositions, but our understanding is that these
have never been accepted as worthwhile. The accomplishment of
transposition by mechanical means is far from new. In fact, the
oldest transposition cipher of which we have any record was
accomplished by means of the Lacedaemonian _scytale_. The Spartan
general, departing for foreign conquests, carried with him a rod,
or scytale, of exactly the same diameter as one retained by the
administration. When it was desired to communicate matter of a
confidential nature, the sender, using a narrow strip of parchment,
wound this carefully around his scytale with edges meeting uniformly
at all points, and wrote his message lengthwise of the rod. When the
strip was unrolled, the message appeared as a series of short
disconnected fragments, one letter, or two letters, or portions of
one or two letters. It was presumed that no person would be able to
read the message without being possessed of a duplicate scytale on
which to rewind the strip. We are left to suppose that this
presumption was justified by fact, though the decryptor of today
would make short work of such a system. The scytale, we believe,
is the oldest known cipher of any kind, and is still serving today
as the emblem of the _American Cryptogram Association_.
Before leaving types, it should be mentioned that any of the
transpositions ordinarily used for disarranging single letters can
also be used for the transposal of entire words. The popular name
for this is “Route Cipher” — possibly because it is rather cumbersome
to accomplish by any other than a “route” transposition.
We have said little concerning _decipherment_. This, in practically
all cases, is a mere matter of performing inversely the two
encipherment operations. For either process, the operator begins by
setting down his key or design, or adjusting his mechanical device
in the agreed manner. The encipherer “writes in” a plaintext, and
“takes off” a cryptogram; the decipherer “writes in” a cryptogram,
and “takes off” (or reads) a plaintext. If the encipherer, by
agreement, has written the text in rows and taken it off by columns,
then the decipherer must do the reverse: write his text by columns
and take it off by rows.
Before entering into the subject of _decryptment_, the student should
acquaint himself with the significance of the various tables appended
to this text, in order that he may consult these or similar tables
for information as to _frequencies_, and _sequence_. Every written
language has its individual characteristics in these two respects,
and, to learn just what these are for each language, various
cryptologists have, from time to time, counted the letters, the short
words, the combinations, and so forth, often on extremely long texts,
afterward arranging these data in the form of charts, or tables, or
lists. Two such counts are never duplicates, and there may be a
noticeable difference, say, between results obtained from literary
text and those obtained from military or telegraphic text; yet
results for any one language are surprisingly uniform. Finding, for
instance, an unexplained cryptogram in which a count of the letters
shows that about 40% of these are vowels (with or without _Y_), we
may classify it, not only as a transposition, but as one enciphered
in English or German, since one of the Latin languages can hardly be
written with so low a vowel percentage. Then, if we note the
occurrences of the letter _E_, and find that this makes up about 12%
of the total number of letters, we may discard the possibility of
German, in which the letter _E_ is far more likely to represent 18%
of the text. Or, if the vowel percentage is high enough to point to
one of the Latin languages, French would be distinguished from the
others by the outstanding frequency of its letter _E_, sometimes as
great as that of the German _E_, while the Spanish, Portuguese, or
Italian language will not always show it as the leading letter, its
place having been taken by _A_. In the Serb-Croat language, the
letter _A_ always predominates, and in Russian the letter _O_.
As to sequence, and considering English combinations only, certain
digrams, such as _TH_, _HE_, _AN_, etc., very consistently
predominate over all others. These almost never show identical
percentages in any two digram counts (as the single letters sometimes
will), and seldom, if ever, are ranked in exactly the same order,
aside from the fact that _TH_ invariably comes first. But in all
counts, the same fifty to sixty digrams (out of 676) are always found
at the top of the list. Thus the Meaker digram chart differs from
similar charts made by many others; yet _any_ digram chart is the
most valuable weapon we have for attacking a cipher. The Carter
contact chart contains the same general information expressed in
another way for special use in transpositions. (This was not figured
from the Meaker chart, but from an earlier one by Ohaver, made on the
same kind of text.)
One very useful phase of frequency data is seen in the group
percentages. Single letters, especially in short texts, may vary
greatly from their normal percentages, while certain classes, taken
as a whole, maintain a fairly constant percentage no matter how
short the text. Such classes, or groups, listed under the general
heading of _English Frequency and Sequence Data_, can be memorized
as having roughly approximate percentages: Vowels, 40%; selected
high-frequency consonants, 30%; extreme low-frequency group, 2%;
the five most frequent letters, mixed, 45%; the nine most frequent
letters, 70%. This final group of nine letters, _E T A O N I S R H_,
hardly ever varies appreciably; the shorter groups will sometimes
vary as much as 5% one way or the other.
Very useful in _code_ decryptment is a list of the commonest words.
Trigrams have also been investigated, the favorite positions of
individual letters in their own words, average word-length,
_patterns_, and endless other information, some of which is
indispensable, and some merely convenient. It will not be possible,
in the space at our disposal, to point out all of the uses to which
this kind of information can be put; the student is urged to take
his cue from the occasional short references made in connection with
examples.
* * *
All ciphers are decrypted by the _general methods_ suitable to their
type, and a transposition cryptogram may involve _factoring_,
_examination of the vowel distribution_, and _anagramming_, either
singly or in combination. These are best explained in connection with
examples, which may themselves have _special methods_, and we have
selected for general discussion four ciphers, two belonging to the
complete-unit type and two to the irregular. A careful study of the
methods used in individual cases should furnish the student with a
basis for analyzing other ciphers and evolving other special methods
to suit particular cases.
Concerning the paper work, which, admittedly, is onerous in most
forms of cipher investigation, much reference may be found, in the
matter which follows, to “paper strips.” These are old stand-bys.
Most decryptors prefer to do all of their work on cross-section
(quadrille) paper, since the writing of the letters into cells
enables them to obtain an accurate spacing both laterally and
vertically, and this paper is easily cut apart along the separating
lines. But for the kind of cryptograms we are likely to see here,
many persons prefer to work with a set of anagram blocks. These can
be prepared at home from cardboard squares, or may be bought in sets
with frequent letters represented in approximately the correct
proportions.
7. By TITOGI.
T S S N I H A Y S T I N T P I S E R O O I A A S N.
Also this: S H C V I E O L E A E W E R M.
8. By G. A. SLIGHT. (Something found in every school-book - IF found!)
T G H M R R I A Y E X N U E E S D E X S H M T I D E Q U O A Y R O A U
N P U E T G T I T E S Y S N O A Q N X A T U A D S I S H X.
9. By PICCOLA.
W I N T A H D A E S W H L E T Y L W A I L H O Q L A S S S A S Q.
10. By NEMO. (Magic Square).
L E A S U L T S G M S L O E I E O I M E A R N S A S R C D E K I U S U
H E M A Q L Y S P R M E O A.
11. By THE ADMIRAL.
B S P N T E A E F T V V O A N E Y A P U Z S E T P T H M N A T A E E R
S D S S K P S J E S T Y S E A L R H I A S K S N T T E Y W O F T H M W
Y K E F E N N H C I E H H U M I H I T E O H G E S U C G D I O O W E A
S A S N E R H M A A S S L E R G S M N E D T H K E M L U A E T V M F O
R A I W P A Y A M A E Y A D.
12. By THE ADMIRAL.
A A F R S R T N E A R B N E E O H S R L T I A P D U E O S I I T T A T
G L F O T S O U S H H E P N Y.
13. By DAN SURR. (Received from General Headquarters following a skirmish).
F A A T R M N O A T I L V I S Y G U C F F I O O E P S N K L T O I N V
R T T O A H N D N E E R E N N B M P U N P O R R K A U O M E A N A I E
T S S B N R G T G S T T I E E I C T H R.
