Elementary cryptanalysis

Now let us consider the four slides of Fig. 138, which are being designated (arbitrarily) as belonging to Types I, II, III, and IV, in what would seem to be the order of their potential resistance to decryptment. Their actual resistance, however, might depend largely upon the manner of their use, and we are assuming throughout the chapter that the encipherment process is identically that described for the Saint-Cyr cipher: The upper alphabet, in all cases, is to be the plaintext one; the index-letter is always the initial one of this plaintext alphabet; and, for the encipherment of cryptograms, the letters of the chosen key-word are to be found in the lower alphabet and brought one by one to stand below the index-letter in order to set up their cipher alphabets. Also, for our immediate purposes, we are neglecting certain precautions the advisability of which will be seen later: First, the mixed

alphabets have all been left undisturbed with their primary key-words (CULPEPER, DAMASCUS) and their alphabetical sequences in plain view; in practice, such alphabets ought to be carried through a transposition block, or otherwise made to appear incoherent. Second, the index-letter should never be A (or any other frequent letter) unless the details of encipherment are varied. (We might, for instance, consider that the index-letter is in the sliding alphabet and that keys are in the upper.)

In the Type I slide, the cipher alphabet is in normal order, and “slides against” a mixed plaintext alphabet. In Type II, we find a mixed cipher alphabet “sliding against” the normal one; in Type III, we find this mixed cipher alphabet “sliding against” itself; and in Type IV, we find it “sliding against” another, and different,

mixed alphabet. Every slide, used in any manner, has an equivalent tableau and while tableaux are seldom used, it is very important that we carry in mind a clear picture of their appearance; otherwise we shall find it difficult to understand how slides can be restored with only partial information. The imaginary tableau which is to serve this purpose, using any one of the four slides in the manner specified, is formed as follows: The plaintext alphabet, with letters in exactly the order of the slide, appears at the top. The 26 cipher alphabets, standing below and parallel to the plaintext one, are all seen in exactly the order of the slide, and are shifted, one letter at a time, exactly as the normal alphabet is shifted in the Vigenère tableau. Thus, exactly as in Vigenère, the columns of this imaginary tableau are duplicates of the rows. Keys, if considered, would repeat the first column of such a tableau. This tableau, as mentioned, is imaginary. Should the encipherer or the decipherer actually desire to make use of a tableau in preference to the slide, he would probably prefer one in which both his plaintext alphabet and his key alphabet are running in normal order, so that letters are easier to find. To form this tableau, he would begin by laying out, in normal order, his plaintext alphabet and his key-alphabet, and then lay out his 26 cipher alphabets in the manner explained in connection with the Beaufort alphabets. Each of the four slides of the figure is accompanied by a partial tableau of this kind, and it will be noticed there that we have only one case in which the (secondary) cipher alphabets bear any resemblance to the primary one. This tableau, too, should be well understood, since the cipher alphabets recovered from cryptograms will be like those of the figure.

Of our four slides, only the Type I is radically different from the rest. Since its basic cipher alphabet is not a mixed one, it makes little difference what has been done to its plaintext alphabet. Notice, in the partial tableau which accompanies it, that the difference between one cipher alphabet and another is purely a matter of alphabetical shift (or of “size,” if we wish to replace all of these letters with numbers). Properly speaking, this cipher belongs to the case of the preceding chapter; it is presented here largely as a warning of what could happen through misuse of the Type I slide. In the remaining three cases, the sliding alphabet is a mixed one; a series of frequency counts taken from cryptograms cannot be “lined up” unless letters can be placed in the right order before these frequency counts are taken. The “right” order may be the original one of the cipher alphabet, or an equivalent order in which the original letters are taken at a constant interval. In these cases, as with any other periodic cipher, the period is found in the usual way. Individual frequency counts are then taken on the several cipher alphabets, and these are examined in the hope of finding a known alphabetical graph; that is, the graph of some mixed alphabet recovered from previous decryptments — (but notice also the C-alphabet under the Type III slide!). It can also be ascertained whether or not the frequency counts have followed one common graph, whether any two or more have followed one graph, and so on. But when it is found that the frequency counts are those of unknown mixed alphabets, then each alphabet is to be treated by simple substitution methods. Here, the principles will still be those of Chapter IX, and we will examine, as briefly as possible, the mechanical phases of their application.

