Multiple-Alphabet Ciphers — The Vigenère
The theory of polyalphabetical substitution is as follows: The
encipherer has at his disposal several simple substitution alphabets,
usually 26. He uses one such alphabet to encipher only one letter;
for the next letter, he may use another cipher alphabet; for the
third letter, a third alphabet; and so on, until some preconcerted
plan has been followed out. The earliest known ciphers of this kind,
the Porta (1563) and the Vigenère (1586), made use of a chart, or
_tableau_, on which all of the available cipher alphabets were
written out in full one below another. The Gronsfeld cipher (1655)
used a purely mental encipherment plan; but the Beaufort ciphers,
arriving two hundred years later (1857), again made use of a tableau,
and something of the same idea survives in the use of _strips_; that
is, a set of long narrow cards, each card carrying a simple
substitution key. Slides, however, must have been in use near the
time of Beaufort, since the best-known of the slide-ciphers, the
Saint-Cyr, was being taught in 1880 at the French military school
from which it takes its name. As to cipher disks, these appear to
have been known even in Porta’s time, and have passed through many
complications, though it has not been a great many years since a very
simple disk was in use in our own army. (A drawing of the United
States Army Cipher Disk may be seen in Webster’s New International
Dictionary.)
To know thoroughly any one of these ciphers is to understand the
fundamental principles of all, and we are going to base our studies
chiefly upon the Vigenère, most perfect of the simpler types, and the
basis upon which others have been founded. Fig. 85 shows, in full,
the Vigenère tableau, or “alphabet square.” The alphabet standing
horizontally across the top of this figure is the plaintext alphabet,
and serves for the whole tableau. Below this, and parallel to it, are
the 26 “Caesar” alphabets, the first one being a duplicate of the
plaintext alphabet, while the remaining 25 have been _shifted_, one
letter at a time, until the last one begins with _Z_. These are the
26 available cipher alphabets, and each one is named according to its
first letter, which is also spoken of as its _key_. Thus, the
key-letter _A_ points out the _A_-alphabet; the key-letter _B_ points
out the _B_-alphabet, and so on. The alphabet standing vertically on
the left side of the tableau is merely a list of these key-letters,
and so is called the key-alphabet. Except where cipher machines are
employed, the ordinary plan of encipherment does not make use of the
full 26 available cipher alphabets; only a few of these are used, and
these few are taken always in a given rotation, so that the cipher
becomes _periodic_. If the rotation includes, say, twelve of the
cipher alphabets (whether or not these are all different), the
cryptograms are said to have a _period of 12_. (The word “cycle” is
also used in this connection.) Since each letter of the normal
alphabet is the key to one of the Vigenère cipher alphabets, the
encipherer, wishing to make use of several different cipher alphabets,
is able to remember their sequence by means of a key-word, in which
each letter will point out one particular cipher alphabet. If today’s
key-word is BED, only three cipher alphabets will be used, the
_B_-alphabet, the _E_-alphabet, and the _D_-alphabet, and the
cryptograms will all have a _period of 3_. But if, tomorrow, the
key-word is changed to CONSTANTINOPLE, the complete rotation will
include fourteen alphabets, and the cryptograms will have a
_period of 14_.
Figure 85
THE VIGENÈRE TABLEAU
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
A A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
B B C D E F G H I J K L M N O P Q R S T U V W X Y Z A
C C D E F G H I J K L M N O P Q R S T U V W X Y Z A B
D D E F G H I J K L M N O P Q R S T U V W X Y Z A B C
E E F G H I J K L M N O P Q R S T U V W X Y Z A B C D
F F G H I J K L M N O P Q R S T U V W X Y Z A B C D E
G G H I J K L M N O P Q R S T U V W X Y Z A B C D E F
H H I J K L M N O P Q R S T U V W X Y Z A B C D E F G
I I J K L M N O P Q R S T U V W X Y Z A B C D E F G H
J J K L M N O P Q R S T U V W X Y Z A B C D E F G H I
K K L M N O P Q R S T U V W X Y Z A B C D E F G H I J
L L M N O P Q R S T U V W X Y Z A B C D E F G H I J K
M M N O P Q R S T U V W X Y Z A B C D E F G H I J K L
N N O P Q R S T U V W X Y Z A B C D E F G H I J K L M
O O P Q R S T U V W X Y Z A B C D E F G H I J K L M N
P P Q R S T U V W X Y Z A B C D E F G H I J K L M N O
Q Q R S T U V W X Y Z A B C D E F G H I J K L M N O P
R R S T U V W X Y Z A B C D E F G H I J K L M N O P Q
S S T U V W X Y Z A B C D E F G H I J K L M N O P Q R
T T U V W X Y Z A B C D E F G H I J K L M N O P Q R S
U U V W X Y Z A B C D E F G H I J K L M N O P Q R S T
V V W X Y Z A B C D E F G H I J K L M N O P Q R S T U
W W X Y Z A B C D E F G H I J K L M N O P Q R S T U V
X X Y Z A B C D E F G H I J K L M N O P Q R S T U V W
Y Y Z A B C D E F G H I J K L M N O P Q R S T U V W X
Z Z A B C D E F G H I J K L M N O P Q R S T U V W X Y
To make use of a cipher alphabet, say the _B_-alphabet, we may lay a
ruler across the tableau in such a way that this one alphabet is
pointed out. Then, to encipher any letter, as _S_, we may find this
letter, _S_, in the plaintext alphabet at the top, and trace down its
column as far as the _B_-alphabet which is being pointed out by the
ruler; we find that the substitute, in this alphabet, is _T_. Or,
wishing to decipher _T_, we find this letter in the _B_-alphabet and
trace upward to the plaintext alphabet in order to find that its
original is _S_. While the foregoing explains the principle, it has
not been expressed in the usual language. Where we have mentioned the
use of the _B_-alphabet, it is much commoner to hear that a certain
letter has been enciphered or deciphered “with key-letter _B_,” and
the usual description of the encipherment will be somewhat as follows:
To encipher _S_ by _B_, find _S_ in the plaintext alphabet, find _B_
in the key-alphabet, and use the substitute which is found at the
intersection of the _S_-column with the _B_-row. Or: To decipher _T_
by _B_, first find the key-letter _B_, trace horizontally to the
right as far as the cipher-letter _T_, then trace upward to its
original, _S_. This, we believe, is the original description, as
explained by Blaise de Vigenère himself, and the original encipherment
plan was that indicated in Fig. 86. The message of this figure is
SEND SUPPLIES TO MORLEY’S STATION. The key-word, BED, has been
repeated often enough to pair one key-letter with each text-letter,
and these pairs are handled _one at a time_: _S_ is enciphered by
_B_, _E_ is enciphered by _E_, _N_ is enciphered by _D_, and so on,
following the original description.
Figure 86
Original Method of VIGENÈRE Encipherment
Key: B E D B E D B E D B E D B E D B E D B E D B E D B E D B
Message: S E N D S U P P L I E S T O M O R L E Y S S T A T I O N
Cipher: T I Q E W X Q T O J I V U S P P V O F C V T X D U M R O
Figure 87
Modern Enciphernent
B E D B E D B E D
S E N D S U P P L
T I Q E W X Q T O
I E S T O M O R L
J I V U S P P V O
E Y S S T A T I O
F C V T X D U M R
N
O
5 10 15 20 25 30
T I Q E W X Q T O J I V U S P P V O F C V T X D U M R O X X
The modern method would be that of Fig. 87. Knowing that a great many
letters are going to be enciphered by _B_, a great many others by _E_,
and a great many others by _D_, and having no wish to preserve
word-divisions, we begin by writing our plaintext into three columns
(or by grouping it conveniently), and then encipher at a single
writing all of those letters which are to be enciphered by any one
same key-letter. That is, we apply one cipher alphabet at a time, as
first explained. The modern practice will also require that the
cryptogram be taken off in five-letter groups, and that the final
group be made complete. This is another of those cases in which the
decryptor will number his letters, as shown in the figure. The student
who has not previously met the Vigenère cipher is urged to perform the
two operations of encipherment and decipherment and thus familiarize
himself with the use of a tableau; it is possible that in most of his
subsequent reading he will find explanations based on the “columns”
and “rows” of a “tableau,” when, as a matter of fact, no tableau has
been used. To understand how this might be, suppose we take a look
now at the Saint-Cyr cipher.
Figure 88
THE SAINT-CYR SLIDE
┌─────────────────────────────────────────────────────┐
│ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z │
┌───────┴┬───────────────────────────────────────────────────┬┴────────────
│ A B C D│E F G H I J K L M N O P Q R S T U V W X Y Z A B C D│E F G H I J..\
└───────┬┴───────────────────────────────────────────────────┴┬─────────────┘
└─────────────────────────────────────────────────────┘ (To Y.)
In Fig. 88, we have the principle of the sliding device by means of
which this encipherment is accomplished. The Saint-Cyr slide is very
easily prepared of cardboard, or of any other flexible and fairly
strong material, but may also be prepared of wood, or may be set up
for any temporary purpose on two strips of paper. Its details, also,
may be varied to suit the operator’s own convenience. As shown,
however, the upper and single alphabet, which is the plaintext one,
is written on a card, and slots will be cut in this card at two
points: Just below and to the left of _A_; and just below and to the
right of _Z_. This plaintext alphabet is considered stationary.
The lower and double alphabet, which is to furnish all of the
substitutes, is written on a long narrow strip, the two ends of which
may be inserted into the slots of the other card. This strip, or
slide, may then be moved back and forth at will. However prepared,
the spacing must be uniform throughout both alphabets. The Saint-Cyr
cipher also makes use of a key-word in which each letter is the key
to a cipher alphabet, and which is applied exactly as in Fig. 86 or
Fig. 87. To apply the key-letter _B_, we adjust the slide in such a
way that the _B_ of the sliding alphabet will stand directly beneath
_A_ of the stationary one. This gives us exactly the same set-up
which we used in Chapter IX for cases of simple substitution; that
is, we have a plaintext alphabet with a cipher alphabet standing just
below it; each plaintext letter is standing directly above its
substitute, and each substitute directly beneath its original. The
cipher alphabet just referred to, in which key-letter _B_, found in
the sliding alphabet, is standing directly below the index-letter,
_A_, found in the stationary alphabet, is identical with the
_B_-alphabet of the Vigenère tableau, and is even called by the same
name. Should we move the sliding alphabet, so as to place key-letter
_C_ directly beneath index-letter _A_, we reproduce the _C_-alphabet
of the Vigenère cipher, again called by the same name. In the figure,
we have the _E_-alphabet in position, with key-letter _E_ standing
directly beneath index-letter _A_. And since the sliding alphabet may
be placed in 26 different positions, each time reproducing one of the
Vigenère cipher alphabets, having the same key and the same name, it
appears that our Saint-Cyr “cipher” is merely a duplication of the
Vigenère. The chances are, then, that even though we call our cipher
by its original name, and even make references to its tableau, our
actual work of encipherment and decipherment will have been
accomplished by means of the more convenient and rapid Saint-Cyr
slide. But where a slide is possible, a _cipher disk_ is also
possible, and many will prefer to use the disk.
To prepare one of these, we might proceed as follows: First, cut out
from cardboard (or other desired material) a pair of disks, one
smaller than the other. Divide the peripheries of both disks into 26
equal segments, and write the 26 letters of the alphabet in a circle
around both of the peripheries, causing both alphabets to run in the
same direction. Place the smaller disk on top of the larger; and,
finally, stick a drawing pin through the exact center of both disks,
to serve as a pivot. The smaller disk may now be rotated to 26
different positions, so that any desired key-letter can be caused to
stand beside index-letter _A_ of the outer disk, and will place in
position the cipher alphabet of which it is the key. The use of this
revolving alphabet in place of a sliding one does away with the
necessity for doubling its length.
Now let us examine carefully Fig. 89, with its two examples of
decipherment. At (a) of this figure, a short cryptogram fragment,
beginning _T I Q_. . . . , is being deciphered with the original
key-word, BED, and is bringing out the message, SEND
SUPPLIES. . . . . This, of course, is to be expected of any cipher.
But at (b), it is this _message fragment_, SEND SUPPLIES, which is
acting as a _trial key_; exactly the same process is being used as if
applying the true key, and this decipherment is bringing out the
original key, repeating over and over. The Vigenère cipher, then,
works equally well in reverse, and in this respect it differs from
some of its kindred ciphers. To understand this peculiarity, we have
merely to consider the tableau. Concerning this we have said that the
horizontal alphabet which stands across the top is the plaintext
alphabet, and that the vertical one at the left is merely a list of
keys. Suppose we decide to look at it the other way round, and say
that the vertical alphabet at the left is the plaintext one, and that
all 26 of the cipher alphabets are standing on end with their
key-letters at the top, so that the horizontal alphabet, written
across the top, is merely a list of these keys. Will there be any
difference in the encipherment? Might the slide, also, be prepared in
a vertical position? Does it make any difference in the results
whether we encipher plaintext _SEN_ by key BED, or encipher plaintext
BED by key _SEN_?
One road to decryptment, then, is clearly indicated. If we have a
probable word, we may use this word exactly as if it were the key,
and, if it is actually present, it will bring out the true key. Or,
if we have no probable word, we may try probable sequences, or make
use of the trigram list. Here, however, we have two separate cases:
The simplest, in which the probable word is long enough to bring out
the key-word _repeating_; and the most difficult, in which the
sequence, or probable word, is very short, and will bring out only a
short fragment of the key-word.
Figure 89
(a) Deciphering with the KEY:
Key: B E D B E D B E D B E D.......
CRYPTOGRAM: T I Q E W X Q T O J I V.......
Plaintext: S E N D S U P P L I E S.......
(b) Deciphering with the MESSAGE:
Trial Key: S E N D S U P P L I E S.......
CRYPTOGRAM: T I Q E W X Q T O J I V.......
True Key: B E D B E D B E D B E D.......
The simpler case is readily explained. We have, say, a cryptogram
beginning _U S Z H L W D B P B G G F S_. . . , in which we suspect
the presence of the word SUPPLIES. We decipher the first eight
letters, _using this probable word as a trial_ _key_, and obtain a
jumbled series of letters _C Y K S A O Z J_, which is not satisfactory.
We leave off the first cryptogram-letter, _U_, and decipher the next
eight, obtaining another jumbled series of letters _A F S W L V X X_.
We start again at the third letter, then at the fourth letter, and
still there is no information. But at the fifth trial, beginning at
the fifth cryptogram-letter, we obtain a series _T C O M E T C O_,
and this is satisfactory, not necessarily because we have recognized
the word COMET, though this, of course, is a very desirable happening,
but because the last three letters, _T C O_, are repeating the first
three. _The series is beginning over_. The student should practice
doing this, using both the tableau and the slide (or disk), until he
is sure that he understands the process. The exact details of his
work are immaterial; if he is sure that his key will be a recognizable
word, it will be satisfactory to make decipherments directly on the
cryptogram, erasing as he goes. Sometimes, however, the key is
incoherent, or apparently so, and a jumbled series like
_C Y K S A O Z J_ might actually be the correct key; for this reason,
it is well to follow a routine of some kind which will preserve all
of the decipherments. One such plan is illustrated in Fig. 90.