14. By PICCOLA. (This is serious advice!)
F F L T A A R N I E U O R N T O T D L A N R W S O I A T T E Y B A N T
M E H S K O G R Z E P S R E I O A O A M S S S M A L P I L Y S.
15. BY FRA-GRANT. (This might have been a little easier. Still - ?)
Q Y T E Y O F U B U Q E H I H T E C H T H S A U A O N S I T I T T T I
E T T E L L S E A P L T N T.
CHAPTER IV
Geometrical Types — The Nihilist Transposition
In the preceding chapter, we glanced at the most elementary form of
_columnar transposition_: a text is written into a block by rows and
taken off by columns in such a way that even though all or part of
the columns may be reversed in direction, these columns are always
left standing one after another in regular order. Columnar
transposition becomes less crude when the order for taking off the
columns is an irregular one, governed by a changeable numerical key,
the length of this key governing also the width of the rectangle.
This process can be examined in Fig. 11. In this figure, the
numerical key, 4 1 6 5 3 2 7, was first derived from a _keyword_,
HALIFAX, according to the following very common plan: The two _A_’s,
taken from left to right, receive the first two numbers; the third
number, in the absence of _B_, _C_, _D_, and _E_, is assigned to
_F_; and so on, following the alphabetical rank of the letters
present, and taking repeated letters from left to right. The presence
of seven numbers implies seven columns, and it is said that the
_key-length_ is 7. When a text has been written into a block of
that width, with a key-number standing above each column, these
columns can be taken off in the order shown by the numbers, and not
in regular sequence.
Figure 11
Usual Plan for Transposing
Columns
H A L I F A X
4 1 6 5 3 2 7
L E T U S H E
A R F R O M Y
O U A T O N C
E C O N C E R
N I N G J E W
E L S X X X X
Cryptogram: E R U C I L H M N E
E X S O O C J X L A O E N E U, etc.
The key, used exactly as described, is a “taking off” key, and
this is the common way of using one. It can, however, be used for
“writing in” the successive units, placing the first letter of a
given unit beneath number 1, the second letter beneath number 2,
and so on until the seventh letter has been written below number 7,
afterward beginning with the first letter of another unit below
number 1 again. Under this plan the first unit of our figure,
_L E T U S H E_, would have been _written in_ in the order
_U L H S T E E_. Since all units would follow exactly the same
pattern, the resulting _columns_ would be identical with those of
the present block; the only essential difference would be that the
new columns are already transposed, and can be taken off in straight
order. The two resulting cryptograms, however, would not be the same.
The unit which was _written in_ in the order _U L H S T E E_, would
have been in the order _E H S L U T E_ had the method been that of
_taking out_ (or “off”).
The Nihilist transposition is ordinarily accomplished by “writing in,”
and its numerical key is applied to _both columns and rows_. Thus its
major unit is a square, and the seven-letter keyword HALIFAX, applied
to both dimensions of a rectangle, demands a unit of 49 letters,
while the shorter word SCOTIA, key-length 6, requires a unit of 36
letters.
Theoretically, this cipher is a _double transposition_, requiring two
successive operations as shown in Fig. 12. But in practice, these two
transpositions can take place simultaneously as pointed out in Fig.
13. The operator, having laid out his key-numbers at top and side of
his square, begins his writing in the cell at which the column headed
by number 1 crosses the row headed by number 1. He _writes in_ his
first unit, proceeds to the row numbered 2 for the writing in of his
second unit, then to the row numbered 3, and so on, taking rows in
the order shown by the numbers at the left, and placing the letters
of his unit by following the numbers across the top. Thus, with only
a little concentration, he has the entire major unit at one
continuous writing. The decipherer, too, having restored his
cryptogram unit to its block and written his two series of numbers,
may read, or copy, continuously. The decipherer, in fact, uses the
exact method which would produce a Nihilist cryptogram if a key were
used in the “taking out” manner. What we have described is the
encipherment of a single major unit; and all cryptograms must
contain an exact number of these major units.
Figure 12
Nihilist Plan
(a) Transposal of Columns (b) Transposal of Rows
S C O T I A S-5 E U J W T O
5 2 4 6 3 1 C-2 R A F O R E
O-4 A N E B C O
S E U H T L (Let us h) T-6 X L X X S E
R A F O R E I-3 A Y U T O M
A Y U T O M A-1 S E U H T L (Let us h)
A N E B C O
E U J W T O (c) Cryptogram: E U J W T O R A F O R E A N E
X L X X S E
B C O X L X X S E A Y U T O M S E U H T L.
The second operation, that of taking off the cryptogram, is not
always done by straight horizontals as we have shown this under
(c) of Fig. 12. This, of course, is the expected way; but the
Nihilist square is quite frequently taken off by some other one of
the forty-odd routes possible to rectangular transpositions. The
decipherer, knowing this route, merely writes his units back into
their blocks; but the decryptor is often faced with a preliminary
problem of discovering how they were taken off. Sometimes he must
also discover how many units a cryptogram contains.
To understand how such problems are solved, it is necessary to pause
and consider the make-up of ordinary written plaintext. English
vowel-percentage, as mentioned, is about 40%, and practically never
varies out of its limits 35%-45%. Each 40 vowels are fairly _evenly_
distributed throughout their 100 letters. Take any English text
whatever, not composed of initials or otherwise distorted, and,
beginning where you please, mark it off into ten-letter segments
and count the vowels in each of the segments. You will find that
the majority of these have exactly the normal number of vowels,
which is 4. Others will have 3 or 5, which, though outside of the
limits 35%-45%, are the closest variations possible. It will be a
rare segment indeed which contains fewer than 3 vowels or a greater
number than 5.
But suppose, having marked off such a text into ten-letter units,
or segments, we take each of these segments individually and mix
up the order of its letters, though still allowing it to stand
where it is. And suppose, having done this, we erase the original
division-marks and, beginning at some point in the midst of a former
segment, we again mark off a series of ten-letter units, and count
the vowels of these new segments. This time, we are just as likely
as not to find seven or eight vowels in one segment and none at all
in the next, depending on just what we did to the old units, and
still we have not actually mixed the units; we simply have our
division marks in the wrong places. Imagine, then, how the vowel
distribution can vary when a transposition is one so planned as to
break up units and scramble their letters.
This fact of uniformity in vowel distribution is of enormous
assistance in dealing with the simpler transpositions. For
instance, it may be that what we want to know is the length of
the units, and that what we have is a cryptogram of 144 letters,
which could be a single square, or a series of 36-letter squares,
or even a series of 16-letter or 9-letter squares. We may start
at the beginning of this cryptogram and mark it off into equal
segments of any length we like, afterward counting the vowels per
segment. If every segment shows approximately a 40% vowel count,
the chances are that we have a series of intact units, each one
merely transposed within itself; but if one segment shows 50%,
another 30%, another 28%, and so on, we may be quite sure that our
division marks are in the wrong places.
Figure 13
5 2 4 6 3 1 5 2 4 6 3 1 5 2 4 6 3 1
5 5 5
2 2 . A . . . E 2 R A F O R E
4 4 4
6 6 6
3 3 3 . Y . . . M
1 . E . . . L 1 S E U H T L 1 S E U H T L
Returning, now, to the Nihilist cipher, suppose we consider the
make-up of its major unit, that is, of any one block. This major
unit is a series of minor units, and each of these minor units, at
the time of encipherment, was written by itself on its own line. In
the beginning, it was a small fragment of plaintext, presumably
conforming closely to a 40% vowel count. It is true that we placed
it on the line in transposed order, but we did not remove any of
its letters or add any new letters. Even in the transposal of the
lines themselves, we merely removed a number of intact units from
one place to another. There has never been a time, throughout the
entire encipherment, when we took any letter out of its original
minor unit and put it with some other unit. Thus, as we first see
our completed Nihilist square, we still have, on each horizontal
line, a small fragment of an English sentence in which all of the
original vowels are still present. If such a block is now taken
off by straight horizontals, it is no more than a series of intact
units. To break up these units, we must at least take it out by
verticals; and they will, of course, be much more thoroughly mixed
when taken out by diagonals or spirals.
