* * *

_Process 1_ (_Bassières_). With group-length 7, as we have seen, our

cryptogram includes seven independent series, or “columns,” of letters.

By beginning at the 1st letter, and taking the 1st, 8th, 15th, 22d,

etc., letters, we may decipher _series 1_ independently of the others;

or, by beginning at the 2d letter, and taking the 2d, 9th, 16th, etc.,

letters, we may decipher _series 2_; and so with the other five series.

Many persons, before doing this, will rewrite this cryptogram into

seven _columns_, which permits that the decipherment of a series be

done straight down its column, and for that reason the word “column”

is sometimes used to describe what we have called here a “series.” In

order to understand the first of the Bassières processes, we need

consider only _series 1_, it being understood that whatever applies

to any one of the seven series applies equally well to the other six.

Figure 120

(a) (b)

Interval 8, found 8 times Possible Reason for L C N

" 16, " 8 "

" 4, " 6 " T H E o r e m/G E T t i..

" 5, " 6 " G E T t i n g T H E b a..

" 7, " 6 " Z L Y . . . . Z L Y . .

Now, considering Fig. 121: If the unknown first key-letter was _A_,

then the first plaintext letter, found by deciphering with key _A_,

was _L_, and this became the key for enciphering the eighth letter.

If the key which enciphered the eighth letter was _L_, then the

eighth letter, found by deciphering with key _L_, was _A_, and this

became the key for enciphering the fifteenth letter. Following out

this decipherment to the end of _series 1_, we find that the plaintext

letters must have been _L A B R Z Z B_, etc., as given in full in the

figure. A glance at the complete series will show that this

decipherment is not a particularly good one. If another decipherment

be carried out, on the hypothesis that the original first key-letter

was _B_, we obtain the series _K B A S Y A A_, etc., which starts out

fairly well, but which, when completed, will contain two _K_’s, one

_Z_, two _B_’s, and one _P_. If a third decipherment be carried out,

on the hypothesis that the original first key-letter was _C_, we

obtain the series _J C Z T X B Z_, etc., which is a poor decipherment

from the beginning. A trial and error method might consist in making

these decipherments one at a time directly on the cryptogram, erasing

one when it is obviously poor, and trying to add the next series

whenever one proves acceptable.

Figure 121

Keys: A L A B

L C N D M E K L C N O Y G T B G X V N D G S S H W A W J......

Plaintext: L A B R

Series 1, (Key A): L A B R Z Z B G Q L F R B G H H C Y Z J.

The Bassières process, however, consists in setting up the entire 26

possible decipherments as these are shown in Fig. 122. In this figure,

the original cryptogram-letters of _series 1_ are standing in a column

at the extreme left. The 26 possible decipherments are also standing

in the form of columns, each decipherment headed by the key with which

it was initiated. If the group-length 7 is correct, then one of these

26 columns shows the original plaintext letters.

Now let us examine, not the columns, but the rows, of this tableau,

and find out just how troublesome it is going to be to prepare

tableaux of the same kind for _series 2_, _series 3_, and possibly

others. The key-letters, across the top, constitute a normal

alphabet, and below this each row contains the 26 decipherments for

some one letter of _series 1_. On the odd-numbered rows, the

decipherments for the odd-numbered letters are alphabetically

arranged, but progressing in a direction contrary to that of their

keys, as if these odd letters represented Vigenère encipherment. On

the even-numbered rows, the decipherments for the even-numbered

letters are also alphabetically arranged, but are progressing

parallel to their keys, as if these even-numbered letters might

represent variant Beaufort encipherment. Evidently, then, the

_A_-decipherment is the only one which must actually be carried out;

afterward, the preparation of the tableau is a matter of extending

alphabets. With similar tableaux prepared for the remaining six

series, we have seven sheets, and on each one of these there is one

column showing the correct decipherment of the series, headed by the

correct key-letter. Thus, our solution is to be the mechanical one

of the preceding chapter. On each one of the tableaux, the apparently

“good” decipherments may be checked for attention; the sheets may be

creased between columns, and the “good” decipherments of one tableau

may be placed directly in contact with those of another.

Figure 122

SERIES No. 1, Prepared as a Tableau. (Corresponds to SHEET No. 1 of Figure 112).

THE

CIPHER The 26 Decipherments, with Keys

LETTERS

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z (Keys)

L L K J I H G F E D C B A Z Y X W V U T S R Q P O N M ←

L A B C D E F G H I J K L M N O P Q R S T U V W X Y Z →

B B A Z Y X W V U T S R Q P O N M L K J I H G F E D C ←

S R S T U V W X Y Z A B C D E F G H I J K L M N O P Q →

Q Z Y X W V U T S R Q P O N M L K J I H G F E D C B A

Y Z A B C D E F G H I J K L M N O P Q R S T U V W X Y

A B A Z Y X W V U T S R Q P O N M L K J I H G F E D C

H G H I J K L M N O P Q R S T U V W X Y Z A B C D E F

W Q P O N M L K J I H G F E D C B A Z Y X W V U T S R

B L M N O P Q R S T U V W X Y Z A B C D E F G H I J K

Q F E D C B A Z Y X W V U T S R Q P O N M L K J I H G

W R S T U V W X Y Z A B C D E F G H I J K L M N O P Q

S B A Z Y X W V U T S R Q P O N M L K J I H G F E D C

H G H I J K L M N O P Q R S T U V W X Y Z A B C D E F

N H G F E D C B A Z Y X W V U T S R Q P O N M L K J I

O H I J K L M N O P Q R S T U V W X Y Z A B C D E F G

J C B A Z Y X W V U T S R Q P O N M L K J I H G F E D

A Y Z A B C D E F G H I J K L M N O P Q R S T U V W X

X Z Y X W V U T S R Q P O N M L K J I H G F E D C B A

I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I

* * *

_Process 2_ (_Bassières_). Fig. 123 shows the second of the Bassières

processes. With 7 decided upon as the group-length, we make up a

_trial key_ having the right number of _A_’s, and decipher the

cryptogram. The new cryptogram, produced in this way, is _periodic_,

and its period, for Vigenère, will be twice the group-length, in the

present case 14. In Fig. 124, where this new cryptogram has been

repeated, written into its period, it is possible to check its

periodicity: It has two repeated sequences, _C J B_ and _W G_, at

suitable intervals, and while these are very few, their evidence is

amply supported by the fact of repeated single letters in every

column. When the periodicity is not confirmed in this way, it can

be assumed that the chosen group-length was not correct.

The make-up of this new cryptogram is not hard to understand if it is

noticed that what we have done is to carry out simultaneously the

seven _A_-decipherments of seven tableaux like that of Fig. 122. We

saw there that the odd-numbered letters of a series react as Vigenère

encipherment and the even-numbered letters as variant Beaufort. With

seven _A_-decipherments made at once, the same will apply to

odd-numbered and even-numbered _groups_. Thus, our new cryptogram

has seven columns enciphered in Vigenère and another seven enciphered

in variant Beaufort. The original seven-letter initial key-word will

decipher both sets of columns; for the first seven, it must be

applied in the Vigenère manner, and, for the other seven, in the

variant Beaufort manner.

Figure 123

a a a a a a a L C N D M E K A A A L M C J B G X K B B X R M K M Z V M

L C N D M E K L C N O Y G T B G X V N D G S S H W A W J Q E V L H O W

L C N D M E K A A A L M C J B G X K B B X R M K M Z V M Z S L Z I T K

Z S L Z I T K Z Q Y X D L N B Z X H Z A O G E T X L U I Q C Y K M P X

Y I J W L E X A P V E C L B H D Q E K U W W G R H X J F B D Y P I P K

Z Q Y X D L N B Z X H Z A O G E T X L U I Q C Y K M P X L B A F W A N

L B A F W A N F C W V V G H R P P L S C J B W G A M Q G G I O T L L I

Q D W A R G U W R L G N I Q S L V L E S P H E U T X B O N D H V X D C

F C W V V G H R P P L S C J B W G A M Q G G I O T L L I H V T C M S U

H V T C M S U H Z K Q X B L C O K A Q P A Y M Y L W K U Z W G L S R E

O U D S J T F J N U Q N Q L A A I L M Z U X I E W O B Y I W E H P D Q

H Z K Q X B L C O K A Q P A Y M Y L W K U Z W G L S R E J A Y W X M M

New Cryptogram: L C N D M E K A A A L M C J - B G X K B B X...........(Etc.)

As to why this encipherment reduces to alternate Vigenère and variant

Beaufort groups, this is best understood by resorting once more to

the “mathematical” aspects of the Vigenère cipher. In a previous

discussion, we have said that Vigenère encipherment consists in the

“addition” of key to message, and that variant Beaufort encipherment

(which, in Vigenère, would be _decipherment_), consists in the

“subtraction” of key from message. In the beginning, our plaintext

is a series of groups, as _A_, _B_, _C_, _D_, _E_, etc. and the first

encipherment operation consists in the _addition_ of a key, as _X_,

but only to the first group, _A_. To encipher group _B_, we add _A_;

to encipher group _C_, we add _B_, and so on, so that when the

auto-encipherment is complete, we have a cryptogram in which the

groups are made up as follows:

_1st_: _2d_: _3d_: _4th_: _5th_:

_A plus X_ _B plus A_ _C plus B_ _D plus C_ _E plus D_. . . . . . (etc.)

Figure 124

The New Cryptogram from Figure 123

L C N D M E K A A A L M C J

B G X K B B X R M K M Z V M

Z S L Z I T K Z Q Y X D L N

B Z X H Z A O G E T X L U I

Q C Y K M P X L B A F W A N

F C W V V G H R P P L S C J

B W G A M Q G G I O T L L I

H V T C M S U H Z K Q X B L

C O K A Q P A Y M Y L W K U

Z W G L S R E J A Y W X M M

1 2 3 4 5 6 7 1 2 3 4 5 6 7

(Vigenère) (Variant Beaufort)

Now, remembering what the mathematical valves were for key-letters,

the trial key, made up entirely of _A_’s, is made up entirely of

_zeros_. When we subtract zero from the first group, we leave it

unchanged, that is, the first cryptogram group is still _A plus X_

(plaintext _plus key_, or Vigenère). When we subtract _A plus X_

from the second group, this cancels the _A_ of both, and leaves _B

minus X_ (plaintext _minus_ _key_, or variant). When we subtract this

from the third group, we cancel the two _B_’s, leaving _C plus X_,

again Vigenère. When we subtract this from the fourth group, we

cancel the two _C_’s, leaving _D minus X_, again variant Beaufort.

And so to the end. Always we come out with the original plaintext

group plus or minus _X_, the key. Those groups which are _plus X_

are Vigenère, and those which are _minus X_ are variant. And _X_,

in all, is the same: the original preliminary key. A comparison

of the same kind applied to the two Beauforts (or a few trials made

on actual groups, if the student is not mathematically disposed) will

show whether or not the auto-enciphered Beauforts can also be reduced

to periodic form, and, if so, what their period is likely to be. In

the case of the true Beaufort, it may be necessary to straighten out

a quirk as to the application of the _trial key_.

Figure 125

Tables of High-Frequency Co-Efficients PHILLIP D. HURST

VIGENÈRE (Cipher Letters)

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

E a e h i n o r s t

T h i n o r s t a e

K A a e h i n o r s t

e O n o r s t a e h i

y N n o r s t a e h i

s I s t a e h i n o r

S i n o r s t a e h

H t a e h i n o r s

R n o r s t a e h i

6 4 1 - 4 4 4 4 4 2 3 4 3 2 3 2 1 4 4 2 2 6 4 2 2 4

BEAUFORT (Cipher Letters)

True Beaufort: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

...VARIANT... A Z Y X W V U T S R Q P O N M L K J I H G F E D C B

E e a t s r o n i h

T t s r o n i h e a

K A a t s r o n i h e

e O o n i h e a t s r

y N n i h e a t s r o

s I i h e a t s r o n

S s r o n i h e a t

H h e a t s r o n i

R r o n i h e a t s

9 4 1 2 4 3 3 3 2 3 3 3 3 4 3 3 3 3 2 3 3 3 3 2 1 4

PORTA (Cipher letters)

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

E r s t n o a e h i

T n o r s t e h i a

K A n o r s t a e h i

e O n o r s t h i a e

y N t n o r s h i a e

s I r s t n o a e h i

S n o r s t e h i a

H r s t n o a e h i

R n o r s t h i a e

3 3 3 2 4 4 3 2 3 4 6 5 3 4 2 3 4 4 - 2 3 3 3 3 3 2

* * *

While the foregoing methods are intensely interesting as an example

of what can be learned by analyzing the structure of a cipher, most

members of the American Cryptogram Association, in practical work,

prefer methods of their own which are quicker in giving results.

These methods, for the most part, have subordinated other

considerations to certain original observations concerning the use

of the purely plaintext key. Where message and key, as in the case

of the autokey and “running key” encipherment, are each made up of

normal text, with both members including the normal 70% of

high-frequency letters, it becomes inevitable that high-frequency

letters in the key and high-frequency letters in the message will be

paired again and again as the co-efficients of cryptogram-letters,

so that cryptograms enciphered with this kind of key must contain a

great many letters caused by this kind of co-incidence. For

convenience in making use of this fact, each member has his own

ideas. Phillip D. Hurst, for instance, prepared a set of tables of

about the kind shown in Fig. 125, one table for each

multiple-alphabet cipher with which he expected to deal. As these

are shown, the alphabet across the top of any table is a list of

possible cryptogram-letters, each cryptogram-letter heading its own

column; and each column contains only those letters which are

themselves members of the high-frequency group _E T A O N I R S H_,

and which, if enciphered by another letter from the same group, would

result in the cryptogram-letter standing at the top of the column.

The key, in each case, can be found at the left. Hurst says that he

always attacks a cryptogram at the _second letter_, on the theory

that this particular letter is likely to have been a frequent one in

both the message and the key. He then attempts to follow out _series

2_, or, if the group-length has not previously been determined, to

find this series. To explain, without going into too much detail, the

second letter in our foregoing autokeyed Vigenère was _C_. A glance

at the table for Vigenère shows that this letter can result from only

one pair of high-frequency co-efficients, _O_ enciphered by _O_.

Hurst will make his first trial on _series 2_, beginning with initial

key-letter _O_, and come out with the correct decipherment at his

very first attempt! With other letters, as _V_ or _A_, it might be

necessary to make as many as six trials, but, as we have seen, it is

hardly ever necessary to carry a trial very far in order to see that

the decipherment is going to be a poor one. The second letter, of

course, will not necessarily give results; but the cryptogram,

remember, is filled with these vulnerable letters, and a decipherment

may be started with any letter whatever and carried out in both

directions.

Figure 126

Where the KEY is a Segment of Ordinary PLAINTEXT:

Estimated Rank of the Cryptogram Letters and Their Frequencies Per 10,000

Figured by C. Stanley Lamb From Table of Ohaver.