Here, the cryptogram, or a substantial portion of it, would be
written across a sheet of quadrille paper, and the probable word
would be written at one side, where each of its letters will govern
one row of decipherments. The first letter, _S_ in the figure, has
been used to _decipher the whole row of cryptogram-letters_, giving
every possible key-letter which can produce _S_. The second letter,
_U_, has been used to decipher them all again (except the very first
letter; we do not expect a word UPPLIES). The third letter, _P_, has
been used to decipher them all a third time; and soon. The resulting
rows of decipherment include all key-letters which could have produced
_S_, then _U_, then _P_, and so on. To read them consecutively,
beginning at any cryptogram letter, start immediately below that
letter, and read diagonally downward to the right. The first diagonal
gives key _CYK_. . . , the second gives _AFS_. . . , and so on to the
fifth diagonal, showing the key as _T C O M E T C O_. (If it is
desired that these possible keys should come out standing in a
horizontal position, then the _decipherments_ may be made diagonally.)
F. R. Carter, the originator of this scheme, does not necessarily
make all of the decipherments which are included in the figure. He
begins with the assumption that his key will be a recognizable word;
having deciphered in full the first three rows, he abandons all of
those diagonals which cannot develop into words. If, in the end, he
is forced to conclude that his key was incoherent, _no decipherments
have been erased_; he may still go back and develop the rest of his
diagonals, in the hope that one will begin repeating.
Figure 90
Deciphering with the Probable Word SUPPLIES - Routine of F.R.CARTER
Cryptogram fragment: .... U S Z H L W D B P B G G F S .........
Probable word: S C A H P T/ E L J X J O O N A .........
U Y F N R C/ J H V H M M L Y .........
P K S W H O/ M A M R R Q D .........
P S W H O M/ A M R R Q D .........
L A L S Q E/ Q V V U H .........
I O V T H T//Y Y X K .........
E Z X L X C//C B O .........
S O//
(Key: COMET)
The more difficult of our two cases, that in which we have no probable
words other than _the_, _and_, _which_, _that_, _have_, _but_, etc.,
can follow exactly the routine outlined in Fig. 90; but in this case
there must be two separate work-sheets. Here, it is usually better to
forget words and start at once with the list of normally frequent
trigrams, _THE_, _AND_, _THA_, _ENT_, _ION_, _TIO_, etc. The
key-fragments which are deciphered by these will be very short, and
very numerous; a great many of them will be very good usable
sequences, and perhaps the correct key-sequence will not look quite
so inviting as others which are incorrect. It becomes necessary, then,
to have a second work-sheet on which we may take these fragments one
by one and try them as keys. If any one of them is a fragment of the
original key, _it must bring out fragments of plaintext, and must
bring them out at some regular interval_. If the scheme of Fig. 90 is
the one preferred, the second work-sheet may be prepared exactly like
the first, and used in the same way. The only difference is as
follows: On the first work-sheet, where the figure shows the word
SUPPLIES, a supposed trigram (_THE_, _AND_, etc.) will have been used
to bring out supposed key-fragments; on the second work-sheet, one of
these supposed key-fragments will have been used. These new rows of
decipherment may then be examined to find out whether any of the new
diagonals contain apparent plaintext fragments, and, if so, whether
these occur at a regular interval.
For this kind of work, however, Ohaver has offered us another routine
which requires somewhat more preparation than Carter’s but which is
well worth the extra trouble, especially if it be remembered that a
trigram-search is never necessary except with the shortest of
cryptograms. For the longer cryptograms, we have easier methods.
Ohaver’s plan can be examined in Fig. 91.
The cryptogram, shown at the top of this figure, contains 26 letters;
therefore, remembering that each letter, except the final two, may
begin a cipher-trigram, it contains 24 trigrams. The preparation of
the two work-sheets requires that these 24 cipher-trigrams be written
out in full on both sheets. This work should be done in ink, or on the
typewriter. Then, too, for a reason which will be explained in a
moment, it is well that the first of these work-sheets be prepared
with a great deal of space, say seven or eight lines, between its
rows of trigrams. Now, considering the first work-sheet, shown at
(a) of the figure: The upper row shows the 24 cipher-trigrams as
originally written out. We have been working down the trigram list,
using every normally frequent trigram as a trial key, and have failed
to find _THE_, _AND_, _THA_, or _ENT_, which means that we have done
quite a lot of tedious work. We have now reached the normally frequent
trigram _ION_, and this we have applied as a trial key, assuming one
by one that each of the 24 trigrams represents _ION_. We have, then,
24 decipherments on the second row, and _any one_ of these 24
deciphered trigrams might be a fragment of the original key. However,
it is natural to assume that a trigram _FRI_ or _WAY_ is more likely
than one such as _XHR_ or _NQB_, and those fragments which look like
usable sequences have been underscored in the figure. These are to be
tested first. At (b), we have the other work-sheet, the upper row, as
before, showing the 24 possible cipher-trigrams. Here, we have already
failed in our tests for key-fragments _FRI_, _WAY_, _DZI_, _NYE_,
which means that we have done some more tedious work, and we have now
arrived at the possible key-fragment _EDA_. If this sequence, _EDA_,
is actually a portion of the original key, it must not only bring out
fragments of a plaintext message, but must bring them out at some
constant distance apart. The point at which we found this is the tenth
trigram, and here it may be advisable to remind that this begins at
the tenth cryptogram letter; that is, _every trigram presents only
one new letter_, so that to find a completely different trigram in
either direction, we must count backward or forward a distance of
three trigrams.
Figure 91
L N F V E O L N V M R N G Q F H H R N H I R V F E B,
(a) Trial Sheet No. 1
ION
LNF NFV FVE VEO EOL OLN LNV NVM VMR MRN RNG NGQ
AZS FRI XHR NQB WAY GXA DZI FHZ NYE EDA JZT FSD
GQF QFH FHH HHR HRN RNH NHI HIR IRV RVF VFE FEB
YCS IRU XTU ZTE ZDA JZU FTV ZUE ADI JHS NRR XQO
(b) Trial Sheet No. 2
EDA
LNF NFV FVE VEO EOL OLN LNV NVM VMR MRN RNG NGQ
HKF JCV BSE RBO ALL KIN HKV JSM RJR ION NKG JDQ
GQF QFH FHH HHR HRN RNH NHI HIR IRV RVF VFE FEB
CNF MCH BEH DER DON NKH JEI DFR EOV NSF RCE BBB
(c) Testing out the Period 5
D A E D A E D A E D A E D A E D
L N F V E O L N V M R N G Q F H H R N H I R V F E B
I N . . A L L . . I O N . . B E H . . D F R . . A Y
(TION?) (FRIDAY?)
Beginning, then, at the tenth trigram, and examining every third
trigram in both directions, we find that our key-fragment has given
us the following decipherments: _HKF_, _RBO_, _HKV_, _ION_, _CNF_,
_DER_, _JEI_, _NSF_. These are largely incoherent; but, in addition,
it must not be overlooked that on the continuously-written cryptogram,
these would be consecutive, giving us a message _H K F R B O_. . .
Applied at interval 3, then, our key-fragment _EDA_, will not
decipher us a message; therefore, the period of this cryptogram,
using this key, cannot be 3.
To examine for the possibility of a period 4, we start again with our
tenth trigram, and examine every fourth decipherment in both
directions; our series, this time, is _JCV_, _KIN_, _ION_, _MCH_,
_NKH_, _NSF_. Most of these are usable, and the first one might be
due to nulls, initials, and so on; but here again we have the reminder
that with each trigram representing only one new letter, these are
_almost consecutive_, starting at the second cryptogram letter, so
that our message, with each fourth letter missing, will be as follows:
_* J C V * K I N * I O N_. . . . Unless we can think of some letters
which would fill these gaps and provide plaintext, our period is
not 4.
Trying again, however, beginning at the tenth trigram and examining
each fifth decipherment, we find something more satisfactory: _ALL_,
_ION_, _BEH_, _DFR_. If these are correct, the period is 5. At (c),
we have gone back to the continuously-written cryptogram in order to
try these in their places; and since a period 5 would mean that each
of the letters _E D A_ is used regularly to encipher each fifth
letter, we are able to include two shorter decipherments at the two
ends of the cryptogram. The next step in logical order is to try
deciphering _T_ in front of _ION_, since the trigram _TIO_ would
have been the next one on our trigram list. This brings out
key-letter _C_, which, if correct, will decipher correctly at each
interval 5, and which extends our key-letters to _C E D A_. We can
see, too, that this is not the beginning of the word; the sequence
we have is _D A * C E_. In the given example, it is not difficult,
also, to guess a probable word, FRIDAY. Now, having twice called
attention to the fact that the trigram-search can grow quite tedious,
we hasten to point out that it need not be made more so by
deciphering each trigram individually. If your trial key is _THE_,
set your slide at the _T_-alphabet (or point this out on the
tableau), and decipher every first letter on the sheet. Then set the
_H_-alphabet in position, and decipher every second letter on the
sheet. Finally, set the _E_-alphabet in position and decipher all of
the remaining letters.
The foregoing few paragraphs have illustrated the worst case in
almost its worst form, but will show the principle. Now let us
consider this work in a much more usual case. As mentioned earlier,
the first of the two work-sheets will be prepared with a great deal
of space between the rows of trigrams. The full number of
decipherments will be made for the first trigram _THE_, but _not
erased_. Just below these, a second row of decipherments will be
made for _AND_, and these, too, will be left standing. (_THA_ can be
omitted.) A third row of decipherments is made for _ENT_, a fourth
row for _ION_, and so on down the list, until there are six or eight
rows of possible key-fragments. These are all examined and compared
with one another, in the hope of finding duplications. Perhaps _THE_
and _AND_ have _both_ brought out a key-fragment _EDA_, or one has
brought out _CED_ and the other _EDA_, having _ED_ in common. It is
far from unusual, in some of these cases, to find a whole series of
these overlapping key-fragments, for instance, _CON_, _ONS_, _NST_.
This will explain why many persons consider the trigram-search the
simplest and most direct way of attacking a Vigenère cryptogram.
For the benefit of the novice, we end the chapter at this point in
order that he may have some practice. Example 104 comprises a
thrilling serial with all the trimmings, gripping and original title,
smashing climax, and a brave hero, John Miller. The key to the title
is STRANGE. Part I repeats a word found in the title; part II repeats
a word of part I; and somewhere are the trigrams _NOT_, _CON_, _YET_,
_ING_, _TEN_, _THE_. We have heard, too, that an amateur encipherer
will occasionally encipher the nulls which he adds in his final group.
Example 105 is easily investigated through short common words. As to
the remaining examples, while it is true that they can be attacked by
the trigram method, the student will probably prefer to leave them
until he has seen the methods outlined in Chapters XIV and XV.
104. By PICCOLA. (For trigram practice. A new key for each fragment).
Title of Serial: S L K R N T K W W Z S N V T W T I A A I I X X X X.
Part I: R I G Z V Z K I U O M H J L B W F P K S R Z T R H E J T W I
O S W I O S G Q I I. Part II: H H T X T N E O L V R M T U L C L P P X
T Y R X K U K B U W U O J Z H X M Z K H. Part III: S Y Z Y R T N F U R
K C U S I I R Q U X W U F K C J N R L Q N F O K V X M P U O N H J A X
J H V O P. Part IV: X B V P Y S X C J J Y U R X O T S P I N Y I L U P
A V M X M M F C I B S T I T O O T B R O.
105. By PICCOLA. (For investigation of short words. - Still Vigenère!)
V Y I D J G I E J S N V R J H J F J D B G E K O W U Y A R F F Z W
V O K U X R P G R J U O E K M R B U Y S U H Q W J L J G C I W H G I W.
106. By NEON. (Any repeated trigram is worth watching!)
P Q X E J F V E G Y M N Y N Y I U F R D S G V R I L P S G Z T M E S I
R K N Y I G P E R W G R R N D L O J N T Y I D X O T Y C I P C R E V C
E S G O I R L I S I R Z Q E U C G L T C I X H Y I X H E L E K Y J E K
P X I E Y R R S L H D L I F Y G P R J G S D I C E.
107. By THE ADMIRAL. (Numbers are always possible!)
L V P R V S F P T Y J S P H L F R C E U S B O S Z P H J F Z N S O A P
K T T V V Z C F R J X C C T P W W R H K E W Y U K W G L N U X C C T P
X W G E R F R Z N V Z O W F J W Q Z N U K W Y O E W M P A I.
108. By NEON. (This cryptogram, circulated in April, 1935, caused great
consternation among solvers. Do you see any reason why?)
T W G J C N I U J X C S L S K K B N V G W I P S U Q I U J A U L J U Z
H B E V J V M A O H G G L T P D G L E Y S S L A F I M J S W Q I U M O
N N F L V H I U I Z D Q K V Y R T W H I M R F E U K P N O V Y T K E F
N V Q N O T.
109. By PICCOLA.
A X S E H G O I W W F O I A L G E M Q W E E N B W R E I K L S H Z Z Q
X L G A H V P Z K L D L G G D W T C M H Q D J N W K E H M V V A B M A.
CHAPTER XIII
The Gronsfeld, Porta, and Beaufort Ciphers
Now let us have a brief look at other classic ciphers of the
multiple-alphabet type, and see to what extent these will differ from
the Vigenère. The Gronsfeld cipher, as may be seen from the specimen
encipherment of Fig. 92, uses a number-key. Its ten alphabets are
governed by the ten digits. To encipher _S_, using key-digit 2,
simply begin at _S_ and count forward 2 in the normal alphabet; the
substitute is _U_. To encipher _E_ with key 8, begin at _E_ and count
forward 8 in the normal alphabet; the substitute is _M_. For
decipherment, count backward in the alphabet. A very superficial
investigation will show that the Gronsfeld key of the figure, 28105,
and the Vigenère key _CIBAF_ will produce identically the same
cryptograms. The key-digit _zero_ governs the _A_-alphabet of the
Vigenère, the key-digit 1 governs the _B_-alphabet, and so on to the
_J_-alphabet. If it is found convenient to use a tableau (as it may
be for the decipherment), the first ten cipher alphabets of the
Vigenère tableau can be ruled off from the rest, and the key-digits,
in the order 0 to 9, can be added beside the key-letters _A_ to _J_.
Or, if the slide is the preferred method, these digits can be written
beneath the first ten letters of the sliding alphabet; it is then
possible to slide them into position below the index (the stationary
_A_), in the same way as the letter-keys. The Gronsfeld cipher, then,
is no more than a minor variation of the Vigenère, and requires no
separate discussion other than a simple reminder that its
possibilities are far more limited than those of the Vigenère proper.
That is, it covers a range of only ten cipher alphabets where the
Vigenère covers 26, and this limitation more than compensates for the
fact that its key is not a plaintext word (presuming, that is, that
we know what cipher has been used. Otherwise, the difficulties are
about the same for both). To understand how this limitation may
modify the case, let us examine the work-sheet shown in Fig. 93.
Figure 92
GRONSFELD Encipherment
Key: 2 8 1 0 5 2 8 1 0 5 2 8...
Plaintext: S E N D S U P P L I E S...
Cryptogram: U M O D X W X Q L N G A...
Here, we have exactly the routine of Fig. 90, except that our search
must be made for probable trigrams, and not for a probable word. We
have begun with the most likely trigram, _THE_. But here we do not
find it possible to do as we did in Fig. 90; that is, _decipher every
letter_, first as _T_, then as _H_, then as _E_. Of the twelve
cryptogram-letters present, only seven can be deciphered as _T_; the
rest are too far away from it in the normal alphabet, and would
require keys larger than 9. Of the six letters which immediately
follow the possible _T_’s (the seventh is not shown), only three can
be deciphered as _H_. And of the three letters which immediately
follow a possible _TH_, only two can be deciphered as _E_ or as _A_.
