Elementary cryptanalysis

DYFR   SWCX   VHZS   WMLB   TMLB   CZYO   PHUT   WKHT,   JKOS 
MOSY   PHOB,  NHTK   IKAR   AMLW   WHCU,   DUKT!   LMSR   LYZV 
ECMQ   XKOS,   DMOT   VHNK,   VMLB,   PUCK!   VHDK   YZKO,   GHLB 
UYVS!   WHAT   BOYS,   YOUR   LUCK!

If the probable word is a pattern word, so much the better; but every word carries a pattern in the normal frequencies of its letters. For instance, the word CIPHER, considered in relation to a text of 100 letters, has, roughly, the frequency-pattern 3-7-2-5-12-6; or, considered in relation to a 200-letter text, a pattern which is approximately double the first: 6-14-4-10-24-12. A cryptogram supposed to contain this word may be prepared as recommended in Chapter IX, with a frequency-figure written above each letter. The frequency-pattern of the word CIPHER, based on approximately the same amount of text, may then be written on a slip of paper and passed along below the frequency-figures shown for cryptogram-letters, in the hope of finding points at which the two sets of figures are, to some extent, alike. Wherever such points can be found, the suspected word can be assumed to be present there. So long as the method remains that of simple substitution, any substitutes which can be found in this way can have no other originals than those first determined; thus, their substitution throughout the cryptogram will serve to bring out other possibilities.

For the multiple-substitute cases, that is, those cases in which all or part of the letters may have more than one substitute, the frequencies of such letters as I, H, E, R, may be left blank (or cut in half, dependent upon just what the cipher is), and only the frequencies of C and P, standing two positions apart, need be considered. Particularly helpful, in this case, would be a probable word such as CRYPTOGRAM, in which five infrequent letters are standing at known distances apart. The frequency-pattern of this word, based on 100, can be expressed roughly as 3 - 2 2 - - 2 - - 2, and the attempt made to find points in the cryptogram at which five letters of somewhat these frequencies are standing at the given intervals apart. The foregoing is based on the supposition that while the encipherer, having several substitutes per letter, will be able to conceal the true frequencies of his high-frequency letters, there is not much that he can do toward concealing his low frequencies. He can, of course, produce any frequencies that he likes by swamping his text with nulls; and this, in the hands of a clever operator, can be very effective, especially if the circumstances are such that he can keep his method a secret. But for the average practical purpose, the time consumed in the encipherment, and the increased length of the cryptograms, are highly undesirable features, especially if it be kept in mind that there are many other ciphers than simple substitution. As to attack by analytical methods, the one device which is more likely than any other to prove applicable in all cases is the preparation of a digram count of exactly the kind we saw in Fig. 68. Such a chart will afford the means for studying carefully the contacts of any given letter; just what its variety seems to be; whether or not this seems disproportionate to its apparent frequency; whether or not it shows a tendency to touch letters of lower frequency, or to be present in reversals; and so on.

Many of these ciphers, however, make use of two letters to represent one. With these, it is the single-letter frequency count which is best made on a chart. That is, the cryptogram is first marked off into its pairs, and these pairs are counted in the same way as that described for digrams. But digrams, in this case, will be represented by four letters, and usually the number of different pairs is so large that the examination of digrams will have to be done by listing. For any cipher whatever in which the substitutes are two-digit numbers, a frequency count taken in chart form is usually far more convenient than one made by listing the numbers in advance. With only the ten digits, the 100 cells can be made larger than the 676 cells needed for letters, and the chart still be small and compact. The pairs of digits would be counted in exactly the same way as so many digrams. With numbers, it is sometimes possible to take the subsequent digram count, also, on a chart. Solution, in many cases, involves pure guess-work. The decryptor, perhaps, has begun his examination by testing his cryptogram for some variation of the “Caesar” encipherment. He has counted the first hundred or so of his letters, and has discovered that his frequency count is not going to be that of an ordinary simple substitution; that is, it is evidently not going to be one which he would be able to mark off into sections of high, medium, and low frequencies (usually with several letters missing), which would certainly be the case had each plaintext letter been replaced always with a given substitute throughout the cryptogram. Perhaps he has then marked his cryptogram into pairs of numbers or letters, and finds that these, also, are not likely to furnish the kind of frequency count which betrays simple substitution or some other cipher with which he is familiar. At this point, he is likely to pause and consider the source of the cryptogram. Is this the work of an expert, or the work of an amateur? Is it worthwhile to make up the statistics? Or shall I try for some one of the novelties which I have met many times before?

