ELEMENTARY CRYPTANALYSIS

PREFACE

The word cryptography, properly speaking, embraces the entire field of secret writing, while that branch of the subject dealing with the solution and reading of cryptic messages is generally referred to as cryptanalysis.

Works on the subject of secret writing are comparatively numerous, if not always easily available, but works devoted purely to the analysis of such writing and the solving of its cryptograms have, until recently, been so rare as to be almost non-existent for the general reader.

Today we have two particularly excellent works, but both in foreign languages: Cours de cryptographie, by General Marcel Givierge, and Manuale di crittografia, by General Luigi Sacco. In English, we find a more elementary work, The Solution of Codes and Ciphers, by Louis C. S. Mansfield (Maclehose, London), which, the writer has been told, is to be a first volume. As to America’s contribution, we seem to find only small books such as Colonel Parker Hitt’s A B C of Secret Writing, covering three ciphers, or Colonel H. O. Yardley’s Yardleygrams.

There are, however, many works which deal most interestingly with the analysis and decryptment of some one particular cipher. Most of these are short works, published in magazines or incorporated into books of a general nature, and nearly always the one cipher dealt with is that type of simple substitution which appears with separated words in the puzzle section of our current magazines and newspapers.

One well-known gem of cryptanalysis, equal to any modern specimen, can be found in the story, The Gold-Bug, by Edgar Allan Poe. This, too, deals with the simple substitution cipher just referred to, but covers a case in which word-divisions are absent. Poe has also left us an essay called Cryptography.

Rosario Candela’s recent book, The Military Cipher of Commandant Bazeries, shows the unraveling of one particular cryptogram which, for many years, had baffled the best efforts of all amateurs, and, it is rather suspected, of some few who were not amateurs. The book contains a chapter on general cryptanalysis, and also some cryptograms for solution.

Secret and Urgent, by Fletcher Pratt, is primarily a history of secret writing (a most interesting one, by the way), but contains also a number of examples of cryptanalysis; it also shows a table which the writer has never before seen in published form: a list of English trigrams (three-letter sequences) and the frequency with which they are used in the language. Other examples of decryptment may be found in the Macbeth translation of Langie’s genial little book, De la cryptographie; the appendix to this translation contains the coveted Playfair demonstration, prepared by Lieutenant Commander W. W. Smith of the United States Navy.

Just why so absorbing a subject has been so neglected in a world full of puzzle lovers is hard to understand, especially since the analytic writer, in addition to entertainment, has something to offer of a more serious nature. It is true that trained cryptanalysts are not greatly in demand in peacetime, and that our present corps of cryptographers has a personnel more than ample for providing necessary codes and ciphers, scientifically selected to fit their individual purposes, and safeguarded with suitable protective devices. Yet of what value is the most excellent of ciphers if, at the time of direst need, this cipher, with all of its safeguards, must be placed in the hands of even one man who cannot appreciate its intrinsic value or imagine a need for extra precautions? At any rate, we make our feeble attempt to reach this “one man.” May he learn, at least, that there are reasons for his instructions!

In the planning of the present treatise, all purely historical aspects of secret writing were neglected, and many well-known ciphers whose interest is chiefly historical or literary have either been omitted or given but cursory treatment. Certain other ciphers, representative of types, have been treated at whatever length seemed advisable for bringing out principles; and, with each type discussed, a generous number of cryptograms has been provided, on which the student will be able to test his skill as he learns. The student who masters these fundamentals will be acquainted with the principal forms of cipher, and will be able to solve cryptograms prepared by means of these ciphers provided the cryptograms are of adequate length and based on a language which he understands, or of which he is able to secure understandable specimens. Within limits, he should also be able to analyze and solve such cryptograms without being told in advance what the cipher is. This, we believe, is the kind of text-book desired by the many who desire information about “ciphers.”

