Elementary cryptanalysis

The lower and double alphabet, which is to furnish all of the substitutes, is written on a long narrow strip, the two ends of which may be inserted into the slots of the other card. This strip, or slide, may then be moved back and forth at will. However prepared, the spacing must be uniform throughout both alphabets. The Saint-Cyr cipher also makes use of a key-word in which each letter is the key to a cipher alphabet, and which is applied exactly as in Fig. 86 or Fig. 87. To apply the key-letter B, we adjust the slide in such a way that the B of the sliding alphabet will stand directly beneath A of the stationary one. This gives us exactly the same set-up which we used in Chapter IX for cases of simple substitution; that is, we have a plaintext alphabet with a cipher alphabet standing just below it; each plaintext letter is standing directly above its substitute, and each substitute directly beneath its original. The cipher alphabet just referred to, in which key-letter B, found in the sliding alphabet, is standing directly below the index-letter, A, found in the stationary alphabet, is identical with the B-alphabet of the Vigenère tableau, and is even called by the same name. Should we move the sliding alphabet, so as to place key-letter C directly beneath index-letter A, we reproduce the C-alphabet of the Vigenère cipher, again called by the same name. In the figure, we have the E-alphabet in position, with key-letter E standing directly beneath index-letter A. And since the sliding alphabet may be placed in 26 different positions, each time reproducing one of the Vigenère cipher alphabets, having the same key and the same name, it appears that our Saint-Cyr “cipher” is merely a duplication of the Vigenère. The chances are, then, that even though we call our cipher by its original name, and even make references to its tableau, our actual work of encipherment and decipherment will have been accomplished by means of the more convenient and rapid Saint-Cyr slide. But where a slide is possible, a cipher disk is also possible, and many will prefer to use the disk.

To prepare one of these, we might proceed as follows: First, cut out from cardboard (or other desired material) a pair of disks, one smaller than the other. Divide the peripheries of both disks into 26 equal segments, and write the 26 letters of the alphabet in a circle around both of the peripheries, causing both alphabets to run in the same direction. Place the smaller disk on top of the larger; and, finally, stick a drawing pin through the exact center of both disks, to serve as a pivot. The smaller disk may now be rotated to 26 different positions, so that any desired key-letter can be caused to stand beside index-letter A of the outer disk, and will place in position the cipher alphabet of which it is the key. The use of this revolving alphabet in place of a sliding one does away with the necessity for doubling its length.

Now let us examine carefully Fig. 89, with its two examples of decipherment. At (a) of this figure, a short cryptogram fragment, beginning T I Q. . . . , is being deciphered with the original key-word, BED, and is bringing out the message, SEND SUPPLIES. . . . . This, of course, is to be expected of any cipher. But at (b), it is this message fragment, SEND SUPPLIES, which is acting as a trial key; exactly the same process is being used as if applying the true key, and this decipherment is bringing out the original key, repeating over and over. The Vigenère cipher, then, works equally well in reverse, and in this respect it differs from some of its kindred ciphers. To understand this peculiarity, we have merely to consider the tableau. Concerning this we have said that the horizontal alphabet which stands across the top is the plaintext alphabet, and that the vertical one at the left is merely a list of keys. Suppose we decide to look at it the other way round, and say that the vertical alphabet at the left is the plaintext one, and that all 26 of the cipher alphabets are standing on end with their key-letters at the top, so that the horizontal alphabet, written across the top, is merely a list of these keys. Will there be any difference in the encipherment? Might the slide, also, be prepared in a vertical position? Does it make any difference in the results whether we encipher plaintext SEN by key BED, or encipher plaintext BED by key SEN?

One road to decryptment, then, is clearly indicated. If we have a probable word, we may use this word exactly as if it were the key, and, if it is actually present, it will bring out the true key. Or, if we have no probable word, we may try probable sequences, or make use of the trigram list. Here, however, we have two separate cases: The simplest, in which the probable word is long enough to bring out the key-word repeating; and the most difficult, in which the sequence, or probable word, is very short, and will bring out only a short fragment of the key-word.