VIGENÈRE

V A I S ERL WHB XGM FOZ K N T P U J Y C Q D

344 314 304 296 (Intermediate) 150 112 84 84 84 72 72 64 49 --

BEAUFORT

& VARIANT

A N E W O M Z BQK JRT HVF GUDX P L S I Y C

480 262 246 246 196 196 191 (Intermediate) 121 121 104 104 57 57

PORTA

K N L E RMF TWP UYQ XGC AVI BJZ D H O S

329 300 282 275 (Intermediate) 132 113 97 --

Another method, originated by C. Stanley Lamb, differs from Hurst’s

chiefly in that his observations were made from _digrams_ and not

from single letters. Originally, Lamb had been collaborating with

Admiral Snow in establishing frequency counts for various kinds of

ciphers, so that when the system was unknown, it would be possible

to tell one from another. Fig. 126, for instance, gives a rough

estimate as to what the rank and frequency should be for each letter

in the kind of cipher we have under consideration. Finding a

reasonably long cryptogram in which the letters _D_ and _Q_ have

ranked among the last, with letters _V_, _A_, _I_, and _S_ ranking

among the first, we have a fairly good reason for suspecting that the

encipherment was accomplished with a very long Vigenère plaintext key.

Figure 127

(a) Preparation of the mixed alphabet............ C U L P E • • R

A B D F G H I J

K M N O Q S T V

W X Y Z

C A K W U B M X L D N Y P F O Z E G Q H S I T R J V

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

(b) ENCIPHERMENT - Auxiliary Key X, or 8:

Plaintext: S E N D S U P P L I E S T O M O R

FIRST Substitution: 21 17 11 10 21 5 13 13 9 22 17 21 23 15 7 15 24

AUTOKEY (Addition): 8 21 17 11 10 21 5 13 13 9 22 17 21 23 15 7 15

C R Y P T O G R A M... 29-38-28-21-31-26-18-26-22-31-39-38-44-38-22-22-39-

════════

══════════════

L E Y T O M O P R O W S T O P

9 17 12 23 15 7 15 24 24 15 4 21 23 15 13

24 9 17 12 23 15 7 15 24 24 15 4 21 23 15

33-26-29-35-38-22-22-39-48-39-19-25-44-38-28.

══════════════ ════════

xxxxxxxxxxx xxxxx

(c) Detail of DECIPHERENT:

Cryptogram Numbers: 29 38 28 21 31 26 18 26 ...

AUTOKEY (Subtraction): 8 21 17 11 10 21 5 13 ...

PRIMARY CRYPTOGRAM...... 21 17 11 10 21 5 13 13 ...

Re-Substitution......... S E N D S U P P ...

(d) Vigenère Autokey - What Happens to REPEATED SEQUENCES with a ONE-LETTER KEY:

Key... X/ T H E M O N T H E X T

Text... T H E M O N T H E X T E

A L A L

But for short cryptograms, Lamb did not find these characteristic

frequency counts half so convincing as the presence in a cryptogram

of certain _digrams_, which appeared to be characteristic for each

cipher, since he was always able to find from 7 to 10 of them in each

100 letters. By making use of the high-frequency digrams (_th_, _he_,

_er_, _in_, _an_, and so on), he then established lists of cipher

digrams which were very characteristic indeed for each type of

encipherment. Thus, in attacking an autokey, it is possible to make

a good beginning with such a digram as _VV_ (_er_-_re_) or _XK_

(_th_-_ed_), if the cipher is Vigenère, and work in both directions.

“_Key-Length 1_.” — Many writers are inclined to make a special case

of the autokey in which the “priming” is done with a single letter,

not that this actually constitutes a different cipher, but because

of the decryptment curiosities which can be brought to light in

connection with it. For instance: Having a cryptogram fragment

. . . . . . ._W S Y Q L A H T G B_. . . . . known to be Vigenère

autokey, initiated with a single letter, can you find instantly the

trigrams _SAY_ and _HAT_? Would you have any reason for trying the

word _WAS_? Of the many interesting observations which have come the

writer’s way with reference to the one-letter initial key, only one

has seemed to present the germ of an additional decryptment method.

This observation was one made by Ohaver in connection with a cipher

in which the substitutes were numbers. The cipher itself can be

examined in Fig. 127.

The first step, (a), consists in the preparation of a simple

substitution key in which the plaintext alphabet is in mixed order

and the cipher alphabet is made up of the numbers 1 to 26. The

encipherment, shown at (b), involves two steps. First, there must be

a simple substitution, using the key of (a), and this results in a

_primary cryptogram_. Afterward, this primary cryptogram, preceded

by an initial key-number, is _added to itself_. In the discussion to

follow, our objective will be that of _recovering the primary

cryptogram_ (and not the plaintext, which would have to be found

later by simple substitution methods). Decipherment, indicated at

(c), consists in reversing the two steps of the encipherment: A

series of subtractions restores the primary cryptogram, and is

followed by the resubstitution of letters. At (d) we have a Vigenère

fragment for comparison. The essential fact to be noticed in (d) is

the behavior of repeated sequences when the group-length is 1. Any

repeated sequence in the plaintext continues to show a repetition in

the cryptogram which is shorter by one letter than the original. Even

the repeated digrams will give repeated single letters.

Figure 128

A TRIAL-Decipherment (M. E. OHAVER)

The Cryptogram: 29 38 28 21 31 26 18 26 22 31 39 38 44 38 22 22 39

9 20 18 10 11 20 6 12 14 8 23 16 22 22 16 6 16

20 18 10 11 20 6 12 14 8 23 16 22 22 16 6 16 23

════════

33 26 29 35 38 22 22 39 48 39 19 25 44 38 28

23 10 16 13 22 16 6 16 23 25 14 5 20 24 14

1O 16 13 22 16 6 16 23 25 14 5 20 24 14 14

════════

Now, putting aside the fact of the mixed plaintext alphabet (since we

do not intend to recover the letters) we have here a cipher which, to

all intents and purposes, is the Vigenère autokey initiated with a

single letter. In place of the letters _A_ to _Z_ we have numbers 1

to 26, and the encipherment is a series of additions. In the

corresponding Vigenère case, the group-length 1 will usually show up

plainly in the number of doubled letters — “letters repeated at

interval 1.” And with the group-length determined as 1, it is

possible to begin with some given initial key, as _A_, and either

reproduce the plaintext or convert the autokeyed cryptogram to a

periodic one in which the period is 2 (twice the group-length).

Considering the analogy between the two cases, it should be possible

to do the same thing here. That is, it should be possible to take the

autokeyed cryptogram of (b), initiate its decipherment with some

number chosen between 1 and 26, and either reproduce the primary

cryptogram or convert the autokeyed cryptogram to a periodic one in

which the alternate numbers will belong to two cipher alphabets.

Where this reduction has been carried out in Fig. 128, the initial

decipherment was made with key 9 in order to avoid a discussion of

negative numbers. Also, the fact of numbers will usually limit the

range of the trial keys: here, the first number, 29, was not

enciphered by adding any number smaller than 3.

Now, looking at Fig. 129, let us compare the new cryptogram of Fig.

128 with the primary cryptogram of Fig. 127(b), and see whether or

not it has the expected formation. Between the two cryptograms (the

supposedly periodic one obtained from the trial decipherment and the

one we hope to recover), there is a constant numerical difference in

the pairs of corresponding substitutes, and this difference,

throughout, is alternately plus and minus. Further comparisons can

be made, if the student so desires, by initiating other partial

decipherments with trial-keys 10, 11, 12, etc. Always, the constant

numerical difference persists, and always it is alternately plus and

minus. Moreover, for every time that the initial key-number increases

in size, there is a corresponding decrease in all numbers occupying

the odd serial positions and a corresponding increase in all numbers

occupying the even positions.

Figure 129

Comparison of TRIAL DECIPHERMENT with TRUE DECIPHERMENT

True decipherment - (See Figure 127): 21 17 11 10 21 5 13 13 9 22...

Trial decipherment of Figure 128: 20 18 10 11 20 6 12 14 8 23...

CONSTANT DIFFERENCE: 1 -1 1 -1 1 -1 1 -1 1 -1

We have, then, a periodic cryptogram whose period is 2, and two

cipher alphabets, consisting of numbers, in which the only difference

is one of size. But these substitutes, unlike those of the Vigenère,

will not be placed in normal alphabetical order; to complete the

solution by one of the general methods, it may become necessary to

take a number of frequency counts. For instance, considering the

first of the two Bassières processes, it would be possible to set up

the same tableau (Fig. 122), causing numbers to run alternately

backward and forward (and beginning again at 1 whenever the number 26

is reached). In this way, one of the columns would contain the

primary cryptogram, and a frequency count taken on the numbers of

that column should resemble a simple substitution frequency count.

Considering the second of the Bassières processes, the autokeyed

cryptogram is already reduced to a period of 2; the subsequent

solution of the periodic cryptogram belongs to the general case of

the next chapter; that is, a case in which the cipher alphabets are

in mixed order but parallel. But we have, here, a special method, and

a short-cut. The only difference between our two cipher alphabets is

a matter of size in all corresponding substitutes. If we can find out

what this numerical difference is, we have only to increase or

decrease the size of the numbers in one of the cipher alphabets and

bring it to the level of the other. Our short-cut, as pointed out by

Ohaver, lies in repeated sequences (or even repeated single letters)

in the autokeyed cryptogram. A glance back at the plaintext of the

foregoing example will show that two repetitions were pointed out:

_STO_ and _TOMOR_, and that these were still present in the primary

cryptogram as 21-23-15 and 23-15-7-15-24. In the autokeyed version,

they were still repeated sequences, but shorter in length: 44-38 and

38-22-22-39.

Had we initiated our trial decipherment with the correct number, 8,

these two repetitions would, of course, have worked back to their

original length. But where this trial decipherment was made with a

different initial key-number (Fig. 128) we find that only one of the

sequences, _TOMOR_, has done this; the other, _STO_, has disappeared.

The explanation for this has been summed up in Fig. 130. One sequence

was repeated at interval 8, which is _even_. When the autokeyed

cryptogram is converted to one having period 2, any interval which is

divisible by 2 will contain a certain number of periods; thus, any

repeated sequence at interval 8, will appear in the periodic

cryptogram as one of the ordinary periodic repetitions. The other

sequence, _STO_, was repeated at interval 17, which is _odd_, and

thus cannot show up as a repetition in any cryptogram whose period

is 2.

It is this repeated sequence found at the odd interval which is to

give us our short-cut. We have only two cipher alphabets, each one

having a substitute for _S_, a substitute for _T_, and a substitute

for _O_. When the repetition occurs at the odd interval, we obtain

_both_ substitutes for _S_, _both_ substitutes for _T_, and _both_

substitutes for _O_. By subtracting one sequence from the other, we

may learn the numerical difference between the two cipher alphabets.

Notice that the difference is _constant_, is _alternately plus and

minus_, and is _divisible by 2_. (One alphabet is larger than the

original, and the other is smaller by the same amount.) Our special

method, then, for a cryptogram known to have been enciphered in this

way, is as follows: First, underscore all repeated sequences which

occur at odd intervals, or, in their absence, the repeated single

letters. Those which are long will almost surely represent

repetitions in the plaintext. Then, selecting a suitable number,

make a trial decipherment and examine the resulting sequences. If,

by any chance, those repetitions found at the odd intervals have

worked back to longer repeated sequences, then the trial key and the

original initial key must have been the same. If not, try subtracting

one result from the other. If both have represented the same

plaintext sequence, the result of the subtraction will be a constant

difference, alternately plus and minus, and divisible by 2. To

restore the primary cryptogram, split this uniform difference, adding

half of it to the numbers of one alphabet, and subtracting half of it

from the numbers of the other alphabet. This, as mentioned in the

beginning, will leave a simple substitution cryptogram still to be

investigated.

Figure 130

Respective Behavior of the Cryptogram's Two Repeated Sequences

Sequence 38-22-22-39 Sequence 44-38

Repeated at interval 8 Repeated at interval 17

Trial Decipherments:

1st occurrence: 22-16- 6-16-23 1st occurrence: 22-22-16

2d occurrence: 22-16- 6-16-23 2d occurrence: 20-24-14

2 -2 2

(This interval was EVEN) (This interval was ODD)

Our explanation, perhaps, has been a little rapid, but the student

who has read carefully will be able to discover the “germ” originally

referred to, and to make his own laboratory tests. Also, there may be

an interesting answer to the following question: When the cipher is

one of the Beauforts (using letters), and the auto-encipherment is

initiated with a single letter, does a trial decipherment, initiated

with some other single letter, result in a period of 2?

128. By ELIA, JR. (Variant, Autokeyed).

O O U J V J M K N C B U Q L P F U L A S A Z F T G M P B V A Y V S Q J

L F A W S P C H A E I U N R S M F V W S S O O H M E B E A M K F A A X

R H K Z R J Q A O I A V M E I B T O P D J G P R J N F R X T I I G X F

K D H X A F T H J Q H L A R K T G D L P S B M V Y E E V A O A C S M U

V U W C V C T S K S M W L O N P A O O H M W W P Y P O H I L G A Z Q B

Q U Z B Q P K M B O V K W J H P J A G D C H X G W Q B K O G Y A K S I

W N W E X Q N U S U C V O E Y H Y J J C B T B V J Q M N S P A R V P X

O A G T A V L V C Z B D I X N F M W U E Z L N N N W B M O X G T C P K.

129. By ELIA, JR. (Beaufort, Autokeyed).

O A N C Q R O Q N Y Z G K P L V G P A I A B V H U O L Z F A C F M A V

Z J H T I L L X V B C Z M M T O W Z W A O Q V P M M Q D L Q K O H K F

G O B T L R A U X Y T Y S F N O C Y G R P M U U H T H E W P O O S R G

R Z Z S L Y G K I A N K M M T O W Z W A O Q V A B E U X W T C T J I O

G L P H T E F U F B R X M U Z V L D B P K N S Y A Q B I V M O H P V L

G Z Y F C C W C O M C A W N A A A E V A W M P E B Q X O D O V P X A T

E M A J A T P M J E A Z Z M D S B B N A A A F G L I D N X A M K H K P

D B B P Q Y.

130. By ELIA, JR. (St. Cyr, Autokeyed).

T B F N Q X E F D G F W E A F X S Q U N I G A H E U N B B J L O B Q P

H F A K A S N X G B P E E J W W L Z J O M L L A P R V Y T N M X H Y V

O S E S Q V O A Q M O G V P A J K P Y I U Z F Q G Y J Y T L D F E L Q

Z L W Y Y U Y Z N E P P F W B R W M E E F R W X J W E P R V Y B U M P

Z Z M T S B U K K B A L K Z I L Q A L Z K K F S X Z U S T G J T H A R

G S B X I W V L Z B Z M P I K Y I U R H R V W C V A U F V L W F Q Z U

D I G F W H T Z M S F B K T Z U T R K I V F Z X W L C A U J P A N V S

E O Z U X G I X D S X M G Q E L Q T V B L E I D I A L L A I N O E N L

V J I O I S W Q T D E C T M.

CHAPTER XVII

Some Periodic Number-Ciphers

The use of numbers in a periodic cipher does not, in itself, create a

problem essentially different from that of the letter-ciphers.

Numbers may, in themselves, cause weakness; we saw such a case in the

last of our autokey examples, where a complete disarrangement in

their order did nothing to conceal their size. But oftener than not,

the weakness lies in the construction of the cipher or in the manner

of its application, and while this is fully as true of letter ciphers,

the numbers, for some reason, appear to be more inviting for certain

kinds of misuse.