The decryptor, hoping for the best, writes his cryptogram into a
square (or series of squares) by straight horizontals and counts the
vowels per horizontal line. If his block is wide, he may estimate
the actual number of vowels represented by 40%; if it is narrow,
he may only roughly approximate the number; but in either case what
he hopes to see is _evenness of distribution_. More than half of
his units must be exactly normal, and any which are not exactly
normal must show the smallest variation possible. If he finds that
this is the case, he assumes that his block arrangement is the
encipherer’s original square, with only the minor possibility that
half of his lines may be written in the wrong direction. If his
distribution is not uniform, he counts the vowels per _column_ so
as to find out what kind of distribution he would get from a
vertical arrangement (ascending or descending). If this, too, fails
to show him a uniform vowel distribution, he writes out a new block
by the route of alternating verticals (or gets this count from his
first block; this is possible, though a little confusing). Afterward,
he may go on to the diagonals and spirals until finally he reaches
the arrangement in which more than half of his horizontal lines show
a 40% vowel count, and the rest a minimum variation.
Now let us consider a concrete example of decryptment. The (purely
imaginary) history of the cryptogram shown as Fig. 14 is meager. It
was taken from the body of an unnamed man, killed in attempting to
dynamite a bridge in an American town called Baysport.
Figure 14
I Y W B B O R T A F T I X D G S S E G H N A T O O I T O X T L U T R E
L X F A Y S D R C H T O M E D E I O V I K F T V T L A E U.
To begin with, the cipher appears to be transposition. Its cryptogram
shows 37½% of vowels, very close to the number expected of English
or German. It is too short to provide any reliable distinction
between these two languages, but the source of the cryptogram points
to English. Again, the encipherer, although he has grouped his
message in the usual fives, has neglected to complete his final
group with a null, and from this we judge that 64 letters is the
actual length of the message. The fact that 64 is a _square_ is
promptly noticed. But it is also the sum of several smaller squares,
and the unit might be 16. To investigate this possibility, we may
mark the cryptogram off into four equal segments of 16 letters each,
and count the vowels per segment. The normal number of vowels in a
16-letter segment should be about 6, and segments of this length
are long enough to afford reliable information, so that we may
promptly discard the possible unit 16 when we find that the first
segment shows 5 vowels (31%), the second, 7 vowels (44%), and the
remaining two, respectively, 4 and 8. Such a distribution does not
prove that the unit 16 is a total impossibility, because many things
are not average in single examples, but it is an extremely bad one
and would never be accepted. On the other hand, a satisfactory
distribution does not prove absolutely that a given unit-length,
or block arrangement, is correct. Here, had there been no question
of the ever-present _square_, we might have been led astray by the
unit 32, which divides the vowels of the present cryptogram into
two equal halves. In this connection, we can only say that the
decryptment of any cipher, even the simplest, will at times include
a number of wanderings which we shall have to overlook in
demonstrating principles.
Assuming, then, that the large unit, 64, is correct, we must get it
back into its block — presumably square — in the encipherer’s
original arrangement. Fig. 15 shows the same cryptogram written
into two different blocks. For an 8-letter unit, the normal number
of vowels is about 3 (actually 3.2). In block (a), a count taken on
the horizontal lines shows half of the units normal, two of the
others with the smallest possible variation, and two greatly outside
the 35%-45% limits. When the unit is so short, and when the line
containing only one vowel may be the one which was completed with
nulls, and most particularly when we have no other units to act as
a check, we cannot confidently discard a block of this kind. In
practice, we might waste some time giving it a trial, or we might
look for something better. Notice that its distribution is “ragged.”
We expected to find _even_ distribution, with _more_ than half of
the units exactly normal. This block (a) is the simple horizontal
arrangement. To find out what the simple vertical arrangement would
give us, we have only to examine the columns of this. Here the count
is obviously bad.
In block (b), we have one of the diagonal rearrangements from which
two sets of vowel counts can also be taken. Here, the horizontal
lines have given us exactly what we hoped for: Evenness of
distribution, more than half of the units normal, and only one unit
outside of limits. This, almost surely, is the encipherer’s original
block, in which every line contains one intact unit.
From our meager history of the case, we do not, of course, know that
this is specifically the Nihilist cipher. It becomes a case of
considering the various ciphers with which we happen to be
acquainted, and a _columnar_ transposition of the general kind shown
in Fig. 11 is an exceedingly common case. Moreover, a series of
juggled columns is suggested here in the fact that intact units are
standing on their own lines and still have not resulted in plaintext.
Figure 15
(a) Horizontal Rearrangement, (b) Diagonal Rearrangement,
With TWO Vowel-Counts With TWO Vowel-Counts
I Y W B B O R T 3 I W O F G N O L 3
A F T I X D G S 2 Y B A D H T E R 3
S E G H N A T O 3 B T X G I R D E 2
O I T O X T L U 4 R I E O T S M V 3
T R E L X F A Y 3 T S O U Y O O T 5
S D R C H T O M 1 S T L A T I F L 2
E D E I O V I K 5 A T F H E K T E 3
F T V T L A E U 3 X X C D I V A U 3
4 3 2 3 1 3 4 4 3 1 4 3 4 2 4 3
In Fig. 16, we have the successive steps which would be taken in
order to investigate this probability. At (a), the diagonal
rearrangement of our cryptogram, selected as the most likely of
those which were examined, has been repeated with its eight columns
set wide apart, and consecutively numbered for identification. These
presumed columns are now cut apart, and thus we have eight paper
strips which can be moved about and rearranged in various manners
in the hope of causing words to form on some of the lines.
Since we lack that most powerful of decrypting tools, a _probable
word_, we are forced to begin with probable letter-sequence. If the
magic letter _Q_ were present, we should look for a companion _U_,
and after that for a vowel to follow _QU_. But this, too, is lacking.
Familiarity with English digrams (or, in the case of the beginner,
an inspection of the digram chart or the list of digrams) shows that
_TH_ is by far the most frequent combination used in the language,
and that _HE_ and _HA_, also including an _H_, are very prominent
among the leaders. Further than this, the list of trigrams informs
us that both _THE_ and _THA_ are of outstanding frequency. Of the
four letters included, three are so frequent, and appear in so many
different combinations, as to be confusing; but _H_, though belonging
to the high-frequency group, does not appear in many _different_
combinations, and is less frequent than the other three.
Looking, then, for _H_, we find it twice in our present cryptogram,
once on the second row and once on the seventh; and, since the
seventh row shows two _T_’s and the second only one _T_, suppose we
try the second row, placing together the two columns (strips) which
are headed by the numbers 6-5 in order to set up a digram _TH_ on
the second row, as shown at (b).
Figure 16
(a) (b)
1 2 3 4 5 6 7 8 6 5
I W O F G N O L N G
Y B A D H T E R T H
B T X G I R D E R I
R I E O T S M V S T
T S O U Y O O T O Y
S T L A T I F L I T
A T F H E K T E K E
X X C D I V A U V I
(c)
6 5 7 ........ 6 5 7 4 ... 1 6 5 7 4
N G O N G O F I N G O F
T H E T H E D Y T H E D
R I D R I D G B R I D G
S T M S T M O R S T M O
O Y O O Y O U T O Y O U
I T F I T F A S I T F A
K E T K E T H A K E T H
V I A V I A D X V I A D
(d)
6 5 3 ........ 6 5 3 4 ...