The simpler case is readily explained. We have, say, a cryptogram beginning U S Z H L W D B P B G G F S. . . , in which we suspect the presence of the word SUPPLIES. We decipher the first eight letters, using this probable word as a trial key, and obtain a jumbled series of letters C Y K S A O Z J, which is not satisfactory.

We leave off the first cryptogram-letter, U, and decipher the next eight, obtaining another jumbled series of letters A F S W L V X X. We start again at the third letter, then at the fourth letter, and still there is no information. But at the fifth trial, beginning at the fifth cryptogram-letter, we obtain a series T C O M E T C O, and this is satisfactory, not necessarily because we have recognized the word COMET, though this, of course, is a very desirable happening, but because the last three letters, T C O, are repeating the first three. The series is beginning over. The student should practice doing this, using both the tableau and the slide (or disk), until he is sure that he understands the process. The exact details of his work are immaterial; if he is sure that his key will be a recognizable word, it will be satisfactory to make decipherments directly on the cryptogram, erasing as he goes. Sometimes, however, the key is incoherent, or apparently so, and a jumbled series like C Y K S A O Z J might actually be the correct key; for this reason, it is well to follow a routine of some kind which will preserve all of the decipherments. One such plan is illustrated in Fig. 90.

Here, the cryptogram, or a substantial portion of it, would be written across a sheet of quadrille paper, and the probable word would be written at one side, where each of its letters will govern one row of decipherments. The first letter, S in the figure, has been used to decipher the whole row of cryptogram-letters, giving every possible key-letter which can produce S. The second letter, U, has been used to decipher them all again (except the very first letter; we do not expect a word UPPLIES). The third letter, P, has been used to decipher them all a third time; and soon. The resulting rows of decipherment include all key-letters which could have produced S, then U, then P, and so on. To read them consecutively, beginning at any cryptogram letter, start immediately below that letter, and read diagonally downward to the right. The first diagonal gives key CYK. . . , the second gives AFS. . . , and so on to the fifth diagonal, showing the key as T C O M E T C O. (If it is desired that these possible keys should come out standing in a horizontal position, then the decipherments may be made diagonally.) F. R. Carter, the originator of this scheme, does not necessarily make all of the decipherments which are included in the figure. He begins with the assumption that his key will be a recognizable word; having deciphered in full the first three rows, he abandons all of those diagonals which cannot develop into words. If, in the end, he is forced to conclude that his key was incoherent, no decipherments have been erased; he may still go back and develop the rest of his diagonals, in the hope that one will begin repeating.

The more difficult of our two cases, that in which we have no probable words other than the, and, which, that, have, but, etc., can follow exactly the routine

outlined in Fig. 90; but in this case there must be two separate work-sheets. Here, it is usually better to forget words and start at once with the list of normally frequent trigrams, THE, AND, THA, ENT, ION, TIO, etc. The key-fragments which are deciphered by these will be very short, and very numerous; a great many of them will be very good usable sequences, and perhaps the correct key-sequence will not look quite so inviting as others which are incorrect. It becomes necessary, then, to have a second work-sheet on which we may take these fragments one by one and try them as keys. If any one of them is a fragment of the original key, it must bring out fragments of plaintext, and must bring them out at some regular interval. If the scheme of Fig. 90 is the one preferred, the second work-sheet may be prepared exactly like the first, and used in the same way. The only difference is as follows: On the first work-sheet, where the figure shows the word SUPPLIES, a supposed trigram (THE, AND, etc.) will have been used to bring out supposed key-fragments; on the second work-sheet, one of these supposed key-fragments will have been used. These new rows of decipherment may then be examined to find out whether any of the new diagonals contain apparent plaintext fragments, and, if so, whether these occur at a regular interval.

For this kind of work, however, Ohaver has offered us another routine which requires somewhat more preparation than Carter’s but which is well worth the extra trouble, especially if it be remembered that a trigram-search is never necessary except with the shortest of cryptograms. For the longer cryptograms, we have easier methods. Ohaver’s plan can be examined in Fig. 91.