Its material, compiled by members of the American Cryptogram Association, has had to be gathered from a great many sources, both within the organization and elsewhere, making it impossible, at times, to give credit where credit is due. Our chief indebtedness, however, is to M. E. Ohaver for a series of articles published during the years 1924 to 1928 in the former Flynn’s Magazine and most unfortunately no longer obtainable from the publishers. Further acknowledgment should be made to Colonel Parker Hitt, whose Manual for the Solution of Military Ciphers, though not available for general distribution, can usually be consulted in large public libraries. We have also borrowed liberally from foreign sources, and members of the association have most generously contributed the results of their original research. For this collaboration and co-operation, the writer is particularly grateful.

CONTENTS

The aristocrat of the cipher family is code. This is a form of the substitution cipher which requires the preparation, in advance, of a code book. A series of terms likely to be used in future correspondence (that is, words, phrases, and even sentences) is first gathered into a vocabulary, or “dictionary”; and beside each of these terms is placed a substitute known as a code group, or code word. These substitutes may be groups of letters, or groups of digits, or actual words selected from ordinary language. Very common words or expressions are usually provided with more than one substitute; and nearly always there are substitutes provided for syllables and single letters, so as to take care of all words not originally included in the vocabulary.

No code presents any real security unless the code symbols have been assigned in a thoroughly haphazard manner. This means that any really good code would have to be printed in two separate sections. In one of these, the vocabulary terms would be arranged in alphabetical order, so that they could be readily found when enciphering (encoding) messages; but the code groups would be in mixed order and hard to find. In the other section, the code groups would be rearranged in straight alphabetical (or numerical) order, so as to be readily found when deciphering (decoding), and the vocabulary terms would be in mixed order. Just what is meant can be seen in Fig. 1, showing fragments from an imaginary code book.

A code of this kind, with symbols assigned absolutely at random, provided it is carefully used (never without re-encipherment) and a close guard kept over the code books, represents perhaps the maximum of security to be attained in cryptographic correspondence; and security, of course, is of prime importance in the selection of a cipher for any practical purpose.

But in considering the relative merits of the various ciphers, it is always necessary to take into account many factors other than security, each cipher being evaluated in connection with the purpose for which it is wanted: Under what conditions must the encipherment and decipherment take place? How must the cryptograms be transmitted? How much of the enciphered correspondence is likely to be intercepted? What degree of security, after all, is absolutely imperative?

A commercial, or other, firm, having a permanent base of operations, and in little danger of being blown to bits by an enemy shell, would not consider the first of these questions from the same angle as the War Department, and the War Department, though considering all of them from several different angles of its own, would still not consider them from the same viewpoint as the State Department.

If messages are to be sent by mail, or by hand, or by telephone, or pasted on a billboard, it is conceivable that a cipher which doubles or trebles their length could still be a practical cipher. For transmission by telephone, the presumption is that the cryptogram must be pronounceable, or, certainly, audible. For written communication, individual purposes have been served by means of pictures.

But when the cryptograms are to be sent by wire or radio, it must be possible to convert them into Morse symbols, either letters or figures, but not intermingled letters and figures. Here, length must be considered, involving questions of time, expense, and the current telegraphic regulations. Moreover, it is conceded that a meaningless text will not be transmitted with absolute accuracy, and a cryptogram which is to be sent by this means must not be of such a nature that ordinary errors of transmission will render it unintelligible at the receiving office.

A factor of particularly grave importance in the selection of a cipher to fit a given purpose is the probable amount of enciphered material which is going to fall into the possession of unauthorized persons. A criminal, who has had to send but one brief cryptogram in a lifetime, might reasonably expect that it will remain forever unread, no matter how weak the cipher. A commercial firm, transmitting thousands of words over the air, is more vulnerable; and the diplomatic office, or the newspaper office, which makes the mistake of publishing almost verbatim the translations of cryptograms which have been transmitted by radio, and thus has surely furnished the cipher expert with a cryptogram and its translation, might just as well have presented him with a copy of its code book.