N G O N G O F (Abandoned in
T H A T H A D
R I X R I X G favor of c.)
S T E S T E O
O Y O O Y O U
I T L I T L A
K E F K E F H
V I C V I C D
The formation of this digram _TH_ on the second row has automatically
set up a digram _NG_ on the top row, a digram _RI_ on the third row,
and so on; and we find, upon examining these newly-formed digrams,
that the whole series is made up of good English combinations. Thus,
it looks as if our combination 6-5 is correct, and we will proceed
with a possible _HE_ or _HA_, attempting to complete a trigram _THE_
or _THA_ on the second row.
Both _E_ and _A_ are present on the second row, and we may observe
at the steps marked (c) and (d) in the figure just what would be the
result of adding strip 7 or strip 3. At first glance, it appears that
combinations 6-5-7 and 6-5-3 are about equally probable. But it so
happens that both set-ups have formed a sequence _YO_ on the fifth
line, suggesting _YOU_; and when the only _U_ on that line is tried
in both places, it becomes evident that combination 6-5-7-4 is going
to give better results than combination 6-5-3-4, where we find poor
sequences like _KEFH_. At this point, or earlier, a decryptor will
probably proceed on the left side of his set-up, completing the
syllable _ING_ and the series of column-numbers 1-6-5-7-4, as shown.
When this setting together of columns automatically brings out on
the third row a sequence _BRIDG_, we have our first suggestion of
a _probable word_, since the man who had this cryptogram on his
person had just attempted to blow up a _BRIDGE_. After this, all is
plain sailing; the necessary _E_ happens to be on the same line, and
even if it were not, we have only three strips left, and these may
be placed by trial. Thus our eight paper strips arrive at the stage
indicated on the left-hand side of Fig. 17.
Figure 17
Strips in order Adjustment of rows
2 1 6 5 7 4 8 3
1 W I N G O F L O 2.... B Y T H E D R A
2 B Y T H E D R A 1.... W I N G O F L O
3 T B R I D G E X 6.... T S I T F A L L
4 I R S T M O V E 5.... S T O Y O U T O
5 S T O Y O U T O 7.... T A K E T H E F
6 T S I T F A L L 4.... I R S T M O V E
7 T A K E T H E F 8.... X X V I A D U C
8 X X V I A D U C 3.... T B R I D G E X
"Taking-out" Key: 2 1 6 5 7 4 8 3 1 2 3 4 5 6 7 8
1 2 3 4 5 6 7 8 "Writing-in" Key: 2 1 8 6 4 3 5 7
If we have previously met the Nihilist transposition, we can see now
what the cipher is, and, if it is a true Nihilist, we can finish the
reconstruction _by decipherment with the key_. To do this, we simply
number the rows from 1 to 8 and then disarrange these rows so that
their numbers will reproduce the series of column numbers. This is
shown on the right-hand side of Fig. 17, where the plaintext is
easily read: “By the drawing of lots, it falls to you to take the
first move. Viaduct bridge.” The gentleman required three nulls, and
thriftily made use of them as punctuation. If we have not previously
met the Nihilist encipherment, or if this cryptogram is of a kindred
type but governed by two separate keys, one for columns and another
for rows, the only difference is that we may have to experiment a
little with rows before finding their correct order.
In completing our solution, we have obtained a key, 2 1 6 5 7 4 8 3,
shown in the series of column-numbers, and should other cryptograms
be intercepted having the same key as the first, we need merely
decipher them with our key. It is, however, a “taking out” key, while
the Nihilist, as we have seen, is ordinarily _written in_. Having
either of the keys, we may find the other easily enough as suggested
in the figure. Simply “number the numbers” and put them back in
serial order. The new set of numbers, now disarranged, will show you
the other key. It would not be impossible for the student who is a
good guesser to find the keyword on which our present writing-in key
was based. This kind of work, with paper strips, is much more rapid
than it probably seems, and is often done at random. The keen eye
needs no digram list for the spotting of _HT_, merely reversed, with
_GN_ above it.
Speaking now of the ordinary columnars (Fig. 11), one minor point
should perhaps be brought to the attention of the very new student.
Quite often, a digram, such as the _QU_ of Fig. 18, is not written
on a single line, and it may be necessary to match this valuable
digram in the manner shown at (b) of that figure, coming out in the
end as at (c). In such event, we can later on transfer columns 5-6-7
to the other side of the block, raising them all by one position.
(Column numbers, in this case, are for reference only.) The same
would not apply to a Nihilist block in which the whereabouts of the
“next” row is unknown; the digram_ QU_ would have to be abandoned in
favor of something else.
Figure 18
(a) (b) (c)
1 2 3 4 5 6 7 1 1 2 3 4
7 5 6 7
T H I S I S Q T T H I S
U I T E T R U Q U I S Q U I T E
E B U T W E D U E T R U E B U T
D W E D
We mentioned briefly, too, the possibility of finding alternating
horizontals, so that only half of the rows can be “anagrammed”
together. Such minor problems, and they are numerous, can all be
ironed out easily enough once the student is familiar with his type,
and columnar transposition, encountered frequently and in all sorts
of disguises, is surely the most fascinating of all types. In
Chapter VI we are to meet it again, this time with an incomplete
rectangle.
16. By PICCOLA. (Ordinary columnar).
O E E H E A T F L S V A S Y C I O A E D Q O H D F M C M T C P O G E O
R E U G M I E F U O G C Y W G D Q U U I A L S I E R N O R N R R A T O A Q.
17. By KRIS KROST. (Nihilist).
T C I G R H N L A G T L I S A A O M O R N R I M N N E T R N K S A O E
I S D L E I K H H H E R D F T A S O I E T I H N E B T K E.
18. By MERLIN. (Nihilist. Its keyword has been used as a word-spacer).
T O L F P T E E R B I V O P S N R E W O R L I T T E S E N E T O O H O
F H H E H N Y H I O P F O S T G I P H E I E E T K I N U I B N R A A Y
R R E E W L S T H T E E R D T S E A I R S R E A E R R E P E U E U R S
S U I R R O F E S T R P O P A O R R B E E O N T T E E R T A H E R A R
L A D I O E E Z E L Y A O A Y M S L U L W I Y N N O O S S T G T S H L
W E Y M D M E A R E E U R I Y T P P R N Y N T Y O.
19. By SLEEPY. (Nihilist "route-cipher").
Wants Little Wish Should Long Muster But The Man And Gold Wants If Me
Many Below Mint For Not A So And Nor Of More With Score In Song Wants
Were I That Told Exactly Are Here A Long 'Tis Many 'Tis My But Each
Still Little Would So!
20. By TITOGI. (Ordinary columnar).
T W E I S I A H O D S P O D E R I T O N J E U T A I A S Y S H N T S T
K D N R S W U.
21. By PICCOLA. (Ordinary columnar).
T E E P H B M E F E B N T U X A V E H A R D W X I E L N C V E V R O I
T A F U L B O R O N T H M T M U E F S H O E T T L E D A K E E G D N L
E E N N I O O E B E E E R S T N R Y D C N X O N O E N E X.
(And now try this. Probable word: EXAMPLE).
H E L K L T I P N W H S E S I A X S R R E E A C M C P L T L T E O S D
R A O E E X T I H Y E U H N G E M Y T A S L M A A D S C.