Our cryptogram, shown in Fig. 139, is already written into its correct period, 5, with a few substitutions already made, and a few letters noted as vowels or consonants (v-c). With the period determined as 5, and alphabets found to be in an unknown mixed order, our next step is the preparation of a contact sheet (contact chart, contact count) for each one of the five alphabets, the usual form being that shown in Fig. 140. The necessary number of sheets is prepared in advance by writing the normal alphabet through the center, and each is numbered to show what alphabet it represents. It may also carry the numbers of the two contacting alphabets (those in parentheses in the figure). Then, if the cryptogram is properly grouped, so that all first letters of groups belong to alphabet 1, all second letters to alphabet 2, and so on, the putting down of contact letters is very rapid.

Illustrating with alphabet 2: Start with its first letter, V; find V in the prepared alphabet numbered 2; place on its left side the Y of alphabet 1; place on its right side the N of alphabet 3. Pass on to the next letter, E: contacts are Y-G. Pass on to the third letter, another E: contacts are Z-A. And so on to the end of alphabet 2. Each contact chart, of course, will serve also as a frequency count and as a

graph. The five graphs should now be compared with one another in the hope that some two or more may represent the same alphabet. Such a key-word as DENSE, for instance, makes use twice of the E-alphabet, thus doubling the amount of material in one of the alphabets. In our present case, it is found that the five alphabets are all different. Now, just as in simple substitution, we wish to determine, for each of the five alphabets, what letters are apparently representing vowels, and what letters are more likely to be consonants. For this purpose, some of our “pointers” are still available, and are just as valid as in Chapter IX.

In Fig. 141 we may see some data and probable conclusions concerning alphabet 1. By frequency alone, the four letters B, G, K, Z, of this alphabet might all be vowels. When variety of contact is considered in conjunction with frequency, it is noted that Z shows no variety on its right. And when contacts with low-frequency

letters are also considered (from information present on sheets 5 and 2; in the figure, frequencies of 1, 2, or 3 were considered to be low), it is found that in this respect, too, the letter Z stands apart from the others. These observations, usually, are mental, and conclusions for any one alphabet must often be modified by what is seen in other alphabets. It may be found satisfactory to begin by selecting only the most obvious vowel, or vowels, in each alphabet, and to circle these, or otherwise indicate them, not only on their own sheets, but also on the two adjacent sheets where they are found again as contact letters. When this has been done, the less obvious vowels may be considered again with an additional “pointer,” whether or not they show too much contact with the more obvious vowels. Fig.

142 shows, for each alphabet, the probable conclusions which would be reached after examining the contact sheets of Fig. 140, and before any confirmation is attempted. The next step in order is that of indicating them on the cryptogram itself, and the examination of long segments in which no vowels have been marked. At this stage, too, the total number of spotted vowels may be computed to find out how much of the expected 40% is still missing. Up to this point we have nothing new, and nothing particularly difficult. Whether or not the subsequent work is to become difficult depends chiefly upon the amount of material per alphabet, though granting that the presence of probable words materially alters the case of the shorter cryptogram.

If the most frequent of the spotted vowels in each alphabet can be safely assumed as e, the establishment of other vowel-identities can follow the rules of Chapter IX: The high-frequency vowel which practically never touches e is o; and the one which follows it is a; vowels of lower frequency may precede or follow e, but no vowel should touch it very often. And if, in addition, the most frequent of the spotted consonants in a given alphabet can be safely assumed as t, then h of the next alphabet will seldom be out of reach. A very material aid here is found in those repeated digrams (and trigrams) whose letters are already labeled as vowels or consonants. We find, for instance, ZD, alphabets 1-2, occurring five times, and with both letters already spotted as consonants. This is very likely to represent th, especially when further examination shows it continued as a repeated ZDB, with B already quite likely to represent the e of alphabet 3. Then the contacts of D, alphabet 2, supposed to represent h, have also pointed out a probable new vowel, A, in alphabet 3. Again, we find KC, alphabets 4-5, occurring six times, and with both letters already spotted as consonants — another probable th — followed three times by G, alphabet 1, already likely to represent e, and twice by B, which could thus represent a (the famous English the, tha). And similarly we might continue with a long demonstration.