As to just what constitutes the “perfect” cipher, perhaps it might be said that this description fits any cipher whatever which provides the degree of security wanted for an individual purpose, and which is suited in other respects to that individual purpose. Even a basically weak cipher, in the hands of an expert, can be made to serve its purpose; and the strongest can be made useless when improperly used.

In the present text, we are likely to be found looking at ciphers largely from a military angle, which, apparently, has a more general interest than any other. In time of war, the cryptographic service, that is, the encipherment and transmitting service, is suddenly expanded to include a large number of new men, many of whom know nothing whatever of cryptanalysis, or the science of decryptment. Many of these are criminally careless through ignorance, so that, entirely aside from numerous other factors (including espionage), it is conceded by the various War Departments that no matter what system or apparatus is selected for cipher purposes, the enemy, soon after the beginning of operations, will be in full possession of details concerning this system, and will have secured a duplicate of any apparatus or machine. For that reason, the secrecy of messages must depend upon a changeable key added to a sound basic cipher.

Speed in encipherment and decipherment is desirable, and often urgent; and the conditions under which these operations must often take place are conducive to a maximum of error. The ideal cipher, under these conditions, would be one which is simple in operation, preferably requiring no written memoranda or apparatus which cannot be quickly destroyed and reconstructed from memory, and having a key which is readily changed, easily communicated, and easily remembered. Yet the present tendency, in all armies, seems to be toward the use of small changeable codes, which are written (printed) documents; and, for certain purposes, small mechanical devices.

An enormous number of military cryptograms will be transmitted by radio and taken down by enemy listeners, and even the ordinary wire will be tapped. It is expected that the enemy will intercept dozens, and even hundreds, of cryptograms in a single day, some of which will inevitably be enciphered with the same key. With so much material, knowing the general subject matter, and often exactly what words to expect, or the personal expressions invariably used by individuals, it is conceded that he will read the messages. All that is desired of a cryptogram is that it will resist his efforts for a sufficient length of time to render its contents valueless when he finally discovers them. By that time, of course, the key will have been changed, probably several times, and even the cipher.

With these general facts understood, we may first dispose hastily of the concealment cipher, after which we will examine at greater length the two legitimate types, the transpositions and the substitutions.

The name “null cipher” derives from the fact that in any given cryptogram the greater portion of the letters are null, a certain few being significant, and perhaps a few others being significant only in that they act as indicators for finding truly significant letters. To illustrate what is usually meant: Say that your very good friend, Smith, first complains about a radio which he has bought from your neighbor, Johnson, then asks you to take Johnson the following note: “Having trouble about loudspeaker. Believe antenna connected improperly, but do whatever you can.” By reading the final letter of each word, you will find out what Smith actually had to say to Johnson: GET READY TO RUN.

That is the null cipher reduced to its elements, though naturally it can be more skillfully applied. Significant letters may be concealed in an infinite variety of ways. The key, as here, may be their positions in words, or in the text as a whole. It may be their distance from one another, expressed in letters or in inches, or their distance to the left or right of certain other letters (indicators) or of punctuation marks (indicators); and this distance, or position, need not be constant, or regular. Sometimes it is governed by an irregular series of numbers.

Similar devices are applied to whole words. We agree, say, that in whatever communications we send to our accomplice, only the third word of each sentence is to be significant. Desiring to send him the order, STRIKE NOW, we write him as follows: “The building strike is worrying our friends quite a lot. It has now extended to this part of the city.”

A purely concealment cipher may be enveloped in apparent ciphers of other types. The true message is concealed, as usual, in a dummy message, and the whole is enciphered in one of the legitimate systems. It is then hoped that the decryptor, satisfied with having solved the dummy, will look no further. Even more effective would be the device of concealing the message in what appears to be a cryptogram, but is not. It is easy to string letters together in such a way as to make them resemble most convincingly a transposition cryptogram, and in this case it would be hoped that the investigator’s full attention would be given to the hopeless task of decrypting the dummy.