In order to observe a weakness which need not have existed, let us

consider the slide partially shown in Fig. 131. The use of two-digit

numbers will furnish a hundred substitutes; but a strip of that

length is awkward to handle, and the constructor of the present slide

has confined its length to forty numbers. Then, since he has only

fifteen different cipher alphabets, and wishes to make use of

word-keys, he has adjusted his 26 key-letters to fit the number of

alphabets. Now if the alphabet of the slide (that is, the _cipher

alphabet_, or series of numbers) is written in straight 1-2-3 order,

and if it is considered that letters may have two or more values, so

that _A_ has the values 1, 27, 53, etc., _B_ the values 2, 28, etc.,

_C_ the values 3, 29, and so on, a slide of this kind is exactly the

equivalent of the Saint-Cyr slide, since any cryptogram accomplished

with it could be promptly converted to a Vigenère cryptogram by

substituting letters for numbers. The keys, of course, might differ.

The constructor of the slide has desired something more difficult.

But instead of carrying his forty numbers through a transposition

block, and really mixing them, he has been content to group them, in

regular order, by their tens. We shall see in a moment what happens

to his cryptograms. But he neglects also an opportunity: Presuming

that his circumstances are such as to make the use of numbers

practical at all, why waste the opportunity to use the full one

hundred substitutes? The remaining sixty numbers might have been

placed on the next two rows, and thus, in every position of the

slide, he could have had two or three optional substitutes for every

letter — a much more difficult case than the simple periodic.

Figure 131

A Slide Carrying a NUMBER-Alphabet (and Keys)

( Plaintext Alphabet - Stationary

(

( A B C D E F G H I J K L M .....

( 10 20 30 40 50 60 70 80 90 00 11 21 31 41 51 61 71 .....

Sliding Cipher-Alphabet:

Key-letters may be added: A B C D E F G H I J K L M N O)

( * P Q R • S T U * V W X Y Z *)

The addition of key-letters makes it possible to employ a keyword. For the present

forty-number slide, it was necessary to double them up as in Porta. A slide having

fifty-one numbers would have accommodated all twenty-six of the key-letters.

The cryptogram of Fig. 132 was enciphered with the slide of the

preceding figure, using the key-word CABLO (equivalent to the

numerical key 30-10-20-21-51), and its period, 5, can be determined

in the usual way. However, we have already seen the Kasiski method;

suppose, here, we look at another, originated by Ohaver; and, since

Ohaver himself, explaining his method in connection with a

number-cipher of much the kind we have here, illustrated with single

numbers instead of with sequences, it seems fitting that it be

illustrated again in the same way.

Figure 132

Cryptogram Enciphered with the Slide of Figure 131

32 41 31 61 33 12 32 60 91 91 30 81 70 92 92 51 52 61 23 43 71 01 90 61 71

71 41 12 92 51 01 52 12 91 91 80 50 30 92 53 30 81 62 72 62 30 41 00 02 43

71 20 60 41 51 01 81 00 61 81 71 12 12 31 93 61 50 00 32 33 70 41 00 52 33

22 50 20 51 92 80 31 61 92 23 11 91 01 13 92 81 51 12 91 91 01 30 90 21 82

90 50 01 21 23 70 20 60 01 82 90 31 20 51 91 22 51 12 91 32 12 50 51 51 33

71 10 01 13 92 40 50 91 61 51 60 52 42 91 91 61 01 90 61 43 11 31 60 41 92

51 50 01 02 92 81 21 60 21 33 70 21 60 13 72 70 80 60 21 23 01 90 80 91 43

30 32 20 63 32 80 01 90 61 23 70 90 01 21 82 72 51 30 12 91 50 01 00 62 82

40 50 40 21 53 12 50 12 91 32 12 90 01 81 92 11 41 80 13 92 22 10 21 61 43

11 31 60 21 82 60 32 60 51 92 61 01 42 21 82 22 10 51 63 22 11 01 40 91 51

22 01 90 61 62 30 91 12 42 32 61 12 12 61 33.

As pointed out more than once, those characters having the highest

frequencies in periodic cryptograms will nearly always have derived

these high frequencies because of their occurrence in more than one

of the cipher alphabets; while those having the lower frequencies

will more often represent repetitions in some one cipher alphabet.

Thus, when we find, in the present cryptogram, that the numbers 02,

53, and 63, have each a frequency of 2, it seems reasonable to

suppose, for each number, that its two occurrences were in a single

cipher alphabet; that is, that each one is a periodic repetition.

Now, considering Fig. 133, and confining our observations, for the

moment, to the number 02, we find that this number, in the cryptogram,

occupies serial positions 49 and 154. Having first laid out a series

of columns headed by the various possible periods, 2, 3, 4, 5.

. . . . , we use each possible period in turn as a divisor, first

applying them all to the serial number 49, and then applying them

all to the serial number 154, each time setting down, in the proper

column, _the remainder from the division_. This remainder tells us,

each time, into what cipher alphabet the number 02 would fall, should

the cryptogram be rewritten into the period indicated at the top of a

given column. Still confining our observations to the number 02: It

is seen, under possible period 2, that if this were the period, then

the two occurrences of the number 02 would be in different alphabets.

The same can be seen under possible periods 4, 6, 8, 9, 10. But if

the period were 3, both occurrences of our number would fall into

alphabet 1; if it were 5, both occurrences would fall into alphabet

4; if it were 7, both occurrences would fall into alphabet 7

(remainder zero indicates the final alphabet of the given period).

Here, then, it would appear that possible periods 3, 5, and 7, are

more likely than the rest, as far as the tabulation goes. When

exactly the same observations are made for the number 53, it appears

that the most likely periods are 3 and 5. And when these observations

are made again for the number 63, only the period 5 is indicated as a

likely one. Since the period 5 has been indicated oftener than any

other, this is probably the correct period, as we happen to know

that it is.

When the same method is applied to repeated sequences, the serial

numbers can be those of the repeated first number. And it may, of

course, be applied to letters, just as the Kasiski method might have

been applied here. As to why Ohaver might have preferred this method

in dealing with numbers, let us examine, in the figure, the entire

column under possible period 5. The Ohaver method, unlike the

Kasiski, not only indicates the period, but, in addition, shows the

exact alphabet of that period into which a repeated number will fall.

The number 02 is shown as belonging to alphabet 4 ; the number 53 as

belonging to alphabet 5; and the number 63 as belonging to alphabet

4. It is thus possible to see that the very small number 02 and the

very large number 63 belong to a same cipher alphabet; and since a

range of over sixty numbers cannot correspond to only twenty-six

letters, we may conclude at once that the numbers on the slide were

not in consecutive order. Often, our information is exactly the

opposite.

Figure 133

An OHAVER Method for Finding Period

P O S S I B L E P E R I O D S

Substitute Serial Position 2 3 4 5 6 7 8 9 10 ...

02 49 1 1 1 4 1 0 1 4 9 ...

154 0 1 2 4 4 0 2 1 4 ...

53 40 0 1 0 0 4 5 0 4 0 ...

205 1 1 1 0 1 2 5 7 5 ...

63 179 1 2 3 4 5 4 3 8 9 ...

244 0 1 0 4 4 6 4 1 4 ...

X

X

* * *

Returning, now, to our cryptogram: In the beginning, we probably made

a general frequency count; if not, we now have the five individual

counts to be taken. And, as previously mentioned, a frequency count

made on numbers is much more conveniently accomplished on a 10 x 10

chart than by sorting and listing the numbers. The moment our five

frequency counts are made, in the present case, two facts become

evident: Each count includes only fifteen or twenty _different_

numbers, with about the frequency-distribution of simple substitution;

and, while the tens-digits have included a full series, the units

have never run beyond 3. The cipher, then, is a simple periodic; had

multiple substitutes been used, the frequency counts would have

included more different numbers, and with frequencies more uniformly

distributed. As to the series of numbers, two probabilities are

suggested, and these, in effect, are the same thing: The numbers may

have run in straight order into the thirties, and with each number

reversed; or: the numbers may have been grouped by tens. It is

further possible that the whole series runs backward, or that the

tens do, or the units, or sections of a certain length; and some

uncertainty may arise as to the rank, in the series, of the digit

zero; this digit is ordinarily last, but occasionally is ranked

first. It is, of course, possible that the series of numbers is well

mixed, but the chances are that it is merely methodized; the person

who uses numbers in a simple periodic cipher is not usually one who

knows the dangers of regularity in a cipher alphabet.

Figure 134

A Series of PARALLEL Frequency Counts Which Can Be LINED UP By PATTERN

10 . 111 . . .

20 . 11 111 . .

30 11111 1 11 . .

40 11 . 11 . .

50 1 11111 1111 . . .

60 11 . 11111 1111 . .

70 11111 . 1 . .

80 111 1 11 . .

90 11 111 11111 . .

00 . . 11111 . .

11 11111 . . . .

21 . 11 1 11111 111 .

31 . 1111 1 1 .

41 . 11111 . 11 .

51 11 111 11 1111 1111

61 1111 . 11 11111 1111 .

71 11111 . . . 1

81 11 111 . 1 1

91 . 11 1 11111 111 11111 1

01 1111 11111 11 11111 1 1 .

12 1111 11 11111 111 1 .

22 11111 . . . 1

32 1 111 . 1 1111

42 . . 11 1 .

52 . 111 . 1 .

62 . . 1 1 11

72 1 . . 1 1

82 . . . . 11111 1

92 . . . 1111 11111 1111

02 . . . 11 .

13 . . . 1111 .

23 . . . 1 1111

33 . . . . 11111 1

43 . . . . 11111

53 . . . . 11

63 . . . 11 .

73 . . . . .

83 . . . . .

93 . . . . 1

03 . . . . .

We may try, then, to restore his original arrangement (or an

equivalent one), placing beside it the five frequency counts in their

five columns, as shown in Fig. 134. The probable arrangements are

very few, and the placing of tally-marks opposite their numbers is

very rapid, since this, at each trial, is a mere matter of

copying them from their charts. Once the correct rearrangement is

reached, notice, in the figure, the appearance of the five frequency

counts. Insofar as is ever likely to happen with columnar counts,

_all five have followed the same graph_. This, of course, is the

simplest case; the finding of the encipherer’s original order, so

that every frequency count has followed the graph of the normal

alphabet. Any substitute can be identified, as in Vigenère, by its

serial position in its own alphabet; and where numbers are used,

there is seldom any doubt as to what number comes first in its

alphabet. The shortest road to solution would be as follows: Prepare

a temporary slide _exactly like the one which was used_ (except that

we have no way of knowing what the key-letters were), mark the points

at which the five alphabets begin, and decipher with the slide.

There are many other cases, hardly more difficult, in which our

rearrangement of numbers results, not in the original order, but in

an _equivalent order_. We could, for instance, arrive at a

rearrangement in which we have taken each third number, or each fifth

number, of the original cipher alphabet, so that our rearranged

numbers are following plaintext letters in the order

_A D G J_. . . . or _A F K P_. . . . ; thus, all of our frequency

counts would be following one same graph, though not the graph of the

normal alphabet. The problem here is to make sure that their graphs

are all the same graph, and then subject them to the process called

“lining up.”

Figure 135

The LINING UP of the Frequency Counts of Figure 134

┌1st┐ ┌2d ┐ ┌3d ┐ ┌4th┐ ┌5th┐ TOTALS

│ │ │ │ │ │ │ │ │ │

│ 30│11111 │ 10│111 │ 20│111 │ 21│11111111 │ 51│1111 23 *

│ 40│11 │ 20│11 │ 30│11 │ 31│1 │ 61│ 7

│ 50│1 │ 30│1 │ 40│11 │ 41│11 │ 71│1 7

│ 60│11 │ 40│ │ 50│ │ 51│1111 │ 81│1 7

│ 70│11111 │ 50│111111111│ 60│111111111│ 61│111111111│ 91│111111 38 *

│ 80│111 │ 60│ │ 70│1 │ 71│ │ 01│ 4

│ 90│11 │ 70│ │ 80│11 │ 81│1 │ 12│ 5

│ 00│ │ 80│1 │ 90│11111 │ 91│11111111 │ 22│1 15 *

│ 11│11111 │ 90│111 │ 00│11111 │ 01│1 │ 32│1111 18 *

│ 21│ │ 00│ │ 11│ │ 12│1 │ 42│ ** 1

│ 31│ │ 11│ │ 21│1 │ 22│ │ 52│ ** 1

│ 41│ │ 21│11 │ 31│1 │ 32│1 │ 62│11 6

│ 51│11 │ 31│1111 │ 41│ │ 42│1 │ 72│1 8

│ 61│1111 │ 41│11111 │ 51│11 │ 52│1 │ 82│111111 18 *

│ 71│11111 │ 51│111 │ 61│11 │ 62│1 │ 92│111111111 20 *

│ 81│11 │ 61│ │ 71│ │ 72│1 │ 02│ 3

│ 91│ │ 71│ │ 81│ │ 82│ │ 13│ ** 0

│ 01│1111 │ 81│111 │ 91│1 │ 92│1111 │ 23│1111 16 *

│ 12│1111 │ 91│11 │ 01│111111 │ 02│11 │ 33│111111 20 *

│ 22│11111 │ 01│1111111 │ 12│11111111 │ 13│1111 │ 43│11111 29 *

│ 32│1 │ 12│11 │ 22│ │ 23│1 │ 53│11 6

│ 42│ │ 22│ │ 32│ │ 33│ │ 63│ (V) 0

│ 52│ │ 32│111 │ 42│11 │ 43│ │ 73│ 5

│ 62│ │ 42│ │ 52│ │ 53│ │ 83│ ** 0

│ 72│1 │ 52│111 │ 62│1 │ 63│11 │ 93│1 8

│ 82│ │ 62│ │ 72│ │ 73│ │ 03│ ** 0

265

To show the handling of all such cases (which would include our final

autokey example), let us assume that the five frequency counts of our

figure, though still following a common graph, are not following that

of the normal alphabet. In this case, granting that all fifty-letter

frequency counts will vary considerably from the normal, it is not

quite so obvious that their pattern is the same; we shall have to cut

them apart (preferably having copied numbers beside their frequencies)

and place them side by side for a comparison of their graphs. Where

this has been done, in Fig. 135, their similarity is plain in spite

of some discrepancies, and the moving up or down of any one or more

of the counts (which could be done so as to include another position,

since the range of the numbers is only 25 per alphabet) does not

result in greater similarity. If the alignment of this figure is

correct, then all numbers found on any one row are substituting for

one same original; thus, the added frequencies on any one row will be

the total frequency of some one letter in a 265-letter text, and all

of these totals, collectively, should resemble a frequency count

taken on a simple substitution cryptogram of that length. To just

what extent this is true may be seen at the right side of the figure.

The nine leading letters have totalled 74%, where we normally expect

70%; but any single example can provide its surprises, and the excess

4% is not on the wrong side of the ledger. The other end of the count,

as would be expected of the group _J K Q X Z_, is comparatively blank.

Figure 136

The NIHILIST Number-Substitution

The "Checkerboard" Alphabet:

1 2 3 4 5

1 A B C D E 13 = C

2 F G H I K 34 = O

3 L M N O P 32 = M

4 Q R S T U 15 = E

5 V W X Y Z 44 = T

Encipherment, with Keyword COMET:

S E N D S U P P L I E S T O ....

