The Project Gutenberg eBook of Elementary cryptanalysis This ebook is for the use of anyone anywhere in the United States and most other parts of the world at no cost and with almost no restrictions whatsoever. You may copy it, give it away or re-use it under the terms of the Project Gutenberg License included with this ebook or online at www.gutenberg.org. If you are not located in the United States, you will have to check the laws of the country where you are located before using this eBook. Title: Elementary cryptanalysis Author: Helen Gaines Contributor: George Lamb Release date: January 9, 2025 [eBook #75074] Language: English Original publication: Boston: American Photographic Publishing Co, 1939 *** START OF THE PROJECT GUTENBERG EBOOK ELEMENTARY CRYPTANALYSIS *** ELEMENTARY CRYPTANALYSIS Helen Fouché Gaines Originally published in 1939 by American Photographic Publishing Co. PREFACE The word _cryptography_, properly speaking, embraces the entire field of secret writing, while that branch of the subject dealing with the solution and reading of cryptic messages is generally referred to as _cryptanalysis_. Works on the subject of secret writing are comparatively numerous, if not always easily available, but works devoted purely to the analysis of such writing and the solving of its cryptograms have, until recently, been so rare as to be almost non-existent for the general reader. Today we have two particularly excellent works, but both in foreign languages: _Cours de cryptographie_, by General Marcel Givierge, and _Manuale di crittografia_, by General Luigi Sacco. In English, we find a more elementary work, _The Solution of Codes and Ciphers_, by Louis C. S. Mansfield (Maclehose, London), which, the writer has been told, is to be a first volume. As to America’s contribution, we seem to find only small books such as Colonel Parker Hitt’s _A B C of Secret Writing_, covering three ciphers, or Colonel H. O. Yardley’s _Yardleygrams_. There are, however, many works which deal most interestingly with the analysis and decryptment of some one particular cipher. Most of these are short works, published in magazines or incorporated into books of a general nature, and nearly always the one cipher dealt with is that type of simple substitution which appears with separated words in the puzzle section of our current magazines and newspapers. One well-known gem of cryptanalysis, equal to any modern specimen, can be found in the story, _The Gold-Bug_, by Edgar Allan Poe. This, too, deals with the simple substitution cipher just referred to, but covers a case in which word-divisions are absent. Poe has also left us an essay called _Cryptography_. Rosario Candela’s recent book, _The Military Cipher of Commandant Bazeries_, shows the unraveling of one particular cryptogram which, for many years, had baffled the best efforts of all amateurs, and, it is rather suspected, of some few who were not amateurs. The book contains a chapter on general cryptanalysis, and also some cryptograms for solution. _Secret and Urgent_, by Fletcher Pratt, is primarily a history of secret writing (a most interesting one, by the way), but contains also a number of examples of cryptanalysis; it also shows a table which the writer has never before seen in published form: a list of English trigrams (three-letter sequences) and the frequency with which they are used in the language. Other examples of decryptment may be found in the Macbeth translation of Langie’s genial little book, _De la cryptographie_; the appendix to this translation contains the coveted Playfair demonstration, prepared by Lieutenant Commander W. W. Smith of the United States Navy. Just why so absorbing a subject has been so neglected in a world full of puzzle lovers is hard to understand, especially since the analytic writer, in addition to entertainment, has something to offer of a more serious nature. It is true that trained cryptanalysts are not greatly in demand in peacetime, and that our present corps of cryptographers has a personnel more than ample for providing necessary codes and ciphers, scientifically selected to fit their individual purposes, and safeguarded with suitable protective devices. Yet of what value is the most excellent of ciphers if, at the time of direst need, this cipher, with all of its safeguards, must be placed in the hands of even one man who cannot appreciate its intrinsic value or imagine a need for extra precautions? At any rate, we make our feeble attempt to reach this “one man.” May he learn, at least, that there are reasons for his instructions! In the planning of the present treatise, all purely historical aspects of secret writing were neglected, and many well-known ciphers whose interest is chiefly historical or literary have either been omitted or given but cursory treatment. Certain other ciphers, representative of types, have been treated at whatever length seemed advisable for bringing out principles; and, with each type discussed, a generous number of cryptograms has been provided, on which the student will be able to test his skill as he learns. The student who masters these fundamentals will be acquainted with the principal forms of cipher, and will be able to solve cryptograms prepared by means of these ciphers provided the cryptograms are of adequate length and based on a language which he understands, or of which he is able to secure understandable specimens. Within limits, he should also be able to analyze and solve such cryptograms without being told in advance what the cipher is. This, we believe, is the kind of text-book desired by the many who desire information about “ciphers.” Its material, compiled by members of the American Cryptogram Association, has had to be gathered from a great many sources, both within the organization and elsewhere, making it impossible, at times, to give credit where credit is due. Our chief indebtedness, however, is to M. E. Ohaver for a series of articles published during the years 1924 to 1928 in the former Flynn’s Magazine and most unfortunately no longer obtainable from the publishers. Further acknowledgment should be made to Colonel Parker Hitt, whose _Manual for the Solution of Military Ciphers_, though not available for general distribution, can usually be consulted in large public libraries. We have also borrowed liberally from foreign sources, and members of the association have most generously contributed the results of their original research. For this collaboration and co-operation, the writer is particularly grateful. CONTENTS Preface I. General Information II. Concealment Devices III. Transposition Types IV. Geometrical Types — The Nihilist Transposition V. Geometrical Types — The Turning Grille VI. Irregular Types — Columnar Transposition VII. General Methods — Multiple Anagramming, Etc. VIII. Substitution Types IX. Simple Substitution — Fundamentals X. The Consonant-Line Short Cut A Method for Attacking Difficult Cases (by George C. Lamb) XI. Simple Substitution with Complexities XII. Multiple-Alphabet Ciphers — The Vigenère XIII. The Gronsfeld, Porta, and Beaufort Ciphers XIV. The Kasiski Method for Periodic Ciphers XV. Miscellaneous Phases of Vigenère Decryptment XVI. Auto-Encipherment XVII. Some Periodic Number-Ciphers XVIII. Periodic Ciphers with Mixed Alphabets XIX. Polyalphabetical Encipherment Applied by Groups XX. Vigenère with Key-Progression XXI. Polygram Substitution — The Playfair Cipher XXII. Highlights of Fractional Substitution XXIII. Investigating the Unknown Cipher Appendix English Frequency and Sequence Data Comparative Table of Single-Letter Frequencies Chart Showing Normal Contact Percentages (by F. R. Carter) Chart Showing Frequencies of English Digrams (by O. Phelps Meaker) Some Foreign Language Data Bibliography (by W. D. Witt) The Commonest English Words (by Frank R. Fraprie) English Trigrams (by Frank R. Fraprie) English Digrams (by Frank R. Fraprie) Index CHAPTER I General Information The subject which we are about to study is the analysis and solution of _cipher_, though not including _code_, which is a very special form of cipher demanding something more than elementary knowledge; nor shall we enter at all into the subject of _invisible inks_, certainly a most important aspect of secret writing, but belonging to the province of chemistry rather than to that of cryptanalysis. _Cipher machines_, also, are not within our present scope. The term _cipher_ implies a _method_, or _system_, of secret writing which, generally speaking, is unlimited in scope; it should be possible, using any one given cipher, to transform any _plaintext_ whatever, regardless of its length and the language in which it is written, into a _cryptogram_, or single enciphered message. The process of accomplishing this transformation is called _encipherment_; the opposite process, that of transforming the cryptogram into a plaintext, is called _decipherment_. The word _decrypt_, with its various derivatives, is being used here to signify the process of _solving_ and reading cryptograms without any previous knowledge as to their _keys_, or secret formulas; thus the word _decipher_ has been left to convey only its one meaning, as mentioned above: the mechanical process of applying a known key. Our word _decrypt_, however, is an innovation borrowed from the modern French and Italian writers, and is somewhat frowned upon by leading cryptologists. The word _digram_ is being used to indicate a two-letter sequence; similarly, we have _trigrams_, _tetragrams_, _pentagrams_, etc., to indicate sequences of three, four, five, etc. letters. * * * Ciphers, in general, fall into three major classifications: 1. Concealment Cipher 2. Transposition Cipher 3. Substitution Cipher Minor types, such as “abbreviation,” are sometimes included, though, to the writer, these have never seemed to be truly of a cryptographic nature. In _concealment cipher_, the true letters of the secret message are hidden, or disguised, by any device whatever; and this type of cipher, as a general rule, is intended to pass without being suspected as the conveyor of a secret communication. In _transposition cipher_, the true letters of the secret message are taken out of their text-order, and are rearranged according to any pattern, or _key_, agreed upon by the correspondents. In _substitution cipher_, these original text-letters are replaced with substitutes, or cipher-symbols, and these symbols are arranged in the same order as their originals. There may, of course, be combinations of types, or combinations of several forms belonging to a single type. * * * The aristocrat of the cipher family is _code_. This is a form of the substitution cipher which requires the preparation, in advance, of a _code book_. A series of terms likely to be used in future correspondence (that is, words, phrases, and even sentences) is first gathered into a vocabulary, or “dictionary”; and beside each of these terms is placed a substitute known as a _code group_, or _code word_. These substitutes may be groups of letters, or groups of digits, or actual words selected from ordinary language. Very common words or expressions are usually provided with more than one substitute; and nearly always there are substitutes provided for syllables and single letters, so as to take care of all words not originally included in the vocabulary. No code presents any real security unless the code symbols have been assigned in a thoroughly haphazard manner. This means that any really good code would have to be printed in two separate sections. In one of these, the vocabulary terms would be arranged in alphabetical order, so that they could be readily found when enciphering (_encoding_) messages; but the code groups would be in mixed order and hard to find. In the other section, the code groups would be rearranged in straight alphabetical (or numerical) order, so as to be readily found when deciphering (_decoding_), and the vocabulary terms would be in mixed order. Just what is meant can be seen in Fig. 1, showing fragments from an imaginary code book. Figure 1 ENCIPHERMENT SECTION DECIPHERMENT SECTION Vocabulary Term Code Symbol Code Symbol Vocabulary Term A 9001, 2114, 3000* 1120 Assenting to your Aachen 8463 1121 Horse About 1119, 0034* 1122 Meet me About time for 5434 1123* Come; Paris Armored car 1125 1124 Th- Assenting to your 1120 1125 Armored car *) When a plaintext term has more than one symbol, these are called homophones. Polyphones are symbols which may have more than one meaning. The terms _encoding_, _decoding_ are usually preferred to _enciphering_, _deciphering_. A code of this kind, with symbols assigned _absolutely at random_, provided it is carefully used (never without re-encipherment) and a close guard kept over the code books, represents perhaps the maximum of security to be attained in cryptographic correspondence; and security, of course, is of prime importance in the selection of a cipher for any practical purpose. But in considering the relative merits of the various ciphers, it is always necessary to take into account many factors other than security, each cipher being evaluated in connection with the purpose for which it is wanted: Under what conditions must the encipherment and decipherment take place? How must the cryptograms be transmitted? How much of the enciphered correspondence is likely to be intercepted? What _degree_ of security, after all, is absolutely imperative? A commercial, or other, firm, having a permanent base of operations, and in little danger of being blown to bits by an enemy shell, would not consider the first of these questions from the same angle as the War Department, and the War Department, though considering all of them from several different angles of its own, would still not consider them from the same viewpoint as the State Department. If messages are to be sent by mail, or by hand, or by telephone, or pasted on a billboard, it is conceivable