Elementary cryptanalysis

In the preceding chapter, we glanced at the most elementary form of columnar transposition: a text is written into a block by rows and taken off by columns in such a way that even though all or part of the columns may be reversed in direction, these columns are always left standing one after another in regular order. Columnar transposition becomes less crude when the order for taking off the columns is an irregular one, governed by a changeable numerical key, the length of this key governing also the width of the rectangle. This process can be examined in Fig. 11. In this figure, the numerical key, 4 1 6 5 3 2 7, was first derived from a keyword, HALIFAX, according to the following very common plan: The two A’s, taken from left to right, receive the first two numbers; the third number, in the

absence of B, C, D, and E, is assigned to F; and so on, following the alphabetical rank of the letters present, and taking repeated letters from left to right. The presence of seven numbers implies seven columns, and it is said that the key-length is 7. When a text has been written into a block of that width, with a key-number standing above each column, these columns can be taken off in the order shown by the numbers, and not in regular sequence.

The key, used exactly as described, is a “taking off” key, and this is the common way of using one. It can, however, be used for “writing in” the successive units, placing the first letter of a given unit beneath number 1, the second letter beneath number 2, and so on until the seventh letter has been written below number 7, afterward beginning with the first letter of another unit below number 1 again. Under this plan the first unit of our figure, L E T U S H E, would have been written in in the order U L H S T E E. Since all units would follow exactly the same pattern, the resulting columns would be identical with those of the present block; the only essential difference would be that the new columns are already transposed, and can be taken off in straight order. The two resulting cryptograms, however, would not be the same. The unit which was written in in the order U L H S T E E, would have been in the order E H S L U T E had the method been that of taking out (or “off”).

The Nihilist transposition is ordinarily accomplished by “writing in,” and its numerical key is applied to both columns and rows. Thus its major unit is a square, and the seven-letter keyword HALIFAX, applied to both dimensions of a rectangle, demands a unit of 49 letters, while the shorter word SCOTIA, key-length 6, requires a unit of 36 letters.

Theoretically, this cipher is a double transposition, requiring two successive operations as shown in Fig. 12. But in practice, these two transpositions can take place simultaneously as pointed out in Fig. 13. The operator, having laid out his key-numbers at top and side of his square, begins his writing in the cell at which the column headed by number 1 crosses the row headed by number 1. He writes in his first unit, proceeds to the row numbered 2 for the writing in of his second unit, then to the row numbered 3, and so on, taking rows in the order shown by the numbers at the left, and placing the letters of his unit by following the numbers across the top. Thus, with only a little concentration, he has the entire major

unit at one continuous writing. The decipherer, too, having restored his cryptogram unit to its block and written his two series of numbers, may read, or copy, continuously. The decipherer, in fact, uses the exact method which would produce a Nihilist cryptogram if a key were used in the “taking out” manner. What we have described is the encipherment of a single major unit; and all cryptograms must contain an exact number of these major units.

The second operation, that of taking off the cryptogram, is not always done by straight horizontals as we have shown this under (c) of Fig. 12. This, of course, is the expected way; but the Nihilist square is quite frequently taken off by some other one of the forty-odd routes possible to rectangular transpositions. The decipherer, knowing this route, merely writes his units back into their blocks; but the decryptor is often faced with a preliminary problem of discovering how they were taken off. Sometimes he must also discover how many units a cryptogram contains.

To understand how such problems are solved, it is necessary to pause and consider the make-up of ordinary written plaintext. English vowel-percentage, as mentioned, is about 40%, and practically never varies out of its limits 35%-45%. Each 40 vowels are fairly evenly distributed throughout their 100 letters. Take any English text whatever, not composed of initials or otherwise distorted, and, beginning where you please, mark it off into ten-letter segments and count the vowels in each of the segments. You will find that the majority of these have exactly the normal number of vowels, which is 4. Others will have 3 or 5, which, though outside of the limits 35%-45%, are the closest variations possible. It will be a rare segment indeed which contains fewer than 3 vowels or a greater number than 5.