The cryptogram, shown at the top of this figure, contains 26 letters; therefore, remembering that each letter, except the final two, may begin a cipher-trigram, it contains 24 trigrams. The preparation of the two work-sheets requires that these 24 cipher-trigrams be written out in full on both sheets. This work should be done in ink, or on the typewriter. Then, too, for a reason which will be explained in a moment, it is well that the first of these work-sheets be prepared with a great deal of space, say seven or eight lines, between its rows of trigrams. Now, considering the first work-sheet, shown at (a) of the figure: The upper row shows the 24 cipher-trigrams as originally written out. We have been working down the trigram list, using every normally frequent trigram as a trial key, and have failed to find THE, AND, THA, or ENT, which means that we have done quite a lot of tedious work. We have now reached the normally frequent trigram ION, and this we have

applied as a trial key, assuming one by one that each of the 24 trigrams represents ION. We have, then, 24 decipherments on the second row, and any one of these 24 deciphered trigrams might be a fragment of the original key. However, it is natural to assume that a trigram FRI or WAY is more likely than one such as XHR or NQB, and those fragments which look like usable sequences have been underscored in the figure. These are to be tested first. At (b), we have the other work-sheet, the upper row, as before, showing the 24 possible cipher-trigrams. Here, we have already failed in our tests for key-fragments FRI, WAY, DZI, NYE, which means that we have done some more tedious work, and we have now arrived at the possible key-fragment EDA. If this sequence, EDA, is actually a portion of the original key, it must not only bring out fragments of a plaintext message, but must bring them out at some constant distance apart. The point at which we found this is the tenth trigram, and here it may be advisable to remind that this begins at the tenth cryptogram letter; that is, every trigram presents only one new letter, so that to find a completely different trigram in either direction, we must count backward or forward a distance of three trigrams.

Beginning, then, at the tenth trigram, and examining every third trigram in both directions, we find that our key-fragment has given us the following decipherments: HKF, RBO, HKV, ION, CNF, DER, JEI, NSF. These are largely incoherent; but, in addition, it must not be overlooked that on the continuously-written cryptogram, these would be consecutive, giving us a message H K F R B O. . . Applied at interval 3, then, our key-fragment EDA, will not decipher us a message; therefore, the period of this cryptogram, using this key, cannot be 3.

To examine for the possibility of a period 4, we start again with our tenth trigram, and examine every fourth decipherment in both directions; our series, this time, is JCV, KIN, ION, MCH, NKH, NSF. Most of these are usable, and the first one might be due to nulls, initials, and so on; but here again we have the reminder that with each trigram representing only one new letter, these are almost consecutive, starting at the second cryptogram letter, so that our message, with each fourth letter missing, will be as follows: * J C V * K I N * I O N. . . . Unless we can think of some letters which would fill these gaps and provide plaintext, our period is not 4.

Trying again, however, beginning at the tenth trigram and examining each fifth decipherment, we find something more satisfactory: ALL, ION, BEH, DFR. If these are correct, the period is 5. At (c), we have gone back to the continuously-written cryptogram in order to try these in their places; and since a period 5 would mean that each of the letters E D A is used regularly to encipher each fifth letter, we are able to include two shorter decipherments at the two ends of the cryptogram. The next step in logical order is to try deciphering T in front of ION, since the trigram TIO would have been the next one on our trigram list. This brings out key-letter C, which, if correct, will decipher correctly at each interval 5, and which extends our key-letters to C E D A. We can see, too, that this is not the beginning of the word; the sequence we have is D A * C E. In the given example, it is not difficult, also, to guess a probable word, FRIDAY. Now, having twice called attention to the fact that the trigram-search can grow quite tedious, we hasten to point out that it need not be made more so by deciphering each trigram individually. If your trial key is THE, set your slide at the T-alphabet (or point this out on the tableau), and decipher every first letter on the sheet. Then set the H-alphabet in position, and decipher every second letter on the sheet. Finally, set the E-alphabet in position and decipher all of the remaining letters.