that a cipher which doubles or trebles their length could still be a practical cipher. For transmission by telephone, the presumption is that the cryptogram must be pronounceable, or, certainly, audible. For written communication, individual purposes have been served by means of pictures. But when the cryptograms are to be sent by wire or radio, it must be possible to convert them into Morse symbols, either letters or figures, but not intermingled letters and figures. Here, length must be considered, involving questions of time, expense, and the current telegraphic regulations. Moreover, it is conceded that a meaningless text will not be transmitted with absolute accuracy, and a cryptogram which is to be sent by this means must not be of such a nature that ordinary errors of transmission will render it unintelligible at the receiving office. A factor of particularly grave importance in the selection of a cipher to fit a given purpose is the probable amount of enciphered material which is going to fall into the possession of unauthorized persons. A criminal, who has had to send but one brief cryptogram in a lifetime, might reasonably expect that it will remain forever unread, no matter how weak the cipher. A commercial firm, transmitting thousands of words over the air, is more vulnerable; and the diplomatic office, or the newspaper office, which makes the mistake of publishing almost verbatim the translations of cryptograms which have been transmitted by radio, and thus has surely furnished the cipher expert with a _cryptogram and its translation_, might just as well have presented him with a copy of its code book. As to just what constitutes the “perfect” cipher, perhaps it might be said that this description fits any cipher whatever which provides the degree of security wanted for an individual purpose, and which is suited in other respects to that individual purpose. Even a basically weak cipher, in the hands of an expert, can be made to serve its purpose; and the strongest can be made useless when improperly used. In the present text, we are likely to be found looking at ciphers largely from a military angle, which, apparently, has a more general interest than any other. In time of war, the cryptographic service, that is, the encipherment and transmitting service, is suddenly expanded to include a large number of new men, many of whom know nothing whatever of _cryptanalysis_, or the science of decryptment. Many of these are criminally careless through ignorance, so that, entirely aside from numerous other factors (including espionage), it is conceded by the various War Departments that no matter what system or apparatus is selected for cipher purposes, the enemy, soon after the beginning of operations, will be in full possession of details concerning this system, and will have secured a duplicate of any apparatus or machine. For that reason, the secrecy of messages must depend upon a changeable key added to a sound basic cipher. Speed in encipherment and decipherment is desirable, and often urgent; and the conditions under which these operations must often take place are conducive to a maximum of error. The ideal cipher, under these conditions, would be one which is simple in operation, preferably requiring no written memoranda or apparatus which cannot be quickly destroyed and reconstructed from memory, and having a key which is readily changed, easily communicated, and easily remembered. Yet the present tendency, in all armies, seems to be toward the use of small changeable _codes_, which are written (printed) documents; and, for certain purposes, small mechanical devices. An enormous number of military cryptograms will be transmitted by radio and taken down by enemy listeners, and even the ordinary wire will be tapped. It is expected that the enemy will intercept dozens, and even hundreds, of cryptograms in a single day, some of which will inevitably be enciphered with the same key. With so much material, knowing the general subject matter, and often exactly what words to expect, or the personal expressions invariably used by individuals, it is conceded that he will read the messages. All that is desired of a cryptogram is that it will resist his efforts for a sufficient length of time to render its contents valueless when he finally discovers them. By that time, of course, the key will have been changed, probably several times, and even the cipher. With these general facts understood, we may first dispose hastily of the concealment cipher, after which we will examine at greater length the two legitimate types, the transpositions and the substitutions. CHAPTER II Concealment Devices Concealment writing may take a host of forms. Perhaps its oldest known application is found in the ancient device of writing a secret message on the shaved head of a slave and dispatching the slave with his communication after his growing hair had covered the writing. Or, if this appears a little incredible, the ancients have left us records of another device considerably more practical: that of writing the secret message on a wooden tablet, covering this with a wax coating, and writing a second message on top of the first. In the middle ages we meet a development called _puncture cipher_; any piece of printed matter, such as a public proclamation, serves as the vehicle, and the cipher consists simply in punching holes with a pin under certain letters, so that these letters, read in regular order, will convey the desired information. It is said that this kind of concealment writing was resorted to in England at a comparatively recent period, to avoid the payment of postage. Postage on letters was very high, while newspapers were permitted to travel free, and the correspondents sent their messages very handily by punching holes under the letters printed in newspapers. Where the sender of a message may also control the preparation of the printed vehicle, any desired letters can be pointed out by the use of special type forms, misspelled words, accidental gaps, and so on. But concealment cipher is not necessarily confined to written and printed matter. Ohaver, in his “Solving Cipher Secrets,” demonstrated the conveyance of messages in the shapes and sizes of stones in a garden wall, or in the arrangement of colored candies in a box; and we read, in fiction, of many similar devices, such as a series of knots tied in a string, or beads strung in imitation of the rosary. Again, we hear of cases in which the arrangement of stamps on envelopes is made to represent the terms of a miniature code. All such devices are, of course, combination-cipher rather than pure concealment, since the stones, candies, and so on, must first be made the substitutes for letters or code terms. A method of pure concealment, said to have been used by Cardinal Richelieu, involved the use of a _grille_. Grilles are made of cardboard, sheet-metal, or other flat material, and are perforated with any desired number, size, and arrangement of openings. The Richelieu grille, of approximately the same size and shape as the paper used for correspondence, could be laid over a sheet of paper so as to reveal only certain portions, and the secret message was written on these. The grille was then removed and the rest of the sheet was filled in with extraneous matter in such a way as to present a seemingly continuous text. The legitimate recipient of this message, having a duplicate grille, simply laid this grille over the sheet of paper, and read his message through the apertures. Concealment cipher goes by various names, as _null cipher_, _open-letter cipher_, _conventional writing_, _dissimulated writing_, and so on, not always with a difference in meaning, though “conventional writing” does convey somewhat the idea of a tiny code. (In this, casual words have special meanings.) The name “null cipher” derives from the fact that in any given cryptogram the greater portion of the letters are null, a certain few being significant, and perhaps a few others being significant only in that they act as indicators for finding truly significant letters. To illustrate what is usually meant: Say that your very good friend, Smith, first complains about a radio which he has bought from your neighbor, Johnson, then asks you to take Johnson the following note: “Having trouble about loudspeaker. Believe antenna connected improperly, but do whatever you can.” By reading the final letter of each word, you will find out what Smith actually had to say to Johnson: GET READY TO RUN. That is the null cipher reduced to its elements, though naturally it can be more skillfully applied. Significant letters may be concealed in an infinite variety of ways. The key, as here, may be their positions in words, or in the text as a whole. It may be their distance from one another, expressed in letters or in inches, or their distance to the left or right of certain other letters (indicators) or of punctuation marks (indicators); and this distance, or position, need not be constant, or regular. Sometimes it is governed by an irregular series of numbers. Similar devices are applied to whole words. We agree, say, that in whatever communications we send to our accomplice, only the third word of each sentence is to be significant. Desiring to send him the order, STRIKE NOW, we write him as follows: “The building _strike_ is worrying our friends quite a lot. It has _now_ extended to this part of the city.” A purely concealment cipher may be enveloped in apparent ciphers of other types. The true message is concealed, as usual, in a dummy message, and the whole is enciphered in one of the legitimate systems. It is then hoped that the decryptor, satisfied with having solved the dummy, will look no further. Even more effective would be the device of concealing the message in what appears to be a cryptogram, but is not. It is easy to string letters together in such a way as to make them resemble most convincingly a transposition cryptogram, and in this case it would be hoped that the investigator’s full attention would be given to the hopeless task of decrypting the dummy. Concerning the decryptment of concealment cipher, we regret to say that cryptanalysis has little help to offer. Fortunately, most of these ciphers depend absolutely on the belief that they will not be recognized as cipher, and once they are so recognized, they present no resistance. In those few cases where the secret message is not at once obvious, it is sometimes useful to arrange the words (or sentences) in columns, or in rows, for a closer inspection. Figure 2 I N S P E C T D E T A I L S F O R T R I G L E T H A C K N O W L E D G E T H E B O N D S F R O M F E W E L L We have, for instance, an apparent memorandum in which the awkwardness of the wording, or some other factor, has drawn our attention to the possibility of cipher: “Inspect details for Trigleth — acknowledge the bonds from Fewell.” We arrange these words in column form, aligned by their initials, as in Fig. 2, and the third column promptly gives up the secret message STRIKE NOW. The words of sentences can, of course, be treated in the same way, and where the alignment from the left gives no results, letters or words can be aligned from the right, or from the center. If columns give no results, diagonals can be inspected, or a zig-zagging line between one column and another. Experience counts for most, and extensive reading is a vast help. Having seen methods in use, or read the descriptions of methods, we know of some definite thing to look for. Then, too, some of the concealment ciphers have transposition characteristics. This would be the case with the Legrand cipher, which is of the type called “open letter.” This cipher used a numerical key, which, in turn, was based on a keyword in what seems today a rather odd manner: A keyword CAT, made up of the 3d, 1st, and 20th letters of the alphabet, gives the key 3 1 2 0. Before concealment takes place, a series of word-positions is marked off, and these vacant places are numbered (0 to 9, or 9 to 0), continuing to repeat the ten digits until there are enough of the digits 3, 1, 2, and 0 to accommodate the words of the secret message. This message is then written, word by word, below its digits, beginning with the first digit 3, then going on to find a digit 1, then a digit 2, then a digit 0, then another digit 3, and so on. After the secret message is written into its place, all of the blank positions are filled with connective matter, as in the case of Cardinal Richelieu’s grille-writing. Our later study of transpositions will show approximately how we should go about reading this, once we suspect its use. So far, we have been considering pure concealment. Many of the classic ciphers, fundamentally of the concealment type, are also substitution ciphers, and their decryptment would follow substitution methods. Of these, perhaps the best known is Bacon’s biliteral cipher, summed up in Fig. 3. Figure 3 BACON'S BI-LITERAL ALPHABET A aaaaa IJ abaaa R baaaa B aaaab K abaab S baaab C aaaba L ababa T baaba D aaabb M ababb UV baabb E aabaa N abbaa W babaa F aabab O abbab X babab G aabba P abbba Y babba H aabbb Q abbbb Z babbb S T R I K E baaab baaba baaaa abaaa abaab aabaa N O W abbaa abbab babaa Hold OFf uNtIl you hEar frOm mE agAin. wE May cOMpROmIse. Lord Bacon’s cipher presupposes that the encipherer may so control the preparation of his published work that he may prescribe the type to be used for each printed letter, and it is claimed that he actually used his cipher for the preservation of historical secrets, including that of his own parentage. Two fonts of type are required, the letters of one font differing (very slightly) from those of the other font. These we may speak of as the _A_-font and the _B_-font, and each letter of the alphabet is given a substitute composed of _A_’s and _B_’s, as shown in full in the figure. Before a message, as STRIKE NOW, can be