It is often possible, in these ciphers, to investigate simultaneously
the trigrams _THE_ and _THA_. So far as the cryptogram is shown, then,
there are only two points at which a trigram _THE_ can be present,
while a Vigenère cryptogram of the same length would have presented
ten possibilities. Thus, we have no real need for a second work-sheet;
the only possible key-fragments, 114 and 790, can be tested by any
hit-or-miss method which happens to be quickest.
Figure 93
Decrypting a Known Gronsfeld
Cryptogram Fragment: X U I I A Q E U U Y J W.......
Trigram tried: T 4 1/ 7/ 1 1 5/ 3
H 1/ 9/ 2/
E 4/ 0/
The sequences U I I and A Q E are the only points at which the trigram
T H E could possibly be present, so that only the key-sequences 1 1 4
and 7 9 0 are to be tried. The digram T H alone may be present at Y J.
This cipher is often decrypted in much the same way as a “Caesar”
simple substitution (shown in Fig. 61). The cryptogram, or a
convenient portion of it, is copied on a single line of writing; then,
with each letter as a point of beginning, a series of alphabets is
extended (written in reverse order), but only for a distance which
includes ten letters. That is, the ten possible decipherments for
each cryptogram-letter are written in the form of a ten-letter column.
The decryptor may then inspect the ten rows of decipherment to see
what he can find. At any point where it is possible to find _T_, _H_,
and _E_ in three consecutive columns, the correctness of this possible
_THE_ can be checked by finding out whether or not it has a series of
companion-trigrams standing at some regular interval on exactly the
same three rows.
* * *
In Fig. 94, we have the tableau of Giovanni Battista della Porta,
adjusted to suit the modern 26-letter alphabet. Here we have only
thirteen cipher alphabets, each of which may be governed by either of
two key-letters; these pairs of keys may be seen at the left of their
respective alphabets. In all thirteen of these cipher alphabets, the
encipherment is _reciprocal_. In the _AB_-alphabet, for instance,
which is the first one on the chart, the substitute for _A_ is _N_,
and the substitute for _N_ is _A_. The Porta cipher, the oldest known
of its kind, employs a key-word, applied as in Vigenère. If the
key-letter in use is either _A_ or _B_, the topmost alphabet is the
one to be used; if the key-letter is either _C_ or _D_, the second
alphabet must be used; and so on. Where this encipherment is
illustrated in Fig. 95, it may be of some interest to observe that it
is not totally impossible for two different key-words to produce
identical cryptograms. As to decipherment, we have already mentioned
the fact of reciprocal substitution. Whenever the alphabets are
reciprocal (in any cipher), the decipherment is identically the same
process as encipherment.
Figure 94
The PORTA Tableau
AB A B C D E F G H I J K L M
N O P Q R S T U V W X Y Z
CD A B C D E F G H I J K L M
O P Q R S T U V W X Y Z N
EF A B C D E F G H I J K L M
P Q R S T U V W X Y Z N O
GH A B C D E F G H I J K L M
Q R S T U V W X Y Z N O P
IJ A B C D E F G H I J K L M
R S T U V W X Y Z N O P Q
KL A B C D E F G H I J K L M
S T U V W X Y Z N O P Q R
MN A B C D E F G H I J K L M
T U V W X Y Z N O P Q R S
OP A B C D E F G H I J K L M
U V W X Y Z N O P Q R S T
QR A B C D E F G H I J K L M
V W X Y Z N O P Q R S T U
ST A B C D E F G H I J K L M
W X Y Z N O P Q R S T U V
UV A B C D E F G H I J K L M
X Y Z N O P Q R S T U V W
WX A B C D E F G H I J K L M
Y Z N O P Q R S T U V W X
YZ A B C D E F G H I J K L M
Z N O P Q R S T U V W X Y
The Porta tableau, being smaller than the Vigenère, is not at all
inconvenient to prepare and use as it stands. It can be made still
more compact: The upper half being alike for all thirteen cipher
alphabets, this half can be written _once only_, at the top of the
chart. The lower halves can be written below this on thirteen parallel
lines, with their pairs of keys at the left. A ruler may then be
used, as suggested for Vigenère, to point out any given lower half.
But when it is noticed that these lower halves are identically the
same series of letters, with its point of beginning shifted one
letter at a time, it is promptly seen that a slide is possible, on
which the _N_-to-_Z_ half of the normal alphabet, if written twice in
succession, could be placed in 13 different positions with reference
to the _A_-to-_M_ half; and a slide is more convenient still. The
slide shown in Fig. 96 is another of Ohaver’s devices. The only new
feature in connection with the Porta slide lies in the handling of
the key-letters, which, in this cipher, are no longer the first
letters of their cipher alphabets. Mr. Ohaver has added them on the
sliding portion of the device, each pair of keys being placed directly
below the letter which must stand beneath the index (_A_) whenever one
or the other of the pair is the key-letter in use.
Figure 95
Porta Encipherment
Keyword: E A S T E A S T
Plaintext: S E N D S U P P...
Cipher: D R E Z D H G G...
(Compare:)
Keyword: F A T S F A T S
Plaintext: S E N D S U P P...
Cipher: D R E Z D H G G...
The Porta cipher, aside from its purely historical interest, provides
a most interesting decryptment study in the formation of its
alphabets. Notice that because of the encipherment scheme itself, it
becomes totally impossible that the substitute for any letter, in any
cipher alphabet, can ever be taken from its own half of the normal
alphabet. This limitation is far more visible than that of the
Gronsfeld. We have, say, a cryptogram sequence _H E P_. Can this
represent the trigram _THE_? No, because _E_ cannot represent _H_;
for the same reason, it cannot represent _THA_. Can it represent
_AND_? No, because _H_ cannot represent _A_. Can it represent _ENT_?
No, because _H_ cannot represent _E_. Can it represent _ION_? _TIO_?
_FOR_? _NDE_? _HAS_? It is not until we reach _STH_ that we find a
normally frequent trigram which could have the substitutes _HEP_.
But to gather the full significance of this Porta limitation, and
also a suggestion concerning the detail work when taking advantage of
it, let us picture the case of a probable word: INFANTRY.
Figure 96
A Slide for PORTA - Devised by OHAVER
┌─────────────────────────────────┐
│ A B C D E F G H I J K L M │
┌───────────┤ ┌───────────────────────────┐ ├───────────┐
│ N O P Q │ │ T U V W X Y Z N O P Q R S │ │ V W X Y │
│ │ │ │ │ │
│ │ │ (Keys) │ │ │
│ A C E G │ │ M O Q S U W Y │ │ │
│ B D F H │ │ N P R T V X Z │ │ │
└───────────┤ └───────────────────────────┘ ├───────────┘
│ │
└─────────────────────────────────┘
Using digits 1 and 2 to mean, respectively, the first and the second
half of the normal alphabet, this probable word INFANTRY has the
alphabetical pattern 1 2 1 1 2 2 2 2. And, since every substitute
must have been taken from the other half of the normal alphabet, it
will certainly be represented in any Porta cryptogram by eight letters
having the opposite alphabetical pattern: 2 1 2 2 1 1 1 1. Moreover,
a pattern as long as this is not going to be found very often in any
one cryptogram. The decryptor, then, may proceed as in Fig. 97. Each
cryptogram letter is marked I or 2, or imagined to be so marked, and
this series of digits is examined in the hope of finding a sequence
2 1 2 2 1 1 1 1. If it cannot be found, the word is not present; if
it is found, it can be assumed to represent the word INFANTRY. Here,
we meet with a slight difference between the procedure for Vigenère
and the procedure for Porta.
Figure 97
THE PROBABLE WORD METHOD IN PORTA
Pattern of word INFANTRY: 1 2 1 1 2 2 2 2
Pattern of substitute: 2 1 2 2 1 1 1 1
The cryptogram, with pattern:
F J I D T U V S S L F F I T X M S T M E D L
1 1 1 1 2 2 2 2 2 1 1 1 1 2 2 1 2 2 1 1 1 1
Determining the KEYWORD:
.....X M S T M E D L.....
I N F A N T R Y
E C A M C E C A
F D B N D F D B
D A N C E
In Vigenère, we found it possible to discover the key by simply
taking the probable word and deciphering with it. In Porta, we cannot
do this. We must first pair the two letters, that is, a supposed
substitute with its supposed original, and then find out what key
would cause this. In the figure, for instance, we have a sequence _X
M S T_, assumed to represent _I N F A_. The first corresponding pair
is _X_ = _I_. If we are using the tableau of Fig. 94, one of these
letters, _I_, is never found anywhere except in the 9th column. We
find the _I_-column, and trace down until we find _X_; the key, in
this case, must be _E_ or _F_, The next corresponding pair of letters
(_M_ representing _N_) demands that we find the _M_-column and trace
down to _N_; key _C_ or _D_. The third pair (_S_ representing _F_)
demands that we find the _F_-column, and trace down to _S_; key _A_
or _B_. The fourth pair (_T_ representing _A_) demands that we find
the _A_-column, and trace down to _T_; key _M_ or _N_.
Using the slide of Fig. 96: Place _X_ and _I_ together, and note that
the key-letters standing below the index (stationary _A_) are _EF_.
Place _M_ and _N_ together, and note key-letters _CD_. Place _S_ and
_F_ together, and note key-letters _AB_. Place _T_ and _A_ together,
and note key-letters _MN_. From the recovered pairs of key-letters,
we are to select one each in order to recover the key-word, using
somewhat the logic we might apply in dealing with a key-phrase
cryptogram. In the given case, where we need the two vowels to form
any word at all, it is not difficult to surmise that the key-word was
DANCE. It might not be so easy to decide as between EAST and FATS;
but key-words, as a rule, are seldom so short as those we have been
using, and the longer the word, the fewer the possibilities.
Concerning keys, however, there is one contingency which may have to
be considered: The various modernized versions of this tableau are
not always duplicates. The cipher alphabets will be the same as those
given here; but where we have caused these to shift in the normal
direction, another tableau may show them shifting in reverse. The
first alphabet will be the same as here, but the second, still showing
key-letters _CD_, will show its lower half beginning _Z N O P_. . . ;
the third, still showing key-letters _EF_, will show its lower half
beginning _Y Z N O P_. . . ; and so on. The recovery of the key-word,
of course, is not vital.
* * *
Coming now to the two ciphers which are called Beaufort, we return to
a tableau so closely resembling Vigenère’s tableau that the two can
be used interchangeably. Fig. 98 shows only enough of the Beaufort
tableau to bring out the difference in form. Here, we find no separate
plaintext alphabet and no separate key-alphabet. Those which form the
square have been lengthened by repeating their first letters; and a
27th alphabet, added at the bottom of the tableau, repeats the
alphabet shown at the top. In this way, we have a 27 x 27 alphabet
square in which _all four of the outside alphabets are exactly alike_.
These ciphers, also, make use of a key-word, applied as in Vigenère
and in Porta. As Sir Francis Beaufort himself is said to have used
the tableau, the encipherment of a given plaintext-letter, using a
given key-letter, was accomplished as follows: To encipher plaintext
_S_ with key _C_, find the letter _S_ in any one of the four outside
alphabets, trace into the square along the _S_-column (or row) as far
as the key-letter _C_; at that point, turn a right angle, in either
direction, and trace outward along that row (or column), emerging
from the square at the substitute, which, in the given case, is _K_.
Or: To _decipher_ _K_ with key _C_, begin with _K_, and _follow
identically the encipherment process_, emerging this time at the
plaintext letter, _S_. This process we have called the _true Beaufort_
cipher. Notice that we have _reciprocal encipherment_; encipherment
and decipherment are identically the same thing.
Figure 98
Upper Portion of the BEAUFORT Tableau
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A
B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B
C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C
D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D
E F G H I J K L M.... (Etc.) ....W X Y Z A B C D E
There are no external alphabets. The four outer alphabets of the
square are exactly alike, with A in each of the four corners.
TRUE BEAUFORT Encipherment VARIANT BEAUFORT Encipherment
Key: C O M E T C O M E T C O Key: C O M E T C O M E T C O
Plaintext: S E N D S U P P L I E S Plaintext: S E N D S U P P L I E S
Cipher: K K Z B B I Z X T L Y W Cipher: Q Q B Z Z S B D H P C E
As to the companion cipher, the student will promptly have guessed
this for himself: Instead of starting with the plaintext-letter, _S_,
and tracing inward to the key-letter, it is entirely feasible to begin
with key-letter _C_ and trace inward to the plaintext-letter _S_,
emerging at _Q_ instead of at _K_. This cipher, too, is called
Beaufort, since its method of accomplishment is Beaufort’s method.
But there is a difference in the two resulting ciphers; notice here
that the encipherment is no longer reciprocal; should we start at
key-letter _C_, trace inward to the new cipher-letter, _Q_, and then
trace outward, we do not emerge from the square at the plaintext
letter _S_, but at _O_, an entirely new letter. In order to
distinguish the two ciphers, we have referred to this second process
as the _variant Beaufort_, or sometimes, more briefly, as “the
variant.” There is some justification, also, for calling it the
“Vigenère-Beaufort.” To see why, the student may turn back to his
Vigenère tableau, and actually perform the encipherment, using only
the two sides of this tableau in which the alphabets run from _A_ to
_Z_.
In applying the variant encipherment, in which key-letters are found
first, he need find a given key-letter but once, then lay a ruler
along the row (or column) indicated by that key-letter, and encipher
at a single writing all plaintext letters which are going to have that
particular key. But if, as previously recommended, he has familiarized
himself with the use of the Vigenère tableau, he will see instantly
that the operation which, in the variant Beaufort he is calling
_encipherment_, is identical, in every particular, with the operation
which, in Vigenère, he would have called _decipherment_, and that, in
order to decipher the variant, he must perform the operation which,
in Vigenère, is called encipherment. Neither of these operations
provides a reciprocal substitution; instead, they are reciprocal to
each other. Once it is seen that this is true, it becomes equally
plain that the Saint-Cyr slide serves just as well for the variant
as for the Vigenère. To make use of it in applying the variant
encipherment, set key-letters below index-letter _A_, exactly as if
making ready to encipher in Vigenère, but reverse the functions of
the two alphabets; that is, find all plaintext letters in the lower
one, and take their substitutes from the upper one.
Figure 99
How to find the C-alphabet of each Beaufort
TRUE BEAUFORT VARIANT BEAUFORT
Key: C C C C C C C C Key: C C C C C C C C
Plaintext: A B C D E F G H... Plaintext: A B C D E F G H...
Cipher ALPHABET: C B A Z Y X W V... Cipher ALPHABET: Y Z A B C D E F...
Now, consider the true Beaufort cipher: Here, plaintext letters are
found first, and keys are found by tracing into the square, so that
encipherment is more or less a letter-by-letter process, and hardly
so convenient as in the other two ciphers. It is true that every
ascending diagonal in the tableau is made up of only one key-letter,
so that a ruler, laid diagonally across this tableau, will point out
a whole line of _C_’s, or _O_’s, or _M_’s. But practically every one
of these diagonals is broken into two portions, so that in attempting
to encipher by one key-letter at a time, we find it rather confusing
to make the necessary adjustments. Is there not, then, a more
convenient method for applying the Beaufort? Every cipher of this
family, remember, provides a certain number of individual simple
substitution cipher-alphabets. For every key (whether it is a letter
or a number) there is some kind of cipher alphabet showing a
substitute for _A_, a substitute for _B_, a substitute for _C_, and
so on. To isolate one of these cipher alphabets, and find out what it
is like, we have merely to take some one key-letter (or some one
key-number) and discover what these substitutes are, and what their
order is; that is, we need merely _encipher the normal alphabet_,
using this one key. This is true of every cipher of the
multiple-alphabet type. The process can be seen in Fig. 99, where the
_C_-alphabet (that is, the alphabet governed by key-letter _C_) is
being isolated for each of the Beaufort ciphers.