CHAPTER V
Geometrical Types — The Turning Grille
The well-known _turning grille_, also known as the _rotating_, or
_revolving_ grille, is said to have been originated by an Italian,
Girolamo Cardano (or Cardan). Such grilles can be prepared from any
substantial material capable of being made into sheets and marked
into cells, and may take the form of any geometrical figure which
happens to be equilateral. The number of cells to be clipped out,
so as to form apertures for the writing of letters, is based on the
shape of the grille, as: one-third of the total number for a
triangle, one-fourth for a square, and so on; and the writing of the
letters is done on a section of paper of the same size and shape as
the grille, and preferably ruled off into cells which correspond to
those of the grille. After such a grille has been placed on its
corresponding section of paper, and a letter has been written through
each aperture, the grille is _turned_ a certain number of degrees to
a new position on the same section of paper, so as to cover from
sight the letters already written, and expose another series of blank
cells for the writing of new letters; and this continues until the
grille has taken its full number of positions and every cell has been
accounted for on the section of paper beneath it. The preferred
grille is a square, based on square cells, and takes four positions.
Usually it is based on an _even number_ of these cells; otherwise,
the full number of cells is not evenly divisible into quarters,
leaving an extra central cell which has to be omitted or specially
dealt with.
The grille called “Fleissner,” after an Austrian cryptologist,
Eduard Fleissner von Wostrowitz, is the perfected Cardan grille as
described by Jules Verne in his story, “Mathias Sandorf.” Colonel
Fleissner’s grille is a square, taking four positions, and is always
based on an even number of cells. In preparing this grille, it is
easy enough to select apertures at random in such a way that each one
governs its own four cells on the paper beneath, causing each of
these to be uncovered exactly once. But concerning the preparation
of the grille, there is a phase which affects the value of the cipher
itself: unless the grille can be constructed at will, in accordance
with a key which is “easily changed, communicated, and remembered,”
it requires the keeping on hand of a material apparatus which can be
stolen or copied, or which cannot be destroyed in case of emergency.
There are, of course, many ways in which a key could be applied. The
method used here is one published several years ago by Ohaver, and
can be studied in Fig. 19. First, as shown at (a), we have a quick
mechanical method for selecting apertures that cannot conflict. The
square is divided into four quarters, and each quarter, treated as
if it were the one occupying the upper left-hand corner, receives
its consecutive cell numbers, 1 to 9 (or 1 to 4, 1 to 16, 1 to 25,
1 to 36, etc.). If the route of writing-in is made exactly the same
for all four of the quarters, it becomes possible to clip _one each_
of the numerals 1, 2, 3, 4, 5 . . . . . . . etc., taken absolutely at
pleasure, and each resulting aperture will expose only its particular
four cells. This can be seen at (b).
The grille shown at (b), however, was based on the key-phrase
FRIENDLY GROUPS, and the method can be studied at (c), following
Ohaver’s plan, even to its minute details. The fact that the square
is based on 6 is told in the initial letter of the key-word, _F_,
6th letter of the alphabet. This key-word must yield nine letters,
one for each proposed aperture in the grille. A short word, such as
FRIEND, can be lengthened by a partial repetition, as FRIENDFRI,
while a longer word is cut off after its ninth letter, as it was in
Fig. 19. This literal key is next converted to a numerical key, as
explained in the preceding chapter, and the nine resulting numbers
are divided as evenly as possible into four sections. Finally,
considering the four quarters of the grille in some definitely agreed
rotation, each section of key-numbers will show what numerals are to
be clipped from a given quarter. In the figure, the numerals 3 and 8
were clipped from the first quarter, numerals 5 and 2 from the second
— proceeding in a clockwise direction, — numerals 7 and 1 from the
third quarter, and numerals 6, 9, and 4 from the remaining quarter.
Figure 19 - Preparation of a Grille
(a) (b)
Top
1 2 3 7 4 1 _ _ 3 _ _ _
4 5 6 8 5 2 _ _ _ _ 5 2
7 8 9 9 6 3 _ 8 _ _ _ _
3 6 9 9 8 7 _ 6 9 _ _ 7
2 5 8 6 5 4 _ _ _ _ _ _
1 4 7 3 2 1 _ 4 _ _ _ 1
(c)
F R I E N D L Y G
3 8.5 2.7 1.6 9 4 1st Q: 3,8; 2d: 5,2; 3d: 7,1; 4th: 6,9,4
Another method for selecting cells, proposed by Edward Nickerson,
dispenses with numerals, using in their places the letters of a
key-word which must be without repetitions, as FRIENDLY G happens to
be. If these nine letters, all different, be written into the nine
cells of each quarter, following exactly the same route in each case,
it becomes possible to clip one each of the letters _F_, _R_, _I_,
_E_, _N_, _D_, _L_, _Y_, _G_, taken wherever desired. The choice can
be made as follows: Taking the four quarters of the grille in the
agreed rotation, follow the normal alphabet, clipping _A_, (when
present,) from the first quarter, _B_, (when present,) from the
second quarter, _C_, (when present,) from the third quarter, and so
on. Or, to insure a more even distribution, rearrange the nine
letters in alphabetical sequence: _D E_, _F G_, _I L_, _N R Y_, and
divide as in the former plan, clipping _D_ and _E_ from the first
quarter, _F_ and _G_ from the second, and so on. While it is possible
to provide key-phrases of sixteen letters, without repeating, it is
probably more convenient to take whatever number of letters is needed
from a key-mixed alphabet of the following type:
F R I E N D L Y G O U P S A B C . . . . . . W X Z _f r i e_ . . . . . .
In Fig. 20, at (a), (b), (c), (d), we have a detailed picture of the
operation of this grille on the 36-letter plaintext unit: MISFIRE ON
VIADUCT JOB X RUSH INSTRUCTIONS. One definite edge of the grille must
be designated as the top, and there is a right and a wrong side.
Taking precautions in these respects, we place the grille over a
sheet of paper and mark its outline with a pencil (or otherwise make
sure of maintaining this one location). We write the first nine
letters as at (a), and give the grille a quarter-turn to the right.
We add the second nine letters as at (b) — where the newly-written
letters are the capitals; the others, in lower case, are presumed to
be hidden from sight by the solid portion of the grille. Another
quarter-turn makes ready for the next nine letters (c), and a
remaining quarter-turn completes the revolution (d). The writing-in,
at all times, is _straight ahead_: cells taken from left to right,
and lines taken from top to bottom.
Figure 20 - Four Stages of Encipherment
(a) (b)
_ _ M _ _ _ _ _ m _ _ _
_ _ _ _ I S V _ I A i s
_ F _ _ _ _ _ f D _ _ U
_ I R _ _ E _ i r _ _ e
_ _ _ _ _ _ _ _ _ _ C _
_ O _ _ _ N T o J _ O n
(c) (d)
B _ m _ X _ b T m R x U
v _ i a i s v C i a i s
R f d U S u r f d u s u
_ i r _ H e T i r I h e
I N _ _ c _ i n O N c S
t o j S o n t o j s o n
In the Jules Verne story, the three units of his cryptogram were left
standing in their blocks. Verne’s heroes were clever enough to
unearth a ready-made grille, and, by laying this, in its four
successive positions, above each of the three blocks, were able to
read the message through the apertures. Today, such blocks would be
taken off in five-letter groups, and possibly by a devious route. A
little concealment can be afforded, too, by completing the last
five-letter group with nulls, or, better, by adding these nulls at
the beginning of the cryptogram. It is also possible to make the
final 36-letter unit _incomplete_ by blanking out its bottom cells
before putting in the letters.