The foregoing few paragraphs have illustrated the worst case in almost its worst form, but will show the principle. Now let us consider this work in a much more usual case. As mentioned earlier, the first of the two work-sheets will be prepared with a great deal of space between the rows of trigrams. The full number of decipherments will be made for the first trigram THE, but not erased. Just below these, a second row of decipherments will be made for AND, and these, too, will be left standing. (THA can be omitted.) A third row of decipherments is made for ENT, a fourth row for ION, and so on down the list, until there are six or eight rows of possible key-fragments. These are all examined and compared with one another, in the hope of finding duplications. Perhaps THE and AND have both brought out a key-fragment EDA, or one has brought out CED and the other EDA, having ED in common. It is far from unusual, in some of these cases, to find a whole series of these overlapping key-fragments, for instance, CON, ONS, NST. This will explain why many persons consider the trigram-search the simplest and most direct way of attacking a Vigenère cryptogram.

For the benefit of the novice, we end the chapter at this point in order that he may have some practice. Example 104 comprises a thrilling serial with all the trimmings, gripping and original title, smashing climax, and a brave hero, John Miller. The key to the title is STRANGE. Part I repeats a word found in the title; part II repeats a word of part I; and somewhere are the trigrams NOT, CON, YET, ING, TEN, THE. We have heard, too, that an amateur encipherer will occasionally encipher the nulls which he adds in his final group. Example 105 is easily investigated through short common words. As to the remaining examples, while it is true that they can be attacked by the trigram method, the student will probably prefer to leave them until he has seen the methods outlined in Chapters XIV and XV.

Here, we have exactly the routine of Fig. 90, except that our search must be made for probable trigrams, and not for a probable word. We have begun with the most likely trigram, THE. But here we do not find it possible to do as we did in Fig. 90; that is, decipher every letter, first as T, then as H, then as E. Of the twelve cryptogram-letters present, only seven can be deciphered as T; the rest are too far away from it in the normal alphabet, and would require keys larger than 9. Of the six letters which immediately follow the possible T’s (the seventh is not shown), only three can be deciphered as H. And of the three letters which immediately follow a possible TH, only two can be deciphered as E or as A. It is often possible, in these ciphers, to investigate simultaneously the trigrams THE and THA. So far as the cryptogram is shown, then, there are only two points at which a trigram THE can be present, while a Vigenère cryptogram of the same length would have presented ten possibilities. Thus, we have no real need for a second work-sheet;

the only possible key-fragments, 114 and 790, can be tested by any hit-or-miss method which happens to be quickest.

This cipher is often decrypted in much the same way as a “Caesar” simple substitution (shown in Fig. 61). The cryptogram, or a convenient portion of it, is copied on a single line of writing; then, with each letter as a point of beginning, a series of alphabets is extended (written in reverse order), but only for a distance which includes ten letters. That is, the ten possible decipherments for each cryptogram-letter are written in the form of a ten-letter column. The decryptor may then inspect the ten rows of decipherment to see what he can find. At any point where it is possible to find T, H, and E in three consecutive columns, the correctness of this possible THE can be checked by finding out whether or not it has a series of companion-trigrams standing at some regular interval on exactly the same three rows.

In Fig. 94, we have the tableau of Giovanni Battista della Porta, adjusted to suit the modern 26-letter alphabet. Here we have only thirteen cipher alphabets,

each of which may be governed by either of two key-letters; these pairs of keys may be seen at the left of their respective alphabets. In all thirteen of these cipher alphabets, the encipherment is reciprocal. In the AB-alphabet, for instance, which is the first one on the chart, the substitute for A is N, and the substitute for N is A. The Porta cipher, the oldest known of its kind, employs a key-word, applied as in Vigenère. If the key-letter in use is either A or B, the topmost alphabet is the one to be used; if the key-letter is either C or D, the second alphabet must be used; and so on. Where this encipherment is illustrated in Fig. 95, it may be of some interest to observe that it is not totally impossible for two different key-words to produce identical cryptograms. As to decipherment, we have already mentioned the fact of reciprocal substitution. Whenever the alphabets are reciprocal (in any cipher), the decipherment is identically the same process as encipherment.