concealed, it must be expressed in _A_’s and _B_’s, five of these for each of its letters, as shown, so that a message of 9 letters attains a length of 45. For its concealment, we may use any text whatever whose length is 45 letters, for instance, one whose obvious meaning is the contrary of the secret one: “Hold off until you hear from me again. We may compromise.” The first five letters, _HOLDO_, are to represent _S_, the next five, _FFUNT_, are to represent _T_, and so on; and the sole purpose of the _A_’s and _B_’s is to point out the kind of type which must be used in printing the corresponding letters. In the encipherment of the figure, letters taken from the _A_-font are indicated by lower-case and those of the _B_-font by capitals, though it is understood that no such emphatic difference is contemplated in the cipher. While the average modern person would have no opportunity for employing Lord Bacon’s cipher as described, he has access to an unlimited number of vehicles other than type-difference. Anything, in fact, may serve the purpose, so long as the material is available in two distinguishable forms and in sufficient quantity. Our message of 29 _A_’s and 16 _B_’s could be expressed with a deck of playing cards if aces and face-cards are considered to represent _B_’s. It could assume the form of a fence with 45 palings, in which the _B_-palings are crooked, damaged, or missing. Ohaver once made use of a cartridge belt in which the _A_-loops contained cartridges and the _B_-loops were empty. There is an excellent opportunity here, too, for the compiling of “fake” cryptograms, with _A_-letters and _B_-letters distinguished as vowels and consonants, or by the part of the normal alphabet from which they have been taken. With a biliteral or binumeral alphabet which requires 26 groups, we cannot have fewer than five characters to the group without making groups of different lengths. But another well-known cipher alphabet, devised by the Abbé Trithème for use in much the same way, is triformed, and thus permits that the group-length be reduced to three. The Trithème (Trithemius; Trittemius) alphabet, expressed in digits 1-2-3, was approximately that shown in Fig. 4. Figure 4 A TRI-NUMERAL ALPHABET A 111 J 211 S 311 B 112 K 212 T 312 C 113 L 213 U 313 D 121 M 221 V 321 E 122 N 222 W 322 F 123 O 223 X 323 G 131 P 231 Y 331 H 132 Q 232 Z 332 I 133 R 233 & 333 This alphabet has had many applications, including the use of colored candy previously mentioned. One contributor to Ohaver’s column submitted a cryptogram of the open-letter type in which the digits 1, 2, 3, were indicated in the _number of syllables_ of the successive words. A sentence, “Can you be sure of sufficient assistance from Mayberry?” indicates the digits 1 1 1, 1 1 3, 3 1 3; and, if the alphabet of Fig. 4 is the one in use, represents the letters _A C U_. This is of particular interest in that it is easily done without involving the awkward turns of language that so often betray the concealment cipher. (This same contributor, a Mr. Levine, evolved another cipher, accomplished by an arithmetical process, by which it was possible to make a cryptogram convey two separate messages!) Many writers have shown alphabets of the biform and triform types applied to open-letter communications by making the significant factor the _number of vowels_ contained in successive words. Thus, the sentence given above yields a series 1, 3, 1, 2, 1, 4, 4, 1, 4. Using a biform alphabet, these are usually considered simply as odd and even; with a triform alphabet, some disposition must be made of numbers larger than 3. The subject is fascinating, and the literature of cryptography is rich with examples. However, we need not delve further into what, after all, is only the stepchild of a legitimate science. The matter of telegraphic transmission alone will bar these ciphers for most general purposes, or the fact that a cipher once betrayed will never serve again. Then, too, the censorship combats it by cutting out or rearranging or changing words, causing the open letter (or telegram) to convey only the information which it purports to convey. Concealment cipher has, of course, the unique virtue of being able to convey messages under circumstances which make it seem that no communication has passed, and we have hardly touched upon the fact that the short message, prior to its concealment, may have been a well-enciphered one. But we rather suspect that, for the end desired, invisible inks are more convenient and practical. 1. By PICCOLA. On peut être Napoleon sans être son ami, mes enfants! 2. By B. NATURAL. FOR SALE: Spring coats. All fine Scotch serge, for ensembles. Stoat trimmed, fashioned right. Black shirred lining, striped. Effective for brides. Act quickly. - Abraham Batz, 522 Broad, Telephone Exchange 7104-R. 3. By TITOGI. How about releasing Tony, the gang chief? He don't lie, and is not the true slayer either. Let us be friends. I am all right. Ed Lehr. 4. By TRYIT. To those friends considering, it is always news, but all filled ciphers disturb happiness with varied answers! 5. By PICCOLA. Do not send for any supplies before Monday, at earliest. Order once only, as men in charge are feeling sore about your threat to encourage the mutiny at Ford's. - Wilson. 6. By PICCOLA. (Why not, indeed?) A W I T H A N Y S E N D F O R I T Y O U M U S T B E F E A R T H E C A N H I T T R Y A B O U R E O U T I S E C H I Y O U A N D M Y T I O N C U P C R E A S K T O C A N D Q. CHAPTER III Transposition Types Transposition has already been explained as a form of cipher in which the letters of a message are disarranged from their natural order in accordance with any pattern, or key, agreeable to the correspondents. The fact that _any_ plan may be followed will suggest the possible ramifications as to detail. Transpositions are, in fact, found in every conceivable degree of complexity. They are not even unanimous in their demand that there be two separate operations in the preparation of a cryptogram: (1) the writing down of the plaintext letters, and (2) the taking off of these letters. Generally speaking, these ciphers follow two types, the regular (geometrical, symmetrical), and the irregular. The strictly geometrical type, sometimes called _complete-unit_ transposition, is based on one comparatively small _unit_, or _cycle_, repeated over and over, every unit having exactly the same number of letters and exactly the same disarrangement as the rest. This type always demands an exact number of units, and when a plaintext message is not evenly divisible into units, it must either be cut down to fit, or lengthened by the addition of extra letters called _nulls_. Some of these keys are actual geometrical figures, such as triangles, diamonds, hexagons, etc., or conventional designs like crosses. Any figure of this kind provides a number of cells, or points, for the _writing in_ of letters, and thus will serve as a mnemonic device, or key. Figure 5 A D E H I L M P X X X X B C F G J K N O Plaintext message: A B C D E F G H I J K L M N O P. Cryptogram (a) A D B C E H F G I L J K M P N O. Cryptogram (b) A D E H I L M P B C F G J K N O. The two operations of writing-in and taking off may be governed by any agreed ruling, though the second of these must be made to result in five-letter groups if the cryptogram is to be transmitted by wire or radio. Fig. 5, in which an imaginary message has been represented as _A B C D E_ . . . . . , shows only one of the many ways in which a simple cross could be used as the key for the writing-in operation, together with only two of the many cryptograms which could be taken off from this one arrangement. This figure shows also, in its two cryptograms (a) and (b), two fundamentally different plans for the taking off of transpositions. The unit here is 4, the first unit containing the letters _A B C D_, the next unit _E F G H_, and so on. In cryptogram (a), the letters of every unit are still standing together in a group, while in cryptogram (b), the letters of any one unit have been mixed with letters of other units. In this latter case, the two correspondents will have to agree upon a certain number of crosses per line; otherwise, they run the risk of having to decrypt each other’s cryptograms. The most popular of the geometrical figures appears to be the square, with or without a series of numbers 1 to 25, 1 to 36, and so on. Any device or game, which will provide a square, is likely to be seized upon as the source of a transposition key. We find two widely-known examples of this in the “magic square” and the “knight’s tour.” A _magic square_, as most of us understand this term, is made up of a series of numbers, such as 1 to 25, 1 to 36, which are so arranged in their cells (positions) that the added numbers of any row, column, or diagonal, will always give the same total. A square of given size will provide more than one magic square arrangement; and these numbers, being a series, constitute an _order_, which, once it can be remembered or reconstructed, will serve either for writing in or for taking off a unit of 25, 36, etc., letters. The _knight’s tour_ is based on the chessboard, a unit of 64 cells. In the game of chess, where each piece has certain prescribed moves, the piece called the knight must move diagonally across a 2 x 3 oblong. The “tour” consists in starting the knight at one corner and carrying him completely over the 64 cells of the chessboard, causing him to touch every square exactly once without having made any other move than the one allotted to him. Fig. 6 will show one of the many such tours which have been published. Such designs will serve either for writing in or for taking out. In either case, the text is made to contain exactly 64 letters or a multiple thereof. For writing in, the first letter is placed in the cell corresponding to No. 1, the next letter in the cell numbered 2, and so on. For puzzle purposes, the 64 letters are usually left standing in the form of a square. As cipher, they would be taken off, by rows, or by columns, or otherwise. Or the 64 letters may first be written in simple order into the form of a square, and then taken out one by one following the route of the knight. Figure 6 1 4 53 18 55 6 43 20 52 17 2 5 38 19 56 7 3 64 15 54 31 42 21 44 16 51 28 39 34 37 8 57 63 14 35 32 41 30 45 22 50 27 40 29 36 33 58 9 13 62 25 48 11 60 23 46 26 49 12 61 24 47 10 59 Other ciphers of the regular type merely employ a unit of so many letters, to be arranged in some specified order, generally in accordance with a numerical key. If, say, the unit has a length of six letters, which we will represent as _A B C D E F_, and the specified order for these is 6 2 1 4 3 5, this unit may be transposed to read _F B A D C E_. Each unit will be transposed to have exactly this pattern, except that semi-occasionally we find a final unit slightly different from the others, owing to the fact that nulls were not added to complete its length (Accurately speaking, this transfers the cipher to the “irregular” class). Units, once transposed in this way, may continue to stand intact, one after another; or they may remain intact, merely exchanging places with one another; or the cipher may be so planned that they do not remain intact, as was the case with our cryptogram (b) of Fig. 5. Often, two ciphers will differ from each other only in the method by which their cryptograms are produced; oftener, there will be an actual difference, but one which is purely superficial. For instance, we have just mentioned a plaintext unit _A B C D E F_ as having been transposed with a key 6 2 1 4 3 5 to result in the order _F B A D C E_. Identically the same numerical key, used in another way, will transpose this unit in the order _C B E D F A_. The two resulting cryptograms would be different, but the _kind_ of cryptogram would not. An extremely common form of complete-unit transposition is that indicated in Fig. 7, where a short message, LET US HEAR FROM YOU AT ONCE CONCERNING JEWELS QQ (38 letters plus 2 _nulls_), has been written into an oblong, or _block_, in one order and taken off in another. Both the writing in and the taking off follow a _route_, rather than a key and, for that reason, the cipher is often spoken of as _route transposition_, rather than _rectangular transposition_. Three of the many possible _routes_ are shown in the three (partial) cryptograms of the figure. In this connection, the American popular terminology seems to favor _horizontals_ and _verticals_, rather than “rows” and “columns.” The writing in or the taking out of a text is said to be done by _straight horizontals_, or by _reversed horizontals_ (backward), or by _alternate_ (or _alternating_) _horizontals_ (written alternately in both directions). Similarly, we find ascending, or descending, or _alternate verticals_; and again the _diagonal_ routes will be described as _ascending_, _descending_, or _alternate_. The route may also be a _spiral_ one, and in this case it is said to be _clockwise_ or _counter-clockwise_. Figure 7 L E T U S Cryptograms: H E A R F R O M Y O (a) By descending verticals, from the left: L H R U C U A T O N C E C O N C N E E E O A E E G L T A M T C R J S U, etc. C E R N I N G J E W (b) By alternating verticals from the right, top: E L S Q Q S F O N N I W Q Q E N O O Y R U T A M T, etc. (c) By diagonals: L H E R E T U O A U C A M R S C E T Y F N E C O O, etc. For all of these routes, the point of beginning is nearly always one of the four corners, except in the case of the two _spiral_ routes, which are just as likely to begin with a central letter, particularly when the rectangle is a square. Colonel Parker Hitt, in his _Manual for the Solution of Military Ciphers_, shows the same series of letters written into forty different blocks, always beginning at one of the four corners. Rectangular transposition, when used as cipher and not simply as a puzzle, requires that one dimension