In the Beaufort proper, we find that the _C_-alphabet will begin with
_C_ and come out in the order _C B A Z Y X_. . . . , which is merely
the normal alphabet reversed. Should we investigate the _D_-alphabet,
we should find that this begins at _D_ and comes out in the order
_D C B A Z Y_. . . . , again the normal alphabet reversed; or,
investigating the _E_-alphabet, we should find _E D C B A Z_. . . . ,
always the normal alphabet written backward, and always beginning with
whatever letter is called the key. This being the case, it becomes
quite evident that a slide is possible, and the formation of this
slide is clearly indicated in the left-hand tabulation of the figure:
Its upper alphabet must run in one direction and its lower alphabet
in the other; if one of the two is made of double length, it becomes
possible to place any one of the 26 key-letters in juxtaposition with
index _A_, thus bringing into position any one of the 26
cipher-alphabets which are governed by these keys. Nor does it make a
particle of difference which of the two _A_’s, the upper or the lower,
is regarded as the index-letter; when _C_ is standing below _A_, then
_A_ is also standing below _C_. We saw, in the tableau itself, that
the true Beaufort encipherment gives reciprocal substitution. This,
however, was not our first meeting with one of the Beaufort alphabets;
in Chapter IX, we met the _Z_-alphabet. We saw there that whenever a
cipher alphabet is merely the plaintext alphabet written backward, it
makes no difference which of the two is called a cipher alphabet; we
may see here that this fact is not altered by shifting one of the
alphabets. Since a slide is possible, it follows that a disk is also
possible. This particular cipher disk, on which one alphabet runs
forward and the other backward, was used long ago in our own army,
and is widely known in this country as “The United States Army Cipher
Disk.” Most persons, apparently, prefer the slides, on which the
letters are always right-side up, and the preparation of which does
not involve the division of a circle into 26 equal arcs. Of those who
prefer the disks, practically all will make the smaller disk
_reversible_, with the normal alphabet on one side and the reversed
alphabet on the other.
Figure 100
A Pair of COMPLEMENTARY Alphabets:
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
A Z Y X W V U T S R Q P O N M L K J I H G F E D C B
By doubling the length of one or the other of these
two alphabets, we may use them to form a slide which
will encipher and decipher the true BEAUFORT.
Now, returning to our Fig. 99, and examining its right-hand
tabulation: We find that, in isolating the _C_-alphabet of the
variant Beaufort, we have merely reproduced the _Y_-alphabet of the
Vigenère. Should we now isolate its _Y_-alphabet, we should find that
we have obtained the _C_-alphabet of the Vigenère. Further
investigation will show that the _D_-alphabet of one is the
_X_-alphabet of the other, that the _E_-alphabet of one is the
_W_-alphabet of the other; and so on. Only their _A_-alphabets and
their _N_-alphabets are keyed alike. Thus we seem to have here a case
of “reciprocal” key-letters. These particular pairs of corresponding
letters, _B_ and _Z_, _C_ and _Y_, _D_ and _X_, and so on, are called
_complements_, one letter of each pair being _complementary_ to the
other. Since the letters _A_ and _N_ have no complements (or serve as
their own complements), the normal alphabet will furnish only twelve
such pairs, and these are shown complete in Fig. 100. In this same
set-up, it can be seen that the _A_-alphabet of the Beaufort cipher
is the complement of the normal alphabet. Thus, having provided
ourselves with a Beaufort slide (or disk), we have always at hand a
means for finding out the complements of letters. Once it is clearly
understood that the chief difference between a Vigenère cryptogram
and a variant cryptogram lies in the names of their respective cipher
alphabets, it becomes evident that we might decrypt a variant,
believing it to be a Vigenère, and have no trouble whatever in
reading its message, though finding that it has an _incoherent key_.
Vigenère keys, of course, can be incoherent; occasionally they are
based in some way on numbers, following the Gronsfeld scheme. But
usually, this is not true; the incoherency is only apparent, and a
little investigation will discover what the trouble is. In the case
just mentioned, the variant key-word COMET will come out in Vigenére
as _Y M O W H_, or vice versa; all that is necessary, in order to
discover the original key-word, is to set the Beaufort slide at the
_A_-alphabet, and perform a bit of simple substitution. Another cause
for the apparently incoherent key lies in the use of some other
index-letter than the stationary _A_. Say, for instance, that the
encipherer has used the key-word COMET, but has placed his key-letters
beneath index _D_. The key recovered by the decryptor is _Z L J B Q_;
to find the original key-word, he need merely “run it down the
alphabet.”
Figure 101
Applying a PROBABLE WORD to BEAUFORT
(a)
Cryptogram, TRUE BEAUFORT: K K Z B B I Z X T L Y W T Q
Probable word.......... S C C R T T A R P L D Q O L I
U E T V V C T R N F S Q N K
P O Q Q X O M I A N L I F
P Q . . . M I A N . I .
L E
I T
E C
S O
Use the word SUPPLIES as a trial key, exactly as in Vigenère, but make
use of the VARIANT method, and not tho TRUE BEAUFORT.
***
***
(b)
Cryptogram, VARIANT BEAUFORT: Q Q B Z Z S B D H P C E H K
Probable word............. S Y Y J H H A J L P X K M P S
U W H F F Y H J N V I K N Q
P M K K D M O S A N P S V
P . . . . O S . N . P .
L W
I H
E Y
S M
This was deciphered as a Vigenère, and showed the repeating of a scrambled
key: Y M O W H. Had it been deciphered with the BEAUFORT SLIDE, suggested
in Figure 100, it would have reproduced the plaintext keyword, C O M E T.
Of the ciphers we have seen, then, those three which are complete,
that is, which employ a full 26 alphabets, are curiously interrelated
to one another. In the matter of substitution (encipherment and
decipherment), the Beaufort stands alone, in that it is reciprocal,
while the other two ciphers are reciprocal to each other in this
respect. But in the matter of keys, it is the Vigenère which stands
alone, in that it can be deciphered indifferently by key-letter or
message-letter, where this is not true of either Beaufort. _In this
respect, these two ciphers are reciprocal_. To see this plainly, we
may examine our three encipherments, each one showing a different
cryptogram obtained from the plaintext fragment SEND SUPPLIES, using
key COMET. The Vigenère version was seen in Fig. 90. If this be
_deciphered with its message_, SEND SUPPLIES, the result is a
repeating key-word COMET COMET CO. The other two cryptograms were
those of Fig. 98. Here, the Beaufort cryptogram, beginning
_K K Z B B_, if deciphered with the key COMET, gives the
message-letters _S E N D S_. But when we attempt to decipher it using
_S E N D S_ as our key, we obtain: _I U O C R_. It becomes necessary,
in order to find out our key-letters, that we proceed as we did for
Porta: Assuming that the slide is being used, place message _S_
beside cipher _K_, and find out what key-letter is standing beside
the index _A_. Place _E_ and _K_ together, and find the next key,
and so on. That is, change the position of the slide for every
decipherment.
In this same figure, the variant cryptogram begins _Q Q B Z Z_. If it
be deciphered with the correct key-word COMET, we obtain the correct
message-letters, _S E N D S_. But if we attempt to decipher it with a
key _S E N D S_, we obtain the same series as in the other case:
_I U O C R_. To decipher it as a variant, we must again proceed
letter by letter. How, then, are we going to apply a probable word as
we did with the Vigenère in Fig. 90? How are we going to decipher a
whole row of letters, first as _S_, then as _U_, then as _P_, and so
on? Must we do this letter by letter, shifting the slide for every
letter on every row? And suppose it is a page of trigrams, where we
wish to decipher every trigram on the page as _THE_? Is there no way
in which we can decipher all first-letters as _T_, all second letters
as _H_, and all third letters as _E_, with only three settings of a
slide? The answer is simple. _Switch the slides_. We have said (and
shown) that in this respect the two Beauforts are reciprocal. Where
the cryptogram is true Beaufort, and you desire to use your probable
word as a trial key, do this with your Saint-Cyr slide (used in
reverse, that is, as if enciphering in Vigenère). If your cryptogram
is variant Beaufort, use the Beaufort slide (or treat it as a
Vigenère, and obtain the key later). Both cases can be looked at in
Fig. 101. The cryptogram at (a) is our same Beaufort cryptogram; that
at (b) is our same variant. In another chapter, we shall look a little
more closely into this odd triangle of Vigenère-variant-Beaufort.
Meanwhile, the interested student might like to investigate for
himself a few of the curious angles:
Would it be possible to prepare a tableau for the true Beaufort, and
use it in exactly the manner described for Vigenère? Recalling the
appearance of the Vigenère tableau (Fig. 85): Suppose we should add
to this another vertical alphabet, this time on the right-hand side,
causing this new alphabet to begin at _A_ and run backward,
_A Z Y X_. . . . Could this new alphabet be made to serve any useful
purpose? More than one? What about the reversible cipher-disk? Is
there any way at all in which it would be possible to encipher and
decipher Vigenère cryptograms with a Beaufort slide, or Beaufort
cryptograms with a Vigenère slide? Could you make a cipher disk for
the Porta?
110. By NEON. (Gronsfeld).
J Q Q Y P I R S F Q Y J N E U R U V E F V W P E B Q F G T E M K U K G
R W E T Z I D V I Q Q S Z I H K W M C E K B F J Q Q X T R F V R J K O
A T E E N J U M S N G L P I B S O A S R Y S A X R U O J G W M V R U S
V D Q Q R D P P K P L I C.
111. By B. NATURAL. (Gronsfeld).
L N P L G S Y R U A I R I Q X R E N D I U U N H D
Y M S U U O Q N S T I T U G L W R E R V B Z D U Q
S I C T U Q B T F X J F E H J W N I K U N H A Y H
I E P R G X K W M P U K U L F N G Q P R B X Z R E
T E U U W T R X J F N H J Y O J U V S P N W O Z G
S O Q C J N W K G E B X Z R I P U N X B N A W O -
112. By B. NATURAL. (Porta).
I O U K J G F Y S M Q S X H W W D P K M M J E S P Y W Y L B X B V U D
X T V L V O G Q K S L W W Q S E U D K W J I A M G W Z C W F O U I M M
V Z F U Q K S O X D S E L E E P T I O T U L U L W W P K Q K S Z E U.
113. By KRIS KROST. (Beaufort. Probable word: AMERICA).
N D L H T I E Y R K F M F H L C S Z Q A H B H T Y H A F P I V I D C S
X P Z E X N K W Q R M S A H E Q X G R E H A U H G D S O O A G X U G D
W G T I L S A P D V H A Q W E W Z M I M Y Y Q O B F E K C M M T F N E
V H W Z Y B G P W V E H R Z V U O O N B K X F O Z J A Z I Q N Z T T O
P R V I T.
114. By WHOSIT. (Variant Beaufort).
K O A S Y B B S G P A R Y A T F R F D U L W H J A R G H S G U W D B C
J R V M C U P S T Q W M B Y S I W Y I F H B A A F I A N Y H J L S B T
J O C Z E E N N R U A S R U I E J N O E P S G C G W V U M E A K W R L
Y H N S R G H B A H.
115. By PICCOLA. (Short Simple Substitution. - No keyword).
O F T D A F F B E H Z H W G W F O M; M F W R J D E D N V F P Z K
W F D Y F M Z Q K K Z T.
CHAPTER XIV
The Kasiski Method for Periodic Ciphers
Prior to the 1860’s, the ciphers of the past two chapters had been
regarded as entirely safe. A radical change of opinion took place in
1863, when Major F. W. Kasiski, a German cryptanalyst, was so
indiscreet as to publish certain of his observations. The student
will surely have noticed, among the examples of Chapters XII and XIII,
the happening which is suggested in Fig. 102. Some sequence, usually
a digram, is repeated in the plaintext, and happens to be enciphered
more than once by exactly the same few key-letters; the result is a
_repeated sequence in the cryptogram_. What he may have failed to
notice is the _periodicity_ of such repeated sequences. In order that
the same few key-letters be used again, _the key-word must have been
repeated an exact number of times_, so that, in these cases of
repeated cryptogram-sequences, the distance from first-letter to
first-letter is _evenly divisible by the key-length_ — or period (in
the figure, the distance from _V_ to _V_ is 10, which is twice the
key-length, 5). This does not mean that all repeated sequences found
in Vigenère cryptograms are periodic. Often, they are purely
accidental; oftener still, they will be due to the repetition of
alphabets in the key itself, especialiy if it is such a word as
CORCORAN or DESDEMONA. But a distinct majority of them, according to
Kasiski, are caused by periodicity; and if all of the repeated
sequences found in a given cryptogram be examined to find what the
separating interval is in each case, and if all of these intervals be
factored, _the factor which predominates will betray the period of
the cryptogram_.
Figure 102
A common happening in all PERIODIC ciphers:
Vigenère key: C O M E T C O M E T C O M E T C O M
Plaintext: T H E R E I S A N O T H E R Q U E S
REPEATED SEQUENCE: V V Q V . . . . . . V V Q V . . . .
In order to have a look at the Kasiski method, we will consider the
cryptogram shown in Fig. 103; and, to approximate a more troublesome
case, we will assume that no repeated sequences can be found except
those few which have been underscored in the figure. With the
cryptogram-letters serially numbered, in the manner shown, the
distance apart of any two of them is readily learned by subtraction.
The digram _CH_ is found beginning at the 1st letter and again at the
46th letter; 46 minus 1 equals 45, their distance apart. Thus, if
_CH_ is one of the periodic repetitions, the period could be 15, 9,
5, or even 3. The trigram _UBF_, 8th and 63d letters, shows an
interval 55; here, the period could be 11 or 5. Notice that a period
5 has been indicated by both.
Now let us look at Fig. 104, where the method of presentation is once
more a debt to M. E. Ohaver. In this figure, the repeated sequences
have been listed, and each one is accompanied by the two serial
numbers of its two first letters, together with the interval which
was obtained by subtraction. Ohaver’s process provides a column for
each possible factor, beginning with 2 and carried as far as desired.
Opposite each interval, its various possible factors may then be
noted in their correct columns. In the average case, the correct
period will be pointed out by _the column showing the largest number
of entries_. But in this connection, it must be taken into
consideration that _small_ factors 2 and 3, and even factors 4 and 5,
are usually present in considerable numbers, partly as accidentals,
but also because they are factors of the period itself; that is, if
the period is 6, there will surely be factors 2 and 3 for every
factor 6, and there will usually be a few extra appearances due to
accidental repetition.
Figure 103
5 10 15 20 25 30
C H G S L F A U B F X U P H S J D A G Y X M N Z U W W J P D
35 40 45 50 55 60
J S U P L G C G F K R N I M F C H K O A Q A V X O N N U I L
65 70 75 80 85 90
N S U B F N D V P K A I P L S N M Q O H M E U I L B L K Q W
95 100 105 110 115 120
N D V I Y X U I I A Q E U U Y J W C O K O E N M P W W J J J
125 130 135 140 145 150
Q I U O V C M W D O X F C O L F S K U L V B W U N R V G T B
155 160 165 170
B S Q N L U E P H A Q T Q X V A K Q O E
Now, considering our tabulation, and ignoring the fact that short
periods like 2 and 3 are seldom encountered, we find that factors 3
and 5 are present in equal numbers. Often, we are faced with exactly
this problem. Here are two factors which have appeared in approximately
equal numbers. Which one of these actually represents the period?