Text... 43 15 33 14 43 45 35 35 31 24 15 43 44 34 ....

Key.... 13 34 32 15 44 13 34 32 15 44 13 34 32 15 ....

56 49 65 29 87 58 69 67 46 68 28 77 76 49 ....

This cryptogram is usually seen without grouping: 56-49-65-29-87-58.....

Our substitutes, remember, are assumed to be in mixed order. We do

not know what letter is represented by the five numbers of the top

row, or by the five numbers of any other row. To proceed with

solution, we shall have to assign arbitrary values, calling the top

row _A_ (or 01), the second row _B_ (or 02), the third row _C_ (or

03), and so on; and when all of these substitutions have been made

on the cryptogram, _the case has been reduced to one of simple

substitution_. The mechanics by which the substitutions are made can

be exactly those of the other case: Prepare a temporary slide, on

which the numbers run in the order decided upon, and slide this

against the normal alphabet (or any other); the result is a simple

substitution cryptogram which can be solved by simple substitution

methods. This case, first in one form and then in another, is

encountered again and again; and however it may seem that its cause,

in some one example, is a different one, yet the fault in all such

examples is the same: The basic cipher alphabet (the primary one

from which others are derived), either by its actual construction

or by the method of its application, was not truly a mixed alphabet.

* * *

In some of the periodic ciphers, the basic cipher alphabet is a

“checkerboard” of the kind we saw in Chapter XI, the substitutes

being two-digit numbers which will point out the columns and rows of

their originals. This primary alphabet, however, seldom appears

unchanged in the cryptograms, as “position 1” often does when a slide

is used, or as the _A_-alphabet often does in the Vigenère cipher.

Instead, we find a series of secondary cipher alphabets all of which

have been derived from the primary one according to a mathematical

process.

In view of the fact that any cipher which will necessarily double the

lengths of messages is of doubtful value, it seems inadvisable here

to do more than mention the infinite multiplicity of processes which

would be possible; but with checkerboards, it is difficult to imagine

any usable process which would not result in parallel frequency

counts; that is, counts which all follow the same graph and thus are

capable of being “lined up.” With most of these, in fact, the

difference between any two of the (secondary) cipher alphabets will

be a difference in _size_ which is uniform from _A_ to _Z_. (Often,

the same result is produced with slides.) Here, then, we may content

ourselves with a glance at one such cipher which is interesting

rather than important. In Fig. 136, we have another of the Nihilist

ciphers. Its primary alphabet is that most famous of checkerboards,

the _Polybius square_, said to have been the invention of the ancient

Greek historian, and certainly well known in his era as the basis for

a signalling system — a capacity, incidentally, in which it still

serves. We are showing it here in what seems to be the favorite

version: The alphabet of the square is the normal one, normally

arranged, with _J_ the missing letter; and the order of reading for

the two digits is row-column. It should be understood, however, that

these details, in practice, are quite variable.

For the Nihilist encipherment, the message is first subjected to a

simple substitution, using the checkerboard key. A key-word, treated

in the same way, is repeated often enough to pair one key-number with

each message-number, and the final cryptogram is formed by adding

these pairs of numbers. Decipherment, of course, will be the

subtraction of key-numbers from the finished cryptogram and the

resubstitution of letters. We have, then, another periodic cipher,

not essentially different from those already seen. Any number in the

checkerboard can become a key, to be applied periodically at some

given interval, and thus may govern one of the 25 possible cipher

alphabets. It would be possible to lay out any one of these cipher

alphabets, simply by adding a given amount to each number of the

primary one; if all of them were written one below another, and if

the primary alphabet were written across the top and along one side,

we should have a tableau which could be used in identically the

manner described for the use of the Vigenère tableau.

Decryptment, too, can parallel that of the Vigenère: The period of a

cryptogram can be found through repeated sequences, or, in their

absence, through repeated single numbers, and individual frequency

counts can be taken on the several alphabets of the period. If the

arrangement of letters in the checkerboard is that of the figure, or

any other strictly alphabetical one to which the order of the numbers

can be adjusted, these frequency counts will all follow the graph of

the normal alphabet, with allowance made for the missing letter. Or,

if the arrangement of letters in the checkerboard is not strictly

alphabetical, then the several frequency counts, no matter how badly

mixed, will still be parallel; they will all follow one graph, and

thus can be “lined up.” Very often, however, given the opportunity

to examine and analyze a cipher, it becomes possible to formulate for

it a special method which is much more rapid than the general one;

Ohaver, who first published a special method for the Nihilist, has

compared this cipher to a leaky boat in the open ocean.

Notice that its primary alphabet contains only the digits 1-2-3-4-5.

The maximum difference among these is 4; and the addition of any same

number to all of them does not change this fact; the maximum

difference between any two of the sums would still be 4. But the

number which is added during encipherment is also a number containing

no digit other than 1-2-3-4-5; thus any number found in a cryptogram

can be considered as carrying two separate additions, one for tens

and one for units. Even when two 5’s are added together, the result

is an all-revealing zero; the “carried” digit 1 can be mentally

“borrowed” back, causing the zero to become 10, and decreasing by 1

the size of the digit which precedes the zero. Specifically: Finding

in a cryptogram the number 40, we may regard this as having only

3 tens, with 10 units; or finding the number 110, we may regard it

as having 10 tens and 10 units. Thus, there is never a time when it

is impossible to see the tens and units as having been separately

added; if we find, in a Nihilist cryptogram, the two numbers 29 and

87, with a difference greater than 4 in their respective tens-digits,

we may say promptly that they were not enciphered with the same key;

no digit whatever added to any two digits of the original square can

produce a difference greater than 4. But if the two cryptogram

numbers are 30 and 77, where the difference in the tens-digits

appears, at first glance, to be only 4, the presence of the zero

must be taken into account; thus, the number 30 has only 2 tens,

and the difference between 2 and 7 is greater than 4; therefore,

the numbers 30 and 77 could not have been enciphered with the same

key. It is interesting, also, to note that the digit 2, found in a

cryptogram, can have been produced in only one way: the addition of

1 and 1; and that the digit 0, found in a cryptogram, can only have

been produced by the addition of 5 and 5. Either one of these digits

gives away its key; but, further than this, the cipher provides four

“give-away” numbers, 22, 30, 102, and 110, the presence of any one

of which in a cryptogram will give away the key to a whole cipher

alphabet.

Figure 137

Cryptogram by EDWIN LINDQUIST: Final Investigation of

Supposed Period 4

24-66-35-77-37-77-55-59-55-45-55-88-28-66-46-

24 66 35 77

88-37-67-33-59-58-65-45-66-67-58-44-55-34-79- 37 77 55 59

55 45 55 88

44-59-55-45-42-87-28-76-43-78-46-86-26-67-24- 28 66 46 88

37 67 33 59

85-26-67-28-76-26-78-46-65-65-88-36-49-54-67- 58 65 45 66

67 58 44 55

28-65-42-88-36-49-44-89-57-58-54-66-47-67-26. 34 79 44 59

55 45 42 87

28 76 43 78

46 86 26 67

24 85 26 67

28 76 26 78

46 65 65 88

36 49 54 67

28 65 42 88

36 49 44 89

57 58 54 66

47 67 26

(Acceptable throughout)

Now, to look at Ohaver’s special method, let us consider the

cryptogram of Fig. 137, prepared by another “inventor” of exactly

the same method. It can be noted, first, that this cryptogram has

not resulted from the addition of a single number throughout, since

it contains pairs of numbers like 24-88, 42-87, and so on, which

have a greater difference than 4 in either their tens or their units.

Now, using a bit of scratch-paper, we may, if we like, scribble down

a series of possible periods, 2, 3, 4, 5, 6, and so on, to be crossed

off as fast as we eliminate them. Considering these, one by one:

_Period 2_: With a thumbnail on the first number, 24, and another on

the third number, 35, we may run quickly through the cryptogram

comparing numbers found at interval 2; that is, the first and third

numbers, the second and fourth, the third and fifth, and so on, until

stopped by the two numbers 33 and 38, whose difference, in the units,

is greater than 4, showing that their key was not the same. Period 2,

then, is eliminated.

_Period 3_: Here we are stopped short at the very first comparison.

The numbers 24 and 77, found at the first interval 3, have a

difference greater than 4 in their tens, and thus cannot have been

enciphered with the same key. Period 3 is also eliminated.

_Period 4_: Starting again, and comparing numbers taken at interval

4, we are able to go all the way to the end of the cryptogram without

finding any two numbers whose difference, either in tens or in units,

is greater than 4. The numbers compared, however, included only those

which would have been adjacent in their columns. To make sure that

period 4 is possible, we must see numbers collectively in each of

the four columns, and this is best done by recopying the cryptogram

into its apparently possible period 4. Further examination, made

individually on each column, still shows no two numbers in any one

column whose difference, either in tens or in units, is greater than

4. It is possible, then, that each of the four columns was enciphered

with a single key; and while this is not absolute proof that the

period 4 is correct, those cases are extremely rare in which a period

found in this manner is not the correct one. With period 4 accepted,

and given as much material as we have, perhaps we can also discover

just what key-number was added to primary numbers in order to produce

each of the four alphabets. Considering alphabets one at a time, and

examining separately the tens and the units:

_Alphabet 1_: The tens-half of the first column contains a digit 2;

and since this can only have been produced by the addition of 1 and 1,

the only possible key-digit here is 1. (We have already ascertained

that all digits in this column could have had a same key.) The

units-half has a range of 4-5-6-7-8, the maximum range possible.

The smallest digit which can result in 8 is 3, and the largest which

can result in 4 is 3; that is, the only digit which can result in all

of the digits 4-5-6-7-8 is 3, so that the only possible key-digit

here is 3. Conclusion: The key which produced the first cipher

alphabet must have been 13, _since it cannot possibly be anything

else_.

_Alphabet 2_: The tens-half of the second column ranges over the

full five digits 4-5-6-7-8 (key 3), and the units-half ranges over

the digits 5-6-7-8-9 (key 4). The key which produced the second

cipher alphabet is 34.

_Alphabet 3_: The tens-half of the third column contains the

“giveaway” digit 2, and the units-half contains this digit also.

The key which produced the third cipher alphabet is 11.

_Alphabet 4_: The tens-half of the fourth column ranges only over

the digits 5-6-7-8, with nothing to indicate whether the missing one

is 4 or 9. Thus, the key to the tens might have been either 3 or 4,

though it could not have been anything else. The units have the full

range of digits, 5-6-7-8-9, key 4. In the fourth cipher alphabet,

then, we cannot tell immediately whether the key is 34 or 44.

Granting, however, that the arrangement of letters in Lindquist’s

key-square was the same as that of Fig. 136, the substitution of

letters for numbers may suggest which of the two numbers, 34 or 44,

is the correct key. With one of these we obtain letters _C O A O_,

and, with the other, _C O A T_, a word (The student might find it

of interest to decipher this cryptogram and learn what the minister

had to say).

* * *

Any sufficiently long cryptogram, then, will reveal both its period

and its key, and this regardless of how the letters were arranged in

the encipherer’s checkerboard. It may then be deciphered with its own

key, and the case, at worst, becomes one of simple substitution. With

shorter cryptograms, we often find, as here, that some one or more of

the cipher alphabets could have had two or more possible keys. This

happening, presuming that the alphabetical arrangement of the square

is a known one, or one easily reconstructed, presents no real

problem; a little experimentation on the cryptogram will show which

keys bring out a message. When the alphabet of the square is an

unknown mixed one, the problem may vary according to length, and the

number of key-combinations which are found to be possible. If, for

instance, the case resembles that of our preceding cryptogram, where

only one alphabet out of four was in doubt, then, remembering that

the Nihilist cipher alphabets are of a kind whose frequency counts

can be “lined up,” we might take frequency counts on the several

alphabets, and supply the missing numbers of the doubtful one by

making its pattern match that of the rest. With several alphabets

in doubt, which could only happen when frequency counts are too scant

to betray their graph, it might become necessary to decipher the

periodic cryptogram with each possible combination of key-numbers,

each time obtaining a new cryptogram, and accept, among these new

cryptograms, the one whose general frequency count seems most likely

to be that of a simple substitution. The correct cryptogram, in this

case, should also contain some fresh repetitions; that is,

repetitions which were not present in the periodic one. As to the

three examples which follow, there should be little difficulty in

deciding whether or not the Nihilist cipher is represented.

131. By B. NATURAL.

45 68 48 46 60 78 45 78 24 59 35 67 50 75 38 58 53 60 65 26 54 46 68 55 38 67 42

69 56 59 24 59 70 54 30 85 32 90 44 46 45 56 79 54 30 86 22 78 27 26 44 49 78 75

38 54 55 78 47 27 45 49 89 44 49 88 42 59 56 49 42 86 50 52 26 55 42 60 47 36 22

50 78 65 50 76 35 78 28 59 26 50 68 54 60 76 25 87 28 29 55 58 59 73 59 97 54 69

66 57 26 46 78 65 48 76 45 57 47 29 65 79 77 55 30 57 35 89 45 49 53 46 66 75 57

97 55 68 28 47 22 66 66.

132. By PICCOLA. (Keyword, CRYPT. Fifth alphabet contains Q. But: Can you

rearrange the numbers on the strip before taking frequencies?

15 20 23 18 03 15 26 12 26 25 03 30 40 14 20 09 20 25 11 15 17 25 16 02 29

30 25 21 18 03 11 16 27 30 26 10 02 21 17 01 06 25 13 01 25 03 30 23 26 23

06 27 12 11 20 12 22 16 18 03 29 20 19 01 19 17 19 12 12 20 02 11 14 18 19

13 20 38 11 23 19 01 19 01 27 30 16 21 01 23 17 24 22 25 03 19 26 21 11 28

11 17 16 21 03 13 20 28 05 20 06 26 13 11 26 11 16 27 26 16 02 26 18 05 25

06 03 16 03 03 30 26 16 27 28 10 02 16 02 29 06 26 27 11 24 15 20 23 13 15

11 25 13 05 24 28 20 40 27 19 19 30 27 19 19 13 02 23 21 28 11 30 14 28 03

18 26.

133. By PICCOLA. (If you recognize this gem of literature, you are beyond the

draft age. It got around the censor in 1918).

20 08 17 29 15 09 01 05 08 29 24 11 06 05 10 26 13 22 06 01 18 19 05 03 16 24 13

16 04 08 07 19 12 18 24 11 17 09 07 27 26 22 01 15 21 21 10 03 06 22 03 18 04 22

20 06 07 24 12 19 10 19 10 30 10 19 16 24 13 16 04 08 23 01 10 10 23 10 09 05 08

17 21 22 09 15 21 21 10 03 06 06 21 20 12 22 21 08 18 19 23 05 02 01 11 34 19 27

12 06 02 15 10 22 03 03 02 11 12 19 10 11 19 27 13 12 18 24 19 13 24 15 07 16 16

16 26 20 04 05 11 29 26 20 03 10 19 10 23 11 16 19 13 16 04 08 25 17 05 24 20 20

23 09 10 25 20 25 02 05 07 16 26 20 04 05 11.

134. By DAN SURR. (Should you be worried at finding this in Daughter's boudour?)

A B C D E F G E H D G E F J E K H D L J D G J M M J D G J M E

E F J E O J E L F A C B D G. - P G M G.