The Porta tableau, being smaller than the Vigenère, is not at all inconvenient to prepare and use as it stands. It can be made still more compact: The upper half being alike for all thirteen cipher alphabets, this half can be written once only, at the top of the chart. The lower halves can be written below this on thirteen parallel lines, with their pairs of keys at the left. A ruler may then be used, as suggested for Vigenère, to point out any given lower half. But when it is noticed that these lower halves are identically the same series of letters, with its

point of beginning shifted one letter at a time, it is promptly seen that a slide is possible, on which the N-to-Z half of the normal alphabet, if written twice in succession, could be placed in 13 different positions with reference to the A-to-M half; and a slide is more convenient still. The slide shown in Fig. 96 is another of Ohaver’s devices. The only new feature in connection with the Porta slide lies in the handling of the key-letters, which, in this cipher, are no longer the first letters of their cipher alphabets. Mr. Ohaver has added them on the sliding portion of the device, each pair of keys being placed directly below the letter which must stand beneath the index (A) whenever one or the other of the pair is the key-letter in use.

The Porta cipher, aside from its purely historical interest, provides a most interesting decryptment study in the formation of its alphabets. Notice that because of the encipherment scheme itself, it becomes totally impossible that the substitute for any letter, in any cipher alphabet, can ever be taken from its own half of the normal alphabet. This limitation is far more visible than that of the Gronsfeld. We have, say, a cryptogram sequence H E P. Can this represent the trigram THE? No, because E cannot represent H; for the same reason, it cannot represent THA. Can it represent AND? No, because H cannot represent A. Can it represent ENT? No, because H cannot represent E. Can it represent ION? TIO? FOR? NDE? HAS? It is not until we reach STH that we find a normally frequent trigram which could have the substitutes HEP. But to gather the full significance of this Porta limitation, and also a suggestion concerning the detail work when taking advantage of it, let us picture the case of a probable word: INFANTRY.

Using digits 1 and 2 to mean, respectively, the first and the second half of the normal alphabet, this probable word INFANTRY has the alphabetical pattern 1 2 1 1 2 2 2 2. And, since every substitute must have been taken from the other half of the normal alphabet, it will certainly be represented in any Porta cryptogram by eight letters having the opposite alphabetical pattern: 2 1 2 2 1 1 1 1. Moreover, a pattern as long as this is not going to be found very often in any one cryptogram. The decryptor, then, may proceed as in Fig. 97. Each cryptogram letter is marked I or 2, or imagined to be so marked, and this series of digits is examined in the hope of finding a sequence 2 1 2 2 1 1 1 1. If it cannot be found, the word is not present; if it is found, it can be assumed to represent the word INFANTRY. Here, we meet with a slight difference between the procedure for Vigenère and the procedure for Porta.

In Vigenère, we found it possible to discover the key by simply taking the probable word and deciphering with it. In Porta, we cannot do this. We must first pair the two letters, that is, a supposed substitute with its supposed original, and then find out what key would cause this. In the figure, for instance, we have a sequence X M S T, assumed to represent I N F A. The first corresponding pair is X = I. If we are using the tableau of Fig. 94, one of these letters, I, is never found anywhere except in the 9th column. We find the I-column, and trace down until we find X; the key, in this case, must be E or F, The next corresponding pair of letters (M representing N) demands that we find the M-column and trace down to N; key C or D. The third pair (S representing F) demands that we find the F-column, and trace down to S; key A or B. The fourth pair (T representing A) demands that we find the A-column, and trace down to T; key M or N.