Returning, now, to our mechanical operations: Dealing, as we are, with five different alphabets, it becomes imperative that we keep track of substitutes; otherwise, with all of our numerous trials and erasures, it is almost impossible to know what substitutes have been identified and what substitutes are still available for identification. Also, totally apart from this matter of convenience, we shall probably want these five lists of substitutes for use on future cryptograms. This applies to any series of cipher alphabets, whether or not they are in any way related to one another. But it is very seldom indeed that a series of cipher alphabets used in the same cryptogram will be unrelated alphabets. Nearly always, they will have resulted from the use of a slide, and when this is true, the recovery of alphabets and parts of alphabets enables us to reconstruct the slide. The usual plan for recording substitutes is to lay out a plaintext alphabet in A B C order and then, directly below it, to rule off several rows of cells, one row for each cipher alphabet. Thus, any substitute, identified in any alphabet, may be written directly below its presumed original and on the row which corresponds to its particular cipher alphabet. We sometimes speak of such a set-up as a “key-frame” or “key-skeleton,” though a better name, probably, would be “partial tableau.” (Every row, if completed, will show one cipher alphabet of the kind we saw in the partial tableaux of Fig. 138.) Such a “key-frame” for our present cryptogram can be seen in Fig. 143. At (a) of this figure we have the first tentative identifications. The most frequent vowel in each of the first four cipher alphabets has been assumed as e (in practice, the O of alphabet 5 would also be assumed as e). The ZD of alphabets 1-2 and the KC of alphabets 4-5 have both been assumed as th, and after each th, we are trying one letter as a. The five rows of this set-up we may now speak of as “alphabets.” At (b) we are beginning to speculate as to what kind of slide has been used.

Suppose that the cryptogram has been enciphered with a Type II slide. If so, our plaintext alphabet, in the key-frame, is already arranged like the one on the slide; and when this is true, as may be seen by glancing back at Fig. 138, the recovered cipher alphabets will also build up with their letters in exactly the same order as that of the slide, and, in the end, if fully completed, will show a picture of the original sliding alphabet taking five of its possible positions.

Examining the first cipher alphabet of (a), we note that the lineal distance from B to G is 4 positions. If our hypothesis is correct, then the lineal distance BG will have to be 4 positions in all of the other alphabets. The third alphabet contains a B; measuring 4 positions to the right of this letter, we find that G of the third alphabet would fall below i, and thus would be the substitute for i in the third alphabet. To see whether or not this is likely, we return to the contact sheet, where we find that G has already been spotted as a vowel (see the list in Fig. 142). So far, so good. Then, the first cipher alphabet of (a) shows the lineal distance BZ as 19 positions. Returning to the third alphabet, and measuring 19 positions to the right of B, we find that Z, in this alphabet, would fall below x. Examination of the contact chart shows that Z has not been used in the third alphabet, making it satisfactory as the substitute for x. Still good. Again, the third alphabet shows the distance AB as 4 positions. Still pursuing our hypothesis, the first alphabet must also contain an A standing 4 positions to the left of B. If so, it will fall below w, and the frequency of A, in the first alphabet is found to be 2, which is

satisfactory as that of w. With G and Z added to alphabet 3, and with A added to alphabet 1, we may now turn our attention to alphabet 4, which contains a Z, and, by making similar observations there, we may add to the 4th cipher alphabet the letters A B G, and, to the 1st and 3d alphabets, the letter K. Thus we arrive at (b) through what is ordinarily referred to as the “symmetry of position” existing among the several cipher alphabets.

But the second and fifth alphabets cannot yet be combined with the other three, since neither of these contains any letter in common with them, and thus we have no point from which to measure lineal distances. We know, however, that if our hypothesis is correct, the letters A B G K Z, in these alphabets also, will be found at exactly the same lineal distances as before. It would be possible to prepare a sort of slide on which these letters, written twice in succession, are spaced as in the other three alphabets, and use this in experimenting with alphabets 2 and 5.