Concerning the decryptment of concealment cipher, we regret to say that cryptanalysis has little help to offer. Fortunately, most of these ciphers depend absolutely on the belief that they will not be recognized as cipher, and once they are so recognized, they present no resistance. In those few cases where the secret message is not at once obvious, it is sometimes useful to arrange the words (or sentences) in columns, or in rows, for a closer inspection.

We have, for instance, an apparent memorandum in which the awkwardness of the wording, or some other factor, has drawn our attention to the possibility of cipher: “Inspect details for Trigleth — acknowledge the bonds from Fewell.” We arrange these words in column form, aligned by their initials, as in Fig. 2, and the third column promptly gives up the secret message STRIKE NOW.

The words of sentences can, of course, be treated in the same way, and where the alignment from the left gives no results, letters or words can be aligned from the right, or from the center. If columns give no results, diagonals can be inspected, or a zig-zagging line between one column and another.

Experience counts for most, and extensive reading is a vast help. Having seen methods in use, or read the descriptions of methods, we know of some definite thing to look for. Then, too, some of the concealment ciphers have transposition characteristics. This would be the case with the Legrand cipher, which is of the type called “open letter.”

This cipher used a numerical key, which, in turn, was based on a keyword in what seems today a rather odd manner: A keyword CAT, made up of the 3d, 1st, and 20th letters of the alphabet, gives the key 3 1 2 0. Before concealment takes place, a series of word-positions is marked off, and these vacant places are numbered (0 to 9, or 9 to 0), continuing to repeat the ten digits until there are enough of the digits 3, 1, 2, and 0 to accommodate the words of the secret message. This message is then written, word by word, below its digits, beginning with the first digit 3, then going on to find a digit 1, then a digit 2, then a digit 0, then another digit 3, and so on. After the secret message is written into its place, all of the blank positions are filled with connective matter, as in the case of Cardinal Richelieu’s grille-writing. Our later study of transpositions will show approximately how we should go about reading this, once we suspect its use.

So far, we have been considering pure concealment. Many of the classic ciphers, fundamentally of the concealment type, are also substitution ciphers, and their decryptment would follow substitution methods. Of these, perhaps the best known is Bacon’s biliteral cipher, summed up in Fig. 3.

While the average modern person would have no opportunity for employing Lord Bacon’s cipher as described, he has access to an unlimited number of vehicles other than type-difference. Anything, in fact, may serve the purpose, so long as the material is available in two distinguishable forms and in sufficient quantity. Our message of 29 A’s and 16 B’s could be expressed with a deck of playing cards if aces and face-cards are considered to represent B’s. It could assume the form of a fence with 45 palings, in which the B-palings are crooked, damaged, or missing. Ohaver once made use of a cartridge belt in which the A-loops contained cartridges and the B-loops were empty. There is an excellent opportunity here, too, for the compiling of “fake” cryptograms, with A-letters and B-letters distinguished as vowels and consonants, or by the part of the normal alphabet from which they have been taken.

With a biliteral or binumeral alphabet which requires 26 groups, we cannot have fewer than five characters to the group without making groups of different lengths. But another well-known cipher alphabet, devised by the Abbé Trithème for use in much the same way, is triformed, and thus permits that the group-length be reduced to three. The Trithème (Trithemius; Trittemius) alphabet, expressed in digits 1-2-3, was approximately that shown in Fig. 4.

The most popular of the geometrical figures appears to be the square, with or without a series of numbers 1 to 25, 1 to 36, and so on. Any device or game, which will provide a square, is likely to be seized upon as the source of a transposition key. We find two widely-known examples of this in the “magic square” and the “knight’s tour.”