Ohaver’s recommendations include these: Where two factors seem almost
equally prominent, select the larger if it is a multiple of the
smaller. If one factor is not a multiple of the other, try to select
a period which is a multiple of both (as 15 here, includes both 3 and
5). He points out also that the factor which is the correct key-length
will usually be accompanied, in the tabulation, by quite a number of
its own multiples, growing gradually fewer and fewer as their size
increases. In this respect, our factors 3 and 5 are both disappointing.
If we consider factor 5, we find factors 10 and 15, but not growing
fewer; instead the number increases. We find no factor 20, but we do
find a factor 25; another increase. Or, if we consider factor 3, we
find factors 6 and 9, but no factor 12, and then a sudden increase in
the number of factors 15. This is a case in which the decryptor would
play safe by selecting the period 15.
Figure 104
Tabulation for Finding Period M.E.OHAVER
Repeated Positions - POSSIBLE FACTORS of INTERVALS
Sequence Intervals
C H 46 - 1 = 45 3 5 9 15
U B F 63 - 8 = 55 5 11
U P 33 - 12 = 21 3 7 21
S U 62 - 32 = 30 2 3 5 6 10 15
P L 73 - 34 = 39 3 13
W W J 116 - 26 = 90 2 3 5 6 9 10 15 18
N D V 91 - 66 = 25 5 25
The factors found in the largest number of DIFFERENT intervals are 3 and 5.
The student who cares to examine this matter more closely may do so
by preparing for himself a less haphazard listing of the cryptogram’s
repeated sequences. Perhaps the most satisfactory way of doing this
is to begin by making a general frequency count. Then, in order to
have the more reliable information at once, start the tabulations by
examining those letters whose frequency is only 2; follow this with
an examination of those having a frequency of 3, and so on. The
theory is that letters of these frequencies are much more likely to
belong to only one alphabet, while the letters of higher frequency
have probably been enciphered in several different alphabets, so that
their repeated sequences are not so sure to be periodic. For other
cases in which there may be some doubt, the writer’s advice is to
select large factors in preference to small factors. Or, if the
decision must be made between two factors such as 6 and 7, where a
period of 42 would be necessary in order to include both, simply
select the handiest and give it a trial. With the longer cryptograms,
as we shall see in a moment, an error in the choice is very speedily
discovered; as to the shorter cryptograms, there is one rule which
invariably holds good: _If you meet with any resistance at all_ in
dealing with the kind of ciphers which were shown in the past two
chapters, you have probably selected the wrong period.
Figure 105
Individual Frequency Counts - PERIOD 5
Alphabet 1 Alphabet 2 Alphabet 3 Alphabet 4 Alphabet 5
A 11 11 1 111
B 11 1 11 1
C 111 1 11
D 111 1 1
E 1111 1
F 11 1 1 111
G 1 111 1
H 11 11 1
I 11 11 1111
J 111 11 1 1
K 1 111 111
L 1 1 11111 11
M 1 111 11
N 11111 11 11 1 1
O 1 11111 1 11
P 111 111 1
Q 1111 1111 1
R 11
S 1111 1 11
T 1 1
U 1 11 11111 11 111 1
V 1 1 111 11
W 11 111 11 1
X 1111 11
Y 111
Z 1
Often, however, where one clue is missing, there will be another
present to take its place. Repeated _trigrams_ are less likely than
repeated digrams to be accidental, and longer repeated sequences are
still less likely to be so. In the present tabulation, we find that
three of the repetitions are trigrams; in all three cases the period
5 is suggested, while only one suggests also a period 3. That is, if
we use a period of 15, two of these trigrams will have to be
considered accidental.
If the period here is 5, then we are dealing with _five simple
substitution alphabets_. These five alphabets have been used over and
over again, always in a given rotation; therefore, if the cryptogram
be rewritten into _five columns_ (it is already conveniently grouped),
the letters in each column will belong to one same alphabet, and it
becomes possible to _take a separate frequency count on each one of
these five alphabets_. These individual frequency counts may be seen
in Fig. 105. Originally, we had a length of 170 letters, and, if the
student desires to take a frequency count on the complete cryptogram,
he will find that he has no truly predominant letters which could
represent some of the letters _E T A O N I R S H_. Instead, he has a
series of frequencies which are all fairly close to 4% of the text
(6 or 7), and which, should he rearrange them in decreasing order,
would have somewhat the following appearance:
10-10-10-9-9-9-8-8-8-7-7-7-7. . . . . .3-2-2-1. He will probably find,
also, that every letter of the alphabet has been used at least once,
something which would be very rare indeed in any normal English text
of 170 letters. But in these five individual frequency counts, each
belonging to a separate alphabet, matters are different. Here, the
alphabets represented have a length of only 34 letters each, and yet,
in the third, fourth, and fifth alphabets, there is one predominant
letter, which could represent _E_, or some other letter which has
taken the place of _E_, while, in the first and second alphabets,
there are some few letters distinctly more prominent than others.
Also, each alphabet has shown some gaps in sequence, where letters of
the class _J K Q X Z_, and possibly also some letters like _B P V W_,
would surely be missing in a normal text of only 34 letters.
A frequency count made on columns is not, of course, normal. We saw
this in dealing with transpositions, when we considered
vowel-distribution. Yet, as length increases, we find that the letters
present in columns begin to approach more and more the proportions
found in normal text; here, with only 34 letters, it would be
possible, in any one of these frequency counts, to assign the letters
to groups of high, moderate, and low frequencies. _Whenever our
frequency counts do not have this general aspect, the period cannot
be correct_. (There are, of course, the very short cryptograms, in
which the actual frequencies are not apparent.) So far, we are dealing
with any cipher whatever of the periodic type, and many of these
ciphers do not make use of simple shifted alphabets, or even of
alphabets which are in any way related to one another.
Now let us consider the one case in which the alphabets are all
“Caesars.” In this case, whether the cipher is Vigenère, Beaufort, or
Porta, we have only to identify one letter in order to identify a
whole alphabet. Suppose we examine, first, alphabet 5, in which the
one outstanding letter, _L_, has appeared 7 times. Does this letter
represent _e_? If _L_ of alphabet 5 represents _e_, then, counting
backward (that is, upward), we find that the letter _a_ will have to
be represented by _H_; this alphabet, then, will be the _H_-alphabet
if the cipher is Vigenère. The letter _H_ has a frequency of only 1,
which, in normal text, is not particularly satisfactory as the
frequency of _a_, but this frequency count has not been taken from
normal continuous text; suppose we examine the rest of the alphabet,
and find out what the frequencies would be for other letters.
Beginning at _H_, and calling letters in the order _a_, _b_, _c_, we
find that this fifth alihabet, provided it is the _H_-alphabet, will
contain: 3 _d_’s, 7 _e_’s, 2 _h_’s, 2 _l_’s, 2 _o_’s, 3 _r_’s,
3 _t_’s, and 3 _y_’s. That is, each letter present which shows a
frequency greater than 1 will represent some plaintext original
which, normally, is of some frequency, the only exception being _y_,
which is a vowel. This is the best we can expect of any columnar
frequency count made on only 34 letters; but more convincing still,
and more reliable, is the fact that out of the entire group
_j k q x z_ we find only _x_, represented once. Alphabet 5, then, is
entirely acceptable as the _H_-alphabet of the Vigenère cipher.
Let us see what we can find out about alphabet 3. Here, the strongly
predominant letter is _U_. But when we attempt to identify this as
_e_, we find that we should have to accept an alphabet containing
3 _q_’s, 2 _x_’s, and 3 _z_’s, all occurring in only thirty-odd
letters of text. We meet with similar trouble when we attempt to
identify _U_ as _t_, as _a_, as _o_, and so on. It is not until we
try it as _s_ that we have good luck, finding only a series of blanks
to represent the letters _b_, _j_, _k_, _q_, _v_, _w_, _x_, and _z_.
And if _U_ represents _s_, this alphabet begins at _C_. Alphabet 3,
then, is entirely acceptable as the _C_-alphabet of the Vigenère
cipher, and we have two of the key-letters: * * _C_ * _H_.
In alphabet 1, the leading letter, _N_, is not so strongly
predominant, and yet, when we assume it as the substitute for _e_,
we find that the rest of the count is satisfactory. Alphabet 1, then,
is acceptable as the _J_-alphabet of the Vigenère cipher and we have
three of the key-letters: _J_ * _C_ * _H_.
In alphabet 2, we find no one leading letter, but the two most
prominent frequencies are standing opposite _E_ and _S_, as if this
count might represent the normal alphabet itself. The absence of _O_
and the presence of only one _T_ is hardly significant in a columnar
count; but further examination shows an excess of _M_’s and _W_’s,
and this is more disturbing. However, a single _K_ has appeared as
the only representative of the group _J K Q X Z_; the low-frequency
letters _B_ and _V_ have appeared but once each; and there is an
absence of _Y_’s to counterbalance those which were too numerous in
one of our other alphabets. So that a detailed examination, and the
failure to identify this as any other alphabet, will lead to its
tentative acceptance as the _A_-alphabet of the Vigenère cipher. (We
can know definitely when we attempt to decipher with it.) With
alphabet 2 accepted as the _A_-alphabet, we now have four of the
key-letters: _J A C_ * _H_. We shall return in a moment to consider
the one which is still missing; but according to those present, it
does not look as if our key is going to develop into a recognizable
word.
Alphabets of the kind we saw in No. 2 can be much more satisfactorily
identified by means of a _graph_. This graph, when the cipher is
Vigenère, is no more than a picture of the normal frequency table.
Ordinarily, it will be a strip of paper on which the normal alphabet
has been written twice in succession, with a straight line standing
at right angles to each letter, this line being long or short
according to the normal frequency of its accompanying letter.
A description of one such graph, suggested by L. H. Patty, will serve
to explain them all: Assuming that the several frequency counts are
standing in a vertical position, as we see them in Fig. 105, and that
the work has been done on quadrille paper, the graph will also be
prepared vertically, and the strip of paper will be quadrille paper
with squares of the same size, so that the spacing, vertically, will
be the same for graph and frequency counts. The graph, however, will
be twice the length of the frequency counts, and will carry the normal
alphabet written twice in succession (except that the final _Z_ can
be omitted). The basis for frequencies can be 200, 100, or any other
basis desired. If the basis is 200, each small square might represent
a frequency of 5, so that a horizontal line placed beside _E_
(frequency 24), would have a length of nearly five of the small
squares. Or, if the basis is 100, each small square might represent a
frequency of 2, and the horizontal line placed beside _E_ (frequency
12), would have a length of six of the small squares. Or, if this
same graph is being made on a typewriter, we might dispense with the
horizontal lines and use a series of diagonals (or 1’s, or asterisks),
after the manner of tally-marks, using whatever number of these is the
actual frequency of the letter per 200, or per 100; this will give a
good clear picture of the normal frequency count. It is understood
that the upper and lower halves of the graph are to be prepared
exactly alike, and that there is to be no skipping of extra spaces
between them. Thus the graph, being twice the length of the frequency
counts, and spaced to match them, can be moved up and down beside each
one of these until some point is found at which the _pattern_ of the
given frequency count bears some resemblance to a pattern found
somewhere on the graph. If no such pattern can be found, the
conclusion is that the frequency count was not made on one of the
simple shifted alphabets; however, due allowance must be made, as in
the case of our alphabet 2, for the difference in length and for the
fact that frequency counts of this kind have been made on columns.
Patty’s graph, so far, is representing only the shifted normal
alphabet; that is, the cipher alphabets belonging to Vigenère,
variant, and Gronsfeld ciphers. If its horizontal lines be made very
heavy, and retraced on the opposite side of the strip, and if the
letters be written on that side, opposite exactly the same horizontal
lines as before, the reverse side of the strip will furnish another
graph for identifying the reversed alphabets of the Beaufort cipher.
Other graphs can be prepared for other kinds of alphabets. For
instance, a graph suitable for examining a series of Porta frequency
counts could be made in two halves, each of double length; the
_A_-to-_M_ half would serve for comparison with the _N_-to-_Z_
halves of the frequency counts, and vice versa.
Figure 106
Another Tabulation for Finding the Period EDWIN LINDQUIST
Repeated Interval List of all PRIME Factors.....
Sequence 2 3 5 7 11....(Etc.)
J C V 24 111 1
C V 13
D D V 36 11 11
D S 12 11 1
S S 8 111
D T J 60 11 1 1
T J 48 1111 1
This was based on a cryptogram whose period was 12. The PRIME
FACTOR 2 is obviously included twice, and the PRIME FACTOR 3 once.
* * *
The Vigenère cipher, and, in particular, the Kasiski method of
solution, have given rise to much research among members of the
American Cryptogram Association. We doubt that any of this research
has ever resulted in any new or valuable discovery. Yet it is
interesting in that it shows a body of amateurs arriving at devices
which are fully as effective or convenient as those proposed by
seasoned cryptanalysts. Carter’s “discovery,” for instance, which we
saw in Fig. 90, was purely his own device; at that time, he had never
heard of the “probable word method” proposed by Commandant Bazeries,
one of the greatest of modern cryptanalysts. A great many of the
first suggestions were directed at methods for making the
trigram-search less tedious; these were largely duplications of a
same idea, involving the use either of a tableau or of a slide; one
example will be shown in the next chapter. The use of graphs, also,
was a sort of simultaneous “invention.” As to Kasiski processes, while
Ohaver’s tabulation had been published, it had been out of print and
was not available for several years. The only information to be had
was the fact that a period could be discovered by factoring intervals
between repetitions, and Edwin Lindquist, finding this rather vague,
devised for his own use the tabulation which is shown as Fig. 106.
This tabulation was made from a cryptogram in which the period was 12.
Lindquist, instead of preparing columns for all possible factors,
prepared them only for _prime factors_, the repeated sequences and
their separating intervals being listed in about the same way as in
Ohaver’s tabulation. Now, taking one of the intervals, as 24: Tally
in column 2, and the interval is reduced to 12. Tally again in column
2, and the interval is reduced to 6. Tally again in column 2, and the
interval is reduced to 3, which is itself a prime factor. Tally a
final time in column 3, and the interval 24 has been reduced to its
prime factors. This process is almost entirely mental, and _very
rapid_. Examining the results: Columns 2 and 3 are very full,
indicating that prime factors 2 and 3 are both included in the period.
But in column 3, the tallies are largely single, indicating that this
factor is included only once in the period; while, in column 2, the
tallies are largely in pairs, indicating that this factor is probably
included twice in the period; had it been included three times, it
would have shown up oftener in threes. Conclusion: The period is
2 x 2 x 3, which is 12. This tabulation will be found fully as
convenient as Ohaver’s, and its results fully as accurate.
Figure 107
The "SHIFT" Method for Identifying Alphabet 4 EDWIN LINDQUIST
Letters apparently of the high-frequency class: I O P U
Their possible originals................E T A O N I R S H
Amount of SHIFT if I represents.. 4 15 8 20 21 0 17 16 1*
" " " " O " .. 10 21 14 0 1* 6 23 22 7
" " " " P " .. 11 22 15 1* 2 7 24 23 8
" " " " U " .. 18 1* 20 6 7 12 3 2 13
A SHIFT of 1 (the B-alphabet) makes all four of these letters the
substitutes for high-frequency originals. It almost certainly
the shift which was made.