CHAPTER XVIII

Periodic Ciphers with Mixed Alphabets

Periodic cryptograms in which the cipher alphabets are mixed are

nearly always produced by means of slides. Before discussing these

ciphers, it may be well to clarify a few terms which otherwise could

leave room for uncertainty. We have, for instance, two, and sometimes

three, key-words. There is a primary one (sometimes two) used in the

preparation of the slide, and a secondary one, often called the

“specific” key, which is used, as in Vigenère, for the encipherment

of cryptograms. Since we shall have practically no occasion to

mention the primary key-word (or words), any references which are

made here to a key-word, unless clearly seen to refer to the

preparation of a mixed alphabet, can be understood as meaning the

secondary one, that is, the specific key which selects the cipher

alphabets. Perhaps it is also advisable to call attention once more

to the existence of a primary cipher alphabet (the basic one which is

written twice in succession on the slide) and of the 26 secondary

cipher alphabets which can be derived from it by placing it in its 26

possible positions. These are usually referred to simply as “the

alphabets,” while the basic one is more commonly called “the sliding

alphabet.” All, of course, are the same alphabet except for their

points of beginning.

To see clearly what is meant by an “equivalent slide,” the student

may make an experiment: First, form a temporary slide, using any two

26-letter alphabets, and use the slide to encipher a short message.

Now form another temporary slide on which the two alphabets of the

preceding slide (both treated by exactly the same plan) have been

rearranged so that their letters are taken at every interval 3 (or at

every interval 5, or 7, or 9 — any interval whatever that is not

divisible by 2 or 13), and with care taken always to maintain this

constant interval even when the 26th letter is reached and the 1st

reappears. Then, using this new slide in the same way as before,

encipher the same message with the same key, and compare this new

cryptogram with the first. Finally, an _alphabetical_ interval (or

distance) between two letters will mean their distance apart in the

normal alphabet, while a _lineal_ interval (or distance) will mean

their distance apart in any alphabet whatever. That is, the

_alphabetical_ distance from _A_ to _B_ is invariably 1 (position),

while their _lineal_ distance apart on a slide, or in the rows or

columns of a tableau, could be anything from 1 to 25. Where these

intervals must be mentioned often, the distance from _A_ to _B_ will

be referred to more briefly as “the distance _AB_.”

* * *

Now let us consider the four slides of Fig. 138, which are being

designated (arbitrarily) as belonging to _Types I_, _II_, _III_, and

_IV_, in what would seem to be the order of their potential

resistance to decryptment. Their actual resistance, however, might

depend largely upon the manner of their use, and we are assuming

throughout the chapter that the encipherment process is identically

that described for the Saint-Cyr cipher: The upper alphabet, in all

cases, is to be the plaintext one; the index-letter is always the

initial one of this plaintext alphabet; and, for the encipherment of

cryptograms, the letters of the chosen key-word are to be found in

the lower alphabet and brought one by one to stand below the

index-letter in order to set up their cipher alphabets. Also, for

our immediate purposes, we are neglecting certain precautions the

advisability of which will be seen later: First, the mixed alphabets

have all been left undisturbed with their primary key-words (CULPEPER,

DAMASCUS) and their alphabetical sequences in plain view; in practice,

such alphabets ought to be carried through a transposition block, or

otherwise made to appear incoherent. Second, the index-letter should

never be _A_ (or any other frequent letter) unless the details of

encipherment are varied. (We might, for instance, consider that the

index-letter is in the sliding alphabet and that keys are in the

upper.)

Figure 138

SLIDE - TYPE I.

Plaintext: C U L P E R Z Y X W V T S Q O N M K J I H G F D B A

CIPHER: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C.....

══════════════════════════════════════════════════

a b c d e f g h i j k l m n o p .......

Key A: Z Y A X E W V U T S R C Q P O D .......

Key B: A Z B Y F X W V U T S D R Q P E .......

Key C: B A C Z G Y X W V U T E S R Q F .......

══════════════════════════════════════════════════

SLIDE - TYPE II.

Plaintext: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

CIPHER: C U L P E R Z Y X W V T S Q O N M K J I H G F D B A C U L.....

══════════════════════════════════════════════════

a b c d e f g h i j k l m n o p .......

Key A: A C U L P E R Z Y X W V T S Q O .......

Key B: B A C U L P E R Z Y X W V T S Q .......

Key C: C U L P E R Z Y X W V T S Q O N .......

══════════════════════════════════════════════════

SLIDE - TYPE III.

Plaintext: C U L P E R Z Y X W V T S Q O N M K J I H G F D B A

CIPHER: C U L P E R Z Y X W V T S Q O N M K J I H G F D B A C U L.....

══════════════════════════════════════════════════

a b c d e f g h i j k l m n o p .......

Key A: B D A F P G H I J K M U N O Q L .......

Key B: D F B G L H I J K M N C O Q S U .......

Key C: A B C D E F G H I J K L M N O P .......

══════════════════════════════════════════════════

SLIDE - TYPE IV.

Plaintext: D A M S C U B E F G H I J K L N O P Q R T V W X Y Z

CIPHER: C U L P E R Z Y X W V T S Q O N M K J I H G F D B A C U L.....

══════════════════════════════════════════════════

a b c d e f g h i j k l m n o p .......

Key A: C R P A Z Y X W V T S Q U O N M .......

Key B: A E L B R Z Y X W V T S C Q O N .......

Key C: U Z E C Y X W V T S Q O L N M K .......

══════════════════════════════════════════════════

In the _Type I_ slide, the cipher alphabet is in normal order, and

“slides against” a mixed plaintext alphabet. In _Type II_, we find a

mixed cipher alphabet “sliding against” the normal one; in _Type III_,

we find this mixed cipher alphabet “sliding against” itself; and in

_Type IV_, we find it “sliding against” another, and different, mixed

alphabet. Every slide, used in any manner, has an equivalent _tableau_

and while tableaux are seldom used, it is very important that we carry

in mind a clear picture of their appearance; otherwise we shall find

it difficult to understand how slides can be restored with only

partial information. The imaginary tableau which is to serve this

purpose, using any one of the four slides in the manner specified, is

formed as follows: The plaintext alphabet, _with letters in exactly

the order of the slide_, appears at the top. The 26 cipher alphabets,

standing below and parallel to the plaintext one, are all seen in

exactly the order of the slide, _and are shifted, one letter at a

time, exactly as the normal alphabet is shifted in the Vigenère

tableau_. Thus, exactly as in Vigenère, _the columns of this imaginary

tableau are duplicates of the rows_. Keys, if considered, would repeat

the first column of such a tableau. This tableau, as mentioned, is

imaginary. Should the encipherer or the decipherer actually desire to

make use of a tableau in preference to the slide, he would probably

prefer one in which both his plaintext alphabet and his key alphabet

are running in normal order, so that letters are easier to find. To

form this tableau, he would begin by laying out, in normal order, his

plaintext alphabet and his key-alphabet, and then lay out his 26

cipher alphabets in the manner explained in connection with the

Beaufort alphabets. Each of the four slides of the figure is

accompanied by a partial tableau of this kind, and it will be noticed

there that we have only one case in which the (secondary) cipher

alphabets bear any resemblance to the primary one. This tableau, too,

should be well understood, since the cipher alphabets recovered from

cryptograms will be like those of the figure.

Figure 139

5 10 15 20 25 30

Y V N G K Y E G D P Z E A Y K H S M D Q K K W S J I Q V I O

P E I T E A v c I c c c v

35 40 45 50 55 60

K C F K Q J P M L B J X G K C Z D B G N G Q B D Q M E O N K

I T c v I T H T H E P E c E c E

65 70 75 80 85 90

X T Y A D D D G J R X R X F W G D A Y T Q S G G C G P B Y O

H H I E H A I P H E E v

95 100 105 110 115 120

C L W K C B I C F E Z D G J W K U F K C B U I Z Y B K E K C

T H A T H I I c T H A c E A c T H

125 130 135 140 145 150

G K T A O Q C B Y Q U U F Z G G Z Y F N F M J V Z B L Q J U

E c H v E c c E E v A

155 160 165 170 175 180

V M M J T A E F V S M E N K Q J E I Z Y A L Q Y R X R X F R

v W E v E T c E E W

185 190 195 200 205 210

O U F V S V V V V P K T B K C G O M I K B Q V Z N B I N A O

c v c v I E T H E v A c c E A H v

215 220 225 230 235 240

C E V V J F V U Z S B K M K C G P M D T K K Y A D D D Y Z C

E c v E A c v T H E v I c H H E H

245 250 255 260 265 270

B T K V S G Q W I T Z D A K P G W B I O N D G R C H P B H U

A M v E c T H A T E E v H I H E

275 280 285 290 295 300

G K T Q H G U V Z N Y X M L H F S M D Q K K W Z Q U D A M T

E c E c c E v v c I c E c H A

305 310 315 320 325 330

Z D B J O P E U L R Y U G K U Z E U S J Z D B O D R E S I O

T H E v E c I T T E T H E E v

335 340 345

R L A B L J R S Z Q Y Q V F L

A L E c c c

* * *

Of our four slides, only the _Type I_ is radically different from the

rest. Since its basic cipher alphabet is not a mixed one, it makes

little difference what has been done to its plaintext alphabet.

Notice, in the partial tableau which accompanies it, that the

difference between one cipher alphabet and another is purely a matter

of alphabetical shift (or of “size,” if we wish to replace all of

these letters with numbers). Properly speaking, this cipher belongs

to the case of the preceding chapter; it is presented here largely as

a warning of what could happen through misuse of the _Type I_ slide.

In the remaining three cases, the sliding alphabet is a mixed one; a

series of frequency counts taken from cryptograms cannot be “lined up”

unless letters can be placed in the right order before these frequency

counts are taken. The “right” order may be the original one of the

cipher alphabet, or an equivalent order in which the original letters

are taken at a constant interval. In these cases, as with any other

periodic cipher, the period is found in the usual way. Individual

frequency counts are then taken on the several cipher alphabets, and

these are examined in the hope of finding a known alphabetical graph;

that is, the graph of some mixed alphabet recovered from previous

decryptments — (but notice also the _C_-alphabet under the _Type III_

slide!). It can also be ascertained whether or not the frequency

counts have followed one common graph, whether any two or more have

followed one graph, and so on. But when it is found that the frequency

counts are those of unknown mixed alphabets, then each alphabet is to

be treated by simple substitution methods. Here, the principles will

still be those of Chapter IX, and we will examine, as briefly as

possible, the mechanical phases of their application.

Our cryptogram, shown in Fig. 139, is already written into its

correct period, 5, with a few substitutions already made, and a few

letters noted as vowels or consonants (_v_-_c_). With the period

determined as 5, and alphabets found to be in an unknown mixed order,

our next step is the preparation of a contact sheet (contact chart,

contact count) for each one of the five alphabets, the usual form

being that shown in Fig. 140. The necessary number of sheets is

prepared in advance by writing the normal alphabet through the

center, and each is numbered to show what alphabet it represents.

It may also carry the numbers of the two contacting alphabets (those

in parentheses in the figure). Then, if the cryptogram is properly

grouped, so that all first letters of groups belong to alphabet 1,

all second letters to alphabet 2, and so on, the putting down of

contact letters is very rapid.

Illustrating with alphabet 2: Start with its first letter, _V_; find

_V_ in the prepared alphabet numbered 2; place on its left side the

_Y_ of alphabet 1; place on its right side the _N_ of alphabet 3.

Pass on to the next letter, _E_: contacts are _Y_-_G_. Pass on to the

third letter, another _E_: contacts are _Z_-_A_. And so on to the end

of alphabet 2. Each contact chart, of course, will serve also as a

frequency count and as a graph. The five graphs should now be

compared with one another in the hope that some two or more may

represent the same alphabet. Such a key-word as DENSE, for instance,

makes use twice of the _E_-alphabet, thus doubling the amount of

material in one of the alphabets. In our present case, it is found

that the five alphabets are all different. Now, just as in simple

substitution, we wish to determine, for each of the five alphabets,

what letters are apparently representing vowels, and what letters are

more likely to be consonants. For this purpose, some of our

“pointers” are still available, and are just as valid as in

Chapter IX.

Figure 140

(5) 1 (2) (1) 2 (3)

YT A EL A

CSNKZYCC B IUKLQIKT B

OO C LE QK C FB

DD D DD ZZUNZDZGDZ D BGAGYAGABB

E RZPCJMAMZY E GAOFNIVUUS

HJN F MVS F

HUPSCCGCCWN G QDPKZOPQWKU G

CK H SP H

J I Q BB I CN

LQBQ J PXER J

QTPWOQ K KCUTKK KGKBGBK K WETMYTW

L RABC L WQQA

SQ M EE VF M JM

O N D N

R O U G O M

O P E HGGJ P MBMB

OT Q SC YGBGI Q VBVWV

OD R EL JXX R XXS

S FQH S MGM

T BKX T YBK

QQ U UD YGOUBK U FIFFVG

SU V MV FVY V NVU

W G W B

RRK X TRR YJ X GM

QRNK* Y VEXUQ Y

JUTTECP Z EDDDDED G Z Y

(2) 3 (4) (3) 4 (5) (4) 5 (1)

LDDDE A YYKMB YNTY A DOOD A

DDPWTCPQD B GDYYKIHJO A B L L B J

I C F C RZKKKKKGK C ZGBBGGGBH

D MMBMG D PQQTQ OAA D DDR

K E K E F E Z

UEUUC F KKZVV VXYCX F WENRL F

UDDSDXE G DKJGJRK GBN G KNC Z G G

H B H U LQ H GF

EU I ZZ SBWMV I OKTOO I

M J V BMQGG J RWUTO SVS J IFZ

T K V GAMBMEFWGF K QCCCCQCCPU INYG K YHXB

L UMM L BHR FB L J*

SXPKOMPS M DLJIKDLD A M T M

IEV N GKA O N K ZZFG N GFBY

E O N B O D IJIAAYI O KCQCNPR

P P KVD P ZKG

LL Q JY T Q H ZZDKYDKD Q KJMUJKUY

R G R C LFYJ R XXOY

RE S IZ UW S JJ VZVV S MVBG

KK T AQ T MIDJY T QAKZZ

EEV U ZLS U KHJ U VGZ

QUEQVQ V IVZVZF KVVFFJ V ZSSPJS V

KQLK W SKIZ W JF W GK

RR X FF X X

DKZT Y AFAZ QBBAA Y KTOQR ZZ Y BA

Z SWVYUVIFI Z YGYNSCNQQ V Z B

Figure 141

Consideration of Alphabet No. 1

Letter: Frequency: LOW-FREQUENCY CONTACTS VARIETY OF CONTACT

Left Right Total* Left Right Total*

B (v) 7 2 3 5 6 6 12

G (v)(= E?) 11 5 3 8 8 8 16

K (v) 6 2 1 3 5 4 9

Z (c) 7 4 - 4 6 2 8

(*) These observations are not absolute, as in simple substitution.