A grille can be used in other ways. Negligible changes can be
produced in its cryptograms by altering the customary order of its
four positions. A more substantial change is introduced by departures
from the straight horizontal direction of the writing-in. It is
possible to revolve the paper instead of the grille, setting the
letters right-side-up at the time of their taking off. And in all
of these cases, the grille is still serving as an instrument for
_writing-in_; there would be corresponding cases in which it is used
as an instrument for _taking out_ the letters of a prepared block.
Each variation, perhaps, would require its own separate analysis
before its individual inherent weaknesses could be spotted and used
as the basis for a special method. If the student, after observing
some special methods applied to ordinary grille encipherment, cares
to try his hand at analyzing some one of its variations, we suggest
that he take a series of numbers, 1 to 36, 1 to 64, etc., and carry
these through a complete encipherment to see what becomes of each
one.
* * *
Grille transposition, like the Nihilist, involves a major unit
composed of minor units. But here, the four minor units are never
left intact, and if the type of encipherment is not known in advance,
the decryptment of a single block will give somewhat more trouble
than the decryptment of a single Nihilist block, for the reason that
the decryptor usually exhausts the simpler possibilities before
trying the complex. With grille encipherment known, or suspected, we
have a cipher bristling with points of attack.
The strictly horizontal writing-in of each minor unit has had to be
done within a fairly short compass, and no two consecutive letters of
this unit can have been placed very far apart without causing other
letters to draw closer together. Their average distance apart is four
cells. For the decryptor, this actual distance apart of letters is
made shorter by his knowledge that for each letter considered, there
are three others which cannot have been written into the same unit
with it, _and that he knows definitely what these three letters are_.
Particularly interesting is the assistance he receives from the
symmetrical pattern into which the letters of his four units are
written; position 3 is position 1 reversed, and position 4 is
position 2 reversed. Thus, having tentatively selected the letters
of a probable word, or fairly long sequence, he can check the
correctness of his observations by examining another sequence which
would automatically build up, traveling in the opposite direction,
in the reverse position of the grille.
For a clear understanding of these matters, suppose we consider the
decryptment of the block just enciphered, on the assumption that we
suspect the presence there of the word VIADUCT. Fig. 21 shows a 6 x 6
block carrying consecutive cell-numbers, which are also the serial
numbers of the cryptogram letters, as these appear in a separate
block beside the first. It is understood that our first move would be
that of ascertaining whether or not the seven letters of this word
are all present. It must be remembered, too, that a long word is not
necessarily altogether in one unit; the grille might have been turned
before the word was completed.
In the present case, however, our first letter, _V_, is found near
the top of the square, and only once, so that if the word VIADUCT is
present, a substantial portion of it must have been written before
the grille was turned. We expect to find letters _I_, _A_, _D_, _U_,
and so on, following the letter _V_ in just that order, and without
any very great distance between any two of them; and if, approaching
the bottom of the square, we find it necessary to proceed backward
for _U_, _C_, or _T_, then the grille was surely turned before that
_U_, _C_, or _T_, was written.
Now, considering together the two blocks of Fig. 21, we find that our
first letter, _V_, occupies cell No. 7. In imagination, we revolve a
grille in which the only aperture has been cut in cell 7, and find
that this aperture exposes the cells numbered 5, 30, and 32. These
three cells, then, were surely covered from sight when the letter
_V_ was written into cell 7, and regardless of what the letters are
that occupy these three cells, it is definitely impossible that any
one of the three could have been used in the same minor unit with the
_V_ of cell 7.
Looking for a letter _I_, we find several within a very short range.
But the block contains only one _A_, and since we cannot proceed
backward after selecting the _I_, the position of _A_ (cell 10) tells
us that only the _I_ of cell 9 is possible. We accept, then, the _I_
of cell 9, and, again revolving an imaginary grille with its only
aperture cut in cell 9, we eliminate the letters found in cells 17,
28, and 20. Similarly, accepting _A_ of cell 10, we eliminate
whatever letters are occupying cells 23, 27, and 14. So far, none of
the letters eliminated have been wanted for the development of the
word VIADUCT; but notice that the fourth letter, _D_, found only
once in the block, occupies cell 15, thus eliminating the letters of
cells 16, 22, and 21, one of which is _U_, the next letter
needed. Thus, we are not forced to make a decision as between the _U_
of cell 16 and the _U_ of cell 18.
Figure 21
1 2 3 4 5 6 B T M R X5 U
7 8 9 10 11 12 V7 C I9 A10 I S
13 14 15 16 17 18 R F D15 U S U18
19 20 21 22 23 24 T19 I R I22 H E
25 26 27 28 29 30 I N O27 N28 C S30
31 32 33 34 35 36 T O32 J S O N
We have put together, then, the letters _V I A D U_ in the only
manner which is possible at all, and their cell-numbers, taken in
order, are 7-9-10-15-18. If the grille is reversed, these same
openings, named in the same order, will uncover cells 30-28-27-22-19;
these new cells, however, will not be seen in reverse order; they
will be in straight order like their letters. If, then, our sequence
_V I A D U_ is correct, the five letters found in cells
19-22-27-28-30, taken in normal order, should form an acceptable
English combination. A glance at the right-hand block of Fig. 21
will show that this check-sequence is _T I O N S_.
When we selected _V_, we automatically selected _S_ of cell 30 as
its check-letter. When we added _I_ on the right-hand side of _V_,
we obtained with it the _N_ of cell 28 on the _left_ side of _S_,
giving the check-digram as _NS_, entirely acceptable. With _A_, we
added the _O_ of cell 27, giving the check-trigram as _ONS_,
still acceptable; and so on to _IONS_, _TIONS_. Our complete word
VIADUCT produces the check-sequence _UCTIONS_. It must not be
objected that the fact of having only one each of letters _V_,
_A_, _D_, has too greatly facilitated the search. This is
an entirely legitimate expectation in a case where we deal with one
unit, and the decryptor, when possible, chooses his probable word
with this in mind. In the absence of a probable word, we are never
without probable sequences: the list of frequent trigrams, and the
various common affIxes, such as _-TION_, _-MENT_, _-ENCE_, _-ABLE_,
_CON-_, _PRE-_, etc. For the first three or four letters, where
decisions are sometimes uncertain, it is more satisfactory to work
directly on the square (prepared in ink), so that impossible cells
may be canceled in pencil, and the pencil marks erased when wrong;
but once well started, a paper or celluloid grille can be prepared
to fit the block, and the chosen cells actually cut out as they are
selected. Having found seven out of nine apertures, we may, if we
like, turn the paper grille and experiment with its other two
positions. The letters, in this case, will show gaps in sequence,
and may indicate by these gaps just where the new openings ought to
be cut. With one full unit determined, we have the grille for reading
the others. The only remaining problem would be that of deciding the
exact sequence of these four units, with their context as a guide.
For the case in which it is necessary to begin with letter-sequences,
particularly if driven back to the digram list, the device shown in
Fig. 22 may prove of considerable assistance: The cryptogram is
written in both directions, and thus pairs every letter with its
check-letter, so that check-sequences here would be written backward.
This idea is adapted from General Givierge’s _Cours de cryptographie_.
Figure 22
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
B T M R X U V C I A I S R F D U S U
N O S J O T S C N O N I E H I R I T
36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19
19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36
T I R I H E I N O N C S T O J S O N
U S U D F R S I A I C V U X R M T B
18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1
Working with digrams is tedious, but will, in the end, give results.