One device which is particularly popular with amateurs is that of assigning to each letter the numerical value which represents its serial position in the normal (or reversed) alphabet, A having the value 1, B the value 2, and so on, and afterward representing each plaintext letter with two (or more) others which will express some arithmetical process. For instance, the letter C (value 3) might, in some one of these systems, have the substitute AB (1 plus 2), or the substitute DA (4 minus 1), or the substitute YD (25 plus 4 equals 29; and 29 minus 26 equals 3); and so on to infinity.

Other simple devices, hardly worth calling ciphers, which have been used in the columns of The Cryptogram under the title “Simple Substitution with Frills,” have included: (1) The use of false word divisions. (2) The simple reversal of an otherwise unmanipulated cryptogram. (3) The use of two given digrams, placed alternately at the ends of words. (4) The use of a new cipher alphabet for each new sentence. The first of these, of course, should have been suspected after examination of the apparent terminal letters. The second, theoretically, ought to be spotted if the method of solution includes a close investigation of digrams. As to the third device, any two digrams, used in the manner described, will attain impossible percentages; our leading digram, TH, in normal text, remains fairly close to three or four percent. It was the fourth device, however, which caused the greatest consternation among the younger solvers; in this case, the making of the frequency count will show what the trouble is: It begins very well, with the expected resemblance to a normal count, and suddenly begins to grow erratic.

Not every variation encountered in dealing with simple substitution is employed with the deliberate intention of creating difficulties. Those correspondents, for instance, who select some one letter, as X, and place it after each word as a word-separator, do so because they find it difficult to read their texts unless the word-divisions are present. As to whether or not this device does actually create difficulties: The person who is content to make use of simple substitution as his means of secret communication, is not usually inspired to employ more than one such letter. The length of an English word being somewhat shorter than five letters, any single letter placed religiously after each word will attain a frequency (based on the new length) of not less than 18%, where the letter E, at its very maximum, can rarely attain 15%. The decryptor, taking his preliminary frequency count, quickly discovers this one letter of enormous frequency. He might suspect German, or even French, and look for other characteristics of those languages. But having reason to believe that the language is English, he recognizes this letter instantly for what it is; he first makes sure that it is distributed throughout the cryptogram at an average interval of five or six letters, then calmly circles it out and deals with a case of word-divisions.

Considering something of a more practical nature, there is another very common device, used with every conceivable kind of cipher, which is not in the least intended for the purpose of creating difficulties, yet invariably does in short cryptograms. The ordinary practice, when dealing with numbers, necessary punctuation marks, and so on, is to write these out in words: three hundred twenty five; quote; dollars. But where a given correspondence is likely to involve a great many of these, so that the ordinary practice is very wasteful, the encipherer is nearly always provided with a little “cipher alphabet” of the general kind indicated in Fig. 76, in which the ten digits, any desired punctuation marks, and any other needed symbols ($, %, @) have each a single substitute. In the “alphabet” of the figure, the number 325 will be enciphered CBE. But if this enciphered group CBE is always to be cleanly distinguishable from the rest of the text, a means must be found for making this distinction, and this is usually done by reserving some one letter to act solely as an indicator and never using this letter for any other purpose. This indicator-letter, as W, may then be placed at the beginning and end of the enciphered group CBE, and the resulting group, WCBEW, may be placed in the plaintext message, ready to receive whatever kind of encipherment is given to the rest of the letters. These groups, used in short cryptograms, can give about the same amount of trouble as would so many nulls. But where cryptograms are longer, with a great many such groups, the decryptor invariably spots them by means of the recurrent indicator. Sometimes one letter is used, and sometimes two (W. . .W, or K. . .W); but in either case, the indicator always appears as a pair of correlatives, and wherever the first of the pair is found, its companion is never far away. Some provision must, of course, be made for replacing the indicator letter in the plaintext alphabet. In English, we ordinarily select J for any such omission; this is a letter which is rarely used, and, on those scattered occasions when it does occur, it can be replaced with I. Among the Latins, it is commoner to make use of K and W; these two letters are not used at all in their native languages, and can be replaced, respectively, with Q and VV. It is also possible to omit X, replacing it with KS, or V, replacing it with U. The fact that it is possible to shorten the message alphabet without appreciably impairing the clearness of its messages has given rise to what is probably the most practical of the simple substitution variations: two or three letters, as J, K, V, are omitted from the plaintext alphabet, while the cipher alphabet retains its full 26, and in this way some extra substitutes are provided which can be given to the more frequent letters. It is possible to dispense with as many as five letters, replacing J, K, X, V, W with I, Q, QS, U, UU, and assign the extra substitutes to E, T, A, O, N. Fig. 77 illustrates an alphabet of this kind. Here, the letters I J are to have the same substitute, and the letters K Q are to have the same substitute. This releases two extra substitutes which may be given to E and T.