But suppose, having marked off such a text into ten-letter units, or segments, we take each of these segments individually and mix up the order of its letters, though still allowing it to stand where it is. And suppose, having done this, we erase the original division-marks and, beginning at some point in the midst of a former segment, we again mark off a series of ten-letter units, and count the vowels of these new segments. This time, we are just as likely as not to find seven or eight vowels in one segment and none at all in the next, depending on just what we did to the old units, and still we have not actually mixed the units; we simply have our division marks in the wrong places. Imagine, then, how the vowel distribution can vary when a transposition is one so planned as to break up units and scramble their letters.

This fact of uniformity in vowel distribution is of enormous assistance in dealing with the simpler transpositions. For instance, it may be that what we want to know is the length of the units, and that what we have is a cryptogram of 144 letters, which could be a single square, or a series of 36-letter squares, or even a series of

16-letter or 9-letter squares. We may start at the beginning of this cryptogram and mark it off into equal segments of any length we like, afterward counting the vowels per segment. If every segment shows approximately a 40% vowel count, the chances are that we have a series of intact units, each one merely transposed within itself; but if one segment shows 50%, another 30%, another 28%, and so on, we may be quite sure that our division marks are in the wrong places.

Returning, now, to the Nihilist cipher, suppose we consider the make-up of its major unit, that is, of any one block. This major unit is a series of minor units, and each of these minor units, at the time of encipherment, was written by itself on its own line. In the beginning, it was a small fragment of plaintext, presumably conforming closely to a 40% vowel count. It is true that we placed it on the line in transposed order, but we did not remove any of its letters or add any new letters. Even in the transposal of the lines themselves, we merely removed a number of intact units from one place to another. There has never been a time, throughout the entire encipherment, when we took any letter out of its original minor unit and put it with some other unit. Thus, as we first see our completed Nihilist square, we still have, on each horizontal line, a small fragment of an English sentence in which all of the original vowels are still present. If such a block is now taken off by straight horizontals, it is no more than a series of intact units. To break up these units, we must at least take it out by verticals; and they will, of course, be much more thoroughly mixed when taken out by diagonals or spirals.

The decryptor, hoping for the best, writes his cryptogram into a square (or series of squares) by straight horizontals and counts the vowels per horizontal line. If his block is wide, he may estimate the actual number of vowels represented by 40%; if it is narrow, he may only roughly approximate the number; but in either case what he hopes to see is evenness of distribution. More than half of his units must be exactly normal, and any which are not exactly normal must show the smallest variation possible. If he finds that this is the case, he assumes that his block arrangement is the encipherer’s original square, with only the minor possibility that half of his lines may be written in the wrong direction. If his distribution is not uniform, he counts the vowels per column so as to find out what kind of distribution he would get from a vertical arrangement (ascending or descending). If this, too, fails to show him a uniform vowel distribution, he writes out a new block by the route of alternating verticals (or gets this count from his first block; this is possible, though a little confusing). Afterward, he may go on to the diagonals and spirals until finally he reaches the arrangement in which more than half of his horizontal lines show a 40% vowel count, and the rest a minimum variation.

Now let us consider a concrete example of decryptment. The (purely imaginary) history of the cryptogram shown as Fig. 14 is meager. It was taken from the body of an unnamed man, killed in attempting to dynamite a bridge in an American town called Baysport.

To begin with, the cipher appears to be transposition. Its cryptogram shows 37½% of vowels, very close to the number expected of English or German. It is

too short to provide any reliable distinction between these two languages, but the source of the cryptogram points to English. Again, the encipherer, although he has grouped his message in the usual fives, has neglected to complete his final group with a null, and from this we judge that 64 letters is the actual length of the message. The fact that 64 is a square is promptly noticed. But it is also the sum of several smaller squares, and the unit might be 16. To investigate this possibility, we may mark the cryptogram off into four equal segments of 16 letters each, and count the vowels per segment. The normal number of vowels in a 16-letter segment should be about 6, and segments of this length are long enough to afford reliable information, so that we may promptly discard the possible unit 16 when we find that the first segment shows 5 vowels (31%), the second, 7 vowels (44%), and the remaining two, respectively, 4 and 8. Such a distribution does not prove that the unit 16 is a total impossibility, because many things are not average in single examples, but it is an extremely bad one and would never be accepted. On the other hand, a satisfactory distribution does not prove absolutely that a given unit-length, or block arrangement, is correct. Here, had there been no question of the ever-present square, we might have been led astray by the unit 32, which divides the vowels of the present cryptogram into two equal halves. In this connection, we can only say that the decryptment of any cipher, even the simplest, will at times include a number of wanderings which we shall have to overlook in demonstrating principles.