Using the slide of Fig. 96: Place X and I together, and note that the key-letters standing below the index (stationary A) are EF. Place M and N together, and note key-letters CD. Place S and F together, and note key-letters AB. Place T and A together, and note key-letters MN. From the recovered pairs of key-letters, we are to select one each in order to recover the key-word, using somewhat the logic we might apply in dealing with a key-phrase cryptogram. In the given case, where we need the two vowels to form any word at all, it is not difficult to surmise that the key-word was DANCE. It might not be so easy to decide as between EAST and FATS; but key-words, as a rule, are seldom so short as those we have been using, and the longer the word, the fewer the possibilities. Concerning keys, however, there is one contingency which may have to be considered: The various modernized versions of this tableau are not always duplicates. The cipher alphabets will be the same as those given here; but where we have caused these to shift in the normal direction, another tableau may show them shifting in reverse. The first alphabet will be the same as here, but the second, still showing key-letters CD, will show its lower half beginning Z N O P. . . ; the third, still showing key-letters EF, will show its lower half beginning Y Z N O P. . . ; and so on. The recovery of the key-word, of course, is not vital.

Coming now to the two ciphers which are called Beaufort, we return to a tableau so closely resembling Vigenère’s tableau that the two can be used interchangeably. Fig. 98 shows only enough of the Beaufort tableau to bring out the difference in form. Here, we find no separate plaintext alphabet and no separate key-alphabet. Those which form the square have been lengthened by repeating their first letters;

and a 27th alphabet, added at the bottom of the tableau, repeats the alphabet shown at the top. In this way, we have a 27 x 27 alphabet square in which all four of the outside alphabets are exactly alike. These ciphers, also, make use of a key-word, applied as in Vigenère and in Porta. As Sir Francis Beaufort himself is said to have used the tableau, the encipherment of a given plaintext-letter, using a given key-letter, was accomplished as follows: To encipher plaintext S with key C, find the letter S in any one of the four outside alphabets, trace into the square along the S-column (or row) as far as the key-letter C; at that point, turn a right angle, in either direction, and trace outward along that row (or column), emerging from the square at the substitute, which, in the given case, is K. Or: To decipher K with key C, begin with K, and follow identically the encipherment process, emerging this time at the plaintext letter, S. This process we have called the true Beaufort cipher. Notice that we have reciprocal encipherment; encipherment and decipherment are identically the same thing.

As to the companion cipher, the student will promptly have guessed this for himself: Instead of starting with the plaintext-letter, S, and tracing inward to the key-letter, it is entirely feasible to begin with key-letter C and trace inward to the plaintext-letter S, emerging at Q instead of at K. This cipher, too, is called Beaufort, since its method of accomplishment is Beaufort’s method. But there is a difference in the two resulting ciphers; notice here that the encipherment is no longer reciprocal; should we start at key-letter C, trace inward to the new cipher-letter, Q, and then trace outward, we do not emerge from the square at the plaintext letter S, but at O, an entirely new letter. In order to distinguish the two ciphers, we have referred to this second process as the variant Beaufort, or sometimes, more briefly, as “the variant.” There is some justification, also, for calling it the “Vigenère-Beaufort.” To see why, the student may turn back to his Vigenère tableau, and actually perform the encipherment, using only the two sides of this tableau in which the alphabets run from A to Z.

In applying the variant encipherment, in which key-letters are found first, he need find a given key-letter but once, then lay a ruler along the row (or column) indicated by that key-letter, and encipher at a single writing all plaintext letters which are going to have that particular key. But if, as previously recommended, he has familiarized himself with the use of the Vigenère tableau, he will see instantly that the operation which, in the variant Beaufort he is calling encipherment, is identical, in every particular, with the operation which, in Vigenère, he would have called decipherment, and that, in order to decipher the variant, he must perform the operation which, in Vigenère, is called encipherment. Neither of these operations

provides a reciprocal substitution; instead, they are reciprocal to each other. Once it is seen that this is true, it becomes equally plain that the Saint-Cyr slide serves just as well for the variant as for the Vigenère. To make use of it in applying the variant encipherment, set key-letters below index-letter A, exactly as if making ready to encipher in Vigenère, but reverse the functions of the two alphabets; that is, find all plaintext letters in the lower one, and take their substitutes from the upper one.