The cryptogram, as we first saw it, showed all substitutions which are possible from (b) of Fig. 143, together with a few v-c notations which were listed in Fig. 142 but not further investigated. In case the student cares to complete solution, he might refer to certain precautions mentioned at the beginning of the chapter. Notice, in the last figure, the lineal distance from G to K; what letters would you feel inclined to try in the three intervening positions? Or notice the distance BG. What letter is very likely to have been taken here for use in the key-word, and where is it likely to stand in that word? If the index-letter was A, does it seem possible that the a-substitutes could all be selected in advance directly from the contact sheets? Would this be possible if the encipherment process were varied so that an index, selected in the sliding alphabet, were brought to stand below keys in the stationary one? The cryptogram is known to contain the word SUPPOSE, and the period is 5. Is there any room here for pattern methods?

Our Type II slide, then, unlike the remaining three, builds up automatically in the key-frame, owing to the simple fact that we are able to set down the plaintext alphabet in the encipherer’s original order. The method of solution, so far as we know, was first published (1883) by Auguste Kerckhoffs, who seems to have originated the term “symmetry of position.” The invention of the cipher is credited to “a member of the (French) Commission on Military Telegraphy.”

If these parallel cipher alphabets are to be avoided in the key-frame, but still using a Type II slide, General Sacco has suggested that the encipherment process be altered as follows: Let the index-letter and the key-letter both be found in the upper alphabet. Slide the plaintext letter to stand below the index-letter, and use the substitute which will then be standing below the key-letter. This, of course, would have to be letter-by-letter encipherment, and represents one of those rare cases in which a slide is less convenient and rapid than its equivalent tableau. If this tableau be laid out in full, as explained for Beaufort alphabets, it shows, on its 26 rows, 26 cipher alphabets not one of which appears to be at all related to the others. One of these (the one in which index-letter and key-letter are the same) will be the normal alphabet. We may find the original sliding alphabet, however, by looking at columns. Such a tableau is exactly equivalent to the Delastelle tableau if the Z-alphabet be made the normal one. Delastelle’s tableau was described as follows: Using the mixed alphabet, fill in the tableau by columns, beginning each column with whatever letter, in the mixed alphabet, follows the plaintext letter shown above the column. This causes the final alphabet to come out in A B C order. The Delastelle tableau is not nearly so easy to reconstruct as that of the ordinary Type II slide; the method, however, will be plain enough when we have understood the reconstruction of Types III and IV.

The Type I slide, as pointed out in the beginning, is somewhat out of place in the present chapter; every frequency count will follow the graph of the mixed plaintext alphabet, so that all can be “lined up” by their common pattern. Having letters, and not numbers, the “top” of a frequency count may be anywhere; it is usually best to prepare at least one of the frequency counts of double length in order to effect the alignment. Granting, however, that for some reason the common pattern of the frequency counts has not been recognized, then the method of decryptment would be exactly the same as for any other case of mixed alphabets.

Fig. 144 shows the development of the key-frame in this case. At (a), some substitutes have been correctly identified in each of four cipher alphabets. But long before reaching this stage, the most careless of decryptors must have noticed that the difference between any two cipher alphabets is purely a matter of alphabetical shift. This is particularly visible as between alphabets 3 and 4, where the alphabetical interval is only 1; examination of alphabets 1 and 2 shows that wherever both substitutes are present, their alphabetical difference is 14; and further examination shows that the alphabetical distance from alphabet 2 to alphabet 3 is 17. The use, here, of a Saint-Cyr slide enables us to arrive very quickly at (b). The alphabets of (b) are, of course, secondary cipher alphabets, and the primary one obviously runs in normal order (or, at worst, in a strictly methodized order which is easily obtainable from the normal one). What we still lack, in order to reconstruct the slide, is the mixed plaintext alphabet, and this can be recovered as at (c). Write out the normal alphabet (known to be the original cipher alphabet), then, using any one of the secondary alphabets, place originals above their substitutes wherever these are known. In the given example, all missing letters can be filled in by alphabetical sequence; and even though the index-letter was one of low frequency, and thus was not used in the message, the student should have no trouble whatever in discovering the key-word which governs the four cipher alphabets.