Assuming, then, that the large unit, 64, is correct, we must get it back into its block — presumably square — in the encipherer’s original arrangement. Fig. 15 shows the same cryptogram written into two different blocks. For an 8-letter unit, the normal number of vowels is about 3 (actually 3.2). In block (a), a count taken on the horizontal lines shows half of the units normal, two of the others with the smallest possible variation, and two greatly outside the 35%-45% limits. When the unit is so short, and when the line containing only one vowel may be the one which was completed with nulls, and most particularly when we have no other units to act as a check, we cannot confidently discard a block of this kind. In practice, we might waste some time giving it a trial, or we might look for something better. Notice that its distribution is “ragged.” We expected to find even distribution, with more than half of the units exactly normal. This block (a) is the simple horizontal arrangement. To find out what the simple vertical arrangement would give us, we have only to examine the columns of this. Here the count is obviously bad.

In block (b), we have one of the diagonal rearrangements from which two sets of vowel counts can also be taken. Here, the horizontal lines have given us exactly what we hoped for: Evenness of distribution, more than half of the units normal, and only one unit outside of limits. This, almost surely, is the encipherer’s original block, in which every line contains one intact unit.

From our meager history of the case, we do not, of course, know that this is specifically the Nihilist cipher. It becomes a case of considering the various ciphers

with which we happen to be acquainted, and a columnar transposition of the general kind shown in Fig. 11 is an exceedingly common case. Moreover, a series of juggled columns is suggested here in the fact that intact units are standing on their own lines and still have not resulted in plaintext.

In Fig. 16, we have the successive steps which would be taken in order to investigate this probability. At (a), the diagonal rearrangement of our cryptogram, selected as the most likely of those which were examined, has been repeated with its eight columns set wide apart, and consecutively numbered for identification. These presumed columns are now cut apart, and thus we have eight paper strips which can be moved about and rearranged in various manners in the hope of causing words to form on some of the lines.

Since we lack that most powerful of decrypting tools, a probable word, we are forced to begin with probable letter-sequence. If the magic letter Q were present, we should look for a companion U, and after that for a vowel to follow QU. But this, too, is lacking.

Familiarity with English digrams (or, in the case of the beginner, an inspection of the digram chart or the list of digrams) shows that TH is by far the most frequent combination used in the language, and that HE and HA, also including an H, are very prominent among the leaders. Further than this, the list of trigrams informs us that both THE and THA are of outstanding frequency. Of the four letters included, three are so frequent, and appear in so many different combinations, as to be confusing; but H, though belonging to the high-frequency group, does not appear in many different combinations, and is less frequent than the other three.

Looking, then, for H, we find it twice in our present cryptogram, once on the second row and once on the seventh; and, since the seventh row shows two T’s and the second only one T, suppose we try the second row, placing together the two columns (strips) which are headed by the numbers 6-5 in order to set up a digram TH on the second row, as shown at (b).

The formation of this digram TH on the second row has automatically set up a digram NG on the top row, a digram RI on the third row, and so on; and we find, upon examining these newly-formed digrams, that the whole series is made up of good English combinations. Thus, it looks as if our combination 6-5 is correct, and we will proceed with a possible HE or HA, attempting to complete a trigram THE or THA on the second row.

Both E and A are present on the second row, and we may observe at the steps marked (c) and (d) in the figure just what would be the result of adding strip 7 or strip 3. At first glance, it appears that combinations 6-5-7 and 6-5-3 are about equally probable. But it so happens that both set-ups have formed a sequence YO on the fifth line, suggesting YOU; and when the only U on that line is tried in both places, it becomes evident that combination 6-5-7-4 is going to give better results than combination 6-5-3-4, where we find poor sequences like KEFH. At this point, or earlier, a decryptor will probably proceed on the left side of his set-up, completing the syllable ING and the series of column-numbers 1-6-5-7-4, as shown. When this setting together of columns automatically brings out on the third row a sequence BRIDG, we have our first suggestion of a probable word, since the man who had this cryptogram on his person had just attempted to blow up a BRIDGE. After this, all is plain sailing; the necessary E happens to be on the same line, and even if it were not, we have only three strips left, and these may be placed by trial. Thus our eight paper strips arrive at the stage indicated on the left-hand side of Fig. 17.