Now, consider the true Beaufort cipher: Here, plaintext letters are found first, and keys are found by tracing into the square, so that encipherment is more or less a letter-by-letter process, and hardly so convenient as in the other two ciphers. It is true that every ascending diagonal in the tableau is made up of only one key-letter, so that a ruler, laid diagonally across this tableau, will point out a whole line of C’s, or O’s, or M’s. But practically every one of these diagonals is broken into two portions, so that in attempting to encipher by one key-letter at a time, we find it rather confusing to make the necessary adjustments. Is there not, then, a more convenient method for applying the Beaufort? Every cipher of this family, remember, provides a certain number of individual simple substitution cipher-alphabets. For every key (whether it is a letter or a number) there is some kind of cipher alphabet showing a substitute for A, a substitute for B, a substitute for C, and so on. To isolate one of these cipher alphabets, and find out what it is like, we have merely to take some one key-letter (or some one key-number) and discover what these substitutes are, and what their order is; that is, we need merely encipher the normal alphabet, using this one key. This is true of every cipher of the multiple-alphabet type. The process can be seen in Fig. 99, where the C-alphabet (that is, the alphabet governed by key-letter C) is being isolated for each of the Beaufort ciphers.

In the Beaufort proper, we find that the C-alphabet will begin with C and come out in the order C B A Z Y X. . . . , which is merely the normal alphabet reversed. Should we investigate the D-alphabet, we should find that this begins at D and comes out in the order D C B A Z Y. . . . , again the normal alphabet reversed; or, investigating the E-alphabet, we should find E D C B A Z. . . . , always the normal alphabet written backward, and always beginning with whatever letter is called the key. This being the case, it becomes quite evident that a slide is possible, and the formation of this slide is clearly indicated in the left-hand tabulation of the figure: Its upper alphabet must run in one direction and its lower alphabet in the other; if one of the two is made of double length, it becomes possible to place any one of the 26 key-letters in juxtaposition with index A, thus bringing into position any one of the 26 cipher-alphabets which are governed by these keys. Nor does it make a particle of difference which of the two A’s, the upper or the lower, is regarded as the index-letter; when C is standing below A, then A is also standing below C. We saw, in the tableau itself, that the true Beaufort encipherment gives reciprocal substitution. This, however, was not our first meeting with one of the Beaufort alphabets; in Chapter IX, we met the Z-alphabet. We saw there that whenever a cipher alphabet is merely the plaintext alphabet written backward, it makes no difference which of the two is called a cipher alphabet; we may see here that this fact is not

altered by shifting one of the alphabets. Since a slide is possible, it follows that a disk is also possible. This particular cipher disk, on which one alphabet runs forward and the other backward, was used long ago in our own army, and is widely known in this country as “The United States Army Cipher Disk.” Most persons, apparently, prefer the slides, on which the letters are always right-side up, and the preparation of which does not involve the division of a circle into 26 equal arcs. Of those who prefer the disks, practically all will make the smaller disk reversible, with the normal alphabet on one side and the reversed alphabet on the other.

Now, returning to our Fig. 99, and examining its right-hand tabulation: We find that, in isolating the C-alphabet of the variant Beaufort, we have merely reproduced the Y-alphabet of the Vigenère. Should we now isolate its Y-alphabet, we should find that we have obtained the C-alphabet of the Vigenère. Further investigation will show that the D-alphabet of one is the X-alphabet of the other, that the E-alphabet of one is the W-alphabet of the other; and so on. Only their A-alphabets and their N-alphabets are keyed alike. Thus we seem to have here a case of “reciprocal” key-letters. These particular pairs of corresponding letters, B and Z, C and Y, D and X, and so on, are called complements, one letter of each pair being complementary to the other. Since the letters A and N have no complements (or serve as their own complements), the normal alphabet will furnish only twelve such pairs, and these are shown complete in Fig. 100. In this same set-up, it can be seen that the A-alphabet of the Beaufort cipher is the complement of the normal alphabet. Thus, having provided ourselves with a Beaufort slide (or disk), we have always at hand a means for finding out the complements of letters. Once it is clearly understood that the chief difference between a Vigenère cryptogram and a variant cryptogram lies in the names of their respective cipher alphabets, it becomes evident that we might decrypt a variant, believing it to be a Vigenère, and have no trouble whatever in reading its message, though finding that it has an incoherent key. Vigenère keys, of course, can be incoherent; occasionally they are based in some way on numbers, following the Gronsfeld scheme. But usually, this is not true; the incoherency is only apparent, and a little investigation will discover what the trouble is. In the case just mentioned, the variant key-word COMET will come out in Vigenére as Y M O W H, or vice versa; all that is necessary, in order to discover the original key-word, is to set the Beaufort slide at the A-alphabet, and perform a bit of simple substitution. Another cause for the apparently incoherent key lies in the