The foregoing is one of those cases in which the decryptor can learn a great deal by taking his frequency count in the form of a digram chart. And he knows, of course, that his cryptogram contains some two letters whose combined frequencies will reproduce the frequency of E, or of T.

In Fig. 78, we have a “checkerboard” which, primarily, is intended as a transformation device; that is, a means for replacing single letters with syllables, and, consequently, for replacing five-letter incoherent groups with ten-letter pronounceable groups; under the European agreement, the price of transmission is the same

for both, and the pronounceable groups are less likely to result in transmission errors. The alphabet is first reduced to 25 letters (in this case by the omission of X), and is written into a 5 x 5 square. The five vowels, written at one side, will then serve to designate the five rows, while five other letters, written across the top, will designate columns. Any letter found inside the square may thus be pointed out by naming the two letters which will indicate its column and row. In the given example, A can be replaced with EN or NE; T with UL or LU, and so on.

The fact that two interchangeable substitutes have been provided for each letter of the alphabet has led many persons to use this device, absolutely without modifications, as a simple substitution key. Yet it must be plain that any decryptor, taking his preliminary frequency count, will discover, before going very far, that this count is being made on only ten different letters, and thus can represent only one possible kind of encipherment. A frequency count taken on the pairs, with no distinction made between a given digram and its reversal, will afford the necessary proof; after that, the average decryptor will usually replace the pairs with single letters (or numbers), just as he would in dealing with printers’ symbols, or other inconvenient characters. The checkerboards which are actually intended for encipherment purposes ordinarily use digits for pointing out columns and rows. Where the digits at the side are the same as those across the top, it becomes necessary to observe an order, as column-row, or row-column, and this, using only five digits, is ordinary simple substitution, in which every letter has one substitute. But if the five digits at the side are different from the five written across the top, then the order is immaterial, and any number may be interchangeable with its reversal; that is, 17 or 71 can represent the same letter.

This encipherment might not be spotted so promptly as the case in which only ten letters are present out of a possible 26. But if the count is made on a chart, as recommended at the beginning of the chapter, it is very readily detectible that there are two separate groups of digits, neither one of which has ever formed any combination within itself, every number in the cryptogram being composed of one digit from each group. Thus we see plainly the trail which is left by co-ordinates.

Checkerboards, of course, can be used to better advantage. But, before leaving the simple for the complex, we must not overlook the celebrated key-phrase cipher, which discards the idea of multiple substitutes in favor of multiple originals! This cipher, shown in Fig. 79, is said to have been used for serious purposes. Its only difference from the ordinary simple substitution lies in the nature of the cipher alphabet, which must be a plaintext sentence, or phrase, containing the necessary 26 letters. The mysterious pronouncement, “One who has passed on is among us,” is the earliest example of which the writer has any recollection; those of later years have been largely proverbs, or other familiar sayings: “Journeys end in lovers’ meeting”; “Prosperity is just around the C.” As any cryptogram-letter may have five or six different originals, it is readily understood why the cryptograms of the key-phrase cipher are seldom seen without their word-divisions; yet, curiously enough, their translations are almost never ambiguous.