In Fig. 141 we may see some data and probable conclusions concerning

alphabet 1. By frequency alone, the four letters _B_, _G_, _K_, _Z_,

of this alphabet might all be vowels. When variety of contact is

considered in conjunction with frequency, it is noted that _Z_ shows

no variety on its right. And when contacts with low-frequency letters

are also considered (from information present on sheets 5 and 2; in

the figure, frequencies of 1, 2, or 3 were considered to be low), it

is found that in this respect, too, the letter _Z_ stands apart from

the others. These observations, usually, are mental, and conclusions

for any one alphabet must often be modified by what is seen in other

alphabets. It may be found satisfactory to begin by selecting only

the most _obvious vowel_, or vowels, in each alphabet, and to circle

these, or otherwise indicate them, not only on their own sheets, but

also on the two adjacent sheets where they are found again as contact

letters. When this has been done, the less obvious vowels may be

considered again with an additional “pointer,” whether or not they

show too much contact with the more obvious vowels. Fig. 142 shows,

for each alphabet, the probable conclusions which would be reached

after examining the contact sheets of Fig. 140, and before any

confirmation is attempted. The next step in order is that of

indicating them on the cryptogram itself, and the examination of long

segments in which no vowels have been marked. At this stage, too, the

total number of spotted vowels may be computed to find out how much

of the expected 40% is still missing. Up to this point we have

nothing new, and nothing particularly difficult. Whether or not the

subsequent work is to become difficult depends chiefly upon the

amount of material per alphabet, though granting that the presence of

probable words materially alters the case of the shorter cryptogram.

Figure 142

Conclusions for the Five Alphabets

Alphabet No. Vowels Consonants

1 B G K * Z

2 E D K Q U

3 B G M * V

4 V Z K

5 O C Q

(*) When B and G appear as vowels in two different alphabets,

the graphic appearance of these two alphabets (1 and 3) should

be given another inspection. It happens they are not the same.

If the most frequent of the spotted vowels in each alphabet can be

safely assumed as _e_, the establishment of other vowel-identities

can follow the rules of Chapter IX: The high-frequency vowel which

practically never touches _e_ is _o_; and the one which follows it

is _a_; vowels of lower frequency may precede or follow _e_, but no

vowel should touch it very often. And if, in addition, the most

frequent of the spotted consonants in a given alphabet can be safely

assumed as _t_, then _h_ of the next alphabet will seldom be out of

reach. A very material aid here is found in those _repeated digrams_

(and trigrams) whose letters are already labeled as vowels or

consonants. We find, for instance, _ZD_, alphabets 1-2, occurring

five times, and with both letters already spotted as consonants.

This is very likely to represent _th_, especially when further

examination shows it continued as a repeated _ZDB_, with _B_ already

quite likely to represent the _e_ of alphabet 3. Then the contacts of

_D_, alphabet 2, supposed to represent _h_, have also pointed out a

probable new vowel, _A_, in alphabet 3. Again, we find _KC_,

alphabets 4-5, occurring six times, and with both letters already

spotted as consonants — another probable _th_ — followed three times

by _G_, alphabet 1, already likely to represent _e_, and twice by

_B_, which could thus represent _a_ (the famous English _the_, _tha_).

And similarly we might continue with a long demonstration.

* * *

Returning, now, to our mechanical operations: Dealing, as we are,

with five different alphabets, it becomes imperative that we keep

track of substitutes; otherwise, with all of our numerous trials and

erasures, it is almost impossible to know what substitutes have been

identified and what substitutes are still available for

identification. Also, totally apart from this matter of convenience,

we shall probably want these five lists of substitutes for use on

future cryptograms. This applies to any series of cipher alphabets,

whether or not they are in any way related to one another. But it is

very seldom indeed that a series of cipher alphabets used in the same

cryptogram will be unrelated alphabets. Nearly always, they will have

resulted from the use of a slide, and when this is true, the recovery

of alphabets and parts of alphabets enables us to reconstruct the

slide. The usual plan for recording substitutes is to lay out a

plaintext alphabet in _A B C_ order and then, directly below it, to

rule off several rows of cells, one row for each cipher alphabet.

Thus, any substitute, identified in any alphabet, may be written

directly below its presumed original and on the row which corresponds

to its particular cipher alphabet. We sometimes speak of such a

set-up as a “key-frame” or “key-skeleton,” though a better name,

probably, would be “partial tableau.” (Every row, if completed, will

show one cipher alphabet of the kind we saw in the partial tableaux

of Fig. 138.) Such a “key-frame” for our present cryptogram can be

seen in Fig. 143. At (a) of this figure we have the first tentative

identifications. The most frequent vowel in each of the first four

cipher alphabets has been assumed as _e_ (in practice, the _O_ of

alphabet 5 would also be assumed as _e_). The _ZD_ of alphabets 1-2

and the _KC_ of alphabets 4-5 have both been assumed as _th_, and

after each _th_, we are trying one letter as _a_. The five rows of

this set-up we may now speak of as “alphabets.” At (b) we are

beginning to speculate as to what kind of slide has been used.

Suppose that the cryptogram has been enciphered with a _Type II_

slide. If so, our plaintext alphabet, in the key-frame, is already

arranged like the one on the slide; and when this is true, as may be

seen by glancing back at Fig. 138, the recovered cipher alphabets

will also build up with their letters in exactly the same order as

that of the slide, and, in the end, if fully completed, will show a

picture of the original sliding alphabet taking five of its possible

positions.

Examining the first cipher alphabet of (a), we note that the _lineal_

distance from _B_ to _G_ is 4 positions. If our hypothesis is correct,

then the lineal distance _BG_ will have to be 4 positions in all of

the other alphabets. The third alphabet contains a _B_; measuring 4

positions to the right of this letter, we find that _G_ of the third

alphabet would fall below _i_, and thus would be the substitute for

_i_ in the third alphabet. To see whether or not this is likely, we

return to the contact sheet, where we find that _G_ has already been

spotted as a vowel (see the list in Fig. 142). So far, so good. Then,

the first cipher alphabet of (a) shows the lineal distance _BZ_ as

19 positions. Returning to the third alphabet, and measuring 19

positions to the right of _B_, we find that _Z_, in this alphabet,

would fall below _x_. Examination of the contact chart shows that

_Z_ has not been used in the third alphabet, making it satisfactory

as the substitute for _x_. Still good. Again, the third alphabet

shows the distance _AB_ as 4 positions. Still pursuing our hypothesis,

the first alphabet must also contain an _A_ standing 4 positions to

the left of _B_. If so, it will fall below _w_, and the frequency of

_A_, in the first alphabet is found to be 2, which is satisfactory as

that of _w_. With _G_ and _Z_ added to alphabet 3, and with _A_ added

to alphabet 1, we may now turn our attention to alphabet 4, which

contains a _Z_, and, by making similar observations there, we may add

to the 4th cipher alphabet the letters _A B G_, and, to the 1st and

3d alphabets, the letter _K_. Thus we arrive at (b) through what is

ordinarily referred to as the “symmetry of position” existing among

the several cipher alphabets.

Figure 143

(a)

a b c d e f g h i j k l m n o p q r s t u v w x y z

1 - B G Z

2 - E D

3 - A B

4 - Z K

5 - C

(b)

a b c d e f g h i j k l m n o p q r s t u v w x y z

1 - B G K Z A

2 - E D

3 - A B G K Z

4 - Z A B G K

5 - C

But the second and fifth alphabets cannot yet be combined with the

other three, since neither of these contains any letter in common

with them, and thus we have no point from which to measure lineal

distances. We know, however, that if our hypothesis is correct, the

letters _A B G K Z_, in these alphabets also, will be found at

exactly the same lineal distances as before. It would be possible to

prepare a sort of slide on which these letters, written twice in

succession, are spaced as in the other three alphabets, and use this

in experimenting with alphabets 2 and 5.

The cryptogram, as we first saw it, showed all substitutions which

are possible from (b) of Fig. 143, together with a few _v_-_c_

notations which were listed in Fig. 142 but not further investigated.

In case the student cares to complete solution, he might refer to

certain precautions mentioned at the beginning of the chapter.

Notice, in the last figure, the lineal distance from _G_ to _K_;

what letters would you feel inclined to try in the three intervening

positions? Or notice the distance _BG_. What letter is very likely

to have been taken here for use in the key-word, and where is it

likely to stand in that word? If the index-letter was _A_, does it

seem possible that the _a_-substitutes could all be selected in

advance directly from the contact sheets? Would this be possible if

the encipherment process were varied so that an index, selected in

the sliding alphabet, were brought to stand below keys in the

stationary one? The cryptogram is known to contain the word SUPPOSE,

and the period is 5. Is there any room here for _pattern_ methods?

* * *

Our _Type II_ slide, then, unlike the remaining three, builds up

automatically in the key-frame, _owing to the simple fact that we

are able to set down the plaintext alphabet in the encipherer’s

original order_. The method of solution, so far as we know, was

first published (1883) by Auguste Kerckhoffs, who seems to have

originated the term “symmetry of position.” The invention of the

cipher is credited to “a member of the (French) Commission on

Military Telegraphy.”

If these parallel cipher alphabets are to be avoided in the

key-frame, but still using a _Type II_ slide, General Sacco has

suggested that the encipherment process be altered as follows: Let

the index-letter and the key-letter both be found in the upper

alphabet. Slide the plaintext letter to stand below the index-letter,

and use the substitute which will then be standing below the

key-letter. This, of course, would have to be letter-by-letter

encipherment, and represents one of those rare cases in which a

slide is less convenient and rapid than its equivalent tableau. If

this tableau be laid out in full, as explained for Beaufort alphabets,

it shows, on its 26 rows, 26 cipher alphabets not one of which appears

to be at all related to the others. One of these (the one in which

index-letter and key-letter are the same) will be the normal alphabet.

We may find the original sliding alphabet, however, by looking at

_columns_. Such a tableau is exactly equivalent to the _Delastelle

tableau_ if the _Z_-alphabet be made the normal one. Delastelle’s

tableau was described as follows: Using the mixed alphabet, fill in

the tableau by columns, beginning each column with whatever letter,

in the mixed alphabet, follows the plaintext letter shown above the

column. This causes the final alphabet to come out in _A B C_ order.

The Delastelle tableau is not nearly so easy to reconstruct as that

of the ordinary _Type II_ slide; the method, however, will be plain

enough when we have understood the reconstruction of _Types III_ and

_IV_.

* * *

The _Type I_ slide, as pointed out in the beginning, is somewhat out

of place in the present chapter; every frequency count will follow

the graph of the mixed plaintext alphabet, so that all can be “lined

up” by their common pattern. Having letters, and not numbers, the

“top” of a frequency count may be anywhere; it is usually best to

prepare at least one of the frequency counts of double length in

order to effect the alignment. Granting, however, that for some

reason the common pattern of the frequency counts has not been

recognized, then the method of decryptment would be exactly the same

as for any other case of mixed alphabets.

Fig. 144 shows the development of the key-frame in this case. At (a),

some substitutes have been correctly identified in each of four cipher

alphabets. But long before reaching this stage, the most careless of

decryptors must have noticed that the difference between any two

cipher alphabets is purely a matter of alphabetical shift. This is

particularly visible as between alphabets 3 and 4, where the

alphabetical interval is only 1; examination of alphabets 1 and 2

shows that wherever both substitutes are present, their alphabetical

difference is 14; and further examination shows that the alphabetical

distance from alphabet 2 to alphabet 3 is 17. The use, here, of a

Saint-Cyr slide enables us to arrive very quickly at (b). The

alphabets of (b) are, of course, secondary cipher alphabets, and the

primary one obviously runs in normal order (or, at worst, in a

strictly methodized order which is easily obtainable from the normal

one). What we still lack, in order to reconstruct the slide, is the

mixed plaintext alphabet, and this can be recovered as at (c). Write

out the normal alphabet (known to be the original cipher alphabet),

then, using any one of the secondary alphabets, place originals above

their substitutes wherever these are known. In the given example, all

missing letters can be filled in by alphabetical sequence; and even

though the index-letter was one of low frequency, and thus was not

used in the message, the student should have no trouble whatever in

discovering the key-word which governs the four cipher alphabets.

* * *

In considering the reconstruction of the remaining two slides, we

shall have to keep clearly in mind the _imaginary tableau_ on which

the plaintext alphabet has exactly the order of the one on the slide,

so that cipher alphabets, also, have exactly the order of the one on

the slide, and are shifted one letter at a time, as in the Vigenère

tableau. For one thing, we are going to call some of these alphabets

by numbers, or refer to them as odd-numbered and even-numbered

alphabets. Thus, with the alphabet we have been using, the _first_

alphabet in the imaginary tableau is position 1 of the slide:

_C U L P E R Z Y X W V T_. . . . . . , the _second_ alphabet is

position 2 of the slide: _U L P E R Z_. . . . . . . , the _third_

alphabet is position 3 of the slide: _L P E R Z Y_. . . . . , and so

on to the _26th_ alphabet, which is the final position of the slide:

_A C U L_. . . . . But over and above this, it must be remembered

that _the columns of this imaginary tableau are duplicates of the

rows_, just as they are in the Vigenère tableau. We do not, of course,

recover any of these alphabets in the order mentioned, since our

plaintext alphabet of the key-frame must necessarily be arranged in

its _a_-_b_-_c_ order. For instance, the _fourth_ alphabet, which,

in the imaginary tableau, begins with its key-letter, _P_, and runs

in the order _P E R Z Y X W V T_. . . . . , comes out in one of our

examples (_Type III_ slide) as _L U P C Y A B D_. . . . . , and in

the other (_Type IV_ slide) as _E W Y P V T S_. . . .

Figure 144

The Alphabets from a TYPE I Slide:

(a)

a b c d e f g h i j k l m n o p q r s t u v w x y z

1 - L . . J Q . H G F . . . . B A . . R Y X . . . . . .

2 - Z . . . E . . . T . . C Q . O . . . . . B . . . . .

3 - Q P . O V N . . . . I . . G F U . . D C . B A . Y .

4 - R . . P W . . M L . J . . . G . . . . D . . . . . .

(b)

a b c d e f g h i j k l m n o p q r s t u v w x y z

1 - L K . J Q I H G F . D O C B A P . R Y X N W V . T .

2 - Z Y . X E W V U T . R C Q P O D . F M L B K J . H .

3 - Q P . O V N M L K . I T H G F U . W D C S B A . Y .

4 - R Q . P W O N M L . J U I H G V . X E D T C B . Z .

(c) Alphabet No. 1:

Plaintext: o n m k . i h g f d b a . u l p e r . y . w v t s .

CIPHER (Rearranged): A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

* * *

The _Type III_ slide is, in many respects, the most interesting

member of its family. With every alphabet taking exactly the same

order (that is, the plaintext alphabet, the key-alphabet, and all

cipher alphabets in the imaginary tableau), it parallels the Vigenère

in every particular except the order of the 26 letters. It has a

corresponding Beaufort form, and a corresponding variant in which

complementary keys are based on the order of the mixed alphabet. Its

14th alphabet, like the _N_-alphabet of the Vigenère, is reciprocal

throughout. And its first alphabet, like the _A_-alphabet of the

Vigenère, is a duplicate of the plaintext alphabet. This was pointed

out in connection with the slide of Fig. 138, where key-letter and

index-letter were both _C_. There are two ciphers, then (the _Type

III_ slide and the Delastelle tableau), in which we are sometimes

able to find, among a number of mixed frequency counts, a single one

which follows perfectly the graph of the Vigenère _A_-alphabet.