of the oblong be fixed, the other dimension being entirely dependent on the length of the message to be conveyed. In the figure, the pre-arranged width of the block, called its _key-length_, was 5, and the filling of the block required 8 complete units. These were written one by one as simple bits of plaintext, and were then broken up in the method of taking off. Occasionally it will be the vertical dimension of the block which is fixed, and the plaintext will be written in by columns, beginning at the left or at the right. But there is so little difference in the results of the two procedures that a decryptor may solve and read a cryptogram without learning which of the two was actually followed. Ordinarily, it is the simple operation which comes first, the writing in of intact units one after another. Sometimes the opposite is true, the operation of writing in being made very complex, so that the whole block is the unit, the taking off being done by simple rows or columns. Frequently both operations are complex. This kind of transposition belongs rather to the category of puzzles than to cipher; any reasonably intelligent person can decrypt it, knowing what it is. However, it has not infrequently been applied to serious purposes, and a decryptor, encountering an unknown transposition, would not overlook the possibility of simple rectangular encipherment. Decryptment, here, is merely a matter of trying out the known routes, and it would never be actually necessary to write out the entire forty-plus blocks, or even half of these, for any one rectangle. The decryptor begins by counting the letters of his cryptogram and factoring the number of these, to find out what oblongs are possible. A 36-letter cryptogram, for instance, might mean dimensions 6 x 6, or dimensions 4 x 9. It could, conceivably, represent dimensions 3 x 12, or 2 x 18. But key-lengths are hardly ever shorter than 5, or as long as 18. He would seize upon the square as the object of his first investigation, writing the cryptogram into that block by various known routes, and also _reading_ by various known routes, diagonally, horizontally, vertically, backward, or upside down, until he begins to find words. As a rule, this does not take him very long; often the very efforts of an encipherer to achieve complexity will result in an easier task for the decryptor. However, a spiral will sometimes give trouble. Figure 8 A E I B D F H J C G K........etc. Taken off: A E I & B D F H J & C G K... The examples appended to this chapter are all of the complete-unit type, and require little knowledge of cryptanalysis for their solution. Passing on to irregular types, we find these in all degrees of difficulty, from the very simple “rail fence” to the formidable “U. S. Army” double transposition. The “rail fence” family is outlined sketchily in Fig. 8. The writing in of the plaintext follows a zig-zag route, downward by so many letters, then upward to the line of beginning, as indicated by the series _A B C_ . . . . . , and the taking off of the cryptogram is done by straight lines. In explanation of the character _&_, this has been used here as a signal to show the ends of the straight lines. No such signal is needed if a proper understanding exists between correspondents as to the construction of the “fence” and the length of it which may occupy one line of writing; and in some cases the straight lines are all equal in length. In Fig. 9, we have a suggested _grille-transposition_, of a kind described by Mario Zanotti as “indefinite.” This kind of grille, we believe, is the invention of General Sacco. To picture it complete, we may imagine a flat surface, such as a piece of cardboard, marked off into squares, having dimensions 12 x 6, and turned sidewise. Assuming this to be shown in full, we are looking at 12 _columns_, and each column has 6 of the small squares, or cells. To convert this piece of cardboard into an encipherment grille, we clip out three squares from each one of its 12 columns, always in the most haphazard manner possible. The resulting grille will thus have 36 openings, and, if placed over a sheet of paper (preferably also marked into cells), enables us to transpose the first 36 letters of a message by writing them one at a time into the 36 apertures in some one order and taking them off in another. The original plan was the reverse of the usual: write the letters by columns and take them off by rows. Figure 9 [ (N) ... [(S) (O) ( ) ... [(T)(I) ( )( ) ... [ (K) ... [(R)(E) ( ) ... [ (W)( )( ) ... Cryptogram: N S O T I K R E W. In the figure, a 9-letter message, STRIKE NOW, has been written into the first three columns of such a grille, and, taken off by rows, comes out in the order _N_, _SO_, _TI_, _K_, _RE_, _W_. While the figure shows this cryptogram regrouped in the usual fives, the original method, as prescribed with the device, would have grouped it in threes, that is, to correspond with the number of apertures per column. This would facilitate the operation of decipherment, which is as follows: Count the number of letters in the cryptogram _and divide this number by 3_, in order to find how many columns were used. Cover (or ignore) the unused portion of the grille, write the cryptogram by straight horizontals into the uncovered portion, then read, or copy, by descending verticals. The recipient of the present cryptogram, for instance, finds nine letters, divides this number by 3, thus ascertaining that three columns were used, covers up the other nine columns, then, proceeding by straight horizontals, places one cryptogram-letter wherever he sees a hole. Having thus restored all letters to their proper columns, he has the plaintext message before him. It will be noticed that an encipherer uses only the number of columns that he needs. His last column does not have to be completed with nulls, as in the case of complete-unit ciphers. As this grille has just been described, its full capacity is 36 letters, and it has a repeating cycle of that length, presuming that, after the transposition of the first 36 letters, another 36-letter unit is to be transposed by the same grille standing in the same position. But this grille, reversed, provides a new pattern; and the opposite side of the grille provides two additional patterns. These positions may be numbered, thus providing for the encipherment of 144 letters, even assuming that the positions are to be used in 1, 2, 3, 4 order and without varying the method of use. Add to this that the cryptographic offices may have provided half-a-dozen different grilles to be used interchangeably and not always in exactly the same way, and it becomes plain that such an encipherment, in the hands of an operator who knows his business, could be made to furnish a very effective form of transposition. Figure 10 2 1 L E T U S H E A R 5 4 3 2 1 F R O M Y O 0 9 8 7 6 5 4 3 2 1 U 7 6 5 4 3 2 1 A T O N 3 2 1 C E C O N C E R 4 3 2 1 N I N G J E W 7 6 5 4 3 2 1 E L S Q Zanotti, and others, have also described mechanical devices of a patentable type for accomplishing very involved transpositions. The principle on which most of these operate can be seen in Fig. 10. A certain number of pointers, or narrow sliding rulers, all carrying the same progression of numbers, are so attached to a framework that they can be set, by means of a numerical key, to project at irregular lengths over a sheet of quadrille paper cut to fit into the frame. Thus, each pointer indicates a certain number of empty cells, as nine on the first line, six on the next, and so on. In the example of the figure, presuming that each pointer carries only ten numbers, and that the full number of these pointers is seven, the numerical key would be the column of numbers at the extreme left: 2-5-0-7-3-4-7. The message here is written in the usual horizontals, with a null (not strictly necessary) completing the last line. It could be taken off by columns: _L_, _EC_, _TEN_, _UFCI_, etc. The decipherer, having a duplicate apparatus, would set this according to the pre-arranged key, copy the cryptogram by columns, and read it by rows. The exact method, of course, can be varied. Some attempt has been made, too, to evolve cipher machines which will produce effective transpositions, but our understanding is that these have never been accepted as worthwhile. The accomplishment of transposition by mechanical means is far from new. In fact, the oldest transposition cipher of which we have any record was accomplished by means of the Lacedaemonian _scytale_. The Spartan general, departing for foreign conquests, carried with him a rod, or scytale, of exactly the same diameter as one retained by the administration. When it was desired to communicate matter of a confidential nature, the sender, using a narrow strip of parchment, wound this carefully around his scytale with edges meeting uniformly at all points, and wrote his message lengthwise of the rod. When the strip was unrolled, the message appeared as a series of short disconnected fragments, one letter, or two letters, or portions of one or two letters. It was presumed that no person would be able to read the message without being possessed of a duplicate scytale on which to rewind the strip. We are left to suppose that this presumption was justified by fact, though the decryptor of today would make short work of such a system. The scytale, we believe, is the oldest known cipher of any kind, and is still serving today as the emblem of the _American Cryptogram Association_. Before leaving types, it should be mentioned that any of the transpositions ordinarily used for disarranging single letters can also be used for the transposal of entire words. The popular name for this is “Route Cipher” — possibly because it is rather cumbersome to accomplish by any other than a “route” transposition. We have said little concerning _decipherment_. This, in practically all cases, is a mere matter of performing inversely the two encipherment operations. For either process, the operator begins by setting down his key or design, or adjusting his mechanical device in the agreed manner. The encipherer “writes in” a plaintext, and “takes off” a cryptogram; the decipherer “writes in” a cryptogram, and “takes off” (or reads) a plaintext. If the encipherer, by agreement, has written the text in rows and taken it off by columns, then the decipherer must do the reverse: write his text by columns and take it off by rows. Before entering into the subject of _decryptment_, the student should acquaint himself with the significance of the various tables appended to this text, in order that he may consult these or similar tables for information as to _frequencies_, and _sequence_. Every written language has its individual characteristics in these two respects, and, to learn just what these are for each language, various cryptologists have, from time to time, counted the letters, the short words, the combinations, and so forth, often on extremely long texts, afterward arranging these data in the form of charts, or tables, or lists. Two such counts are never duplicates, and there may be a noticeable difference, say, between results obtained from literary text and those obtained from military or telegraphic text; yet results for any one language are surprisingly uniform. Finding, for instance, an unexplained cryptogram in which a count of the letters shows that about 40% of these are vowels (with or without _Y_), we may classify it, not only as a transposition, but as one enciphered in English or German, since one of the Latin languages can hardly be written with so low a vowel percentage. Then, if we note the occurrences of the letter _E_, and find that this makes up about 12% of the total number of letters, we may discard the possibility of German, in which the letter _E_ is far more likely to represent 18% of the text. Or, if the vowel percentage is high enough to point to one of the Latin languages, French would be distinguished from the others by the outstanding frequency of its letter _E_, sometimes as great as that of the German _E_, while the Spanish, Portuguese, or Italian language will not always show it as the leading letter, its place having been taken by _A_. In the Serb-Croat language, the letter _A_ always predominates, and in Russian the letter _O_. As to sequence, and considering English combinations only, certain digrams, such as _TH_, _HE_, _AN_, etc., very consistently predominate over all others. These almost never show identical percentages in any two digram counts (as the single letters sometimes will), and seldom, if ever, are ranked in exactly the same order, aside from the fact that _TH_ invariably comes first. But in all counts, the same fifty to sixty digrams (out of 676) are always found at the top of the list. Thus the Meaker digram chart differs from similar charts made by many others; yet _any_ digram chart is the most valuable weapon we have for attacking a cipher. The Carter contact chart contains the same general information expressed in another way for special use in transpositions. (This was not figured from the Meaker chart, but from an earlier one by Ohaver, made on the same kind of text.) One very useful phase of frequency data is seen in the group percentages. Single letters, especially in short texts, may vary greatly from their normal percentages, while certain classes, taken as a whole, maintain a fairly constant percentage no matter how short the text. Such classes, or groups, listed under the general heading of _English Frequency and Sequence Data_, can be memorized as having roughly approximate percentages: Vowels, 40%; selected high-frequency consonants, 30%; extreme low-frequency group, 2%; the five most frequent letters, mixed, 45%; the nine most frequent letters, 70%. This final group of nine letters, _E T A O N I S R H_, hardly ever varies appreciably; the shorter groups will sometimes vary as much as 5% one way or the other. Very useful in _code_ decryptment is a list of the commonest words. Trigrams have also been investigated, the favorite positions of individual letters in their own words, average word-length, _patterns_, and endless other information, some of which is indispensable, and some merely convenient. It will not be possible, in the space at our disposal, to point out all of the uses to which this kind of information can be put; the student is urged to take his cue from the occasional short references made in connection with examples. * * * All ciphers are decrypted by the _general methods_ suitable to their type, and a transposition cryptogram may involve _factoring_, _examination of the vowel distribution_, and _anagramming_, either singly or in combination. These are best explained in connection with examples, which may themselves have _special methods_, and we have selected for general discussion four ciphers, two belonging to the complete-unit type and two to the irregular. A careful study of the methods used in individual cases should furnish the student with a basis for analyzing other ciphers and evolving other special methods to suit particular cases. Concerning the paper work, which, admittedly, is onerous in most forms of cipher investigation, much reference may be found, in the matter which follows, to “paper strips.” These are old stand-bys. Most decryptors prefer to do all of their work on cross-section (quadrille) paper, since the writing of the letters into cells enables them to obtain an accurate spacing both laterally and vertically, and this paper is easily cut apart along the separating lines. But for the kind of cryptograms we are likely to see here, many persons prefer to work with a set of anagram blocks. These can be prepared at home from cardboard squares, or may be bought in sets with frequent letters represented in approximately the correct proportions. 