Considering, for instance, Fig. 22, its first letter is _B_. Of
letters standing immediately to the right of _B_, the first one which
would form a good digram with it is the _R_ of cell 4. But
consideration of a possible digram _BR_, cells 1-4, shows the
check-digram as _JN_, cells 33-36, and this latter digram is so rare
in the language that Meaker did not find it even once in his
10,000-letter text. The next letter known to have an affnity for _B_
is the _U_ of cell 6, but a possible digram _BU_, cells 1-6, cannot
be considered, for the reason that cells 1 and 6 are uncovered by the
same opening in the grille. The distance away of the next letters to
which _B_ is partial proves frightening, and _B_ is abandoned (it is
actually followed by the _X_ of cell 5).
Figure 23
R R T H A O U E E O S B A G D E A E
A V E B K U N E S F D I A N K S S S
T A D P E B R A N S U K O D X F D N
C R E A R R N J A T I Y G O A O A R
A O I L I D X T U S O B R A A N L E
T S G T E P L M A O T V H R A X E X
Beginning over, with _T_ of cell 2: The first frequent digram noticed
is _TR_, cells 2-4, and shows the check-digram as _JO_, cells 33-35.
We accept this at once, because the letter _J_ must presumably be
followed by a vowel, and the only vowel immediately available is
this particular _O_. To extend the accepted _TR_, we require a vowel.
The first one is U, cell 6, and extends the check-digram to _TJO_,
cells 31-33-35, acceptable if _T_ is the final letter of a word. To
extend the supposed trigram _TRU_, we experiment with _C_ of cell 8
and obtain a check-sequence _CTJO_, cells 29-31-33-35, which is still
encouraging. We must know, of course, that no two of the chosen cells
are in conflict with each other. The unit we have partially
reconstructed is the second one of Fig. 20, and the check-sequence
is the fourth unit.
A method somewhat resembling the foregoing consists in writing
another block beside the first, in which the letters of the
cryptogram are strictly in reversed order. The pattern of the
check-sequence will then follow exactly that of the sequence under
examination, merely with its letters in reverse order. Still a
further suggestion was made by Herbert Raines: In the preparation of
the two blocks, one in straight order and the other in reverse order,
the writing should be done vertically, with all columns containing
four letters. The symmetry can still be found, and any two
consecutive plaintext letters are more nearly at their original
distance apart — the average 4.
So far, we have been dealing with an isolated unit. In Fig. 23 we
have a longer cryptogram, suspected of being a reply to the first.
We have set it up in its three blocks, expecting to decipher it with
the same grille, but find that something is wrong. To see quickly
how the presence of several units modifies the case, suppose we
consider some sequence, right or wrong, which is easily examined,
such as the _AVE_ on the second row of the first block. Regardless
of what the transposition is, if all three of these units are
enciphered alike, each of the additional blocks contains a
corresponding trigram in exactly the same location as the one under
consideration; here we have _NES_ in the second block and _ANK_ in
the third. But if the transposition is specifically that of the
grille, each one of the three trigrams _AVE_, _NES_, _ANK_, has a
check-trigram in its own block. Thus we have the six trigrams listed
with their cell-numbers in Fig. 24. Since all of these are acceptable,
we should, in practice, be encouraged to accept them; thus, it may be
well to say here that, in dealing with all ciphers these false
beginnings will quite frequently pitch the decryptor headlong into a
solution, through no act of wisdom on his own part.
Figure 24
Straight Reversed
7 8 9 28 29 30
A V E L I D
N E S S O B
A N K N L E
Now, in order to arm ourselves against the larger grilles, which are
somewhat more troublesome, and for investigation of cryptograms which
may or may not have been accomplished with a grille, suppose we take
a look at Ohaver’s mechanical method — that is, his use of paper
strips. Picturing any block of 36 cells, numbered consecutively as we
saw these in Fig. 21, let us imagine that there is a grille placed
over this block, and that this grille has only one opening. If the
cell that shows is No. 1, then, at the first turn of the grille, we
uncover cell No. 6; at the next turn, cell No. 36; and, at the final
turn, cell No. 31. We will call this series of cell-numbers an
_index_, and say that the index for this particular aperture is
1-6-36-31. In the first block of the new cryptogram, the letters
which follow this index are _R O P T_. In the second block, the same
index governs the letters _U B V L_, and, in the third block,
_A E X H_. But if the single opening in our hypothetical grille has
exposed cell No. 2, then its _index_, discovered in the same way, is
2-12-35-25, and the corresponding letters, in the three blocks of
this cryptogram are, respectively, _R U E A_, _E I T X_, and
_G S E R_. Similarly, each one of the other seven apertures possible
in this quarter of the grille has an index, expressible in
cell-numbers, and governs a certain series of letters in each
cryptogram block. If the grille is the Fleissner, the index for any
aperture, in a grille of any size, will always contain four numbers,
and will govern four letters per block.
If the grille is a 16-letter one, there will be only four of these
indices, beginning in cells 1, 2, 5, 6. If it is a 36-letter grille,
there will be nine, beginning in cells 1, 2, 3, 7, 8, 9, 13, 14, 15.
A 64-letter grille will have 16, beginning in cells 1, 2, 3, 4, 9,
10, 11, 12, 17, 18, 19, 20, 25, 26, 27, 28; and so on to grilles of
100, 144, etc., letters. After one grows accustomed to the
swastika-like route of the open cell, such indices are not at all
difficult to prepare at the moment of need; however, many solvers
prefer to make them up in sets, once for all, and have them ready as
they happen to be wanted. As to the finding of the four letters per
block which follow any one index, it is sufficient to remember that
the cell numbers, arranged in the manner shown, are also the serial
numbers of the letters belonging to any one unit. Thus it is not
necessary to write the units into their squares; we need merely
number the letters of a unit from 1 to 36, and select those having
the desired serial numbers.
Returning, now, to our cryptogram: Our unit appears to be 36, since a
division of this kind distributes the vowels uniformly; and a unit of
36 may have been produced with a grille. If so, this grille had 9
apertures, and we need 9 paper strips, one for each aperture. On each
strip we are to have: the four index numbers, the four corresponding
letters from the first block, the four corresponding letters from the
second block, and the four corresponding letters from the third block.
But since, in each case, the first three cell-numbers or the first
three letters _must be repeated_, our strip will actually contain
seven numbers and twenty-one letters. These nine strips are prepared
all in one set-up, the details of which can be examined in Fig. 25.
In Fig. 26, the strips of Fig. 25 have been cut apart and rearranged
in such a way as to bring out plaintext on the top row of every block;
this is, of course, the first _full_ row, as pointed out in each case
by the four asterisks. It will be noticed that the top row of
cell-numbers is arranged in strictly ascending order (our strictly
horizontal route of writing-in). If the third row be now examined (as
pointed out by two asterisks), it is found that this, too, carries
plaintext, merely written backward, and that here the cell-numbers
are arranged in strictly descending order.
Figure 25
Preparation of Slips
Index....... 1 2 3 7 8 9 13 14 15
6 12 18 5 11 17 4 10 16
36 35 34 30 29 28 24 23 22
31 25 19 32 26 20 33 27 21
1 2 3 7 8 9 13 14 15
6 12 18 5 11 17 4 10 16
36 35 34 30 29 28 24 23 22
Block 1...... R R T A V E T A D
O U B A K E H B P
P E T D I L R R A
T A C S O R G I E
R R T A V E T A D
O U B A K E H B P
P E T D I L R R A
Block 2...... U E E N E S R A N
B I K S D U O F S
V T O B O S Y I T
L X N M T J A U A
U E E N E S R A N
B I K S D U O F S
V T O B O S Y I T
Block 3...... A G D A N K O D X
E S N A S D E S F
X E X E L N R A O
H R G R A O A A A
A G D A N K O D X
E S N A S D E S F
X E X E L N R A O
Now, to read the cryptogram: Each full row of numbers includes all
cell-numbers belonging to some one of the four units, and any one of
these four rows of numbers is a key to the grille, since it shows
exactly what cells were uncovered when the corresponding unit was
written in. To obtain the grille, we have only to select some one row
of numbers, as 12-36-10-16-34-9-26-32-13, and clip out these
particular cells in a square numbered as we saw it in Fig. 21. The
student who cares to know what “instructions” were being sent might
also satisfy his curiosity as to whether or not this new cryptogram
could have been deciphered rather than decrypted.