Mr. Lindquist also developed his own method for identifying alphabets.
This method, which, in theory, is _graphic_, is not particularly
applicable to the kind of alphabets we have been considering; that is,
it would not be needed when there is so much material. But for shorter
examples, where alphabets contain only ten or fifteen letters each, it
comes close to being that magical thing referred to by Lamb, a
“mechanical crypt-solver.” This method can be examined in Fig. 107,
where it is being applied to our so-far unidentified alphabet 4. An
examination of this alphabet 4 (of Fig. 105) shows that it has four
letters of more prominence than the rest: _I_, _O_, _P_, _U_. These
letters, or most of them, should represent high-frequency originals;
and our method consists in examining them collectively in order to
find out what amount of “shift” must have taken place in order that
some four of the letters _E T A O N I R S H_ would have resulted in
these four particular substitutes. The word “shift” is best understood
by picturing the movement of the lower alphabet on a Saint-Cyr slide.
If the two _A_’s are together, this is the starting position, and the
“amount of shift” is zero. If the _B_-alphabet be moved into position,
we have a _shift of 1_; if the _C_-alphabet be moved into position,
we have a _shift of 2_; and so on. These “shift-numbers,” 0 to 25,
can be written below the letters of the sliding alphabet.
Now, considering only one of our letters, _I_: If this is the
substitute for _e_, the normal alphabet was shifted 4 positions; if
it is the substitute for _t_, the amount of shift was 15; if it is
the substitute for _a_, the amount of shift was 8; and so on through
the rest of the nine letters belonging to the high-frequency group.
Finally, having considered our letter _I_ as the substitute for all
nine of these possibilities, we arrive at a _series of nine
shift-numbers_: 4-15-8-20-21-0-17-16-1. And unless one of these is
the correct shift, the cryptogram-letter I does not represent a
high-frequency letter at all. In the figure, this examination has
been made for all four of the letters _I_, _O_, _P_, and _U_, and
opposite each of these we have the resulting series of nine
shift-numbers. A comparison of the four series of numbers will show
that _each one includes a shift of 1_. A shift of 1, then, that is,
the _B_-alphabet, would have caused all four of our cryptogram-letters
to become substitutes for high-frequency originals. This is almost
certainly the shift which was made; but should the assumption prove
incorrect, then a shift of 7 has appeared in three of the lines, and
the _H_-alphabet would be the next choice. Lindquist’s method was
found so effective for cases of scant material, that two members of
the Association, M. R. Collins and Helen S. Pearson, decided,
independently of each other, to set it up in permanent form, so as
to avoid fresh computations for each new cryptogram.
Figure 108
Tableau Showing SHIFTS for Each Letter of the Alphabet - (MORRIS R. COLLINS)
For VIGENÈRE For BEAUFORT
E T A O N I R S H E T A O N I R S H
22 7 0 12 13 18 9 8 19 A 4 19 0 14 13 8 17 18 7
23 8 1 13 14 19 10 9 20 B 5 20 1 15 14 9 18 19 8
24 9 2 14 15 20 11 10 21 C 6 21 2 16 15 10 19 20 9
25 10 3 15 16 21 12 11 22 D 7 22 3 17 16 11 20 21 10
0 11 4 16 17 22 13 12 23 E 8 23 4 18 17 12 21 22 11
1 12 5 17 18 23 14 13 24 F 9 24 5 19 18 13 22 23 12
2 13 6 18 19 24 15 14 25 G 10 25 6 20 19 14 23 24 13
3 14 7 19 20 25 16 15 0 H 11 0 7 21 20 15 24 25 14
4 15 8 20 21 0 17 16 1 I 12 1 8 22 21 16 25 0 15
5 16 9 21 22 1 18 17 2 J 13 2 9 23 22 17 0 1 16
6 17 10 22 23 2 19 18 3 K 14 3 10 24 23 18 1 2 17
7 18 11 23 24 3 20 19 4 L 15 4 11 25 24 19 2 3 18
8 19 12 24 25 4 21 20 5 M 16 5 12 0 25 20 3 4 19
9 20 13 25 0 5 22 21 6 N 17 6 13 1 0 21 4 5 20
10 21 14 0 1 6 23 22 7 O 18 7 14 2 1 22 5 6 21
11 22 15 1 2 7 24 23 8 P 19 8 15 3 2 23 6 7 22
12 23 16 2 3 8 25 24 9 Q 20 9 16 4 3 24 7 8 23
13 24 17 3 4 9 0 25 10 R 21 10 17 5 4 25 8 9 24
14 25 18 4 5 10 1 0 11 S 22 11 18 6 5 0 9 10 25
15 0 19 5 6 11 2 1 12 T 23 12 19 7 6 1 10 11 0
16 1 20 6 7 12 3 2 13 U 24 13 20 8 7 2 11 12 1
17 2 21 7 8 13 4 3 14 V 25 14 21 9 8 3 12 13 2
18 3 22 8 9 14 5 4 15 W 0 15 22 10 9 4 13 14 3
19 4 23 9 10 15 6 5 16 X 1 16 23 11 10 5 14 15 4
20 5 24 10 11 16 7 6 17 Y 2 17 24 12 11 6 15 16 5
21 6 25 11 12 17 8 7 18 Z 3 18 25 13 12 7 16 17 6
Collins’ device took the form of a tableau, as shown in Fig. 108. In
this figure, the vertical alphabet running through the center is a
list of possible cryptogram-letters. On the side marked “Vigenère,”
the four lines of numbers standing beside the letters _I_, _O_, _P_,
and _U_, are the same as those included in Fig. 107. It will be
noticed that only the first line of numbers (opposite _A_) need be
found from the slide; after that, each column is a series 0 to 25.
The same is true with reference to the Beaufort shifts. These,
incidentally, were computed on the assumption that the Beaufort keys,
_A_, _B_, _C_, _D_. . . . . . . are passing in their normal
alphabetical order beneath the stationary _A_ (as most of us prepare
the Beaufort slide, this is backward). Fig. 109 shows a similar
tableau prepared for the Porta shifts. The zero-position here is the
_AB_-alphabet, a shift of 1 is the _CD_-alphabet, and so on. Collins,
however, did not use the shift-numbers. _He increased these by 1_,
using numbers 1 to 26, which represent the 26 positions of the slide,
or, better, the serial positions in the normal alphabet of the 26
key-letters. Others who have since prepared similar tableaux have
dispensed altogether with numbers, and have used the key-letters
themselves. Doing this, the first row of the Vigenère portion will
show the nine key-letters _W H A M N S J I T_, the second row will
show key-letters, _X I B N O T K J U_, and so on. If the letters
appearing on the slide have been numbered, one method is fully as
convenient as the other, though in dealing with a plaintext key one
would probably prefer the letters. In any case, where some four
letters, such as our _I O P U_ of the foregoing alphabet, have been
found more than once in a given frequency count, it is merely
necessary to find these four letters one by one in the vertical
alphabet and _copy_ their accompanying numbers. It is even possible,
having these three tableaux, to decide whether the frequency counts
taken from a periodic cryptogram represent the alphabets of the
Vigenère, the Beaufort, or the Porta.
Figure 109
Tableau Showing SHIFTS for PORTA
E A I H T O N R S
9 0 5 6 N 6 1 0 4 5 A
10 1 6 7 O 5 0 12 3 4 B
11 2 7 8 P 4 12 11 2 3 C
12 3 8 9 Q 3 11 10 1 2 D
0 4 9 10 R 2 10 9 0 1 E
1 5 10 11 S 1 9 8 12 0 F
2 6 11 12 T 0 8 7 11 12 G
3 7 12 0 U 12 7 6 10 11 H
4 8 0 1 V 11 6 5 9 10 I
5 9 1 2 W 10 5 4 8 9 J
6 10 2 3 X 9 4 3 7 8 K
7 11 3 4 Y 8 3 2 6 7 L
8 12 4 5 Z 7 2 1 5 6 M
Miss Pearson’s device took the form of _strips_, a set of 26 for each
of the three ciphers. Fig. 110 shows the first five of her Vigenère
set as she originally prepared them, using the “position-numbers,”
which are all larger by 1 than those of the tableau. Aside from this,
each strip represents one row from the Vigenère half of Collins’
tableau. But where Collins had arranged his numbers according to the
frequencies of the nine possible originals (so that possibilities
found on the left might have more significance than others found on
the right), Miss Pearson arranged hers in straight numerical order,
and spaced them in such a way that No. 1 is always in the first
column, No. 2 is always in the second column, and so on. Had she used
key-letters, all _A_’s would have been in the first column, all _B_’s
in the second column, and so on. As to the use of these strips:
Presuming that the four leading cryptogram-letters are the same as
before, simply pick out the four strips which are headed by the
letters _I_, _O_, _P_, and _U_, and set them together. If any of the
numbers are duplicated, _you will find them standing in the same
column_. These, remember, are the devices of amateurs, and both will
be found very effective. It will be noticed that the basis is the
finding of key-letters (or numbers) and not the identification of
cipher alphabets.
Now compare these devices with a method proposed by an expert, in
which the basis is the identification of cipher alphabets, and not
their keys: With this method, a tableau is prepared (which could be
arranged like the one of Fig. 85) in which the only letters shown on
any one line are the substitutes for the nine high-frequency letters.
If, for instance, the tableau is intended for the Vigenère cipher,
the top row will contain only the letters _A E H I N O R S T_, _and
the other 17 positions will be left blank_. The second row will
contain only the letters _B F I J O P S T U_, the third will contain
only the letters _C G J K P Q T U V_, and so on. Or, if the tableau
is intended for the Beaufort cipher, the top row will contain only
the letters _A W T S N M J I H_, the second row only the letters
_B X U T O N K J I_, and so on. Thus, after having taken a series of
frequency counts, we may find out, in each of these frequency counts,
which are its leading letters, then consult the prepared tableau to
find out which of its alphabets will show these same leading letters.
An added suggestion is as follows: Prepare the tableau, as described,
using black ink. Then, using red ink, add to each alphabet the
substitutes for _J K Q X Z_ (perhaps, also, for _B P V W_); that is,
the substitutes for those letters which ought to be largely _absent_.
This makes it much easier to decide between two alphabets in which
the more frequent letters have made it seem that one is as likely as
the other. It will be found that letters of low or moderate frequency
are ordinarily as helpful in these ciphers as those of high-frequency;
an instance has been pointed out in which those of the cryptogram can
be more so: Where the question is one of deciding between two possible
periods, a new tabulation can be made using only the sequences found
in connection with those letters which are less frequent in the
cryptogram than others, and thus not so sure to belong to more than
one alphabet.
Figure 110
Strips for Determining SHIFTS HELEN S. PEARSON
SET FOR VIGENÈRE
---------------------------------------------------------------------------------
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
A 1 _ _ _ _ _ _ 8 9 10 _ _ 13 14 _ _ _ _ 19 20 _ _ 23 _ _ _
=================================================================================
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
B _ 2 _ _ _ _ _ _ 9 10 11 _ _ 14 15 _ _ _ _ 20 21 _ _ 24 _ _
=================================================================================
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
C _ _ 3 _ _ _ _ _ _ 10 11 12 _ _ 15 16 _ _ _ _ 21 22 _ _ 25 _
=================================================================================
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
D _ _ _ 4 _ _ _ _ _ _ 11 12 13 _ _ 16 17 _ _ _ _ 23 24 _ _ 26
=================================================================================
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
E 1 _ _ _ 5 _ _ _ _ _ _ 12 13 14 _ _ 17 18 _ _ _ _ 24 25 _ _
---------------------------------------------------------------------------------
NOTE: The numbers here are POSITION-numbers, instead of SHIFT-numbers. A
shift of zero is "position 1" of a slide. This is also the numerical, or
serial, position of A in the normal alphabet. Most members of the American
Cryptogram Association prefer to dispense with numbers, and use key-letters.
We have seen, then, what can be done in place of the trigram-search in
the case of those longer cryptograms. Having one of only 170 letters,
we first found out its period, and then (presuming that we accepted
the _B_-alphabet in the case of alphabet 4), found out all five of
its key-letters _J A C B H_, and even the type of encipherment
(obviously Gronsfeld), _without having deciphered a single letter of
its message_. We are now in a position to go back and investigate any
which are still unsolved. With Vigenère methods and principles
thoroughly understood, the student is fully in possession of methods
for dealing with any periodic cipher whatever _in which he knows what
the cipher alphabets are_. All that remains, then, is to pick up a
few loose ends, and observe a few variations from the strictly
periodic encipherment, after which we may consider the case of the
unknown cipher alphabets.
116. By NEMO. (A Vigenère? Or a snare and a delusion?)
W L P C V M O G K E E I F M U R W W F H V M F F W E Y X A V U B I C Z
O J M L C H V X Y F K S C U S X I L M G B Q I D B W I F G B I Q Z G Z
H F J Y P M K I G V P T W Y K W Z H W M Z H W I F A P S D N W F H E D
S C X A V O E B Y Y O K C O Y U I H U J L H U D X P P W V V H P F W Y
L G F B V E J M A A G B P I E B A V U V Q L Z N L P W A J W.
117. By NEON. (U.S.Army Cipher Disk. Surely not an advertisement?)
D J T X J M H L M K O M F D T F N E U I G D D N A A U S N S A C F G Y
M Z Y A Q A N M W U W S R B R F J J Q S K A Y B A N B L T O J E R K S
N W X A G T J L Z Y S T V A R B X L K N R L V D U U F O F A K Z L W Y T E E W.
118. By TITOGI. (What! Another Vigenère? Some collusion here!)
D W P W Z T C G H H Z B B V W F B H I F W Q B L L J D Z R G U M M E S
W B D W L J K X I F Y Z D G K Y I O I K D W P M F H C M S F Q G C E L
J I I H W A M I W L J Z I W S W K V W E.
119. By THE ADMIRAL. (Vigenère).
N S R V K D K S I W J W Y C E C E G K C E B D K N Q Y S J U L X Z O L
X P S U V U T F B S O I N P C R R E U Y O N U F K H K Z D D O J P Q Z
C K J I E N A F J D W B U S J U R C L C J C E P C O K T V F A F P Y X
G K K Y Z V.
120. By THE ADMIRAL. (Beaufort).
Z N J L N Y H C Z D A U D D Z I N H R C Z Y Z K H G B P E C L M L W Y
R O I J Q D T L Q O Z H Q S N D V E S E P E J O Y L S Z O J U P G T K
J F K C U W N S H G W F D T M G K K D W E H L Z R N S B G V E S R A U
K K U M J Z M T K N K F Q L G K C U P Z U S D L W D E Z U B D Y F O D.
121. By DOR. (Another "Aristocrat." - Not hard. No keyword).
A B C D E F G C H G I J A K G F D J F B L M E D M M I M G B A N F L C
L O G J P N F D R F C L N. O G P I M S D A N T D L I F U. F C B G
N B P J E G J F C L E F, K C G A I E D V B F.
CHAPTER XV
Miscellaneous Phases of Vigenère Decryptment
When a Vigenère cryptogram is very short, its alphabets are no longer
readily identified by their graphic appearance. But its period, in
the majority of cases, can still be determined, and it still remains
true that the identification of one letter identifies a whole
alphabet. The example of Fig. 111 contains only 30 letters. With this
cryptogram in the form shown at (a), we are still dependent upon the
search for trigrams and short words, but the case is modified by the
presence of a repeated trigram. Unless this repetition, _ZIL_, is
accidental, it indicates a maximum period of 12, and the cryptogram
is long enough to provide another interval 12, with another trigram,
_EUK_, upon which any key-fragment brought out at _ZIL_ can be tested
in order to see whether or not it will bring out another good
sequence. When it finally does, the intermediate trigrams (those at
intervals 6 or 4) can be tried, in the hope of finding a shorter
period.