7. By TITOGI. T S S N I H A Y S T I N T P I S E R O O I A A S N. Also this: S H C V I E O L E A E W E R M. 8. By G. A. SLIGHT. (Something found in every school-book - IF found!) T G H M R R I A Y E X N U E E S D E X S H M T I D E Q U O A Y R O A U N P U E T G T I T E S Y S N O A Q N X A T U A D S I S H X. 9. By PICCOLA. W I N T A H D A E S W H L E T Y L W A I L H O Q L A S S S A S Q. 10. By NEMO. (Magic Square). L E A S U L T S G M S L O E I E O I M E A R N S A S R C D E K I U S U H E M A Q L Y S P R M E O A. 11. By THE ADMIRAL. B S P N T E A E F T V V O A N E Y A P U Z S E T P T H M N A T A E E R S D S S K P S J E S T Y S E A L R H I A S K S N T T E Y W O F T H M W Y K E F E N N H C I E H H U M I H I T E O H G E S U C G D I O O W E A S A S N E R H M A A S S L E R G S M N E D T H K E M L U A E T V M F O R A I W P A Y A M A E Y A D. 12. By THE ADMIRAL. A A F R S R T N E A R B N E E O H S R L T I A P D U E O S I I T T A T G L F O T S O U S H H E P N Y. 13. By DAN SURR. (Received from General Headquarters following a skirmish). F A A T R M N O A T I L V I S Y G U C F F I O O E P S N K L T O I N V R T T O A H N D N E E R E N N B M P U N P O R R K A U O M E A N A I E T S S B N R G T G S T T I E E I C T H R. 14. By PICCOLA. (This is serious advice!) F F L T A A R N I E U O R N T O T D L A N R W S O I A T T E Y B A N T M E H S K O G R Z E P S R E I O A O A M S S S M A L P I L Y S. 15. BY FRA-GRANT. (This might have been a little easier. Still - ?) Q Y T E Y O F U B U Q E H I H T E C H T H S A U A O N S I T I T T T I E T T E L L S E A P L T N T. CHAPTER IV Geometrical Types — The Nihilist Transposition In the preceding chapter, we glanced at the most elementary form of _columnar transposition_: a text is written into a block by rows and taken off by columns in such a way that even though all or part of the columns may be reversed in direction, these columns are always left standing one after another in regular order. Columnar transposition becomes less crude when the order for taking off the columns is an irregular one, governed by a changeable numerical key, the length of this key governing also the width of the rectangle. This process can be examined in Fig. 11. In this figure, the numerical key, 4 1 6 5 3 2 7, was first derived from a _keyword_, HALIFAX, according to the following very common plan: The two _A_’s, taken from left to right, receive the first two numbers; the third number, in the absence of _B_, _C_, _D_, and _E_, is assigned to _F_; and so on, following the alphabetical rank of the letters present, and taking repeated letters from left to right. The presence of seven numbers implies seven columns, and it is said that the _key-length_ is 7. When a text has been written into a block of that width, with a key-number standing above each column, these columns can be taken off in the order shown by the numbers, and not in regular sequence. Figure 11 Usual Plan for Transposing Columns H A L I F A X 4 1 6 5 3 2 7 L E T U S H E A R F R O M Y O U A T O N C E C O N C E R N I N G J E W E L S X X X X Cryptogram: E R U C I L H M N E E X S O O C J X L A O E N E U, etc. The key, used exactly as described, is a “taking off” key, and this is the common way of using one. It can, however, be used for “writing in” the successive units, placing the first letter of a given unit beneath number 1, the second letter beneath number 2, and so on until the seventh letter has been written below number 7, afterward beginning with the first letter of another unit below number 1 again. Under this plan the first unit of our figure, _L E T U S H E_, would have been _written in_ in the order _U L H S T E E_. Since all units would follow exactly the same pattern, the resulting _columns_ would be identical with those of the present block; the only essential difference would be that the new columns are already transposed, and can be taken off in straight order. The two resulting cryptograms, however, would not be the same. The unit which was _written in_ in the order _U L H S T E E_, would have been in the order _E H S L U T E_ had the method been that of _taking out_ (or “off”). The Nihilist transposition is ordinarily accomplished by “writing in,” and its numerical key is applied to _both columns and rows_. Thus its major unit is a square, and the seven-letter keyword HALIFAX, applied to both dimensions of a rectangle, demands a unit of 49 letters, while the shorter word SCOTIA, key-length 6, requires a unit of 36 letters. Theoretically, this cipher is a _double transposition_, requiring two successive operations as shown in Fig. 12. But in practice, these two transpositions can take place simultaneously as pointed out in Fig. 13. The operator, having laid out his key-numbers at top and side of his square, begins his writing in the cell at which the column headed by number 1 crosses the row headed by number 1. He _writes in_ his first unit, proceeds to the row numbered 2 for the writing in of his second unit, then to the row numbered 3, and so on, taking rows in the order shown by the numbers at the left, and placing the letters of his unit by following the numbers across the top. Thus, with only a little concentration, he has the entire major unit at one continuous writing. The decipherer, too, having restored his cryptogram unit to its block and written his two series of numbers, may read, or copy, continuously. The decipherer, in fact, uses the exact method which would produce a Nihilist cryptogram if a key were used in the “taking out” manner. What we have described is the encipherment of a single major unit; and all cryptograms must contain an exact number of these major units. Figure 12 Nihilist Plan (a) Transposal of Columns (b) Transposal of Rows S C O T I A S-5 E U J W T O 5 2 4 6 3 1 C-2 R A F O R E O-4 A N E B C O S E U H T L (Let us h) T-6 X L X X S E R A F O R E I-3 A Y U T O M A Y U T O M A-1 S E U H T L (Let us h) A N E B C O E U J W T O (c) Cryptogram: E U J W T O R A F O R E A N E X L X X S E B C O X L X X S E A Y U T O M S E U H T L. The second operation, that of taking off the cryptogram, is not always done by straight horizontals as we have shown this under (c) of Fig. 12. This, of course, is the expected way; but the Nihilist square is quite frequently taken off by some other one of the forty-odd routes possible to rectangular transpositions. The decipherer, knowing this route, merely writes his units back into their blocks; but the decryptor is often faced with a preliminary problem of discovering how they were taken off. Sometimes he must also discover how many units a cryptogram contains. To understand how such problems are solved, it is necessary to pause and consider the make-up of ordinary written plaintext. English vowel-percentage, as mentioned, is about 40%, and practically never varies out of its limits 35%-45%. Each 40 vowels are fairly _evenly_ distributed throughout their 100 letters. Take any English text whatever, not composed of initials or otherwise distorted, and, beginning where you please, mark it off into ten-letter segments and count the vowels in each of the segments. You will find that the majority of these have exactly the normal number of vowels, which is 4. Others will have 3 or 5, which, though outside of the limits 35%-45%, are the closest variations possible. It will be a rare segment indeed which contains fewer than 3 vowels or a greater number than 5. But suppose, having marked off such a text into ten-letter units, or segments, we take each of these segments individually and mix up the order of its letters, though still allowing it to stand where it is. And suppose, having done this, we erase the original division-marks and, beginning at some point in the midst of a former segment, we again mark off a series of ten-letter units, and count the vowels of these new segments. This time, we are just as likely as not to find seven or eight vowels in one segment and none at all in the next, depending on just what we did to the old units, and still we have not actually mixed the units; we simply have our division marks in the wrong places. Imagine, then, how the vowel distribution can vary when a transposition is one so planned as to break up units and scramble their letters. This fact of uniformity in vowel distribution is of enormous assistance in dealing with the simpler transpositions. For instance, it may be that what we want to know is the length of the units, and that what we have is a cryptogram of 144 letters, which could be a single square, or a series of 36-letter squares, or even a series of 16-letter or 9-letter squares. We may start at the beginning of this cryptogram and mark it off into equal segments of any length we like, afterward counting the vowels per segment. If every segment shows approximately a 40% vowel count, the chances are that we have a series of intact units, each one merely transposed within itself; but if one segment shows 50%, another 30%, another 28%, and so on, we may be quite sure that our division marks are in the wrong places. Figure 13 5 2 4 6 3 1 5 2 4 6 3 1 5 2 4 6 3 1 5 5 5 2 2 . A . . . E 2 R A F O R E 4 4 4 6 6 6 3 3 3 . Y . . . M 1 . E . . . L 1 S E U H T L 1 S E U H T L Returning, now, to the Nihilist cipher, suppose we consider the make-up of its major unit, that is, of any one block. This major unit is a series of minor units, and each of these minor units, at the time of encipherment, was written by itself on its own line. In the beginning, it was a small fragment of plaintext, presumably conforming closely to a 40% vowel count. It is true that we placed it on the line in transposed order, but we did not remove any of its letters or add any new letters. Even in the transposal of the lines themselves, we merely removed a number of intact units from one place to another. There has never been a time, throughout the entire encipherment, when we took any letter out of its original minor unit and put it with some other unit. Thus, as we first see our completed Nihilist square, we still have, on each horizontal line, a small fragment of an English sentence in which all of the original vowels are still present. If such a block is now taken off by straight horizontals, it is no more than a series of intact units. To break up these units, we must at least take it out by verticals; and they will, of course, be much more thoroughly mixed when taken out by diagonals or spirals. The decryptor, hoping for the best, writes his cryptogram into a square (or series of squares) by straight horizontals and counts the vowels per horizontal line. If his block is wide, he may estimate the actual number of vowels represented by 40%; if it is narrow, he may only roughly approximate the number; but in either case what he hopes to see is _evenness of distribution_. More than half of his units must be exactly normal, and any which are not exactly normal must show the smallest variation possible. If he finds that this is the case, he assumes that his block arrangement is the encipherer’s original square, with only the minor possibility that half of his lines may be written in the wrong direction. If his distribution is not uniform, he counts the vowels per _column_ so as to find out what kind of distribution he would get from a vertical arrangement (ascending or descending). If this, too, fails to show him a uniform vowel distribution, he writes out a new block by the route of alternating verticals (or gets this count from his first block; this is possible, though a little confusing). Afterward, he may go on to the diagonals and spirals until finally he reaches the arrangement in which more than half of his horizontal lines show a 40% vowel count, and the rest a minimum variation. Now let us consider a concrete example of decryptment. The (purely imaginary) history of the cryptogram shown as Fig. 14 is meager. It was taken from the body of an unnamed man, killed in attempting to dynamite a bridge in an American town called Baysport. Figure 14 I Y W B B O R T A F T I X D G S S E G H N A T O O I T O X T L U T R E L X F A Y S D R C H