A magic square, as most of us understand this term, is made up of a series of numbers, such as 1 to 25, 1 to 36, which are so arranged in their cells (positions) that the added numbers of any row, column, or diagonal, will always give the same total. A square of given size will provide more than one magic square arrangement; and these numbers, being a series, constitute an order, which, once it can be remembered or reconstructed, will serve either for writing in or for taking off a unit of 25, 36, etc., letters.

The knight’s tour is based on the chessboard, a unit of 64 cells. In the game of chess, where each piece has certain prescribed moves, the piece called the knight must move diagonally across a 2 x 3 oblong. The “tour” consists in starting the

knight at one corner and carrying him completely over the 64 cells of the chessboard, causing him to touch every square exactly once without having made any other move than the one allotted to him. Fig. 6 will show one of the many such tours which have been published. Such designs will serve either for writing in or for taking out. In either case, the text is made to contain exactly 64 letters or a multiple thereof. For writing in, the first letter is placed in the cell corresponding to No. 1, the next letter in the cell numbered 2, and so on. For puzzle purposes, the 64 letters are usually left standing in the form of a square. As cipher, they would be taken off, by rows, or by columns, or otherwise. Or the 64 letters may first be written in simple order into the form of a square, and then taken out one by one following the route of the knight.

Other ciphers of the regular type merely employ a unit of so many letters, to be arranged in some specified order, generally in accordance with a numerical key. If, say, the unit has a length of six letters, which we will represent as A B C D E F, and the specified order for these is 6 2 1 4 3 5, this unit may be transposed to read F B A D C E. Each unit will be transposed to have exactly this pattern, except that semi-occasionally we find a final unit slightly different from the others, owing to the fact that nulls were not added to complete its length (Accurately speaking, this transfers the cipher to the “irregular” class). Units, once transposed in this way, may continue to stand intact, one after another; or they may remain intact, merely exchanging places with one another; or the cipher may be so planned that they do not remain intact, as was the case with our cryptogram (b) of Fig. 5.

Often, two ciphers will differ from each other only in the method by which their cryptograms are produced; oftener, there will be an actual difference, but one which is purely superficial. For instance, we have just mentioned a plaintext unit A B C D E F as having been transposed with a key 6 2 1 4 3 5 to result in the order F B A D C E. Identically the same numerical key, used in another way, will transpose this unit in the order C B E D F A. The two resulting cryptograms would be different, but the kind of cryptogram would not.

An extremely common form of complete-unit transposition is that indicated in Fig. 7, where a short message, LET US HEAR FROM YOU AT ONCE CONCERNING JEWELS QQ (38 letters plus 2 nulls), has been written into an oblong, or block, in one order and taken off in another. Both the writing in and the taking off follow a route, rather than a key and, for that reason, the cipher is often spoken of as route transposition, rather than rectangular transposition.

Three of the many possible routes are shown in the three (partial) cryptograms of the figure. In this connection, the American popular terminology seems to favor horizontals and verticals, rather than “rows” and “columns.” The writing in or

the taking out of a text is said to be done by straight horizontals, or by reversed horizontals (backward), or by alternate (or alternating) horizontals (written alternately in both directions). Similarly, we find ascending, or descending, or alternate verticals; and again the diagonal routes will be described as ascending, descending, or alternate. The route may also be a spiral one, and in this case it is said to be clockwise or counter-clockwise.

For all of these routes, the point of beginning is nearly always one of the four corners, except in the case of the two spiral routes, which are just as likely to begin with a central letter, particularly when the rectangle is a square. Colonel Parker Hitt, in his Manual for the Solution of Military Ciphers, shows the same series of letters written into forty different blocks, always beginning at one of the four corners.