As to their decryptment, the student who cares to try the appended example will find that it is hardly more difficult than one of the simpler “aristocrats.” The method is about the same for both, keeping in mind that the frequency shown by any cryptogram-letter is either the frequency belonging to one letter or the exact sum of the frequencies belonging to several. Here, however, the reconstruction of the key simultaneously with the identification of substitutes is a very important adjunct to solving; the cipher-alphabet, being pure plaintext, can often be built up long in advance of solution. It might be added that this cipher, with or without word-divisions, is readily distinguished from all others by the make-up of its frequency count, which, as a rule, consists chiefly of the high-frequency letters in unusual numbers.

Passing now to the more difficult cases, we will glance at a few of those ciphers which are truly multisubstitutional; that is, which provide multiple substitutes for all or most of the plaintext letters. This is usually accomplished by the use of two-digit numbers, of which one hundred are possible: 01-02-03. . . . . .98-99-00. These one hundred numbers may be assigned as substitutes to the twenty-six letters, in proportions roughly approximate to their normal frequencies, as suggested in Fig. 80; or most of them may be so assigned, and the rest reserved as substitutes for digits, punctuation, and so on. For security, however, they must never be assigned in regular order, as in the figure, or even by any methodical process, but absolutely in incoherent order. Thus, while the form indicated in Fig. 80 will be

convenient enough for encipherment purposes, it is much less so for decipherment, and ordinarily there will be two separate tables, the second of these making it more convenient to find numbers. This deciphering key can be prepared as a list, running in numerical order; but a much more usual and convenient method is that of preparing it in the form of a chart; that is, the ten digits are written across the top and along one side of a 10 x 10 square, exactly as if making ready to take a number-count, and the letters, or other characters, are then distributed in the 100 cells so that the correct digits will serve as co-ordinates for pointing them out. Such a key is changeable, but not readily communicated and remembered without written documents; and to overcome this very serious defect, many mnemonic devices have been conceived, of which the following is perhaps the most practical: Simply treat the one hundred numbers as if they were a plaintext message, and encipher the series by any one of the irregular transposition processes.

The two commonest of the checkerboard keys are shown in Fig. 81. When digits are used, as in (a), an order must be observed in reading the two co-ordinates. The letter L, for instance, may have any one of the substitutes 13, 18, 63, or 68, but may not also have their reversals, since these, using the same order, row-column, would all be substitutes for G. Using letters, however, it is possible to have two

entirely different series at top and side, as in (b); in this case, no order need be observed, and the letter L may have any one of eight substitutes: KE, KF, LE, LF, EK, FK, EL, or FL. By including the still unused letters U V W X Y Z, it can be arranged to provide yet more substitutes for some of the letters. For either of these cases, the external numbers or letters (preferably in mixed order), could constitute a semi-fixed key — that is, one not changed every day — while the mixed alphabet of the square could be changed as often as desired. Innumerable other keys of this type are found. For the most part, they are based on rectangles of 35, 36, or 40 cells, the extra cells being used for digits, or other desired symbols, and especially for extra appearances of the more frequent letters.

One such key, the Grandpré cipher shown in Fig. 82, uses 100 cells. The filling of the square with ten ten-letter words provides letters in somewhat the normal frequency proportions, and an eleventh ten-letter word, composed of the ten initials, serves as a sort of mnemonic device for stringing the first ten together. The words, of course, must be chosen in such a way as to include all 26 of the letters.

General Sacco, dealing with fractional substitutions (Chapter XXII), shows the same idea in a checkerboard which he describes as “frequential.” This square is simply filled with letters, used in proportions roughly approximating their normal frequencies; for ready finding, all repetitions of a letter are placed close together, but filled in on diagonals, which, to some extent, will prevent their being represented by consecutive numbers.