T O M E D E I O V I K F T V T L A E U. To begin with, the cipher appears to be transposition. Its cryptogram shows 37½% of vowels, very close to the number expected of English or German. It is too short to provide any reliable distinction between these two languages, but the source of the cryptogram points to English. Again, the encipherer, although he has grouped his message in the usual fives, has neglected to complete his final group with a null, and from this we judge that 64 letters is the actual length of the message. The fact that 64 is a _square_ is promptly noticed. But it is also the sum of several smaller squares, and the unit might be 16. To investigate this possibility, we may mark the cryptogram off into four equal segments of 16 letters each, and count the vowels per segment. The normal number of vowels in a 16-letter segment should be about 6, and segments of this length are long enough to afford reliable information, so that we may promptly discard the possible unit 16 when we find that the first segment shows 5 vowels (31%), the second, 7 vowels (44%), and the remaining two, respectively, 4 and 8. Such a distribution does not prove that the unit 16 is a total impossibility, because many things are not average in single examples, but it is an extremely bad one and would never be accepted. On the other hand, a satisfactory distribution does not prove absolutely that a given unit-length, or block arrangement, is correct. Here, had there been no question of the ever-present _square_, we might have been led astray by the unit 32, which divides the vowels of the present cryptogram into two equal halves. In this connection, we can only say that the decryptment of any cipher, even the simplest, will at times include a number of wanderings which we shall have to overlook in demonstrating principles. Assuming, then, that the large unit, 64, is correct, we must get it back into its block — presumably square — in the encipherer’s original arrangement. Fig. 15 shows the same cryptogram written into two different blocks. For an 8-letter unit, the normal number of vowels is about 3 (actually 3.2). In block (a), a count taken on the horizontal lines shows half of the units normal, two of the others with the smallest possible variation, and two greatly outside the 35%-45% limits. When the unit is so short, and when the line containing only one vowel may be the one which was completed with nulls, and most particularly when we have no other units to act as a check, we cannot confidently discard a block of this kind. In practice, we might waste some time giving it a trial, or we might look for something better. Notice that its distribution is “ragged.” We expected to find _even_ distribution, with _more_ than half of the units exactly normal. This block (a) is the simple horizontal arrangement. To find out what the simple vertical arrangement would give us, we have only to examine the columns of this. Here the count is obviously bad. In block (b), we have one of the diagonal rearrangements from which two sets of vowel counts can also be taken. Here, the horizontal lines have given us exactly what we hoped for: Evenness of distribution, more than half of the units normal, and only one unit outside of limits. This, almost surely, is the encipherer’s original block, in which every line contains one intact unit. From our meager history of the case, we do not, of course, know that this is specifically the Nihilist cipher. It becomes a case of considering the various ciphers with which we happen to be acquainted, and a _columnar_ transposition of the general kind shown in Fig. 11 is an exceedingly common case. Moreover, a series of juggled columns is suggested here in the fact that intact units are standing on their own lines and still have not resulted in plaintext. Figure 15 (a) Horizontal Rearrangement, (b) Diagonal Rearrangement, With TWO Vowel-Counts With TWO Vowel-Counts I Y W B B O R T 3 I W O F G N O L 3 A F T I X D G S 2 Y B A D H T E R 3 S E G H N A T O 3 B T X G I R D E 2 O I T O X T L U 4 R I E O T S M V 3 T R E L X F A Y 3 T S O U Y O O T 5 S D R C H T O M 1 S T L A T I F L 2 E D E I O V I K 5 A T F H E K T E 3 F T V T L A E U 3 X X C D I V A U 3 4 3 2 3 1 3 4 4 3 1 4 3 4 2 4 3 In Fig. 16, we have the successive steps which would be taken in order to investigate this probability. At (a), the diagonal rearrangement of our cryptogram, selected as the most likely of those which were examined, has been repeated with its eight columns set wide apart, and consecutively numbered for identification. These presumed columns are now cut apart, and thus we have eight paper strips which can be moved about and rearranged in various manners in the hope of causing words to form on some of the lines. Since we lack that most powerful of decrypting tools, a _probable word_, we are forced to begin with probable letter-sequence. If the magic letter _Q_ were present, we should look for a companion _U_, and after that for a vowel to follow _QU_. But this, too, is lacking. Familiarity with English digrams (or, in the case of the beginner, an inspection of the digram chart or the list of digrams) shows that _TH_ is by far the most frequent combination used in the language, and that _HE_ and _HA_, also including an _H_, are very prominent among the leaders. Further than this, the list of trigrams informs us that both _THE_ and _THA_ are of outstanding frequency. Of the four letters included, three are so frequent, and appear in so many different combinations, as to be confusing; but _H_, though belonging to the high-frequency group, does not appear in many _different_ combinations, and is less frequent than the other three. Looking, then, for _H_, we find it twice in our present cryptogram, once on the second row and once on the seventh; and, since the seventh row shows two _T_’s and the second only one _T_, suppose we try the second row, placing together the two columns (strips) which are headed by the numbers 6-5 in order to set up a digram _TH_ on the second row, as shown at (b). Figure 16 (a) (b) 1 2 3 4 5 6 7 8 6 5 I W O F G N O L N G Y B A D H T E R T H B T X G I R D E R I R I E O T S M V S T T S O U Y O O T O Y S T L A T I F L I T A T F H E K T E K E X X C D I V A U V I (c) 6 5 7 ........ 6 5 7 4 ... 1 6 5 7 4 N G O N G O F I N G O F T H E T H E D Y T H E D R I D R I D G B R I D G S T M S T M O R S T M O O Y O O Y O U T O Y O U I T F I T F A S I T F A K E T K E T H A K E T H V I A V I A D X V I A D (d) 6 5 3 ........ 6 5 3 4 ... N G O N G O F (Abandoned in T H A T H A D R I X R I X G favor of c.) S T E S T E O O Y O O Y O U I T L I T L A K E F K E F H V I C V I C D The formation of this digram _TH_ on the second row has automatically set up a digram _NG_ on the top row, a digram _RI_ on the third row, and so on; and we find, upon examining these newly-formed digrams, that the whole series is made up of good English combinations. Thus, it looks as if our combination 6-5 is correct, and we will proceed with a possible _HE_ or _HA_, attempting to complete a trigram _THE_ or _THA_ on the second row. Both _E_ and _A_ are present on the second row, and we may observe at the steps marked (c) and (d) in the figure just what would be the result of adding strip 7 or strip 3. At first glance, it appears that combinations 6-5-7 and 6-5-3 are about equally probable. But it so happens that both set-ups have formed a sequence _YO_ on the fifth line, suggesting _YOU_; and when the only _U_ on that line is tried in both places, it becomes evident that combination 6-5-7-4 is going to give better results than combination 6-5-3-4, where we find poor sequences like _KEFH_. At this point, or earlier, a decryptor will probably proceed on the left side of his set-up, completing the syllable _ING_ and the series of column-numbers 1-6-5-7-4, as shown. When this setting together of columns automatically brings out on the third row a sequence _BRIDG_, we have our first suggestion of a _probable word_, since the man who had this cryptogram on his person had just attempted to blow up a _BRIDGE_. After this, all is plain sailing; the necessary _E_ happens to be on the same line, and even if it were not, we have only three strips left, and these may be placed by trial. Thus our eight paper strips arrive at the stage indicated on the left-hand side of Fig. 17. Figure 17 Strips in order Adjustment of rows 2 1 6 5 7 4 8 3 1 W I N G O F L O 2.... B Y T H E D R A 2 B Y T H E D R A 1.... W I N G O F L O 3 T B R I D G E X 6.... T S I T F A L L 4 I R S T M O V E 5.... S T O Y O U T O 5 S T O Y O U T O 7.... T A K E T H E F 6 T S I T F A L L 4.... I R S T M O V E 7 T A K E T H E F 8.... X X V I A D U C 8 X X V I A D U C 3.... T B R I D G E X "Taking-out" Key: 2 1 6 5 7 4 8 3 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 "Writing-in" Key: 2 1 8 6 4 3 5 7 If we have previously met the Nihilist transposition, we can see now what the cipher is, and, if it is a true Nihilist, we can finish the reconstruction _by decipherment with the key_. To do this, we simply number the rows from 1 to 8 and then disarrange these rows so that their numbers will reproduce the series of column numbers. This is shown on the right-hand side of Fig. 17, where the plaintext is easily read: “By the drawing of lots, it falls to you to take the first move. Viaduct bridge.” The gentleman required three nulls, and thriftily made use of them as punctuation. If we have not previously met the Nihilist encipherment, or if this cryptogram is of a kindred type but governed by two separate keys, one for columns and another for rows, the only difference is that we may have to experiment a little with rows before finding their correct order. In completing our solution, we have obtained a key, 2 1 6 5 7 4 8 3, shown in the series of column-numbers, and should other cryptograms be intercepted having the same key as the first, we need merely decipher them with our key. It is, however, a “taking out” key, while the Nihilist, as we have seen, is ordinarily _written in_. Having either of the keys, we may find the other easily enough as suggested in the figure. Simply “number the numbers” and put them back in serial order. The new set of numbers, now disarranged, will show you the other key. It would not be impossible for the student who is a good guesser to find the keyword on which our present writing-in key was based. This kind of work, with paper strips, is much more rapid than it probably seems, and is often done at random. The keen eye needs no digram list for the spotting of _HT_, merely reversed, with _GN_ above it. Speaking now of the ordinary columnars (Fig. 11), one minor point should perhaps be brought to the attention of the very new student. Quite often, a digram, such as the _QU_ of Fig. 18, is not written on a single line, and it may be necessary to match this valuable digram in the manner shown at (b) of that figure, coming out in the end as at (c). In such event, we can later on transfer columns 5-6-7 to the other side of the block, raising them all by one position. (Column numbers, in this case, are for reference only.) The same would not apply to a Nihilist block in which the whereabouts of the “next” row is unknown; the digram_ QU_ would have to be abandoned in favor of something else. Figure 18 (a) (b) (c) 1 2 3 4 5 6 7 1 1 2 3 4 7 5 6 7 T H I S I S Q T T H I S U I T E T R U Q U I S Q U I T E E B U T W E D U E T R U E B U T D W E D We mentioned briefly, too, the possibility of finding alternating horizontals, so that only half of the rows can be “anagrammed” together. Such minor problems, and they are numerous, can all be ironed out easily enough once the student is familiar with his type, and columnar transposition, encountered frequently and in all sorts of disguises, is surely the most fascinating of all types. In Chapter VI we are to meet it again, this time with an incomplete rectangle. 