Concerning the 14th alphabet, however, we are dealing altogether,

here, with a 26-letter alphabet; and some of what follows is being

explained on the theory that the number 26 contains no factors other

than 2 and 13. If the student will give his careful attention to

_reasons_, as well as to methods, he will be able to adjust these

methods to alphabets of other lengths, as, for instance, the very

common 25-letter alphabet met with in foreign texts. The first

alphabet, of course, duplicates the plaintext alphabet regardless of

what alphabet-length is being considered, and thus, whenever a

_Type III_ slide has been used, we are always in full possession of

one of the cipher alphabets.

Figure 145

The Alphabets from a TYPE III Slide:

Behavior of an EVEN-NUMBERED Alphabet

1st Alphabet (Always normal): A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

4th Alphabet: L U P C Y A B D F G H R I J K Z M X N O E Q S T V W

For an EQUIVALENT SLIDE, follow the chain AL-LR-RX-XT-TO......

A L R X T O K H D C P Z W S N J G B U E Y V Q M I F

L R X T O K H D C P Z W S N J G B U E Y V Q M I F A

(1)........... ═ ═ ═

(2)................. ═══ ═══ ═══ ═══ ═══

To find the ORIGINAL SLIDE from the EQUIVALENT one:

(1) Either take letters constantly at interval 9, which is the interval V-W-X:

R Z Y X W V T S Q O N M K J I H G F D B A C U L P E (R)

X W V T S Q O N M K J I H G F D B A C U L P E R Z Y (X)

(2) Or: Spread the letters apart so that the alphabetical sequences K(JI)H, Z(YX)W,

etc. are standing at the right interval, always maintaining the alphabet-length,

26, and intertwine. Both alphabets are the same in this slide:

(The interbals A . . L . . R . . X . . T . . O . . K . . H . . D .

are always odd, . C . . P . . Z . . W . . S . . N . . J . . G . . B

3, 5, 7, etc.) . . U . . E . . Y . . V . . Q . . M . . I . . F . .

Behavior of an ODD-NUMBERED Alphabet

1st Alphabet: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

3d Alphabet: U C L A Z B D F G H I E J K M R N Y O Q P S T V W X

1st HALF-CHAIN: 2d HALF-CHAIN:

A U P R Y W T Q N K I G D (A) B C L E Z X V S O M J H F (B)

Spread the letters of each half, trying interval 2, interval 4, interval 6, and so

on, treating both halves alike, until the intertwining of the two will set up some

alphabetical sequences:

. A . U . P . R . Y . W . T . Q . N . K . I . G . D

B . C . L . E . Z . X . V . S . O . M . J . H . F .

Now, granting that we have completed the decryptment of a message, we

have before us a key-frame in which several cipher alphabets are at

least partially recovered. With one alphabet fully known in advance,

the recovery of another full alphabet usually enables us very quickly

to restore the original slide, or an equivalent slide. The ideal case

is that in which we recover one of the even-numbered alphabets (except

No. 14). The recovery of an odd-numbered alphabet will, at times,

leave us with thirteen possibilities; while the recovery of the 14th

alphabet could be useless, provided we have no other information. The

method of reconstruction can be followed in Fig. 145.

First, we have the perfect case, one in which an even-numbered

alphabet (the 4th) has been recovered in full. We begin by writing

this recovered cipher alphabet letter for letter below (or above)

the one which is always known to us; thus the two substitutes for

_a_ are in a same column, the two substitutes for _b_ are in a same

column, the two substitutes for _c_ are in a same column, and so on.

The columns themselves are not in their original order, but the two

alphabets, throughout, are running parallel, just as they would in

the imaginary tableau, and thus the _columnar distance is uniform_

which separates each pair of substitutes; that is, the _vertical_

distances _AL_, _BU_, _CP_, _DC_, _EY_, etc., are all equal in the

imaginary tableau. If these be rearranged in such a way that the

last letter of each pair is the beginning letter of the next, we

have a chain _AL_-_LR_-_RX_-_XT_-_TO_-_OK_. . . . . made up entirely

of equal vertical intervals, from which the repeated letters may be

dropped: _A L R X T_. . . . . , leaving us a series of 26 letters

known to be equally spaced in the columns of the tableau. Then,

remembering that the columns of this tableau are duplicates of its

rows, we have also a series of 26 letters known to be equally spaced

on the rows. That this series of letters, _A L R X T_. . . . ,

_sliding against itself_, produces exactly the results of the

original series, the student may ascertain for himself; also that a

number of other _equivalent slides_ can be formed by taking letters

of this series at any constant interval which is not divisible by 2

or 13. The total number possible is eleven, of which one was the

original. An equivalent slide, of course, is all that we actually

need for enciphering and deciphering cryptograms. But where

alphabetical sequences existed in the original alphabet, two methods

are shown for obtaining it without writing out the entire eleven

possibilities: (1) Find, at some constant interval, the letters of

an alphabetical, or nearly alphabetical, sequence, as the (reversed)

_V W X_ of the figure, standing at interval 9; the taking of all

letters at this interval brings back the original order. (2) Find

pairs of consecutive letters, as the (reversed) _HK_, _WZ_, _GJ_,

which, if all spread apart to the same extent (some odd interval, as

3 of the figure), would then be standing at their normal alphabetical

intervals, or nearly so. Lay out the 26 positions, and spread the

entire alphabet, maintaining the common interval even after the 26th

position is reached. The figure shows this on several rows; in

practice, there is only one.

If the recovered alphabet is an odd-numbered one, the same plan is

followed, but results in a chain of only 13 letters; it is necessary

to begin with some other letter, not included among the first 13, and

form another 13-letter chain. Having absolutely no additional

information, we cannot combine these two halves with certainty unless

the original alphabet contained some alphabetical, or nearly

alphabetical sequences. Presuming that it did, the method ordinarily

described for combining the two halves is that of the figure. Spread

the letters of the two halves (plan 2 of the preceding case),

treating both halves exactly alike, until a point is found at which

the two halves can be intercombined to show alphabetical sequences.

For this case, however, George C. Lamb, the author of Chapter X,

suggests another plan which would seem to be more direct and less

troublesome than the standard one. Lamb, incidentally, is to be

congratulated here for his entirely new observation: If the two

half-chains can be properly adjusted with reference to each other,

_each pair of letters, regardless of the order, will be a digram

belonging to the original mixed alphabet_. The reason for this

division into halves, of the odd-numbered alphabets, is probably

self-evident: One half contains only odd letters (1-3-5-7-9.

. . . . . . . .) and the other contains only even letters

(2-4-6-8-10. . . . . . .). If both halves were recovered in this

order, and if one half were written directly below the other with

letters 1-2 standing together, then the other pairs would also be

standing together: 3-4, 5-6, 7-8, and so on. We seldom recover them

in straight order; but whatever rearrangement has taken place in one

of the halves has taken place, also, in the other half; should one be

recovered with letters in the order 1-7-13-19-25-5-11. . . . (each

third letter in a series 1-3-5-7. . . . .), then the other will be

recovered with letters in the order 2-8-14-20. . . . . . (each third

letter in a series 2-4-6. . . . . .), though neither half necessarily

begins with the first letter of its series. If, then, we are able to

place together letters 1-2, the other pairs will also be adjusted,

perhaps in the order 1-2, 7-8, 13-14, 19-20, and so on. These pairs

may then be taken at some regular interval and will bring back the

original order 1-2, 3-4, 5-6, and so on.

Figure 146

Another Method for Combining the two Half-Chains of an Odd-Numbered Alphabet

(Originated by GEORGE C. LAMB)

With a Type III slide, based on the key-word EXCORIATE, the 7th alphabet, as

recovered from a cryptogram would come out as shown: H K B L A M N P........

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

H K B L A M N P G Q S U V W D Y Z F E J X C O T R I

The second half-chain, started with D, must be re-adjusted so as to plece in

correspondence the alphabetical sequences PQ, YZ, FG, MN, etc.

1st HALF-CHAIN: A H P Y R F M V C B K S E

2d HALF-CHAIN: (d l u x) T J Q Z I G N W O D L U X

Each corresponding pair of letters was a digram in the original cipher alphabet.

Taking some two letters, as FG, which form an alphabetical sequence, look for

another pair, such as HJ, which may be its continuation. HJ having been found

at the interval 9, try taking pairs at the interval 9:

FG HJ KL MN PQ SU VW YZ EX CO RI AT BD (FG)

Lamb’s method, applied to an actual cipher alphabet, can be seen in

Fig. 146. The first half-chain, if started at _A_, will include the

letters _B_ and _C_, so that the second half-chain would probably

have been started at _D_. But _AD_ will not be a correctly adjusted

digram. It is necessary to look for one which forms an alphabetical

sequence, as _FG_; and when the two halves are adjusted so that _F_

and _G_ are together, other alphabetical, or nearly alphabetical,

sequences are also found to be adjusted, as _MN_, _VW_, _BD_, _KL_,

making it likely that we have found some digrams belonging to the

original mixed alphabet. With this adjustment reached, it is found

that pairs can be taken at the constant interval 9,

_AT_-_BD_-_FG_-_HJ_. . . . . , thus bringing back the original cipher

alphabet.

Presuming that the original alphabet did not contain these

alphabetical sequences, then there are thirteen possible adjustments

for the two half-chains, and any one of these could be the original

alphabet (or its equivalent). But it must not be forgotten that in

an actual case our key-frame always contains portions of other cipher

alphabets; and if the foregoing principle has been well understood,

it may be readily seen how we could make use of these in order to

determine which of the thirteen possible adjustments is correct.

Even the recovery of the 14th cipher alphabet (which results in

thirteen 2-letter chains), would not be useless with this other

information present always in every key-frame. The _Type III_ slide,

in fact, can often be reconstructed without possessing any fully

recovered cipher alphabet. This cipher is very popular with members

of the American Cryptogram Association, and is usually known, for no

very good reason, as “the Quagmires cipher.”

* * *

In the case of the _Type IV_ slide, we do not begin reconstruction

with one complete cipher alphabet already in our possession. It

becomes necessary that we recover two, the perfect case being that

in which one is an odd-numbered alphabet and the other an

even-numbered one. We will follow this case in Fig. 147, where the

two recovered alphabets are Nos. 4 and 7. This tableau, like the

preceding one, has columns which are duplicates of its rows, and to

see our preceding case again (with its one modification), let us

begin by looking only at the three alphabets immediately below the

heading. One of these, the plaintext alphabet, shown in lower-case

letters, we will disregard for a moment, giving our attention only

to the two cipher alphabets.

Figure 147

The Alphabets from a TYPE IV Slide:

Plaintext letters: a b c d e f g h i j k l m n o p q r s t u v w x y z

(1) 4th Alphabet: E W Y P V T S Q O N M K R J I H G F Z D X B A C U L

(2) 7th Alphabet: Y S V Z Q O N M K J I H X G F D B A W C T U L P E R

A CHAIN Started with ab

ab ys vd qx nt jp gl bi sf du xm tz pw lr io fk uh me zc wa ry ov kq hn ej cg (ab)

EW UZ BP GC JD NH SK WO ZT PX CR DL HA EF OI TM XQ RV LY AE FU IB MG QJ VN YS

REARRANGEMENT of this CHAIN:

ab bi io ov vd du uh hn nt tz zc cg gl lr ry ys sf fk kq qx xm me ej jp pw wa

EW WO OI IB BP PX XQ QJ JD DL LY YS SK KF FU UZ ZT TM MG GC CR RV VN NH HA AE

A Reconstructed EQUIVALENT Slide:

Plaintext: a b i o v d u h n t z c g l r y s f k q x m e j p w

CIPHER: E W O I B P X Q J D L Y S K F U Z T M G C R V N H A

ORIGINAL Slide, Found by Taking Letters at the Interval 5:

b u c s m a d z y x w v t .......

W X Y Z R E P L U C A B D .......

These two alphabets, like the two from the Type _III_ slide, are

running parallel in the imaginary tableau, so that we have, as

before, a series of 26 _vertical_ distances, _EY_, _WS_, _YV_, and

so on, all known to be equal in the columnar direction and therefore

known to be equal distances on any row. A chain may be started,

exactly as in the other case, _EY_, _YV_, _VQ_, _QM_, _MI_. . . . . ,

resulting in a series of equally-spaced letters _E Y V Q M I F A L R_.

. . . . . which is either the original cipher alphabet, or the

original one with letters taken at some odd interval other than 13.

It is, however, only the _cipher alphabet_; the mixed _plaintext

alphabet_ must still be found. This may be done, as in the case of

the _Type I_ plaintext alphabet, by using either of the two cipher

alphabets which were first recovered and setting originals above

their substitutes. If this is done with our cipher alphabet in the

order _E Y V Q M I F A L R_. . . . . . , then the plaintext alphabet

comes out in the order _a c e h k o r w z m_. . . . . . , and we have

an equivalent slide. If we first rearrange the sliding alphabet (each

9th letter of the series _E Y V Q_. . . .), we obtain the plaintext

alphabet also rearranged.

Continuing, now, with the rest of our figure: The method we have just

seen was based on a tableau, and our equal intervals were all

vertical. In the figure, we are dealing purely with horizontal

distances, and our method is based, not on a tableau, but on a

_slide_ (as it was with the _Type II_). Our 4th and 7th (secondary)

cipher alphabets, after all, are merely two different positions of

the same slide. If we select any two letters, as _a_ and _b_ of the

plaintext alphabet, and find that their substitutes are, respectively,

_E_ and _W_, in alphabet 4, then the lineal distance _ab_ in the

stationary alphabet must be exactly equal to the lineal distance _EW_

in the sliding one; if this were not true, the letters could not have

coincided as they do. Then, if we find the same substitutes, _E_ and

_W_, in alphabet 7, and note that, in this position of the slide,

they have coincided, respectively, with plaintext letters _y_ and

_s_, then the distance _EW_ in the sliding alphabet must be exactly

equal to the distance _ys_ in the stationary one. It follows from

this that _ys_ and _ab_ are equal in the stationary alphabet. If we

begin again with the lineal interval _ys_, we find that this is equal

to _UZ_ of alphabet 4, and that _UZ_, found again in alphabet 7, is

equal to _vd_. Here, then, is another interval, _vd_, which is equal

to both ab and _ys_. And so we may continue, forming a chain made up

of these known equal intervals, _ab_, _ys_, _vd_, _qx_, etc., for the

plaintext alphabet, and _EW_, _UZ_, _BP_, _GC_, for the cipher

alphabet. Sometimes we return to _ab_ (_EW_) without having included

all 26 letters, and in that case (unless the number of letters

included is a divisor of 26), it becomes necessary to abandon _ab_,

and try starting with some other interval, as _ac_.