In Fig. 83, we have the checkerboard again, with a modification. If the key used is exactly the one of the figure, those letters which are standing on the first three rows may have twelve substitutes each, and those which are standing on the fourth row may have eight. In all of these cases, the substitute for any letter is a pair. But the final row, including here the letters V W X Y Z, is not enciphered with a pair of co-ordinates; each letter may represent itself, or each may represent the one on its left or right, but in any case, the substitute is a single letter. Thus we have cryptograms in which most of the letters are represented by pairs, but a few are not. Such words as ever, you, with, when, by, have, and so on, will occasionally occur; or, if not, then the encipherer may insert a few nulls at strategic points. Thus, the decryptor, taking his count purely on pairs, is expected to take some of them correctly and “straddle” the rest. Such a device is described by Givierge, also the following similar device. The cipher alphabet consists only of two-digit numbers, but includes no number coming from the 40’s. With all of the 40’s omitted, a sequence 44 becomes impossible; and the encipherer, having first prepared his cryptogram, looks it over, and, here and there, inserts a digit 4 beside another digit 4, producing the impossible sequence 44. The decipherer, wherever he sees this, need merely erase one of the 4’s, and since the digits,

in Morse, have their own distinctive symbols, there is no great danger of errors in transmission which the decipherer will be unable to straighten out; but the decryptor, as before, is expected to “straddle.” Concerning decryptment, in all of these cases, there is little that we can say here except that, given sufficient material, these ciphers can all be decrypted with comparatively little trouble.* [footnote: For a clear and detailed exposition of the decryptment method ordinarily used in multiple-substitute cases, see Secret and Urgent (Bobbs-Merrill), page 64 et seq. For dictionary cipher and simple codes, see The Solution of Codes and Ciphers, by Louis C. S. Mansfield (Maclehose), page 56 et seq., or Cryptography (Langie-Macbeth; Dutton), page 88 et seq.] The “straddling” devices, perhaps, would represent the most difficult case, presuming that the decryptor has no probable words and none of the information which comes through espionage or from that even more fertile source, the carelessness of the encipherer. In dealing with one of these, the decryptor, who normally expects a certain amount of uniformity in the frequency counts made from different portions of a same cryptogram, is likely to find that his count is showing altogether new substitutes, or the same substitutes with altogether new frequencies. He suspects, then, that he may be “straddling” between two pairs, and tries making his count in sections until he finally discovers what letters (or digit) are causing the trouble.

The use of co-ordinates, in those cases where row and column are interchangeable as to order, shows up very plainly when the pair-count has been made on a chart; as previously mentioned for a case of digits, the letters will divide automatically into two groups, neither of which ever forms any combination within itself. With the other case, where an order must be observed, there are not so many substitutes per letter. But in either case, it is possible to pair the letters which belong together. Here, for instance, are the letters E and F. The frequent combinations of both E and F are always formed with the same letters; and both have avoided the same letters; these two must have been paired. Their combinations with G and H are much more frequent than their combinations with I and J; thus G and H must have been paired, and I and J must have been paired. This combination

EG (and its equivalents), has been frequently followed by this other combination (and its equivalents) and so on. When a great many pairs can be considered equivalent to one another, it is possible to begin setting up the checkerboard. Some such devices, of course, are safer than others. But the mere fact that they double the lengths of the cryptograms renders them unfit for any purpose where speed is a requirement; nor can the added time and expense of transmission be tolerated for any purpose whatever unless there is some very definite gain in secrecy.

One great objection to any device offering optional substitutes is that the encipherer himself seems unable to take full advantage of his system. Even having at his disposal five different substitutes for E, he falls into the habit of using one of these in preference to the other four; or, determined to avoid this, he uses them meticulously according to rotation, so that when a frequency chart is prepared from his cryptograms, this chart, which is, after all, a graph, will show the five uniform frequencies sticking out like a sore thumb. Even book cipher, notably secure, however unwieldy in use, has been decrypted because of the encipherer’s very human tendency to use a substitute more than once rather than search for a new one among the hundreds at his disposal.