16. By PICCOLA. (Ordinary columnar). O E E H E A T F L S V A S Y C I O A E D Q O H D F M C M T C P O G E O R E U G M I E F U O G C Y W G D Q U U I A L S I E R N O R N R R A T O A Q. 17. By KRIS KROST. (Nihilist). T C I G R H N L A G T L I S A A O M O R N R I M N N E T R N K S A O E I S D L E I K H H H E R D F T A S O I E T I H N E B T K E. 18. By MERLIN. (Nihilist. Its keyword has been used as a word-spacer). T O L F P T E E R B I V O P S N R E W O R L I T T E S E N E T O O H O F H H E H N Y H I O P F O S T G I P H E I E E T K I N U I B N R A A Y R R E E W L S T H T E E R D T S E A I R S R E A E R R E P E U E U R S S U I R R O F E S T R P O P A O R R B E E O N T T E E R T A H E R A R L A D I O E E Z E L Y A O A Y M S L U L W I Y N N O O S S T G T S H L W E Y M D M E A R E E U R I Y T P P R N Y N T Y O. 19. By SLEEPY. (Nihilist "route-cipher"). Wants Little Wish Should Long Muster But The Man And Gold Wants If Me Many Below Mint For Not A So And Nor Of More With Score In Song Wants Were I That Told Exactly Are Here A Long 'Tis Many 'Tis My But Each Still Little Would So! 20. By TITOGI. (Ordinary columnar). T W E I S I A H O D S P O D E R I T O N J E U T A I A S Y S H N T S T K D N R S W U. 21. By PICCOLA. (Ordinary columnar). T E E P H B M E F E B N T U X A V E H A R D W X I E L N C V E V R O I T A F U L B O R O N T H M T M U E F S H O E T T L E D A K E E G D N L E E N N I O O E B E E E R S T N R Y D C N X O N O E N E X. (And now try this. Probable word: EXAMPLE). H E L K L T I P N W H S E S I A X S R R E E A C M C P L T L T E O S D R A O E E X T I H Y E U H N G E M Y T A S L M A A D S C. CHAPTER V Geometrical Types — The Turning Grille The well-known _turning grille_, also known as the _rotating_, or _revolving_ grille, is said to have been originated by an Italian, Girolamo Cardano (or Cardan). Such grilles can be prepared from any substantial material capable of being made into sheets and marked into cells, and may take the form of any geometrical figure which happens to be equilateral. The number of cells to be clipped out, so as to form apertures for the writing of letters, is based on the shape of the grille, as: one-third of the total number for a triangle, one-fourth for a square, and so on; and the writing of the letters is done on a section of paper of the same size and shape as the grille, and preferably ruled off into cells which correspond to those of the grille. After such a grille has been placed on its corresponding section of paper, and a letter has been written through each aperture, the grille is _turned_ a certain number of degrees to a new position on the same section of paper, so as to cover from sight the letters already written, and expose another series of blank cells for the writing of new letters; and this continues until the grille has taken its full number of positions and every cell has been accounted for on the section of paper beneath it. The preferred grille is a square, based on square cells, and takes four positions. Usually it is based on an _even number_ of these cells; otherwise, the full number of cells is not evenly divisible into quarters, leaving an extra central cell which has to be omitted or specially dealt with. The grille called “Fleissner,” after an Austrian cryptologist, Eduard Fleissner von Wostrowitz, is the perfected Cardan grille as described by Jules Verne in his story, “Mathias Sandorf.” Colonel Fleissner’s grille is a square, taking four positions, and is always based on an even number of cells. In preparing this grille, it is easy enough to select apertures at random in such a way that each one governs its own four cells on the paper beneath, causing each of these to be uncovered exactly once. But concerning the preparation of the grille, there is a phase which affects the value of the cipher itself: unless the grille can be constructed at will, in accordance with a key which is “easily changed, communicated, and remembered,” it requires the keeping on hand of a material apparatus which can be stolen or copied, or which cannot be destroyed in case of emergency. There are, of course, many ways in which a key could be applied. The method used here is one published several years ago by Ohaver, and can be studied in Fig. 19. First, as shown at (a), we have a quick mechanical method for selecting apertures that cannot conflict. The square is divided into four quarters, and each quarter, treated as if it were the one occupying the upper left-hand corner, receives its consecutive cell numbers, 1 to 9 (or 1 to 4, 1 to 16, 1 to 25, 1 to 36, etc.). If the route of writing-in is made exactly the same for all four of the quarters, it becomes possible to clip _one each_ of the numerals 1, 2, 3, 4, 5 . . . . . . . etc., taken absolutely at pleasure, and each resulting aperture will expose only its particular four cells. This can be seen at (b). The grille shown at (b), however, was based on the key-phrase FRIENDLY GROUPS, and the method can be studied at (c), following Ohaver’s plan, even to its minute details. The fact that the square is based on 6 is told in the initial letter of the key-word, _F_, 6th letter of the alphabet. This key-word must yield nine letters, one for each proposed aperture in the grille. A short word, such as FRIEND, can be lengthened by a partial repetition, as FRIENDFRI, while a longer word is cut off after its ninth letter, as it was in Fig. 19. This literal key is next converted to a numerical key, as explained in the preceding chapter, and the nine resulting numbers are divided as evenly as possible into four sections. Finally, considering the four quarters of the grille in some definitely agreed rotation, each section of key-numbers will show what numerals are to be clipped from a given quarter. In the figure, the numerals 3 and 8 were clipped from the first quarter, numerals 5 and 2 from the second — proceeding in a clockwise direction, — numerals 7 and 1 from the third quarter, and numerals 6, 9, and 4 from the remaining quarter. Figure 19 - Preparation of a Grille (a) (b) Top 1 2 3 7 4 1 _ _ 3 _ _ _ 4 5 6 8 5 2 _ _ _ _ 5 2 7 8 9 9 6 3 _ 8 _ _ _ _ 3 6 9 9 8 7 _ 6 9 _ _ 7 2 5 8 6 5 4 _ _ _ _ _ _ 1 4 7 3 2 1 _ 4 _ _ _ 1 (c) F R I E N D L Y G 3 8.5 2.7 1.6 9 4 1st Q: 3,8; 2d: 5,2; 3d: 7,1; 4th: 6,9,4 Another method for selecting cells, proposed by Edward Nickerson, dispenses with numerals, using in their places the letters of a key-word which must be without repetitions, as FRIENDLY G happens to be. If these nine letters, all different, be written into the nine cells of each quarter, following exactly the same route in each case, it becomes possible to clip one each of the letters _F_, _R_, _I_, _E_, _N_, _D_, _L_, _Y_, _G_, taken wherever desired. The choice can be made as follows: Taking the four quarters of the grille in the agreed rotation, follow the normal alphabet, clipping _A_, (when present,) from the first quarter, _B_, (when present,) from the second quarter, _C_, (when present,) from the third quarter, and so on. Or, to insure a more even distribution, rearrange the nine letters in alphabetical sequence: _D E_, _F G_, _I L_, _N R Y_, and divide as in the former plan, clipping _D_ and _E_ from the first quarter, _F_ and _G_ from the second, and so on. While it is possible to provide key-phrases of sixteen letters, without repeating, it is probably more convenient to take whatever number of letters is needed from a key-mixed alphabet of the following type: F R I E N D L Y G O U P S A B C . . . . . . W X Z _f r i e_ . . . . . . In Fig. 20, at (a), (b), (c), (d), we have a detailed picture of the operation of this grille on the 36-letter plaintext unit: MISFIRE ON VIADUCT JOB X RUSH INSTRUCTIONS. One definite edge of the grille must be designated as the top, and there is a right and a wrong side. Taking precautions in these respects, we place the grille over a sheet of paper and mark its outline with a pencil (or otherwise make sure of maintaining this one location). We write the first nine letters as at (a), and give the grille a quarter-turn to the right. We add the second nine letters as at (b) — where the newly-written letters are the capitals; the others, in lower case, are presumed to be hidden from sight by the solid portion of the grille. Another quarter-turn makes ready for the next nine letters (c), and a remaining quarter-turn completes the revolution (d). The writing-in, at all times, is _straight ahead_: cells taken from left to right, and lines taken from top to bottom. Figure 20 - Four Stages of Encipherment (a) (b) _ _ M _ _ _ _ _ m _ _ _ _ _ _ _ I S V _ I A i s _ F _ _ _ _ _ f D _ _ U _ I R _ _ E _ i r _ _ e _ _ _ _ _ _ _ _ _ _ C _ _ O _ _ _ N T o J _ O n (c) (d) B _ m _ X _ b T m R x U v _ i a i s v C i a i s R f d U S u r f d u s u _ i r _ H e T i r I h e I N _ _ c _ i n O N c S t o j S o n t o j s o n In the Jules Verne story, the three units of his cryptogram were left standing in their blocks. Verne’s heroes were clever enough to unearth a ready-made grille, and, by laying this, in its four successive positions, above each of the three blocks, were able to read the message through the apertures. Today, such blocks would be taken off in five-letter groups, and possibly by a devious route. A little concealment can be afforded, too, by completing the last five-letter group with nulls, or, better, by adding these nulls at the beginning of the cryptogram. It is also possible to make the final 36-letter unit _incomplete_ by blanking out its bottom cells before putting in the letters. A grille can be used in other ways. Negligible changes can be produced in its cryptograms by altering the customary order of its four positions. A more substantial change is introduced by departures from the straight horizontal direction of the writing-in. It is possible to revolve the paper instead of the grille, setting the letters right-side-up at the time of their taking off. And in all of these cases, the grille is still serving as an instrument for _writing-in_; there would be corresponding cases in which it is used as an instrument for _taking out_ the letters of a prepared block. Each variation, perhaps, would require its own separate analysis before its individual inherent weaknesses could be spotted and used as the basis for a special method. If the student, after observing some special methods applied to ordinary grille encipherment, cares to try his hand at analyzing some one of its variations, we suggest that he take a series of numbers, 1 to 36, 1 to 64, etc., and carry these through a complete encipherment to see what becomes of each one. * * * Grille transposition, like the Nihilist, involves a major unit composed of minor units. But here, the four minor units are never left intact, and if the type of encipherment is not known in advance, the decryptment of a single block will give somewhat more trouble than the decryptment of a single Nihilist block, for the reason that the decryptor usually exhausts the simpler possibilities before trying the complex. With grille encipherment known, or suspected, we have a cipher bristling with points of attack. The strictly horizontal writing-in of each minor unit has had to be done within a fairly short compass, and no two consecutive letters of this unit can have been placed very far apart without causing other letters to draw closer together. Their average distance apart is four cells. For the decryptor, this actual distance apart of letters is made shorter by his knowledge that for each letter considered, there are three others which cannot have been written into the same unit with it, _and that he knows definitely what these three letters are_. Particularly interesting is the assistance he receives from the symmetrical pattern into which the letters of his four units are written; position 3 is position 1 reversed, and position 4 is position 2 reversed. Thus, having tentatively selected the letters of a probable word, or fairly long sequence, he can check the correctness of his observations by examining another sequence which would automatically build up, traveling in the opposite direction, in the reverse position of the grille. For a clear understanding of these matters, suppose we consider the decryptment of the block just enciphered, on the assumption that we suspect the presence there of the word VIADUCT. Fig. 21 shows a 6 x 6 block carrying consecutive cell-numbers, which are also the serial numbers of the cryptogram letters, as these appear in a separate block beside the first. It is understood that our first move would be that of ascertaining whether or not the seven letters of this word are all present. It must be remembered, too, that a long word is not necessarily altogether in one unit; the grille might have been turned before the word was completed. In the present case, however, our first letter, _V_, is found near the top of the square, and only once, so that if the word VIADUCT is present, a substantial portion of it must have been written before the grille was turned. We expect to find letters _I_, _A_, _D_, _U_, and so on, following the letter _V_ in just that order, and without any very great distance between any two of them; and if, approaching the bottom of the square, we find it necessary to proceed backward for _U_, _C_, or _T_, then the grille was surely turned before that _U_, _C_, or _T_, was written. Now, considering together the two blocks of Fig. 21, we find that our first letter, _V_, occupies cell No. 7. In imagination, we revolve a grille in which the only aperture has been cut in cell 7, and find that this aperture exposes the cells numbered 5, 30, and 32. These three cells, then, were surely covered from sight when the letter _V_ was written into cell 7, and regardless of what the letters are that occupy these three cells, it is definitely impossible that any one of the three could have been used in the same minor unit with the _V_ of cell 7. Looking for a letter _I_, we find several within a very short range. But the block contains only one _A_, and since we cannot proceed backward after selecting the _I_, the position of _A_ (cell 10) tells us that only the _I_ of cell 9 is possible. We accept, then, the _I_ of cell 9, and, again revolving an imaginary grille with its only aperture cut in cell 9, we eliminate the letters found in cells 17, 28, and 20. Similarly, accepting _A_ of cell 10, we eliminate whatever letters are occupying cells 23, 27, and 14. So far, none of the letters eliminated have been wanted for the development of the word VIADUCT; but notice that the fourth letter, _D_, found only once in the block, occupies cell 15, thus eliminating the letters of cells 16, 22, and 21, one of which is _U_, the next letter needed. Thus, we are not forced to make a decision as between the _U_ of cell 16 and the _U_ of cell 18. Figure 21 1 2 3 4 5 6 B T M R X5 U 7 8 9 10 11 12 V7 C I9 A10 I S 13 14 15 16 17 18 R F D15 U S U18 19 20 21 22 23 24 T19 I R I22 H E 25 26 27 28 29 30 I N O27 N28 C S30 31 32 33 34 35 36 T O32 J S O N We have put together, then, the letters _V I A D U_ in the only manner which is possible at all, and their cell-numbers, taken in order, are 7-9-10-15-18. If the grille is reversed, these same openings, named in the same order, will uncover cells 30-28-27-22-19; these new cells, however, will not be seen in reverse order; they will be in straight order like their letters. If, then, our sequence _V I A D U_ is correct, the five letters found in cells 19-22-27-28-30, taken in normal order, should form an acceptable English combination. A glance at the right-hand block of Fig. 21 will show that this check-sequence is _T I O N S_. When we selected _V_, we automatically selected _S_ of cell 30 as its check-letter. When we added _I_ on the right-hand side of _V_, we obtained with it the _N_ of cell 28 on the _left_ side of _S_, giving the check-digram as _NS_, entirely acceptable. With _A_, we added the _O_ of cell 27, giving the check-trigram as _ONS_, still acceptable; and so