If we have previously met the Nihilist transposition, we can see now what the cipher is, and, if it is a true Nihilist, we can finish the reconstruction by decipherment with the key. To do this, we simply number the rows from 1 to 8 and then disarrange these rows so that their numbers will reproduce the series of column numbers. This is shown on the right-hand side of Fig. 17, where the plaintext is easily read: “By the drawing of lots, it falls to you to take the first move. Viaduct bridge.” The gentleman required three nulls, and thriftily made use of them as punctuation. If we have not previously met the Nihilist encipherment, or if this cryptogram is of a kindred type but governed by two separate keys, one for columns and another for rows, the only difference is that we may have to experiment a little with rows before finding their correct order.

In completing our solution, we have obtained a key, 2 1 6 5 7 4 8 3, shown in the series of column-numbers, and should other cryptograms be intercepted having the same key as the first, we need merely decipher them with our key. It is, however, a “taking out” key, while the Nihilist, as we have seen, is ordinarily written in. Having either of the keys, we may find the other easily enough as suggested in the figure. Simply “number the numbers” and put them back in serial order. The new set of numbers, now disarranged, will show you the other key. It would not be impossible for the student who is a good guesser to find the keyword on which our present writing-in key was based. This kind of work, with paper strips, is much more rapid than it probably seems, and is often done at random. The keen eye needs no digram list for the spotting of HT, merely reversed, with GN above it.

Speaking now of the ordinary columnars (Fig. 11), one minor point should perhaps be brought to the attention of the very new student. Quite often, a digram, such as the QU of Fig. 18, is not written on a single line, and it may be necessary to match this valuable digram in the manner shown at (b) of that figure, coming out in the end as at (c). In such event, we can later on transfer columns 5-6-7 to the other side of the block, raising them all by one position. (Column numbers, in this case, are for reference only.) The same would not apply to a Nihilist block in which the whereabouts of the “next” row is unknown; the digram QU would have to be abandoned in favor of something else.

We mentioned briefly, too, the possibility of finding alternating horizontals, so that only half of the rows can be “anagrammed” together. Such minor problems, and they are numerous, can all be ironed out easily enough once the student is familiar with his type, and columnar transposition, encountered frequently and in all sorts of disguises, is surely the most fascinating of all types. In Chapter VI we are to meet it again, this time with an incomplete rectangle.

The grille shown at (b), however, was based on the key-phrase FRIENDLY GROUPS, and the method can be studied at (c), following Ohaver’s plan, even to its minute details. The fact that the square is based on 6 is told in the initial letter of the key-word, F, 6th letter of the alphabet. This key-word must yield nine letters, one for each proposed aperture in the grille. A short word, such as FRIEND, can be lengthened by a partial repetition, as FRIENDFRI, while a longer word is cut off after its ninth letter, as it was in Fig. 19. This literal key is next converted to a numerical key, as explained in the preceding chapter, and the nine resulting numbers are divided as evenly as possible into four sections. Finally, considering the four quarters of the grille in some definitely agreed rotation, each section of key-numbers will show what numerals are to be clipped from a given quarter. In the figure, the numerals 3 and 8 were clipped from the first quarter, numerals 5 and 2 from the second — proceeding in a clockwise direction, — numerals 7 and 1 from the third quarter, and numerals 6, 9, and 4 from the remaining quarter.