In considering the reconstruction of the remaining two slides, we shall have to keep clearly in mind the imaginary tableau on which the plaintext alphabet has exactly the order of the one on the slide, so that cipher alphabets, also, have exactly the order of the one on the slide, and are shifted one letter at a time, as in the Vigenère tableau. For one thing, we are going to call some of these alphabets by numbers, or refer to them as odd-numbered and even-numbered alphabets. Thus, with

the alphabet we have been using, the first alphabet in the imaginary tableau is position 1 of the slide: C U L P E R Z Y X W V T. . . . . . , the second alphabet is position 2 of the slide: U L P E R Z. . . . . . . , the third alphabet is position 3 of the slide: L P E R Z Y. . . . . , and so on to the 26th alphabet, which is the final position of the slide: A C U L. . . . . But over and above this, it must be remembered that the columns of this imaginary tableau are duplicates of the rows, just as they are in the Vigenère tableau. We do not, of course, recover any of these alphabets in the order mentioned, since our plaintext alphabet of the key-frame must necessarily be arranged in its a-b-c order. For instance, the fourth alphabet, which, in the imaginary tableau, begins with its key-letter, P, and runs in the order P E R Z Y X W V T. . . . . , comes out in one of our examples (Type III slide) as L U P C Y A B D. . . . . , and in the other (Type IV slide) as E W Y P V T S. . . .

The Type III slide is, in many respects, the most interesting member of its family. With every alphabet taking exactly the same order (that is, the plaintext alphabet, the key-alphabet, and all cipher alphabets in the imaginary tableau), it parallels the Vigenère in every particular except the order of the 26 letters. It has a corresponding Beaufort form, and a corresponding variant in which complementary keys are based on the order of the mixed alphabet. Its 14th alphabet, like the N-alphabet of the Vigenère, is reciprocal throughout. And its first alphabet, like the A-alphabet of the Vigenère, is a duplicate of the plaintext alphabet. This was pointed out in connection with the slide of Fig. 138, where key-letter and index-letter were both C. There are two ciphers, then (the Type III slide and the Delastelle tableau), in which we are sometimes able to find, among a number of mixed

frequency counts, a single one which follows perfectly the graph of the Vigenère A-alphabet. Concerning the 14th alphabet, however, we are dealing altogether, here, with a 26-letter alphabet; and some of what follows is being explained on the theory that the number 26 contains no factors other than 2 and 13. If the student will give his careful attention to reasons, as well as to methods, he will be able to adjust these methods to alphabets of other lengths, as, for instance, the very common 25-letter alphabet met with in foreign texts. The first alphabet, of course, duplicates the plaintext alphabet regardless of what alphabet-length is being considered, and thus, whenever a Type III slide has been used, we are always in full possession of one of the cipher alphabets.

Now, granting that we have completed the decryptment of a message, we have before us a key-frame in which several cipher alphabets are at least partially recovered. With one alphabet fully known in advance, the recovery of another full alphabet usually enables us very quickly to restore the original slide, or an equivalent slide. The ideal case is that in which we recover one of the even-numbered alphabets (except No. 14). The recovery of an odd-numbered alphabet will, at times, leave us with thirteen possibilities; while the recovery of the 14th alphabet could be useless, provided we have no other information. The method of reconstruction can be followed in Fig. 145.

First, we have the perfect case, one in which an even-numbered alphabet (the 4th) has been recovered in full. We begin by writing this recovered cipher alphabet letter for letter below (or above) the one which is always known to us; thus the two substitutes for a are in a same column, the two substitutes for b are in a same column, the two substitutes for c are in a same column, and so on. The columns themselves are not in their original order, but the two alphabets, throughout, are running parallel, just as they would in the imaginary tableau, and thus the columnar distance is uniform which separates each pair of substitutes; that is, the vertical distances AL, BU, CP, DC, EY, etc., are all equal in the imaginary tableau. If these be rearranged in such a way that the last letter of each pair is the beginning letter of the next, we have a chain AL-LR-RX-XT-TO-OK. . . . . made up entirely of equal vertical intervals, from which the repeated letters may be dropped: A L R X T. . . . . , leaving us a series of 26 letters known to be equally spaced in the columns of the tableau. Then, remembering that the columns of this tableau are duplicates of its rows, we have also a series of 26 letters known to be equally spaced on the rows. That this series of letters, A L R X T. . . . , sliding against itself, produces exactly the results of the original series, the student may ascertain for himself; also that a number of other equivalent slides can be formed by taking letters of this series at any constant interval which is not divisible by 2 or 13. The total number possible is eleven, of which one was the original. An equivalent slide, of course, is all that we actually need for enciphering and deciphering cryptograms. But where alphabetical sequences existed in the original alphabet, two methods are shown for obtaining it without writing out the entire eleven possibilities: (1) Find, at some constant interval, the letters of an alphabetical, or nearly alphabetical, sequence, as the (reversed) V W X of the figure, standing at interval 9; the taking of all letters at this interval brings back the original order. (2) Find pairs of consecutive letters, as the (reversed) HK, WZ, GJ, which, if all spread apart to the same extent (some odd interval, as 3 of the figure), would then be standing at their normal alphabetical intervals, or nearly so. Lay out the 26 positions, and spread the entire alphabet, maintaining the common interval even after the 26th position is reached. The figure shows this on several rows; in practice, there is only one.