Figure 148

Some EXERCISES in the RECONSTRUCTION OF ALPHABETS

Plaintext ....... A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Exercise 1: Q * Z A X B O C N * E R F P V G * Y M U I * W * T L

Exercise 2: U V D W S X K Y H Z C F R J Q L I N G P T O M E A B

Exercise 3: H J G K F P E Q O R S T D M B U V W X A Y Z C L I N

Exercise 4: (1) V N U X J Y Z D Q E M P O W C K R I A T L S B F G H

(2) H S G J R K L N F P Q B U I V A W C X Y T Z D E M O

Exercise 5: (1) G X Y Z M H A F T R L K E V Q U O J W I P N S B C D

(2) E * G J I K * L B * * U T C V W * Q D X S * * * * *

The keywords, all selected by Mr. A. F. SEMPER, do not contain any

repeated letters. The TYPES of slide, respectively, are: I, III, III,

IV, and III. In the 5th exercise, the completely recovered alphabet

is a "number 14." (See also practice-cryptogram No. 46).

Here, as in the case of the _Type III_ slide, we sometimes obtain two

13-letter chains; but in the fortunate case of having recovered in

full both an odd-numbered and an even-numbered cipher alphabet, we

end the chain with every letter represented twice, both in the

stationary alphabet and in the sliding one. Pairs of letters

(representing horizontal intervals) can then be rearranged as in the

other case, the second letter of one becoming the first letter of the

next (in both series), and the dropping out of duplicated letters

gives us an equivalent slide. In the figure, starting with _ab_

(_EW_), we find a plaintext alphabet _a b i o v d u_. . . . . and a

cipher alphabet _E W O I B P X_. . . . . . This, as mentioned, is one

of eleven possible equivalent slides, of which one is the original.

Here, the original can be found by taking letters at interval 21. In

the figure, letters were taken at interval 5, a result of observing

the sequence _W X Y Z_ standing at that interval in the lower

alphabet, and the slide comes out in reverse order. This is still an

equivalent slide, and the decryptor may or may not care to decide

which alphabet runs backward.

Since the reconstruction of these mixed-alphabet slides is probably

the most fascinating subject in the whole field of cryptanalysis,

several problems are being appended in Fig. 148. In all of these,

Semper has selected key-words or phrases to contain no repeated

letters. With reference to the practice cryptograms, only one of

those submitted was thought to have enough alphabet-length for purely

analytical attack. The others, even with their probable words or

partial translations, will still require some work. The periods of

these examples are said to be, respectively, 6, 7, 8, 3, and (?).

135. By NEMO. (Type II. Partial solution: WHEN JACK BOOMER,GREEN RIVER,WYO,B..)

T E R P J Y D B N Q S A I M B X B L Y M D O B I T Z P T I H K O K A G

M Y Q R X T D W U U X B O B Q Y D B W Z S V Z G C U P R Z S W V O D M

T Q Z C A T S M Y Q F D B H Z Q U T I H F S V S Y N F U L Z G L B G D

M T R M U C N A J M I Y N Q O F B D P Q L G X U Y W U I P C A Y N J N

X S B K W I J G R L G I B.

136. By NEMO. (Type III. Partial solution: ALOIS STEPHEN,YOUNG VIENNESE CHARGED W..)

H G K S T I L O Y D B O L E G A Z N G P D U W P B D R V Z Q Y Z X F L

Q S B H S L T U Q P S Z G X V A Y T G B C B X K H U R I E D M D X B T

O E P S A R I N K X K J B I T P Y I X R I U Z Y O M I M H P H B E J D

N E B S E F L B F D B H F J B F N L G P L J M I B O G T A W D U E Q E

Z T Y U S I.

137. By THE SQUIRE. (Type III. Probable words: AMERICAN CONSTITUTION. GLADSTONE).

H T F M R S R T Y E O V P D S Z L A X B A C N T N A K X R C S Z K G O

Q U O F A Z R E T D S V I W K W T E L K F R P R B I H I N A S W R R S

B O H T F L A D D L U B U F M Q O J A G I L I D W T Z I M M R H L L V

K W U J S.

138. By ALII KIONA. (Is this a diplomatic telegram?)

L L D R K Y C R F A S E V S U K T D U L X V K E V C A B L Y U P Y M R

K B E X U B T E L W P J F P T I I U Q Q K T F C T P S K Q L W N D A P

B F A E S N M P R K A P T T S H F K B Z R M G P P Y V M S A I F N P Z

A L T S U S A U D N L X A A Z Y P U C H K N P Y V M S I A X K K D B E

T P S A T P K P S Y V T A Y E A P B T E L W P J F P T A X N.

139. By PICCOLA. (This is a straight-alphabet cipher. Won't tell which one!)

A N D N Y L M Y X N K D L R P G C X G Q N A A R Z L D E P L G I A W Q

N E I O G A G P Q G Z V D E I E Z R H A Y P L B P N A G E L N V A G T

D H O K H V G T I N D O L S F C P L R T.

CHAPTER XIX

Polyalphabetical Encipherment Applied by Groups

Any one of the multiple-alphabet ciphers may change keys at each new

group instead of with each consecutive letter. As a rule, this kind

of encipherment is never found except in connection with very simple

ciphers, and the intact plaintext groups, each one standing on its

own key-line, are readily discovered by the decryptor who takes the

precaution of cutting out a segment from his cryptogram and “running

down the alphabet,” first treating the original letters and then, if

necessary, their complements. Porta encipherment, in any form, is

rare, but its cryptograms can be subjected to the same process,

provided the letters of the tested segment are first enciphered in

the _AB_-alphabet, and the subsequent extensions properly carried out.

Figure 149

The "PHILLIPS" Cipher

1 C U L P E* 2 R Z Y X W 2 R Z Y X W 2 R Z Y X W

2 R Z Y X W 1 C U L P E* 3 V T S Q O 3 V T S Q O

3 V T S Q O 3 V T S Q O 1 C U L P E* 4 N M K I H

4 N M K I H 4 N M K I H 4 N M K I H 1 C U L P E*

5 G F D B A 5 G F D B A 5 G F D B A 5 G F D B A

(1) (2) (3) (4)

Plaintext: T R Y M A....... C D O N A....... L D O N T....... H A T M U..

CIPHER: K T Q D C....... T X N F R....... I X C F L....... C R K L D..

2 R Z Y X W 3 V T S Q O 3 V T S Q O 3 V T S Q O

3 V T S Q O 2 R Z Y X W** 4 N M K I H 4 N M K I H

4 N M K I H 4 N M K I H 2 R Z Y X W** 5 G F D B A

5 G F D B A 5 G F D B A 5 G F D B A 2 R Z Y X W**

1 C U L P E* 1 C U L P E* 1 C U L P E* 1 C U L P E*

(5) (6) (7) (8)

..... R P H Y P....... R O P O S....... I T I O N....... C U R L Y.

..... T W G Q W....... M R O R X....... W K W N Z....... T S U Q P.

With mixed alphabets of any kind, a number of cases may arise,

according to whether groups are of uniform length, or of varying

lengths, or, in fact, represent word-lengths; or, in the one case of

uniform groups, according to the length of these groups, or the

amount of material available, or as to how much is known in advance,

and so on. From among so many possibilities, suppose we select the

case of accumulated short messages, and, at the same time, take a

brief look at a cipher which, according to its description, was

actually intended for group-by-group application. This cipher, which

may be examined in Fig. 149, was described in an early issue of

_The Cryptogram_ as having been used for military purposes, and was

called the “Phillips” system. The text of the figure “Try Macdonald

on that Murphy proposition. Curly” includes eight five-letter groups,

thus requiring eight cipher alphabets. The key, as originally prepared,

is a mixed 25-letter alphabet written into a 5 x 5 square, of which

the five rows can be cut apart to form five horizontal strips. It may

also be set up with anagram blocks. This is alphabet 1 (or block 1),

and serves to encipher the first five-letter group. The method of

substitution will be explained in a moment. Alphabet 2 (block 2) is

derived from the first by moving line 1 so that it stands between

lines 2 and 3. Alphabets 3, 4, and 5 are derived by continuing to

move the original line 1 so that it stands, successively, between

lines 3 and 4, between lines 4 and 5, and at the bottom of the square.

Alphabets 6, 7, and 8 are derived by moving the original line 2

according to the same plan. For puzzle purposes, these movements may

continue as they apparently began. Line 2 may be given its one

remaining shift, which places it at the bottom of the square, and

lines 3, 4, and 5 may then be moved downward in the same way as the

first two; some puzzlers, in fact, will afterward continue by treating

columns. But according to the description (the only one the writer has

ever seen of this cipher), the eighth cipher alphabet is the last. For

the encipherment of the next eight groups, either the square is

restored to its original set-up and the same eight alphabets used

again, or the first key is abandoned altogether in favor of an

entirely new one.

Now, considering any one block, as No. 1, the method of substitution

is as follows: Each letter is to be replaced by the one standing

immediately to its right on the descending diagonal. If the given

letter happens to stand at the extreme right side of the square, it

is to be replaced by one standing at the extreme left and on the next

line below. If it happens to stand on the bottom row of the square,

it is to be replaced by one standing on the top row and in the next

column to the right. One letter, in fact, requires both of these

(mental) adjustments; the letter which occupies the lower right-hand

corner is to be replaced by the one occupying the upper left-hand

corner. If the foregoing is well understood, is is quite obvious that

our key-square is, to all intents and purposes, a rhombus formed with

five diagonals. One diagonal is complete, as _C Z S I A_ of block 1.

The other four break off at the right and are continued from the left,

as _L X O N F_ of block 1; or, if you prefer, break off at the bottom

and are continued from the top, as _N F L X O_ of block 1. It should

be obvious, also, that any one of these five diagonals can be

considered as beginning with any one of its five letters without in

the least changing the encipherment. Thus, each diagonal furnishes

what is called _cyclical encipherment_. But, as a matter of fact, the

entire square involves cyclical encipherment: The placing of line 1

at the bottom of the square, or of column 1 on the right side of the

square, or the transfer of several lines or columns, or of both, will

not have any influence whatever on substitutes; for this, it is

necessary to alter the 1-2-3-4-5 order of these rows or columns.

Alphabet 5, then, will be the same as alphabet 1; and if the plan of

the puzzlers be followed, this same alphabet continues to reappear

for the encipherment of each fourth group, blocks 1, 5, 9, 13, 17,

and so on, of a long cryptogram, eventually giving a great deal of

material in one cipher alphabet. Moreover, groups having a length of

five letters will carry some very visible simple substitution patterns.

Now suppose we look at Fig. 150.

These eight cryptograms have all come from one source. The general

frequency count has shown a missing letter, _J_, suggesting the use

of a square, and we have suspected the cipher as “Phillips.” With

cryptograms arranged one below another, as shown, the first five

columns are presumably enciphered with block 1 of that cipher, the

next five columns with block 2, and so on; thus, we presumably have

40 letters each belonging to alphabets 1, 2, and 3, and almost that

number belonging to alphabet 4, that is, enough material for frequency

counts which will show whether or not they have been taken on simple

substitution alphabets. While 40 letters of text are very few, we

could, eventually, solve any simple substitution cryptogram of that

length, or any mixed-alphabet periodic whose alphabets have furnished

40 letters each. In the present case, our first alphabet has furnished

eight known word-beginnings; we have one column known to contain only

initials, and followed by two others which are very likely to be the

hiding-place of vowels. This does not mean that we should have no

preliminary struggles, but in the end there are plenty of clues to

set us on the right road: The predominant letters of alphabet 1 are

_A_, _B_, _O_, _K_, _U_ (practically sure to contain _e_, _t_, and

one of the vowels _a_ or _o_). The column of initials repeats both

_A_ and _T_ (to be compared against a list _t s a_. . . .). The

second and third columns, combined, include _B_ and _O_, three times

each, with _O_ found in the initial column also (both could be vowels,

and _O_ probably represents _a_, though _i_ is also frequently found

as an initial). If _A_, by frequency and initial position, be tried

as _t,_ then the other repeated initial, _T_, can be tried as _s_.

This assumption brings out, in the fourth message, a pattern

_s_ - _t_ _t_ -, in which the second letter, _B_, would have to be a

vowel, either _e_ or _o_, since it has been doubled, with _e_

appearing more likely in the given pattern and also in that of the

sixth message, _s_ - - - _s_. The letter _O_, which under the

encipherment scheme could not possibly be its own substitute, can be

assumed, by frequency, as _a_, rather than _i_.

Figure 150

1. A F S X O S G Y F O N P Y O A K O A D G F Z K S Z O Y Z Y L A W A C F.

2. H O U A L H L E D H D L Y G A V D W A K.

3. K O N B K A X U O N H I Q P L B A Z F F S Y F D R R L Y F.

4. T B A A M A F Q E Z U M A I X G F S K B.

5. D K O A C Y B Y E N I M O W D L E G A D O H C Y U U R G.

6. T B B X T O M M D A S I A A Y D Z.

7. O U S U B U L O I Y G A K X M A K W E L.

8. A K R U W A N A L O N N F M S K A X E U.

General Frequency Count:

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

25 8 3 10 6 11 7 5 5 . 11 10 7 7 15 2 2 4 8 3 10 1 5 6 12 6

Frequency Count on Alphabet 1, Only:

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

6 5 1 1 . 1 . 1 . . 4 1 1 1 5 . . 1 2 3 4 . 1 2 . .

These first correct substitutions are all shown on the left side of

Fig. 151, on the lines marked (a). Surely the next identification

would be the _m_ of _seems_, and probably, too, the _l_ of _settl_. . .

With the vowel _a_ already identified, the repeated _OU_ would be

tried as _an_, and the repeated _KO_ as _ha_, using the digram list.

These are the substitutions marked (b), and from this it is but a

step to the assumptions marked (c). On the right side of this figure,

we are proceeding into alphabet 2. A frequency count here has shown

that the leading letters of this alphabet are _A_, _O_, _Y_, two of

which, _A_ and _O_, were also leaders in alphabet 1. It is one

peculiarity of the “Phillips” cipher that a change in alphabets means

a change in only fifteen of the substitutes, the remaining ten

continuing to represent the same originals as in the preceding

alphabet. Concerning _A_, we can see, from the third and fourth

messages, that it has not continued to represent _t_; but _O_, in the

sixth message, has rather suggested the word _all_ and even the

expression _all right_, which would carry us on into the third

alphabet. From this point onward, then, we are in the same fortunate

position as the decryptor who intercepts his message partly in cipher

and partly in plaintext. With the context as a guide, we need not

worry as to what happens at the ninth group.

Figure 151

First Alphabet Second Alphabet

1. A F S X O S G Y F O ...

(a) t . . . a . . . n a

(b) t . . m a . . o n a

(c) t r y m a . . o n a (Try ma...)

2. H O U A L H L E D H ...

(a) . a . t . . . . . .

(b) . a n t . . s u r .

(c) c a n t . e s u r e (Can't be sure...)

3. K O N B K A X U O N ...

(a) . a . e . i . . a .

(b) h a . e h i m . a t

(c) h a v e h i m . a t (Have him ...)

4. T B A A M A F Q E Z ...

(a) s e t t . i . g . a

(b) s e t t l i n g u .

(c) s e t t l i n g u p (Settling up ...)

5. D K O A C Y B Y E N ...

(a) . . a t . . . . . .

(b) . h a t . o y o u t

(c) w h a t . o y o u t (What do you t...)

6. T B B X T O M M D A ...

(a) s e e . s a l l . i

(b) s e e m s a l l r i

(c) s e e m s a l l r i (Seems all ri...)

7. O U S U B U L O I Y ...

(a) a . . . e . . a . .

(b) a n . n e . s a . o

(c) a n y n e w s a . o (Any news abo...)