Figure 111
(a) (b)
Z I L T F R U I Y T J R Z I L 1 2 3 4 5 6
x x x Z I L T F R
U I Y T J R
K A R O I E A O A E U K L W K. Z I L K A R
x O I E A O A
E U K L W K
But assuming a case in which we have no repeated sequences at all, we
almost never meet with a Vigenère cryptogram in which there are no
_repeated single letters belonging to a same cipher alphabet_. These
repeated single letters can be tabulated with their separating
intervals, _and these intervals factored in exactly the same way as
intervals between repeated sequences_. The evidence, perhaps, will be
less clear, and less reliable, than that obtained through repeated
sequences; as with sequences, the less frequent letters will usually
be more informative than those which are leaders. To illustrate, with
our given example, the single letter _I_ has shown the interval 6
three times, the single letter _R_ has shown it twice, and the single
letters _L_ and _Z_ have shown its multiple. In the average case, the
period will not be so clearly evident as here; however, the example
was not in any way manipulated in order to produce this evidence.
Once the cryptogram of (a) can be rearranged as at (b), we no longer
have before us the piecemeal decipherments and piecemeal tests which
are necessary where a period is likely to be anything at all.
Whatever key-fragments can be brought out at _ZIL_, or on another
trigram, need be tested only on the three columns which contain the
trigram. Even presuming that the evidence has been inconclusive
between two or more periods, the cryptogram, necessarily a short one,
can be written into each of these probable periods, and the two or
more resulting blocks, standing side by side, can be considered more
or less simultaneously. Here, with our period determined as 6, the
columns of (b) are very short, and the number of trials and erasures
should not be many.
For this kind of case, however, many solvers have a preference for
the purely mechanical method which is detailed in Fig. 112. _Sheet 1_
of this figure has been prepared from the first column of our
cryptogram, which included the letters _Z U Z O E_. _Sheet 2_ has
been prepared from the second column, which included the letters
_I I I I U_; and _sheet 3_ has been prepared from the third column,
which included the letters _L Y L E K_. In each case, the column of
cryptogram letters, as it first stands, is also the _A_-decipherment.
With each letter used as a point of beginning, a series of normal
alphabets may be laid out, as in the figure, and the resulting 25
new columns on every sheet will show the other 25 possible
decipherments. But if these decipherments have been caused to
progress in the normal alphabetical direction, and if the cipher is
Vigenère, the key-letters which produce these deciphered columns will
have to run backward in the alphabet. These can be added at the tops
or bottoms of their columns, and can, if desired, be written in red
ink, or otherwise distinguished.
Figure 112
Sheet No. 1 (For Column 1 of b, preceding figure)
KEYS: a z y x w v u t s r q p o n m l k j i h g f e d c b
Z A B C D E F G H I J K L M N O P Q R S T U V W X Y
U V W X Y Z A B C D E F G H I J K L M N O P Q R S T
Z A B C D E F G H I J K L M N O P Q R S T U V W X Y
O P Q R S T U V W X Y Z A B C D E F G H I J K L M N
E F G H I J K L M N O P Q R S T U V W X Y Z A B C D
Sheet No. 2 (For Column 2 of b, preceding figure)
KEYS: a z y x w v u t s r q p o n m l k j i h g f e d c b
I J K L M N O P Q R S T U V W X Y Z A B C D E F G H
I J K L M N O P Q R S T U V W X Y Z A B C D E F G H
I J K L M N O P Q R S T U V W X Y Z A B C D E F G H
I J K L M N O P Q R S T U V W X Y Z A B C D E F G H
U V W X Y Z A B C D E F G H I J K L M N O P Q R S T
Sheet No. 3 (For Column 3 of b, preceding figure)
KEYS: a z y x w v u t s r q p o n m l k j i h g f e d c b
L M N O P Q R S T U V W X Y Z A B C D E F G H I J K
Y Z A B C D E F G H I J K L M N O P Q R S T U V W X
L M N O P Q R S T U V W X Y Z A B C D E F G H I J K
E F G H I J K L M N O P Q R S T U V W X Y Z A B C D
K L M N O P Q R S T U V W X Y Z A B C D E F G H I J
Fig. 113 shows what modifications would be necessary if the sheets
were being prepared for one of the Beauforts. For the variant
Beaufort, the only difference lies in the fact that key-letters must
progress in the same alphabetical direction as their decipherments.
With the true Beaufort, however, the making of an _A_-decipherment
does not mean a simple copying of cryptogram letters, as in the other
two ciphers; this _A_-decipherment must first be made; after that,
the series of normal alphabets can be extended as before, and the
key-letters will progress in the same alphabetical direction as their
deciphered columns.
Now, assuming that these sheets have actually been prepared, say on
quadrille paper, the various columns of decipherment may be examined,
and a check-mark placed beside each column in which the series of
letters appears to represent a “good” decipherment. With longer
columns, those may be checked which contain the largest percentages
of letters _E T A O N I R S H_, without too many of the letters
_J K Q X Z_; with shorter columns, perhaps those are “best” in which
any repeated letters are chiefly vowels, it being remembered that
when the cryptogram contains repeated sequences, as well as repeated
single letters, the possible identity of these repeated digrams or
trigrams must also be taken into consideration. With all of the
apparently good columns checked for attention, _sheet 1_ may be
creased vertically so as to place any desired column on the extreme
right, and this column may then be laid directly against any desired
column of _sheet 2_ for an observation of the resulting digrams. If
these appear to be satisfactory, then _sheet 2_ may also be creased
vertically, and the series of apparently good digrams may be laid
directly against any desired column of _sheet 3_ for an observation
of the resulting trigrams. And so on, if desired, to a possible
_sheet 4_, or _5_, or _6_, though, as a rule, the first three sheets
will be found sufficient. While the method, as indicated, is intended
to be mechanical, that is, largely visual, it would be possible,
where uncertainty exists between two given combinations, to copy
these and subject them to a digram test. But this should not be
necessary in a case where key-letters, as well as their deciphered
columns, are expected to set up good combinations in order to form a
plaintext key-word.
Figure 113
If column Z U Z O E were VARIANT: If column Z U Z O E were BEAUFORT:
KEYS: a b c d e f g ..... KEYS: a b c d e f g .....
Z A B C D E F ..... Z - B C D E F G H .....
U V W X Y Z A ..... U - G H I J K L M .....
Z A B C D E F ..... Z - B C D E F G H .....
O P Q R S T U ..... O - M N O P Q R S .....
E F G H I J K ..... E - W X Y Z A B C .....
An interesting version of this method, as shown by Admiral Elliott
Snow, included the following variations: To begin with, in extending
the alphabets, the decryptor omits altogether the letters
_J K Q X Z_, and perhaps one or two others of extremely low
frequency, simply leaving the blank spaces which indicate their
alphabetical positions. This makes the work more rapid, and, in
addition, the presence of these blank spaces in any column of
decipherment, advertises at once that the column is probably not a
very good one. But Admiral Snow’s columns were not columns; they were
_rows_. A given series of letters: as _Z U Z O E_ of our foregoing
_sheet 1_, is laid out horizontally, and its decipherments are
extended vertically. The spacing on each row is arranged to
correspond with the period; that is, the letters _Z U Z O E_, instead
of being continuous, are spaced six columns apart if the period is 6,
and their decipherments, of course, are spaced in the same way. The
sheets may now be creased horizontally between rows, and one sheet
placed against another in such a way that the resulting digrams are
all standing on diagonals, but have appeared at exactly their
cryptogram distance apart. The student should experiment with both
arrangements and decide which one he likes.
It has been pointed out by C. A. Castle, another of our members, that
the foregoing method will find its chief application, not on a single
cryptogram, but as applied to a case which, so far, we have not
considered in connection with the substitution ciphers: One in which
the decryptor has in his possession five or six cryptograms, all very
brief, but all enciphered with the same key. Here, we have the common
practical case, to be handled in somewhat the same way as the last of
our transposition examples; the cryptograms can be written one below
another, thus forming a series of columns in which every column has
been enciphered with the same cipher alphabet. If this case happens
to involve a comparatively short period, it is possible to take
intervals between repeated sequences found in two different
cryptograms, using the intervals indicated by the number of columns
between the first letter of one sequence and the first letter of its
repetition. Castle’s example, however, was not based on a short key,
but upon an extremely long one, and his five or six messages were
merely fragments, each one of which was _known to be the beginning
of an English sentence_. In the English language, about half of all
initial letters used are found in the group _T A O S H I_ and more
than another one-fourth are found in the group _W C B P F D M_. Thus,
having a series of beginnings in which the first column will include
only initial letters, the number of truly acceptable decipherments
on any _sheet 1_ will usually be quite limited. In addition, with
vowels known to have a fondness for second and third positions in
words, there should be little difficulty in selecting decipherments
from _sheets 2_ and _3_.
* * *
While we have described this device as having been written out on
sheets of paper, there are many persons who prefer to have at hand
a series of cardboard strips which will set up the “sheets”
mechanically. If each of the strips carries the normal alphabet
written twice in succession, it is possible to adjust five of the
strips so as to place the letters _Z U Z O E_ one below another in
the form of a column and automatically set up the other 25 columns.
The strips can be loose, or may form part of a slide. Slides, in
fact, may be used for many purposes, and are well worth preparing
for any kind of cipher which the decryptor expects to encounter a
great many times. The members of the American Cryptogram Association,
who solve a great many Vigenères, Beauforts, and so on, as a matter
of recreation, have practically all “invented” slides (or tableaux)
which will, to some extent, do away with the irksome task of carrying
out a trigram-search. These are prepared in various ways, and
variously used, though the principle for all is about the same as
that indicated in Fig. 114. They are usually referred to as
_decrypting slides_, and the single stationary alphabet, sometimes a
list of key-letters and sometimes not, will be called “the decrypting
alphabet.” C. Stanley Lamb, who is by no means the only “inventor”
of the device illustrated, has this in several different forms,
according to the purpose for which he intends to use it. Notice that
the card, as we have placed it, shows the stationary single alphabet
running contrary to the others, for use on the Vigenère cipher, and
that this card need merely be reversed in order to have a single
stationary alphabet running parallel to the others, for use on the
two Beauforts. As to the sliding double alphabets, there may be as
many of these as the operator feels like setting up; if the device
is being used to assist in the trigram search, three will be needed.
Figure 114
One Form of "DECRYPTING SLIDE" C. STANLEY LAMB
For VIGENÈRE, the "Decrypting Alphabet" runs backward:
| a z y x w v u t s r q p o n m l k j i h g f e d c b |
( A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H ...
( A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E ...
( A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I ...
| z y x w v u t s r q p o n m l k j i h g f e d c b a |
As this is shown, it has been set for the decipherment of a trigram H D G, and
every possible decipherment can be read from the slide without changing its
present adjustment. The entire list of frequent trigrams can be used as trial keys:
Trial Keys: T H E A N D T H A E N T I O N T I O F O R (Etc.)
H D G
Fragment of True Key: O W C H Q D O W G D Q N Z P T O V S C P P (Etc.)
To explain its use: The decryptor here is dealing with a sheet of
trigrams. Each one of these trigrams is to be deciphered as _THE_,
_AND_, _THA_, and so on, following the list of normally frequent
trigrams, and the resulting key-fragments are to be written down for
comparison with one another, in the hope that some two or more will
be duplicates, or will contain overlapping letters. The first of
these cipher trigrams is _HDG_. These three cipher-letters, found on
the three slides, are placed, in order, below _A_. Now, on the first
of the slides, every possible decipherment for _H_ is standing
opposite its key-letter, found in the “decrypting alphabet”; on the
second slide, every possible decipherment for _D_ is standing
opposite the the proper key-letter; and on the third slide, every
possible decipherment for G. To know, then, what key-letters will be
deciphered by _THE_, find _T_ on the first slide and note key-letter
_O_; find _H_ on the second slide and note key-letter _W_; find _E_
on the third slide and note key-letter _C_; the complete key-fragment
is _OWC_. This may be written down, Then, _without changing the
adjustment of the device_: For _AND_, key-fragment _HQD_, and so on
down the list.
Where the cipher is Vigenère, the text-letters may be found in the
“decrypting alphabet” and their keys on the slides, without changing
results. But with either of the Beauforts, a key is specifically a
key and not a text-letter. Thus, when the card is reversed, and the
same process applied for one of the Beauforts, the student must be
careful as to where he finds his letters _T H E_ in each of the two
ciphers. This peculiar relationship of Vigenère-variant-Beaufort is
not hard to untangle if all three of the encipherments are considered
to be purely mathematical operations of addition and subtraction. If
we must add two numbers, as 5 and 10, it makes no difference whether
we call it the sum of 5 plus 10 or the sum of 10 plus 5. But where we
must perform a subtraction, there are two separate cases.
In straight Vigenère encipherment, the process is _addition_, in which
text-letters may be considered to have the values 1 to 26 (their
serial positions in the normal alphabet), while key-letters may be
considered to have the values 0 to 25 (the amount of alphabetical
shift represented by each one). Thus, the encipherment of _J_ by _P_
(10 plus 15) will not result differently from the encipherment of
_P_ by _J_ (16 plus 9); in both cases, we obtain _Y_, alphabetical
value 25.
In variant Beaufort, we have one of the _subtractions_: _Message
minus key_, with the occasional necessity for “borrowing” 26 in order
to make a subtraction possible. Thus, _J_ enciphered by _P_ (10 minus
15) does not give the same result as _P_ enciphered by _J_ (16 minus
9). In the first case (after borrowing 26), we obtain _U_, or 21,
while in the other case we obtain _G_, or 7.
In the true Beaufort, we have the other _subtraction_: _Key minus
message_. This time, we value the key-letters 1 to 26, and the
text-letters 0 to 25. Thus, _J_ enciphered by _P_ (9 taken from 16)
results in _G_, or 7, while _P_ enciphered by _J_ (16 taken from 9)
results in _U_, or 21. Our results, then, are exactly the reverse of
those obtained in the other subtraction.
If these mathematical comparisons be understood, or simply kept in
mind, it will always be possible, whenever a decryptment process has
been explained in connection with only one of the encipherments, to
examine its “mathematical” details and learn from these in just what
respects it would have to be modified in order that it may be applied
with equal success to the other two encipherments. There is another
interesting possibility which may have escaped the student’s notice.
If he will turn back to Fig. 98, in which the same message, using the
same key, was enciphered in both of the Beauforts, one encipherment
coming out as _K K Z B B I Z_. . . . . and the other as
_Q Q B Z Z S B_. . . . . , he will notice that these two cryptograms
are complementary from beginning to end. If we saw any reason for
doing so, we might convert either one of the Beaufort cryptograms to
the other form, and apply its probable word with its own slide.