Another method for selecting cells, proposed by Edward Nickerson, dispenses with numerals, using in their places the letters of a key-word which must be without repetitions, as FRIENDLY G happens to be. If these nine letters, all different, be written into the nine cells of each quarter, following exactly the same route in each case, it becomes possible to clip one each of the letters F, R, I, E, N, D, L, Y, G, taken wherever desired. The choice can be made as follows: Taking the four quarters of the grille in the agreed rotation, follow the normal alphabet, clipping A, (when present,) from the first quarter, B, (when present,) from the second quarter, C, (when present,) from the third quarter, and so on. Or, to insure a more even distribution, rearrange the nine letters in alphabetical sequence: D E, F G, I L, N R Y, and divide as in the former plan, clipping D and E from the first quarter, F and G from the second, and so on. While it is possible to provide key-phrases of sixteen letters, without repeating, it is probably more convenient to take whatever number of letters is needed from a key-mixed alphabet of the following type: F R I E N D L Y G O U P S A B C . . . . . . W X Z f r i e . . . . . .

In Fig. 20, at (a), (b), (c), (d), we have a detailed picture of the operation of this grille on the 36-letter plaintext unit: MISFIRE ON VIADUCT JOB X RUSH INSTRUCTIONS. One definite edge of the grille must be designated as the top, and there is a right and a wrong side. Taking precautions in these respects, we place the grille over a sheet of paper and mark its outline with a pencil (or otherwise make sure of maintaining this one location). We write the first nine letters as at (a), and give the grille a quarter-turn to the right. We add the second nine letters as at (b) — where the newly-written letters are the capitals; the others, in lower case, are presumed to be hidden from sight by the solid portion of the grille. Another quarter-turn makes ready for the next nine letters (c), and a remaining quarter-turn completes the revolution (d). The writing-in, at all times, is straight ahead: cells taken from left to right, and lines taken from top to bottom.

In the Jules Verne story, the three units of his cryptogram were left standing in their blocks. Verne’s heroes were clever enough to unearth a ready-made grille, and, by laying this, in its four successive positions, above each of the three blocks, were able to read the message through the apertures. Today, such blocks would be taken off in five-letter groups, and possibly by a devious route. A little concealment can be afforded, too, by completing the last five-letter group with nulls, or, better, by adding these nulls at the beginning of the cryptogram. It is also possible to make the final 36-letter unit incomplete by blanking out its bottom cells before putting in the letters.

A grille can be used in other ways. Negligible changes can be produced in its cryptograms by altering the customary order of its four positions. A more substantial change is introduced by departures from the straight horizontal direction of the writing-in. It is possible to revolve the paper instead of the grille, setting the letters right-side-up at the time of their taking off. And in all of these cases, the grille is still serving as an instrument for writing-in; there would be corresponding cases in which it is used as an instrument for taking out the letters of a prepared block. Each variation, perhaps, would require its own separate analysis before its individual inherent weaknesses could be spotted and used as the basis for a special method. If the student, after observing some special methods applied to ordinary grille encipherment, cares to try his hand at analyzing some one of its variations, we suggest that he take a series of numbers, 1 to 36, 1 to 64, etc., and carry these through a complete encipherment to see what becomes of each one.

Grille transposition, like the Nihilist, involves a major unit composed of minor units. But here, the four minor units are never left intact, and if the type of encipherment is not known in advance, the decryptment of a single block will give somewhat more trouble than the decryptment of a single Nihilist block, for the reason that the decryptor usually exhausts the simpler possibilities before trying the complex. With grille encipherment known, or suspected, we have a cipher bristling with points of attack.

The strictly horizontal writing-in of each minor unit has had to be done within a fairly short compass, and no two consecutive letters of this unit can have been placed very far apart without causing other letters to draw closer together. Their average distance apart is four cells. For the decryptor, this actual distance apart of letters is made shorter by his knowledge that for each letter considered, there are three others which cannot have been written into the same unit with it, and that he knows definitely what these three letters are.

Particularly interesting is the assistance he receives from the symmetrical pattern into which the letters of his four units are written; position 3 is position 1 reversed, and position 4 is position 2 reversed. Thus, having tentatively selected the letters of a probable word, or fairly long sequence, he can check the correctness of his observations by examining another sequence which would automatically build up, traveling in the opposite direction, in the reverse position of the grille.

For a clear understanding of these matters, suppose we consider the decryptment of the block just enciphered, on the assumption that we suspect the presence there of the word VIADUCT. Fig. 21 shows a 6 x 6 block carrying consecutive cell-numbers, which are also the serial numbers of the cryptogram letters, as these appear in a separate block beside the first. It is understood that our first move would be that of ascertaining whether or not the seven letters of this word are all present. It must be remembered, too, that a long word is not necessarily altogether in one unit; the grille might have been turned before the word was completed.