In book cipher, any agreed book, or other written or printed document, will serve as a key-volume, so long as it is one that is sure to be at hand when wanted. Words, or letters, can then be represented by a series of numbers usually indicating: page, (column), line, serial position. One letter or one word may thus have a substitute such as 20-1-4-32. An example is provided in Fig. 84, which the interested student may puzzle out for himself. The particular key-volume was issued in 1848, but we think this should cause no trouble. When the key-volume selected happens to be the ordinary dictionary, identically the same cipher becomes known as dictionary cipher, which is, to all intents and purposes, a very insecure form of code. Perhaps the two names together, book cipher and dictionary cipher, might be said to represent the maximum and minimum degree of safety found in the code family.

We leave undiscussed the subject of those alphabets which are based on phonetics, with digraphs TH, SH, CH, having their individual symbols, and each vowel capable of having several. The student who desires to prepare one may find the necessary suggestions in any shorthand manual; his substitutes can be two-digit numbers, and his encipherment may be any one of those intended for the normal alphabet. Having made mention of several processes which, to the younger student, may present frightening possibilities, we hasten to add that the four appended examples are all of a type which he should be able to solve without a great deal of difficulty.

To make use of a cipher alphabet, say the B-alphabet, we may lay a ruler across the tableau in such a way that this one alphabet is pointed out. Then, to encipher any letter, as S, we may find this letter, S, in the plaintext alphabet at the top, and trace down its column as far as the B-alphabet which is being pointed out by the ruler; we find that the substitute, in this alphabet, is T. Or, wishing to decipher T, we find this letter in the B-alphabet and trace upward to the plaintext alphabet in order to find that its original is S. While the foregoing explains the principle, it has not been expressed in the usual language. Where we have mentioned the use of the B-alphabet, it is much commoner to hear that a certain letter has been enciphered or deciphered “with key-letter B,” and the usual description of the encipherment will be somewhat as follows: To encipher S by B, find S in the plaintext alphabet, find B in the key-alphabet, and use the substitute which is found at the intersection of the S-column with the B-row. Or: To decipher T by B, first find the key-letter B, trace horizontally to the right as far as the cipher-letter T, then trace upward to its original, S. This, we believe, is the original description, as explained by Blaise de Vigenère himself, and the original encipherment plan was that indicated in Fig. 86. The message of this figure is SEND SUPPLIES TO MORLEY’S STATION. The key-word, BED, has been repeated often enough to pair one

key-letter with each text-letter, and these pairs are handled one at a time: S is enciphered by B, E is enciphered by E, N is enciphered by D, and so on, following the original description.

The modern method would be that of Fig. 87. Knowing that a great many letters are going to be enciphered by B, a great many others by E, and a great many others by D, and having no wish to preserve word-divisions, we begin by writing our plaintext into three columns (or by grouping it conveniently), and then encipher at a single writing all of those letters which are to be enciphered by any one same key-letter. That is, we apply one cipher alphabet at a time, as first explained. The modern practice will also require that the cryptogram be taken off in five-letter groups, and that the final group be made complete. This is another of those cases in which the decryptor will number his letters, as shown in the figure. The student who has not previously met the Vigenère cipher is urged to perform the two operations of encipherment and decipherment and thus familiarize himself with the use of a tableau; it is possible that in most of his subsequent reading he will find explanations based on the “columns” and “rows” of a “tableau,” when, as a matter of fact, no tableau has been used. To understand how this might be, suppose we take a look now at the Saint-Cyr cipher.

In Fig. 88, we have the principle of the sliding device by means of which this encipherment is accomplished. The Saint-Cyr slide is very easily prepared of cardboard, or of any other flexible and fairly strong material, but may also be prepared of wood, or may be set up for any temporary purpose on two strips of paper. Its details, also, may be varied to suit the operator’s own convenience. As shown, however, the upper and single alphabet, which is the plaintext one, is written on a card, and slots will be cut in this card at two points: Just below and to the left of A; and just below and to the right of Z. This plaintext alphabet is considered stationary.