Figure 26
One Correct Adjustment of Slips
┌────┐ ┌────┐
│ 9 ├────┬────┤ 13 │
┌────┐ ┌────┤ 17 │ 8 │ 7 │ 4 │
┌────┤ 1 ├────┬────┤ 3 │ 28 │ 11 │ 5 │ 24 │
│ 2 │ 6 │ 14 │ 15 │ 18 │ 20 │ 29 │ 30 │ 33 │ ****
│ 12 │ 36 │ 10 │ 16 │ 34 │ 9 │ 29 │ 32 │ 13 │
│ 35 │ 31 │ 23 │ 22 │ 19 │ 17 │ 26 │ 7 │ 4 │**
│ 25 │ 1 │ 27 │ 21 │ 3 │ 28 │ 8 │ 5 │ 24 │
│ 2 │ 6 │ 14 │ 15 │ 18 │ │ 11 │ 30 │ │
│ 12 │ 36 │ 10 │ 16 │ 34 │ │ 29 │ │ │
│ 35 │ │ 23 │ 22 │ │ E │ │ │ T │
│ │ │ │ │ │ E │ V │ A │ H │
│ │ R │ │ │ T │ L │ K │ A │ R │
│ R │ O │ A │ D │ B │ R │ I │ D │ G │ ****
│ U │ P │ B │ P │ T │ E │ O │ S │ T │
│ E │ T │ R │ A │ C │ E │ V │ A │ H │**
│ A │ R │ I │ E │ T │ L │ K │ A │ R │
│ R │ O │ A │ D │ B │ │ I │ D │ │
│ U │ P │ B │ P │ T │ │ │ │ │
│ E │ │ R │ A │ │ S │ │ │ R │
│ │ │ │ │ │ U │ E │ N │ O │
│ │ U │ │ │ E │ S │ D │ S │ Y │
│ E │ B │ A │ N │ K │ J │ O │ B │ A │ ****
│ I │ V │ F │ S │ O │ S │ T │ M │ R │
│ T │ L │ I │ T │ N │ U │ E │ N │ O │**
│ X │ U │ U │ A │ E │ S │ D │ S │ Y │
│ E │ B │ A │ N │ K │ │ O │ B │ │
│ I │ V │ F │ S │ O │ │ │ │ │
│ T │ │ I │ T │ │ K │ │ │ O │
│ │ │ │ │ │ D │ N │ A │ E │
│ │ A │ │ │ D │ N │ S │ A │ R │
│ G │ E │ D │ X │ N │ O │ L │ E │ A │ ****
│ S │ X │ S │ F │ X │ K │ A │ R │ O │
│ E │ H │ A │ O │ G │ D │ N │ A │ E │**
│ R │ A │ A │ A │ D │ N │ S │ A │ R │
│ G │ E │ D │ X │ N ├────┤ L │ E ├────┘
│ S │ X │ S │ F │ X │ └────┴────┘
│ E ├────┤ A │ O ├────┘
└────┘ └────┴────┘
* * *
Concerning the grille cryptograms which follow, it seems not
impossible that the student who has seen his principles applied only
to a unit of 36 might find some difficulty in adjusting them to
grilles of other sizes. A tip, then, on Example 22: Instead of the
regulation nulls, its single unit was completed with a common Spanish
phrase beginning with _Q_. And if it still resists: the author’s own
name was used as the key for constructing the grille.
In adjusting his paper strips (when this is the method he prefers) it
makes no particular difference what plan he follows, so long as it
works. Some decryptors prefer to concentrate altogether on the
strictly ascending series of cell-numbers, allowing letters to form
their own sequences. Others will always have before them the set-up
of squares, noting there some possible letter-sequence, finding (by
means of their cell-numbers) the strips which contain these letters,
and then observing results in other blocks. If the given strip cannot
be found, then the cell must be already in use.
The shortest road is that of the probable word. For instance, the
set-up shown as Fig. 26 was actually initiated by the solver at the
letter _J_ of the second block, this being a rare letter and almost
invariably followed by a vowel. Of the several vowels immediately in
sight (in the square) the correct one was promptly suggested by the
sequence so plainly in sight, _OB_, suggesting the word _JOB_, one
already used by these people in discussing their mysterious
activities. The corresponding cell-numbers, 20-29-30, were found to
be on three separate strips — a necessary condition — and when placed
together brought out the straight sequences _RID_ and _OLE_, with
reversed sequences _AVE_, _NEU_, and _AND_. Another very probable
word was suggested by the check-sequence _AVE_ (_HAVE_), and the
necessary _H_ was found with cell-number 33, bringing solution to the
point suggested roughly in Fig. 27, where attention was promptly
focussed on the tetragram _RIDG_, suggesting _BRIDGE_, another word
previously used. There were two strips carrying the desired _E_, but
both refused to fit; and here the cell-numbers came into play. The
last one found, 33, was large and suggested that its letter, _G_,
might be the last letter of a unit; afterward, the building was
continued on the left, with _B_.
Figure 27
Straight Reversed
20 29 30 33 17 8 7 4
R I D G E V A H (Have)
J O B A U E N O (one u)
O L E A D N A E (e and)
22. By PICCOLA. (Probable word: CRYPTOGRAMS).
T S T H E T T U S H O E D G F R D O E O G R I S A A M S N M Q E U G I
B R I E L N O S T H S I C L S E T S W A T H A B R Y P A E.
23. By DAMONOMAD and POPPY. (Probable word: RIGHT FLANK).
A E K D S P V T O O N N A A O N R O N P R O C T I E H T R E H N E T I
A F G S R H T N I L O V T E F F A L M K I E C L A A S N M.
24. By DAMONOMAD and POPPY. (Probable word: SPECIAL MESSENGER).
E Y U I S S N S F P A O P E R I S C O A M N R A I R G A A T A L I M N
E G E E I S O S N O S A D N B E I T N O N G U E P R H T E E W S R U A
S S K V Y P I T O N O U E Y S O C M W O T N S T E U O B D G.
25. By SAHIB.
R N I I I N G T F L A I L N N D E E T D R V E U S E S T H R E I G E Y
F I A N O U R R D L G Y T N H A E O N R N E K C D E E I S E Y B S E F
W Y P G R L O L O E U O F H P A T V E R E H E R A E D G M I T R H N E
E I S Y T Q T S I I S A U S G I E A I C A S L L K L L T T X H V H E A
R X A X.
26. By NEMO.
I K O T H N N E H N E E I R C R A G E L O R N O H K T W T C H O H E I
E S S W W T N E T R H A R E O L S P L A A G E A E R L D B R Y E U I T
R T R E N I D T H E I A D E I E N D P D A B R A E C R K E M T A O A U
T O T S Y N B P E S N U H E S R A H E S U P D.
27. By DAN SURR.
O L T L A L I G E R T I V H E L L E R K I E A E I J F E I Y Y O O U U
S T H E A V A S G Y A S A W C K E P L U E Z T I Z O S I T.
28. By PICCOLA. (This is not a grille. It's a serious matter!)
H S O E S N P T A E T O H I S T W L E D T T F A I B T Y U Y O T C E O
I I T R C Y S B T R A H B T E I D O U S C I U O K R O Q N.