In the present case, however, our first letter, V, is found near the top of the square, and only once, so that if the word VIADUCT is present, a substantial portion of it must have been written before the grille was turned. We expect to find letters I, A, D, U, and so on, following the letter V in just that order, and without any very great distance between any two of them; and if, approaching the bottom of the square, we find it necessary to proceed backward for U, C, or T, then the grille was surely turned before that U, C, or T, was written.

Now, considering together the two blocks of Fig. 21, we find that our first letter, V, occupies cell No. 7. In imagination, we revolve a grille in which the only aperture has been cut in cell 7, and find that this aperture exposes the cells numbered 5, 30, and 32. These three cells, then, were surely covered from sight when the letter V was written into cell 7, and regardless of what the letters are that occupy these three cells, it is definitely impossible that any one of the three could have been used in the same minor unit with the V of cell 7.

Looking for a letter I, we find several within a very short range. But the block contains only one A, and since we cannot proceed backward after selecting the I, the position of A (cell 10) tells us that only the I of cell 9 is possible. We accept, then, the I of cell 9, and, again revolving an imaginary grille with its only aperture cut in cell 9, we eliminate the letters found in cells 17, 28, and 20. Similarly, accepting A of cell 10, we eliminate whatever letters are occupying cells 23, 27, and 14. So far, none of the letters eliminated have been wanted for the development of the word VIADUCT; but notice that the fourth letter, D, found only once in the block, occupies cell 15, thus eliminating the letters of cells 16, 22, and 21, one of which is U, the next letter needed. Thus, we are not forced to make a decision as between the U of cell 16 and the U of cell 18.

We have put together, then, the letters V I A D U in the only manner which is possible at all, and their cell-numbers, taken in order, are 7-9-10-15-18. If the grille is reversed, these same openings, named in the same order, will uncover cells 30-28-27-22-19; these new cells, however, will not be seen in reverse order; they will be in straight order like their letters. If, then, our sequence V I A D U is correct, the five letters found in cells 19-22-27-28-30, taken in normal order, should form an acceptable English combination. A glance at the right-hand block of Fig. 21 will show that this check-sequence is T I O N S.

When we selected V, we automatically selected S of cell 30 as its check-letter. When we added I on the right-hand side of V, we obtained with it the N of cell 28 on the left side of S, giving the check-digram as NS, entirely acceptable. With A, we added the O of cell 27, giving the check-trigram as ONS, still acceptable; and so on to IONS, TIONS. Our complete word VIADUCT produces the check-sequence UCTIONS. It must not be objected that the fact of having only one each of letters V, A, D, has too greatly facilitated the search. This is an entirely legitimate expectation in a case where we deal with one unit, and the decryptor, when possible, chooses his probable word with this in mind. In the absence of a probable word, we are never without probable sequences: the list of frequent trigrams, and the various common affIxes, such as -TION, -MENT, -ENCE, -ABLE, CON-, PRE-, etc. For the first three or four letters, where decisions are sometimes uncertain, it is more satisfactory to work directly on the square (prepared in ink), so that impossible cells may be canceled in pencil, and the pencil marks erased when wrong; but once well started, a paper or celluloid grille can be prepared to fit the block, and the chosen cells actually cut out as they are selected. Having found seven out of nine apertures, we may, if we like, turn the paper grille and experiment with its other two positions. The letters, in this case, will show gaps in sequence, and may indicate by these gaps just where the new openings ought to be cut. With one full unit determined, we have the grille for reading the others. The only remaining problem would be that of deciding the exact sequence of these four units, with their context as a guide.

For the case in which it is necessary to begin with letter-sequences, particularly if driven back to the digram list, the device shown in Fig. 22 may prove of considerable assistance: The cryptogram is written in both directions, and thus pairs every letter with its check-letter, so that check-sequences here would be written backward. This idea is adapted from General Givierge’s Cours de cryptographie.