Rectangular transposition, when used as cipher and not simply as a puzzle, requires that one dimension of the oblong be fixed, the other dimension being entirely dependent on the length of the message to be conveyed. In the figure, the pre-arranged width of the block, called its key-length, was 5, and the filling of the block required 8 complete units. These were written one by one as simple bits of plaintext, and were then broken up in the method of taking off. Occasionally it will be the vertical dimension of the block which is fixed, and the plaintext will be written in by columns, beginning at the left or at the right. But there is so little difference in the results of the two procedures that a decryptor may solve and read a cryptogram without learning which of the two was actually followed. Ordinarily, it is the simple operation which comes first, the writing in of intact units one after another. Sometimes the opposite is true, the operation of writing in being made very complex, so that the whole block is the unit, the taking off being done by simple rows or columns. Frequently both operations are complex. This kind of transposition belongs rather to the category of puzzles than to cipher; any reasonably intelligent person can decrypt it, knowing what it is. However, it has not infrequently been applied to serious purposes, and a decryptor, encountering an unknown transposition, would not overlook the possibility of simple rectangular encipherment.

Decryptment, here, is merely a matter of trying out the known routes, and it would never be actually necessary to write out the entire forty-plus blocks, or even half of these, for any one rectangle. The decryptor begins by counting the letters of his cryptogram and factoring the number of these, to find out what oblongs are possible. A 36-letter cryptogram, for instance, might mean dimensions 6 x 6, or dimensions 4 x 9. It could, conceivably, represent dimensions 3 x 12, or 2 x 18. But key-lengths are hardly ever shorter than 5, or as long as 18. He would seize upon the square as the object of his first investigation, writing the cryptogram into that block by various known routes, and also reading by various known routes, diagonally, horizontally, vertically, backward, or upside down, until he begins to find words. As a rule, this does not take him very long; often the very efforts of an encipherer to achieve complexity will result in an easier task for the decryptor. However, a spiral will sometimes give trouble.

The examples appended to this chapter are all of the complete-unit type, and require little knowledge of cryptanalysis for their solution.

Passing on to irregular types, we find these in all degrees of difficulty, from the very simple “rail fence” to the formidable “U. S. Army” double transposition.

The “rail fence” family is outlined sketchily in Fig. 8. The writing in of the plaintext follows a zig-zag route, downward by so many letters, then upward to the line of beginning, as indicated by the series A B C . . . . . , and the taking off of the cryptogram is done by straight lines. In explanation of the character &, this has been used here as a signal to show the ends of the straight lines. No such signal is needed if a proper understanding exists between correspondents as to the construction of the “fence” and the length of it which may occupy one line of writing; and in some cases the straight lines are all equal in length.

In Fig. 9, we have a suggested grille-transposition, of a kind described by Mario Zanotti as “indefinite.” This kind of grille, we believe, is the invention of General Sacco. To picture it complete, we may imagine a flat surface, such as a piece of cardboard, marked off into squares, having dimensions 12 x 6, and turned sidewise. Assuming this to be shown in full, we are looking at 12 columns, and each column has 6 of the small squares, or cells. To convert this piece of cardboard into an encipherment grille, we clip out three squares from each one of its 12 columns, always in the most haphazard manner possible. The resulting grille will thus have 36 openings, and, if placed over a sheet of paper (preferably also marked into cells), enables us to transpose the first 36 letters of a message by writing them one at a time into the 36 apertures in some one order and taking them off in another. The original plan was the reverse of the usual: write the letters by columns and take them off by rows.

In the figure, a 9-letter message, STRIKE NOW, has been written into the first three columns of such a grille, and, taken off by rows, comes out in the order N, SO, TI, K, RE, W. While the figure shows this cryptogram regrouped in the usual fives, the original method, as prescribed with the device, would have grouped it in threes, that is, to correspond with the number of apertures per column. This

would facilitate the operation of decipherment, which is as follows: Count the number of letters in the cryptogram and divide this number by 3, in order to find how many columns were used. Cover (or ignore) the unused portion of the grille, write the cryptogram by straight horizontals into the uncovered portion, then read, or copy, by descending verticals. The recipient of the present cryptogram, for instance, finds nine letters, divides this number by 3, thus ascertaining that three columns were used, covers up the other nine columns, then, proceeding by straight horizontals, places one cryptogram-letter wherever he sees a hole. Having thus restored all letters to their proper columns, he has the plaintext message before him. It will be noticed that an encipherer uses only the number of columns that he needs. His last column does not have to be completed with nulls, as in the case of complete-unit ciphers.