If the recovered alphabet is an odd-numbered one, the same plan is followed, but results in a chain of only 13 letters; it is necessary to begin with some other letter, not included among the first 13, and form another 13-letter chain. Having absolutely no additional information, we cannot combine these two halves with certainty unless the original alphabet contained some alphabetical, or nearly alphabetical sequences. Presuming that it did, the method ordinarily described for combining the two halves is that of the figure. Spread the letters of the two halves (plan 2 of the preceding case), treating both halves exactly alike, until a point is found at which the two halves can be intercombined to show alphabetical sequences.

For this case, however, George C. Lamb, the author of Chapter X, suggests another plan which would seem to be more direct and less troublesome than the standard one. Lamb, incidentally, is to be congratulated here for his entirely new observation: If the two half-chains can be properly adjusted with reference to each other, each pair of letters, regardless of the order, will be a digram belonging to the original mixed alphabet. The reason for this division into halves, of the odd-numbered alphabets, is probably self-evident: One half contains only odd letters (1-3-5-7-9. . . . . . . . .) and the other contains only even letters (2-4-6-8-10. . . . . . .). If both halves were recovered in this order, and if one half were written directly below the other with letters 1-2 standing together, then the other pairs would also be standing together: 3-4, 5-6, 7-8, and so on. We seldom recover them in straight order; but whatever rearrangement has taken place in one of the halves has taken place, also, in the other half; should one be recovered with letters in the order 1-7-13-19-25-5-11. . . . (each third letter in a series 1-3-5-7. . . . .), then the other will be recovered with letters in the order 2-8-14-20. . . . . . (each third letter in a

series 2-4-6. . . . . .), though neither half necessarily begins with the first letter of its series. If, then, we are able to place together letters 1-2, the other pairs will also be adjusted, perhaps in the order 1-2, 7-8, 13-14, 19-20, and so on. These pairs may then be taken at some regular interval and will bring back the original order 1-2, 3-4, 5-6, and so on.

Lamb’s method, applied to an actual cipher alphabet, can be seen in Fig. 146. The first half-chain, if started at A, will include the letters B and C, so that the second half-chain would probably have been started at D. But AD will not be a correctly adjusted digram. It is necessary to look for one which forms an alphabetical sequence, as FG; and when the two halves are adjusted so that F and G are together, other alphabetical, or nearly alphabetical, sequences are also found to be adjusted, as MN, VW, BD, KL, making it likely that we have found some digrams belonging to the original mixed alphabet. With this adjustment reached, it is found that pairs can be taken at the constant interval 9, AT-BD-FG-HJ. . . . . , thus bringing back the original cipher alphabet.

Presuming that the original alphabet did not contain these alphabetical sequences, then there are thirteen possible adjustments for the two half-chains, and any one of these could be the original alphabet (or its equivalent). But it must not be forgotten that in an actual case our key-frame always contains portions of other cipher alphabets; and if the foregoing principle has been well understood, it may be readily seen how we could make use of these in order to determine which of the thirteen possible adjustments is correct. Even the recovery of the 14th cipher alphabet (which results in thirteen 2-letter chains), would not be useless with this other information present always in every key-frame. The Type III slide, in fact, can often be reconstructed without possessing any fully recovered cipher alphabet. This cipher is very popular with members of the American Cryptogram Association, and is usually known, for no very good reason, as “the Quagmires cipher.”