Working with digrams is tedious, but will, in the end, give results. Considering, for instance, Fig. 22, its first letter is B. Of letters standing immediately to the right of B, the first one which would form a good digram with it is the R of cell 4. But consideration of a possible digram BR, cells 1-4, shows the check-digram as JN, cells 33-36, and this latter digram is so rare in the language that Meaker did not find it even once in his 10,000-letter text. The next letter known to have an affnity for B is the U of cell 6, but a possible digram BU, cells 1-6, cannot be considered, for the reason that cells 1 and 6 are uncovered by the same opening in the grille. The distance away of the next letters to which B is partial proves frightening, and B is abandoned (it is actually followed by the X of cell 5).

Beginning over, with T of cell 2: The first frequent digram noticed is TR, cells 2-4, and shows the check-digram as JO, cells 33-35. We accept this at once,

because the letter J must presumably be followed by a vowel, and the only vowel immediately available is this particular O. To extend the accepted TR, we require a vowel. The first one is U, cell 6, and extends the check-digram to TJO, cells 31-33-35, acceptable if T is the final letter of a word. To extend the supposed trigram TRU, we experiment with C of cell 8 and obtain a check-sequence CTJO, cells 29-31-33-35, which is still encouraging. We must know, of course, that no two of the chosen cells are in conflict with each other. The unit we have partially reconstructed is the second one of Fig. 20, and the check-sequence is the fourth unit.

A method somewhat resembling the foregoing consists in writing another block beside the first, in which the letters of the cryptogram are strictly in reversed order. The pattern of the check-sequence will then follow exactly that of the sequence under examination, merely with its letters in reverse order. Still a further suggestion was made by Herbert Raines: In the preparation of the two blocks, one in straight order and the other in reverse order, the writing should be done vertically, with all columns containing four letters. The symmetry can still be found, and any two consecutive plaintext letters are more nearly at their original distance apart — the average 4.

So far, we have been dealing with an isolated unit. In Fig. 23 we have a longer cryptogram, suspected of being a reply to the first. We have set it up in its three blocks, expecting to decipher it with the same grille, but find that something is wrong. To see quickly how the presence of several units modifies the case, suppose we consider some sequence, right or wrong, which is easily examined, such as the AVE on the second row of the first block. Regardless of what the transposition is, if all three of these units are enciphered alike, each of the additional blocks contains a corresponding trigram in exactly the same location as the one under consideration; here we have NES in the second block and ANK in the third. But if the transposition is specifically that of the grille, each one of the three trigrams AVE, NES, ANK, has a check-trigram in its own block. Thus we have the six trigrams listed with their cell-numbers in Fig. 24. Since all of these are acceptable, we should, in practice, be encouraged to accept them; thus, it may be well to say here that, in dealing with all ciphers these false beginnings will quite frequently pitch the decryptor headlong into a solution, through no act of wisdom on his own part.

Now, in order to arm ourselves against the larger grilles, which are somewhat more troublesome, and for investigation of cryptograms which may or may not have been accomplished with a grille, suppose we take a look at Ohaver’s mechanical method — that is, his use of paper strips. Picturing any block of 36 cells, numbered consecutively as we saw these in Fig. 21, let us imagine that there is a grille placed over this block, and that this grille has only one opening. If the cell that shows is No. 1, then, at the first turn of the grille, we uncover cell No. 6; at the next turn, cell No. 36; and, at the final turn, cell No. 31. We will call this series of cell-numbers an index, and say that the index for this particular aperture is 1-6-36-31. In the first block of the new cryptogram, the letters which follow this index are R O P T. In the second block, the same index governs the letters U B V L, and, in the third block, A E X H. But if the single opening in our hypothetical grille has exposed cell No. 2, then its index, discovered in the same way, is 2-12-35-25, and the corresponding letters, in the three blocks of this cryptogram are, respectively, R U E A, E I T X, and G S E R. Similarly, each one of the other seven apertures possible in this quarter of the grille has an index, expressible in cell-numbers, and governs a certain series of letters in each cryptogram block. If the grille is the Fleissner, the index for any aperture, in a grille of any size, will always contain four numbers, and will govern four letters per block.