As this grille has just been described, its full capacity is 36 letters, and it has a repeating cycle of that length, presuming that, after the transposition of the first

36 letters, another 36-letter unit is to be transposed by the same grille standing in the same position. But this grille, reversed, provides a new pattern; and the opposite side of the grille provides two additional patterns. These positions may be numbered, thus providing for the encipherment of 144 letters, even assuming that the positions are to be used in 1, 2, 3, 4 order and without varying the method of use. Add to this that the cryptographic offices may have provided half-a-dozen different grilles to be used interchangeably and not always in exactly the same way, and it becomes plain that such an encipherment, in the hands of an operator who knows his business, could be made to furnish a very effective form of transposition.

Zanotti, and others, have also described mechanical devices of a patentable type for accomplishing very involved transpositions. The principle on which most of these operate can be seen in Fig. 10. A certain number of pointers, or narrow sliding rulers, all carrying the same progression of numbers, are so attached to a framework that they can be set, by means of a numerical key, to project at irregular lengths over a sheet of quadrille paper cut to fit into the frame. Thus, each pointer indicates a certain number of empty cells, as nine on the first line, six on the next, and so on. In the example of the figure, presuming that each pointer carries only ten numbers, and that the full number of these pointers is seven, the numerical key would be the column of numbers at the extreme left: 2-5-0-7-3-4-7. The message here is written in the usual horizontals, with a null (not strictly necessary) completing the last line. It could be taken off by columns: L, EC, TEN, UFCI, etc. The decipherer, having a duplicate apparatus, would set this according to the pre-arranged key, copy the cryptogram by columns, and read it by rows. The exact method, of course, can be varied.

Some attempt has been made, too, to evolve cipher machines which will produce effective transpositions, but our understanding is that these have never been accepted as worthwhile. The accomplishment of transposition by mechanical means is far from new. In fact, the oldest transposition cipher of which we have any record was accomplished by means of the Lacedaemonian scytale. The Spartan general, departing for foreign conquests, carried with him a rod, or scytale, of exactly the same diameter as one retained by the administration. When it was desired to communicate matter of a confidential nature, the sender, using a narrow strip of parchment, wound this carefully around his scytale with edges meeting uniformly at all points, and wrote his message lengthwise of the rod. When the strip was unrolled, the message appeared as a series of short disconnected fragments, one letter, or two letters, or portions of one or two letters. It was presumed that no person would be able to read the message without being possessed of a duplicate scytale on which to rewind the strip. We are left to suppose that this presumption was justified by fact, though the decryptor of today would make short work of such a system. The scytale, we believe, is the oldest known cipher of any kind, and is still serving today as the emblem of the American Cryptogram Association.

Before leaving types, it should be mentioned that any of the transpositions ordinarily used for disarranging single letters can also be used for the transposal of entire words. The popular name for this is “Route Cipher” — possibly because it is rather cumbersome to accomplish by any other than a “route” transposition.

We have said little concerning decipherment. This, in practically all cases, is a mere matter of performing inversely the two encipherment operations. For either process, the operator begins by setting down his key or design, or adjusting his mechanical device in the agreed manner. The encipherer “writes in” a plaintext, and “takes off” a cryptogram; the decipherer “writes in” a cryptogram, and “takes off” (or reads) a plaintext. If the encipherer, by agreement, has written the text in rows and taken it off by columns, then the decipherer must do the reverse: write his text by columns and take it off by rows.