In the case of the Type IV slide, we do not begin reconstruction with one complete cipher alphabet already in our possession. It becomes necessary that we recover two, the perfect case being that in which one is an odd-numbered alphabet and the

other an even-numbered one. We will follow this case in Fig. 147, where the two recovered alphabets are Nos. 4 and 7. This tableau, like the preceding one, has columns which are duplicates of its rows, and to see our preceding case again (with its one modification), let us begin by looking only at the three alphabets immediately below the heading. One of these, the plaintext alphabet, shown in lower-case letters, we will disregard for a moment, giving our attention only to the two cipher alphabets.

These two alphabets, like the two from the Type III slide, are running parallel in the imaginary tableau, so that we have, as before, a series of 26 vertical distances, EY, WS, YV, and so on, all known to be equal in the columnar direction and therefore known to be equal distances on any row. A chain may be started, exactly as in the other case, EY, YV, VQ, QM, MI. . . . . , resulting in a series of equally-spaced letters E Y V Q M I F A L R. . . . . . which is either the original cipher alphabet, or the original one with letters taken at some odd interval other than 13. It is, however, only the cipher alphabet; the mixed plaintext alphabet must still be found. This may be done, as in the case of the Type I plaintext alphabet, by using either of the two cipher alphabets which were first recovered and setting originals above their substitutes. If this is done with our cipher alphabet in the order E Y V Q M I F A L R. . . . . . , then the plaintext alphabet comes out in the order a c e h k o r w z m. . . . . . , and we have an equivalent slide. If we first rearrange the sliding alphabet (each 9th letter of the series E Y V Q. . . .), we obtain the plaintext alphabet also rearranged.

Continuing, now, with the rest of our figure: The method we have just seen was based on a tableau, and our equal intervals were all vertical. In the figure, we are dealing purely with horizontal distances, and our method is based, not on a tableau, but on a slide (as it was with the Type II). Our 4th and 7th (secondary) cipher alphabets, after all, are merely two different positions of the same slide. If we select any two letters, as a and b of the plaintext alphabet, and find that their substitutes are, respectively, E and W, in alphabet 4, then the lineal distance ab in the stationary alphabet must be exactly equal to the lineal distance EW in the sliding

one; if this were not true, the letters could not have coincided as they do. Then, if we find the same substitutes, E and W, in alphabet 7, and note that, in this position of the slide, they have coincided, respectively, with plaintext letters y and s, then the distance EW in the sliding alphabet must be exactly equal to the distance ys in the stationary one. It follows from this that ys and ab are equal in the stationary alphabet. If we begin again with the lineal interval ys, we find that this is equal to UZ of alphabet 4, and that UZ, found again in alphabet 7, is equal to vd. Here, then, is another interval, vd, which is equal to both ab and ys. And so we may continue, forming a chain made up of these known equal intervals, ab, ys, vd, qx, etc., for the plaintext alphabet, and EW, UZ, BP, GC, for the cipher alphabet. Sometimes we return to ab (EW) without having included all 26 letters, and in that case (unless the number of letters included is a divisor of 26), it becomes necessary to abandon ab, and try starting with some other interval, as ac.

Here, as in the case of the Type III slide, we sometimes obtain two 13-letter chains; but in the fortunate case of having recovered in full both an odd-numbered and an even-numbered cipher alphabet, we end the chain with every letter represented twice, both in the stationary alphabet and in the sliding one. Pairs of letters (representing horizontal intervals) can then be rearranged as in the other case, the second letter of one becoming the first letter of the next (in both series), and the dropping out of duplicated letters gives us an equivalent slide. In the figure, starting with ab (EW), we find a plaintext alphabet a b i o v d u. . . . . and a cipher alphabet E W O I B P X. . . . . . This, as mentioned, is one of eleven possible equivalent slides, of which one is the original. Here, the original can be found by taking letters at interval 21. In the figure, letters were taken at interval 5, a result of observing the sequence W X Y Z standing at that interval in the lower alphabet, and the slide comes out in reverse order. This is still an equivalent slide, and the decryptor may or may not care to decide which alphabet runs backward.

Since the reconstruction of these mixed-alphabet slides is probably the most fascinating subject in the whole field of cryptanalysis, several problems are being appended in Fig. 148. In all of these, Semper has selected key-words or phrases to contain no repeated letters. With reference to the practice cryptograms, only one of those submitted was thought to have enough alphabet-length for purely analytical attack. The others, even with their probable words or partial translations, will still require some work. The periods of these examples are said to be, respectively, 6, 7, 8, 3, and (?).