If the grille is a 16-letter one, there will be only four of these indices, beginning in cells 1, 2, 5, 6. If it is a 36-letter grille, there will be nine, beginning in cells 1, 2, 3, 7, 8, 9, 13, 14, 15. A 64-letter grille will have 16, beginning in cells 1, 2, 3, 4, 9, 10, 11, 12, 17, 18, 19, 20, 25, 26, 27, 28; and so on to grilles of 100, 144, etc., letters. After one grows accustomed to the swastika-like route of the open cell, such indices are not at all difficult to prepare at the moment of need; however, many solvers prefer to make them up in sets, once for all, and have them ready as they happen to be wanted. As to the finding of the four letters per block which follow any one index, it is sufficient to remember that the cell numbers, arranged in the manner shown, are also the serial numbers of the letters belonging to any one unit. Thus it is not necessary to write the units into their squares; we need merely number the letters of a unit from 1 to 36, and select those having the desired serial numbers.

Returning, now, to our cryptogram: Our unit appears to be 36, since a division of this kind distributes the vowels uniformly; and a unit of 36 may have been produced with a grille. If so, this grille had 9 apertures, and we need 9 paper strips, one for each aperture. On each strip we are to have: the four index numbers, the four corresponding letters from the first block, the four corresponding letters from the second block, and the four corresponding letters from the third block. But since, in each case, the first three cell-numbers or the first three letters must be repeated, our strip will actually contain seven numbers and twenty-one

letters. These nine strips are prepared all in one set-up, the details of which can be examined in Fig. 25. In Fig. 26, the strips of Fig. 25 have been cut apart and rearranged in such a way as to bring out plaintext on the top row of every block; this is, of course, the first full row, as pointed out in each case by the four asterisks. It will be noticed that the top row of cell-numbers is arranged in strictly ascending order (our strictly horizontal route of writing-in). If the third row be now examined (as pointed out by two asterisks), it is found that this, too, carries plaintext, merely written backward, and that here the cell-numbers are arranged in strictly descending order.

Now, to read the cryptogram: Each full row of numbers includes all cell-numbers belonging to some one of the four units, and any one of these four rows of numbers is a key to the grille, since it shows exactly what cells were uncovered when the corresponding unit was written in. To obtain the grille, we have only to select some one row of numbers, as 12-36-10-16-34-9-26-32-13, and clip out these particular cells in a square numbered as we saw it in Fig. 21. The student who cares to know what “instructions” were being sent might also satisfy his curiosity as to whether or not this new cryptogram could have been deciphered rather than decrypted.

Concerning the grille cryptograms which follow, it seems not impossible that the student who has seen his principles applied only to a unit of 36 might find some difficulty in adjusting them to grilles of other sizes. A tip, then, on Example 22: Instead of the regulation nulls, its single unit was completed with a common Spanish phrase beginning with Q. And if it still resists: the author’s own name was used as the key for constructing the grille.

In adjusting his paper strips (when this is the method he prefers) it makes no particular difference what plan he follows, so long as it works. Some decryptors prefer to concentrate altogether on the strictly ascending series of cell-numbers, allowing letters to form their own sequences. Others will always have before them the set-up of squares, noting there some possible letter-sequence, finding (by means of their cell-numbers) the strips which contain these letters, and then observing results in other blocks. If the given strip cannot be found, then the cell must be already in use.

The shortest road is that of the probable word. For instance, the set-up shown as Fig. 26 was actually initiated by the solver at the letter J of the second block, this being a rare letter and almost invariably followed by a vowel. Of the several vowels immediately in sight (in the square) the correct one was promptly suggested by the sequence so plainly in sight, OB, suggesting the word JOB, one already used by these people in discussing their mysterious activities. The corresponding cell-numbers, 20-29-30, were found to be on three separate strips — a necessary condition — and when placed together brought out the straight sequences RID and OLE, with reversed sequences AVE, NEU, and AND. Another very probable word was suggested by the check-sequence AVE (HAVE), and the necessary H was found with cell-number 33, bringing solution to the point suggested roughly in Fig. 27, where attention was promptly focussed on the tetragram RIDG, suggesting BRIDGE, another word previously used. There were two strips carrying the desired E, but both refused to fit; and here the cell-numbers came into play. The last one found, 33, was large and suggested that its letter, G, might be the last letter of a unit; afterward, the building was continued on the left, with B.