use of some other index-letter than the stationary A. Say, for instance, that the encipherer has used the key-word COMET, but has placed his key-letters beneath index D. The key recovered by the decryptor is Z L J B Q; to find the original key-word, he need merely “run it down the alphabet.”

Of the ciphers we have seen, then, those three which are complete, that is, which employ a full 26 alphabets, are curiously interrelated to one another. In the matter of substitution (encipherment and decipherment), the Beaufort stands alone, in that it is reciprocal, while the other two ciphers are reciprocal to each other in this respect. But in the matter of keys, it is the Vigenère which stands alone, in that it can be deciphered indifferently by key-letter or message-letter, where this is not true of either Beaufort. In this respect, these two ciphers are reciprocal. To see this plainly, we may examine our three encipherments, each one showing a different cryptogram obtained from the plaintext fragment SEND SUPPLIES, using key COMET. The Vigenère version was seen in Fig. 90. If this be deciphered with its message, SEND SUPPLIES, the result is a repeating key-word COMET COMET CO. The other two cryptograms were those of Fig. 98. Here, the Beaufort cryptogram, beginning K K Z B B, if deciphered with the key COMET, gives the message-letters S E N D S. But when we attempt to decipher it using S E N D S as our key, we obtain: I U O C R. It becomes necessary, in order to find out our key-letters, that we proceed as we did for Porta: Assuming that the slide is being used, place message S beside cipher K, and find out what key-letter is standing beside the index A. Place E and K together, and find the next key, and so on. That is, change the position of the slide for every decipherment.

In this same figure, the variant cryptogram begins Q Q B Z Z. If it be deciphered with the correct key-word COMET, we obtain the correct message-letters, S E N D S. But if we attempt to decipher it with a key S E N D S, we obtain the same series as in the other case: I U O C R. To decipher it as a variant, we must again proceed letter by letter. How, then, are we going to apply a probable word as we did with the Vigenère in Fig. 90? How are we going to decipher a whole row of letters, first as S, then as U, then as P, and so on? Must we do this letter by letter, shifting the slide for every letter on every row? And suppose it is a page of trigrams, where we wish to decipher every trigram on the page as THE? Is there no way in which we can decipher all first-letters as T, all second letters as H, and all third letters as E, with only three settings of a slide? The answer is simple. Switch the slides. We have said (and shown) that in this respect the two Beauforts are reciprocal. Where the cryptogram is true Beaufort, and you desire to use your probable word as a trial key, do this with your Saint-Cyr slide (used in reverse, that is, as if enciphering in Vigenère). If your cryptogram is variant Beaufort, use the Beaufort slide (or treat it as a Vigenère, and obtain the key later). Both cases can be looked at in Fig. 101. The cryptogram at (a) is our same Beaufort cryptogram; that at (b) is our same variant. In another chapter, we shall look a little more closely into this odd triangle of Vigenère-variant-Beaufort. Meanwhile, the interested student might like to investigate for himself a few of the curious angles:

Would it be possible to prepare a tableau for the true Beaufort, and use it in exactly the manner described for Vigenère? Recalling the appearance of the Vigenère tableau (Fig. 85): Suppose we should add to this another vertical alphabet, this time on the right-hand side, causing this new alphabet to begin at A and run backward, A Z Y X. . . . Could this new alphabet be made to serve any useful purpose? More than one? What about the reversible cipher-disk? Is there any way at all in which it would be possible to encipher and decipher Vigenère cryptograms with a Beaufort slide, or Beaufort cryptograms with a Vigenère slide? Could you make a cipher disk for the Porta?