* * *
Now, having seen the great vulnerability of the famous “indecipherable
cipher,” suppose we glance at some of the devices which have been used
for doing away with its periodicity. One such device, that of
_auto-encipherment_ (_autokey_, _autoclave_), has been given its own
separate chapter (the one immediately following), not because of its
value as a cipher, but because of the very interesting decryptment
problem it presents. A second device, the details of which may be
examined in Fig. 115, consists in the use of a very long nonrepeating
key, the popular name for which is “running key.” The value of such a
key, for practical purposes, we have already seen; it was a key of
this kind which Castle had used on his five or six
cryptogram-beginnings. In single examples, however, it gives more
trouble. Unless there is a probable word, its message and key must be
dug out bit by bit, and if the encipherment is Vigenère, any recovered
fragments can belong equally well to the message or to the key.
However, with its key known to be purely plaintext, no fragments need
be considered except those which are usable combinations, and since
the “running key cipher” makes a fascinating puzzle, a specimen has
been included among the practice cryptograms. The original of this,
apparently, was the Hermann cipher. This employed a slide which was
identical with the Saint-Cyr slide except that the stationary alphabet
carried an extra cell (position) marked “index” to be used instead of
the Saint-Cyr index _A_. As the writer saw this, the index-cell was
standing just ahead of _A_, so that the resulting encipherment would
have been that of a Saint-Cyr slide on which the letter _Z_ was
serving as index-letter.
Figure 115
Vigenère with a "Running Key"
Key-letters: M Y C O U N T R Y T I S ...
Plaintext letters: S E N D S U P P L I E S ...
Cryptogram: E C P R M H I G J B M K ...
Of other devices aimed at destroying periodicity, quite a few have
been based in some way on _key-interruption_. A key-word is selected,
as INDEPENDENCE, but the encipherer breaks off before completely using
his rotation, so that the completed cryptogram will be enciphered very
irregularly by such a key as INDEP INDEPEND I IN INDEPENDENC IND
INDEPEN. . . . . . Sometimes this is found as a word-spacing device,
the key beginning over with each new word, though naturally not with
word-separations showing in the cryptograms. But in the average case,
the key-interruption takes place at the discretion of the encipherer;
sometimes the agreement with his correspondent allows him to break
off as he pleases without any sort of signal, leaving the decipherer
to discover the interruptions through the fact that he can no longer
decipher; again, he may use an indicator, as _J_. In the latter case,
he must encipher any _J_’s which may happen to occur in his message
by using the _I_-substitute; then, whenever he decides to break the
key, he first enciphers a _J_. Thus, whenever the decipherer brings
out the letter _J_, he knows that his key is to begin over with the
encipherment of the next letter. It will be noticed that in all of
these cases, the decipherer will have to do his work one letter at
a time.
There is another of these devices which apparently destroys
periodicity and is aimed at throwing all of this onerous work upon
the shoulders of the decryptor without at the same time punishing the
legitimate decipherer. This consists in shortening the two alphabets
of the key, so as to leave some extra letter, which will never be used
in any cryptogram. Encipherment, in this case, is accomplished in the
regular way, producing a periodic cryptogram. The extra letter may
then be inserted at points throughout the cryptogram wherever it can
do the most harm. The decipherer, knowing that this one letter is
always null, need merely erase it. But if this device is to be really
useful, the omitted letter must not be always the same, and this
trouble can be overcome as follows: In the shortening of the plaintext
alphabet, we omit always the unwanted letter, as _J_. But in
shortening the cipher alphabet, we omit first one letter and then
another, according to agreement, and insert _J_ in its place. The
decipherer, knowing what letter is null, erases it; but the decryptor,
granting that he knows what the process is, will still have to
experiment with various letters before he learns which one (or more)
of the 26 is the null of the moment.
Shortened alphabets are not uncommon in ordinary use. We meet with
25-letter alphabets in European examples, the letter _W_ having been
omitted for telegraphic reasons. This case can usually be
distinguished from the one which precedes by the fact that the letter
_W_ is never found in a frequency count, and it presents only the
minor trouble that the ordinary 26-letter slide will not make the
decipherments, so that it becomes necessary to prepare another on
which the letter _W_ is not present. This case can, of course, be
simulated by making use of a 24-letter alphabet.
These devices, taken as a whole, have added little, if at all, to the
security of the straight-alphabet ciphers, though, for the most part,
they have succeeded admirably in rendering their ciphers totally unfit
for general purposes. Considered as single examples, they can, of
course, prove troublesome. We trust that this will not be the case
with some one or two of the appended practice cryptograms, but if so,
we recommend that the student postpone them for a later investigation.
Concerning example No. 122, he may find that some of the material
presented in Chapter XVI applies also to the “running key”
encipherment; with others, a trigram-search may assist in developing
the interrupted key-word; and in one case, a clever decryptor should
find a way for applying his Kasiski method.
122. By SABIO. (Vigenère with Running Key. SENT, AGENT, STOP, IMPREGNATED).
A R U N N I N G K E Y S O Q M A V Q X K L U E R S Z S S R F A H A I V
X W E T N K Z Q N V R A G W V E T F W N L K A T A I B S Z U H P E X U
B W W A S P N F F C. (These are a trifle tedious, but not inhuman).
• • • • • •• •• ••
123. By NEON. (Porta, with key-interruption. Plenty of trigrams!)
A P V K W T P K P V Y G Q P G A K J Z W J N I X J U Q O U K P V W F U
R F X N K C K P R K Q K W F U R G J O V Z O K G X J V Q S W T F K D L
L Y Q L X Z E F L Y U J V Z C X G Q L J M T X W K K P V T V B Y K X P
F J Z Q X B V C O V V H X Z K J Z U Y.
124. By WHOSIT. (Beaufort, with key-interruption. THEY, WHEN, IN, ON, UP, etc).
M X Y F U H P M J B C X O C K A L Q E D B Q A E P R B Z L G L W M J B
Z Z C S A A L A O E K K C W L L J B P H U W B L F Q O R B Z L A O E M
A L O K F P V H Y U Y H Y J L X O L X Z.
125. By B. Natural. (Gronsfeld, with key-interruption).
S O W H Z G H O C V V W L F F F X O F H H X Q S I H S O Y P P H K T Q
H Z F Y J Q G Q H O B X V X O F L R J L F W E A E F H O G G V O F E T
Y M U X O F T H S N F B U A O B W H V C V V H V A O F Q M A G V N H S
S C F U X O F V H E L O A O J O E C V V E Y F A V S N I P L E O U P W
T A G P Q K E T.
126. By TRYIT. (Gronsfeld, with interruptors. MY, TO, THE, OF, IS, BE, WHICH).
R H X G A P A S R E C Z T R T W Z A J Z S G Q A Z M T P E A U X G K Y
Z F W Z S G Q Y O E Y F C T P W B G K O D P W N D X Z A W F O W H T Z
B M O H K Q P K V K S Q N D J Z S L Z X L C R T T N H S H W.
127. By B. NATURAL. (Vigenère. One letter reserved as interruptor. Look out!)
P N B Y C A N D V N P N F Y Z G V N W E J N S I T T T Z B L N O S L N
X R N I L Z H N H M D X D X B Z N B I K W Z H N D J N B M D T N O I K
N E I I H T W Q M F A T N P Q U N T J W D C X N G I C X P Z B L N O S
L N O I J N O S L G N H S C K T Q D N X W N R I I I L M J T R N U M D T.
CHAPTER XVI
Auto-Encipherment
The term _autokey_ (_autoclave_; “the autokey cipher”), as commonly
used, refers to the kind of encipherment shown in Fig. 116, in which
a message becomes its own key for applying some one of the
multiple-alphabet ciphers — usually the Vigenère. It will be noticed
from the figure that the auto-encipherment must be “primed” with a
conventional key; and whenever the words _key-length_, _period_, and
so on, are used in connection with auto-enciphered cryptograms, their
actual reference is to the short initial key. A more accurate term
would seem to be _group-length_. But that a term is needed for
referring to something akin to the period of the ordinary Vigenère
cryptogram can be seen when we consider the mechanics of decipherment:
Figure 116
Vigenère Autokey: C O M E T/S E N D S U P P L I E S T O M O R L E Y S
Plaintext: S E N D S U P P L I E S T O M O R L E Y S S T A T I
CRYPTOGRAM: U S Z H L M T C O A Y H I Z U S J E S K G J E E R A
Our present initial key, COMET, _key-length 5_, serves to decipher
only one _group_ of that length. The five key-letters obtained from
this first decipherment will serve to decipher only one more _group_;
from this, another five key-letters are obtained, and will decipher a
third _group_, and so on. But our _group-length_, sometimes referred
to as “period,” includes five individual series of letters, any one
of which can be enciphered and deciphered independently of the rest.
That is, beginning with _C_, or _O_, or _M_, or _E_, or _T_, and
taking each fifth letter, it is possible to proceed straight through
to the end, enciphering or deciphering only this one series, or
“column.” It will be noticed from the foregoing that the decipherer
gets the short end of the bargain. The encipherer knows in advance
what the key is, and, to some extent, can apply one cipher alphabet
at a time; the decipherer knows only the key to the first group; the
rest he must ferret out for himself.
There is, however, a second form of autokey encipherment in which the
respective difficulties of encipherer and decipherer would be
reversed. This form of auto-encipherment, which can be seen in Fig.
117, makes use of a preliminary key, as in the regular form, but
follows this with the enciphered text instead of with the plaintext.
Such an encipherment results, occasionally, from the mechanical
construction of a cipher machine, and in this case, where the 26
cipher alphabets are in mixed order, and unknown to the decryptor,
may present an interesting decryptment problem. But where the cipher
is Vigenère (or any other in which the decryptor possesses the full
set of cipher alphabets), it can hardly be argued that there is any
great problem about a cryptogram which carries its key in full view.
We will confine ourselves, then, to the usual form of autokey, as
first explained, beginning our studies with a brief glance at the two
common practical cases, that of accumulated cryptograms, and that of
probable words. Procedure, in the former case, is self-evident.
Possessing several cryptograms all initiated with the same preliminary
key, we may write their beginnings one below another to form columns,
and the first few of these columns will constitute an ordinary case
of Vigenère in which every message is known to be the beginning of a
sentence. With beginnings discovered, a little industry accomplishes
the rest.
The case of probable words, on the other hand, presents some
interesting possibilities inherent in the auto-encipherment itself.
When the probable word is short (or if a search is to be made for
normally frequent trigrams), the task of bringing out and testing the
possible key-fragments is made much less onerous by the fact of the
purely plaintext key. Being sure of an abundance of excellent
sequences, we need consider none but the very best of the deciphered
fragments; and for any one considered, the trials need be made only
within a very short range of the spot at which it was found. All of
this work may be done directly on the cryptogram. A correct sequence,
correctly applied, can be followed out in both directions, and will
yield, in full, several of the “columns,” and several consecutive
letters of the initial key. But if it so happens that the probable
word is longer than the initial key, _its first few letters must
become the keys for enciphering its last few_. Consider, for instance,
the word SIMPLICITY, which has a length of ten letters. If the
preliminary key contains only five letters, then, beginning at
-_ICITY_, the keys _SIMPL_- will begin to encipher, causing a certain
long cryptogram-sequence which, for Vigenère, will always be
_A K U I J_. If the preliminary key has six letters, the same word
causes a sequence _U Q F N_ when the cipher is Vigenère; if it has
seven letters, the cryptogram-sequence will be _A B K_; and even an
eight-letter key brings out one certain digram, _L G_. Thus, knowing
what the cipher is, and having at our disposal any comparatively long
probable words, we may write out these sequences _in advance_ and be
ready to look for them in the cryptograms. In addition to whatever
words we consider probable, it is obvious that any other long word
may encipher itself in the same way, and, if it is one important to
the subject matter, is likely to be repeated, causing the cryptogram
to show a _long repeated sequence_. Thus, if we find a long repeated
sequence in a cryptogram, we are able to try this as a common suffix,
_TION_, _MENT_, _ENCE_, _ABLE_, etc., in the expectation of bringing
out some common prefix, _CON_, _PRE_, etc.
Figure 117
Key: C O M E T/ U S Z H L O H O S T .....
S E N D S U P P L I E S T O M .....
U S Z H L O H O S T .....
Note that the cryptogram itself is the key, except that the
first five letters are missing. To decrypt, With any
alphabet, need merely find where to begin using it!
More fascinating, by far, than its practical aspects, however, are
the possibilities presented by the autokeyed cryptogram for analytical
attack. The devices immediately to follow are described by General
Givierge in his _Cours de cryptographie_, and are credited by him to
Commandant Bassières.
First, it is possible to discover the length of the short preliminary
key, or, at any rate, to confine this to certain definite
probabilities. This key, as we have seen, governs a definite
group-length, or “period.” If this group-length, say, is 5, then,
barring the first and final groups, every plaintext letter will be
enciphered by the letter standing five positions to its left, and
will, in its own turn, serve to encipher the one standing five
positions to its right. Since all plaintexts are filled with repeated
letters, roughly half of them separated by even intervals, it stands
to reason that there will be many occasions on which the letter
standing five positions to the left and the one standing five
positions to the right will be the same letter. That is, we must
often find the encipherment pattern of Fig. 118. Some one letter,
as _S_, is repeated at an interval of exactly twice the group-length,
with some other letter, as _R_, standing at exactly the group-length
interval from both of the _S_’s. The first _S_ enciphers _R_, and _R_
enciphers the second _S_. Or, if the repeated letter is _T_ and the
intermediate one is _L_, then _T_ enciphers _L_, and _L_ afterward
enciphers _T_. Where the cipher is Vigenère, the result, in the
cryptogram, is _a repeated letter standing at_ _exactly the
group-length interval_. If the cipher is one of the Beauforts, the
same pattern produces _a pair of complementary letters separated by
exactly the group-length interval_.
Figure 118
S . . . . R T . . . . L
S . . . . R . . . . S T . . . . L . . . . T
J . . . . J E . . . . E
Now, in order to consider the value of this observation, let us
examine the cryptogram of Fig. 119, an autokeyed Vigenère, which, for
convenience, is presented in groups of the correct length, 7.
According to Bassières, should we inspect this cryptogram for
repeated single letters, noting, in each case, the interval of
separation, the correct group-length, 7, will be present among those
intervals which are noted oftenest, and, in many cases, will be the
one which predominates. For making such an examination, perhaps the
simplest plan would be that of listing the possible group-lengths at
the tops of a series of columns, beginning with group-length 1 and
carrying them as far as desired. The counts could then be made by
placing a tally mark in the proper column for each time that a given
interval is noted. The results of this examination, as compared with
the Kasiski examination for a period, may be studied in Fig. 120. At
(a), where the leading intervals of our cryptogram have been listed
with their frequencies, it is noticeable that the correct group-length,
7, is not represented by the predominating interval or even by the
one which is second in frequency; it is merely present among the five
leaders. But we find other cryptograms, not necessarily of great
length, in which some one letter, as _V_, will be repeated five or
six times in succession at exactly the group-length interval, and its
evidence amply confirmed in other repetitions. Then, as at (b), we
may find some fairly good clue, leading us to give the first trial to
the correct group-length; and again we are left, clueless, to try out
five or six different group-lengths before striking the correct one.
Results, then, are variable, and the only certainty, at any rate in a
short cryptogram, is that of being able to limit the group-length to
a given few. With the group-length determined, or with one selected
for trial, we may take our choice of two processes.
Figure 119
L C N D M E E L C N O Y G T B G X V N D G S S H W A W J Q E V L H O W
Y I J W L E X A P V E C L B H D Q E K U W W G R H X J F B D Y P I P K
Q D W A R G U W R L G N I Q S L V L E S P H E U T X B O N D H V X D C
O U D S J T F J N U Q N Q L A A I L M Z U X I E W O B Y I W E H P D Q