Before entering into the subject of decryptment, the student should acquaint himself with the significance of the various tables appended to this text, in order that he may consult these or similar tables for information as to frequencies, and sequence. Every written language has its individual characteristics in these two respects, and, to learn just what these are for each language, various cryptologists have, from time to time, counted the letters, the short words, the combinations, and so forth, often on extremely long texts, afterward arranging these data in the form of charts, or tables, or lists. Two such counts are never duplicates, and there may be a noticeable difference, say, between results obtained from literary text and those obtained from military or telegraphic text; yet results for any one language are surprisingly uniform. Finding, for instance, an unexplained cryptogram in which a count of the letters shows that about 40% of these are vowels (with or without Y), we may classify it, not only as a transposition, but as one enciphered in English or German, since one of the Latin languages can hardly be written with so low a vowel percentage. Then, if we note the occurrences of the letter E, and find that this makes up about 12% of the total number of letters, we may discard the possibility of German, in which the letter E is far more likely to represent 18% of the text. Or, if the vowel percentage is high enough to point to one of the Latin languages, French would be distinguished from the others by the outstanding frequency of its letter E, sometimes as great as that of the German E, while the Spanish, Portuguese, or Italian language will not always show it as the leading letter, its place having been taken by A. In the Serb-Croat language, the letter A always predominates, and in Russian the letter O.

As to sequence, and considering English combinations only, certain digrams, such as TH, HE, AN, etc., very consistently predominate over all others. These almost never show identical percentages in any two digram counts (as the single letters sometimes will), and seldom, if ever, are ranked in exactly the same order, aside from the fact that TH invariably comes first. But in all counts, the same fifty to sixty digrams (out of 676) are always found at the top of the list. Thus the Meaker digram chart differs from similar charts made by many others; yet any digram chart is the most valuable weapon we have for attacking a cipher. The Carter contact chart contains the same general information expressed in another way for special use in transpositions. (This was not figured from the Meaker chart, but from an earlier one by Ohaver, made on the same kind of text.)

One very useful phase of frequency data is seen in the group percentages. Single letters, especially in short texts, may vary greatly from their normal percentages, while certain classes, taken as a whole, maintain a fairly constant percentage no matter how short the text. Such classes, or groups, listed under the general heading of English Frequency and Sequence Data, can be memorized as having roughly approximate percentages: Vowels, 40%; selected high-frequency consonants, 30%; extreme low-frequency group, 2%; the five most frequent letters, mixed, 45%; the nine most frequent letters, 70%. This final group of nine letters, E T A O N I S R H, hardly ever varies appreciably; the shorter groups will sometimes vary as much as 5% one way or the other.

Very useful in code decryptment is a list of the commonest words. Trigrams have also been investigated, the favorite positions of individual letters in their own words, average word-length, patterns, and endless other information, some of which is indispensable, and some merely convenient. It will not be possible, in the space at our disposal, to point out all of the uses to which this kind of information can be put; the student is urged to take his cue from the occasional short references made in connection with examples.

All ciphers are decrypted by the general methods suitable to their type, and a transposition cryptogram may involve factoring, examination of the vowel distribution, and anagramming, either singly or in combination. These are best explained in connection with examples, which may themselves have special methods, and we have selected for general discussion four ciphers, two belonging to the complete-unit type and two to the irregular. A careful study of the methods used in individual cases should furnish the student with a basis for analyzing other ciphers and evolving other special methods to suit particular cases.

Concerning the paper work, which, admittedly, is onerous in most forms of cipher investigation, much reference may be found, in the matter which follows, to “paper strips.” These are old stand-bys. Most decryptors prefer to do all of their work on cross-section (quadrille) paper, since the writing of the letters into cells enables them to obtain an accurate spacing both laterally and vertically, and this paper is easily cut apart along the separating lines. But for the kind of cryptograms we are likely to see here, many persons prefer to work with a set of anagram blocks. These can be prepared at home from cardboard squares, or may be bought in sets with frequent letters represented in approximately the correct proportions.