on to _IONS_, _TIONS_. Our complete word VIADUCT produces the check-sequence _UCTIONS_. It must not be objected that the fact of having only one each of letters _V_, _A_, _D_, has too greatly facilitated the search. This is an entirely legitimate expectation in a case where we deal with one unit, and the decryptor, when possible, chooses his probable word with this in mind. In the absence of a probable word, we are never without probable sequences: the list of frequent trigrams, and the various common affIxes, such as _-TION_, _-MENT_, _-ENCE_, _-ABLE_, _CON-_, _PRE-_, etc. For the first three or four letters, where decisions are sometimes uncertain, it is more satisfactory to work directly on the square (prepared in ink), so that impossible cells may be canceled in pencil, and the pencil marks erased when wrong; but once well started, a paper or celluloid grille can be prepared to fit the block, and the chosen cells actually cut out as they are selected. Having found seven out of nine apertures, we may, if we like, turn the paper grille and experiment with its other two positions. The letters, in this case, will show gaps in sequence, and may indicate by these gaps just where the new openings ought to be cut. With one full unit determined, we have the grille for reading the others. The only remaining problem would be that of deciding the exact sequence of these four units, with their context as a guide. For the case in which it is necessary to begin with letter-sequences, particularly if driven back to the digram list, the device shown in Fig. 22 may prove of considerable assistance: The cryptogram is written in both directions, and thus pairs every letter with its check-letter, so that check-sequences here would be written backward. This idea is adapted from General Givierge’s _Cours de cryptographie_. Figure 22 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 B T M R X U V C I A I S R F D U S U N O S J O T S C N O N I E H I R I T 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 T I R I H E I N O N C S T O J S O N U S U D F R S I A I C V U X R M T B 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 Working with digrams is tedious, but will, in the end, give results. Considering, for instance, Fig. 22, its first letter is _B_. Of letters standing immediately to the right of _B_, the first one which would form a good digram with it is the _R_ of cell 4. But consideration of a possible digram _BR_, cells 1-4, shows the check-digram as _JN_, cells 33-36, and this latter digram is so rare in the language that Meaker did not find it even once in his 10,000-letter text. The next letter known to have an affnity for _B_ is the _U_ of cell 6, but a possible digram _BU_, cells 1-6, cannot be considered, for the reason that cells 1 and 6 are uncovered by the same opening in the grille. The distance away of the next letters to which _B_ is partial proves frightening, and _B_ is abandoned (it is actually followed by the _X_ of cell 5). Figure 23 R R T H A O U E E O S B A G D E A E A V E B K U N E S F D I A N K S S S T A D P E B R A N S U K O D X F D N C R E A R R N J A T I Y G O A O A R A O I L I D X T U S O B R A A N L E T S G T E P L M A O T V H R A X E X Beginning over, with _T_ of cell 2: The first frequent digram noticed is _TR_, cells 2-4, and shows the check-digram as _JO_, cells 33-35. We accept this at once, because the letter _J_ must presumably be followed by a vowel, and the only vowel immediately available is this particular _O_. To extend the accepted _TR_, we require a vowel. The first one is U, cell 6, and extends the check-digram to _TJO_, cells 31-33-35, acceptable if _T_ is the final letter of a word. To extend the supposed trigram _TRU_, we experiment with _C_ of cell 8 and obtain a check-sequence _CTJO_, cells 29-31-33-35, which is still encouraging. We must know, of course, that no two of the chosen cells are in conflict with each other. The unit we have partially reconstructed is the second one of Fig. 20, and the check-sequence is the fourth unit. A method somewhat resembling the foregoing consists in writing another block beside the first, in which the letters of the cryptogram are strictly in reversed order. The pattern of the check-sequence will then follow exactly that of the sequence under examination, merely with its letters in reverse order. Still a further suggestion was made by Herbert Raines: In the preparation of the two blocks, one in straight order and the other in reverse order, the writing should be done vertically, with all columns containing four letters. The symmetry can still be found, and any two consecutive plaintext letters are more nearly at their original distance apart — the average 4. So far, we have been dealing with an isolated unit. In Fig. 23 we have a longer cryptogram, suspected of being a reply to the first. We have set it up in its three blocks, expecting to decipher it with the same grille, but find that something is wrong. To see quickly how the presence of several units modifies the case, suppose we consider some sequence, right or wrong, which is easily examined, such as the _AVE_ on the second row of the first block. Regardless of what the transposition is, if all three of these units are enciphered alike, each of the additional blocks contains a corresponding trigram in exactly the same location as the one under consideration; here we have _NES_ in the second block and _ANK_ in the third. But if the transposition is specifically that of the grille, each one of the three trigrams _AVE_, _NES_, _ANK_, has a check-trigram in its own block. Thus we have the six trigrams listed with their cell-numbers in Fig. 24. Since all of these are acceptable, we should, in practice, be encouraged to accept them; thus, it may be well to say here that, in dealing with all ciphers these false beginnings will quite frequently pitch the decryptor headlong into a solution, through no act of wisdom on his own part. Figure 24 Straight Reversed 7 8 9 28 29 30 A V E L I D N E S S O B A N K N L E Now, in order to arm ourselves against the larger grilles, which are somewhat more troublesome, and for investigation of cryptograms which may or may not have been accomplished with a grille, suppose we take a look at Ohaver’s mechanical method — that is, his use of paper strips. Picturing any block of 36 cells, numbered consecutively as we saw these in Fig. 21, let us imagine that there is a grille placed over this block, and that this grille has only one opening. If the cell that shows is No. 1, then, at the first turn of the grille, we uncover cell No. 6; at the next turn, cell No. 36; and, at the final turn, cell No. 31. We will call this series of cell-numbers an _index_, and say that the index for this particular aperture is 1-6-36-31. In the first block of the new cryptogram, the letters which follow this index are _R O P T_. In the second block, the same index governs the letters _U B V L_, and, in the third block, _A E X H_. But if the single opening in our hypothetical grille has exposed cell No. 2, then its _index_, discovered in the same way, is 2-12-35-25, and the corresponding letters, in the three blocks of this cryptogram are, respectively, _R U E A_, _E I T X_, and _G S E R_. Similarly, each one of the other seven apertures possible in this quarter of the grille has an index, expressible in cell-numbers, and governs a certain series of letters in each cryptogram block. If the grille is the Fleissner, the index for any aperture, in a grille of any size, will always contain four numbers, and will govern four letters per block. If the grille is a 16-letter one, there will be only four of these indices, beginning in cells 1, 2, 5, 6. If it is a 36-letter grille, there will be nine, beginning in cells 1, 2, 3, 7, 8, 9, 13, 14, 15. A 64-letter grille will have 16, beginning in cells 1, 2, 3, 4, 9, 10, 11, 12, 17, 18, 19, 20, 25, 26, 27, 28; and so on to grilles of 100, 144, etc., letters. After one grows accustomed to the swastika-like route of the open cell, such indices are not at all difficult to prepare at the moment of need; however, many solvers prefer to make them up in sets, once for all, and have them ready as they happen to be wanted. As to the finding of the four letters per block which follow any one index, it is sufficient to remember that the cell numbers, arranged in the manner shown, are also the serial numbers of the letters belonging to any one unit. Thus it is not necessary to write the units into their squares; we need merely number the letters of a unit from 1 to 36, and select those having the desired serial numbers. Returning, now, to our cryptogram: Our unit appears to be 36, since a division of this kind distributes the vowels uniformly; and a unit of 36 may have been produced with a grille. If so, this grille had 9 apertures, and we need 9 paper strips, one for each aperture. On each strip we are to have: the four index numbers, the four corresponding letters from the first block, the four corresponding letters from the second block, and the four corresponding letters from the third block. But since, in each case, the first three cell-numbers or the first three letters _must be repeated_, our strip will actually contain seven numbers and twenty-one letters. These nine strips are prepared all in one set-up, the details of which can be examined in Fig. 25. In Fig. 26, the strips of Fig. 25 have been cut apart and rearranged in such a way as to bring out plaintext on the top row of every block; this is, of course, the first _full_ row, as pointed out in each case by the four asterisks. It will be noticed that the top row of cell-numbers is arranged in strictly ascending order (our strictly horizontal route of writing-in). If the third row be now examined (as pointed out by two asterisks), it is found that this, too, carries plaintext, merely written backward, and that here the cell-numbers are arranged in strictly descending order. Figure 25 Preparation of Slips Index....... 1 2 3 7 8 9 13 14 15 6 12 18 5 11 17 4 10 16 36 35 34 30 29 28 24 23 22 31 25 19 32 26 20 33 27 21 1 2 3 7 8 9 13 14 15 6 12 18 5 11 17 4 10 16 36 35 34 30 29 28 24 23 22 Block 1...... R R T A V E T A D O U B A K E H B P P E T D I L R R A T A C S O R G I E R R T A V E T A D O U B A K E H B P P E T D I L R R A Block 2...... U E E N E S R A N B I K S D U O F S V T O B O S Y I T L X N M T J A U A U E E N E S R A N B I K S D U O F S V T O B O S Y I T Block 3...... A G D A N K O D X E S N A S D E S F X E X E L N R A O H R G R A O A A A A G D A N K O D X E S N A S D E S F X E X E L N R A O Now, to read the cryptogram: Each full row of numbers includes all cell-numbers belonging to some one of the four units, and any one of these four rows of numbers is a key to the grille, since it shows exactly what cells were uncovered when the corresponding unit was written in. To obtain the grille, we have only to select some one row of numbers, as 12-36-10-16-34-9-26-32-13, and clip out these particular cells in a square numbered as we saw it in Fig. 21. The student who cares to know what “instructions” were being sent might also satisfy his curiosity as to whether or not this new cryptogram could have been deciphered rather than decrypted. Figure 26 One Correct Adjustment of Slips ┌────┐ ┌────┐ │ 9 ├────┬────┤ 13 │ ┌────┐ ┌────┤ 17 │ 8 │ 7 │ 4 │ ┌────┤ 1 ├────┬────┤ 3 │ 28 │ 11 │ 5 │ 24 │ │ 2 │ 6 │ 14 │ 15 │ 18 │ 20 │ 29 │ 30 │ 33 │ **** │ 12 │ 36 │ 10 │ 16 │ 34 │ 9 │ 29 │ 32 │ 13 │ │ 35 │ 31 │ 23 │ 22 │ 19 │ 17 │ 26 │ 7 │ 4 │** │ 25 │ 1 │ 27 │ 21 │ 3 │ 28 │ 8 │ 5 │ 24 │ │ 2 │ 6 │ 14 │ 15 │ 18 │ │ 11 │ 30 │ │ │ 12 │ 36 │ 10 │ 16 │ 34 │ │ 29 │ │ │ │ 35 │ │ 23 │ 22 │ │ E │ │ │ T │ │ │ │ │ │ │ E │ V │ A │ H │ │ │ R │ │ │ T │ L │ K │ A │ R │ │ R │ O │ A │ D │ B │ R │ I │ D │ G │ **** │ U │ P │ B │ P │ T │ E │ O │ S │ T │ │ E │ T │ R │ A │ C │ E │ V │ A │ H │** │ A │ R │ I │ E │ T │ L │ K │ A │ R │ │ R │ O │ A │ D │ B │ │ I │ D │ │ │ U │ P │ B │ P │ T │ │ │ │ │ │ E │ │ R │ A │ │ S │ │ │ R │ │ │ │ │ │ │ U │ E │ N │ O │ │ │ U │ │ │ E │ S │ D │ S │ Y │ │ E │ B │ A │ N │ K │ J │ O │ B │ A │ **** │ I │ V │ F │ S │ O │ S │ T │ M │ R │ │ T │ L │ I │ T │ N │ U │ E │ N │ O │** │ X │ U │ U │ A │ E │ S │ D │ S │ Y │ │ E │ B │ A │ N │ K │ │ O │ B │ │ │ I │ V │ F │ S │ O │ │ │ │ │ │ T │ │ I │ T │ │ K │ │ │ O │ │ │ │ │ │ │ D │ N │ A │ E │ │ │ A │ │ │ D │ N │ S │ A │ R │ │ G │ E │ D │ X │ N │ O │ L │ E │ A │ **** │ S │ X │ S │ F │ X │ K │ A │ R │ O │ │ E │ H │ A │ O │ G │ D │ N │ A │ E │** │ R │ A │ A │ A │ D │ N │ S │ A │ R │ │ G │ E │ D │ X │ N ├────┤ L │ E ├────┘ │ S │ X │ S │ F │ X │ └────┴────┘ │ E ├────┤ A │ O ├────┘ └────┘ └────┴────┘ * * * Concerning the grille cryptograms which follow, it seems not impossible that the student who has seen his principles applied only to a unit of 36 might find some difficulty in adjusting them to grilles of other sizes. A tip, then, on Example 22: Instead of the regulation nulls, its single unit was completed with a common Spanish phrase beginning with _Q_. And if it still resists: the author’s own name was used as the key for constructing the grille. In adjusting his paper strips (when this is the method he prefers) it makes no particular difference what plan he follows, so long as it works. Some decryptors prefer to concentrate altogether on the strictly ascending series of cell-numbers, allowing letters to form their own sequences. Others will always have before them the set-up of squares, noting there some possible letter-sequence, finding (by means of their cell-numbers) the strips which contain these letters, and then observing results in other blocks. If the given strip cannot be found, then the cell must be already in use. The shortest road is that of the probable word. For instance, the set-up shown as Fig. 26 was actually initiated by the solver at the letter _J_ of the second block, this being a rare letter and almost invariably followed by a vowel. Of the several vowels immediately in sight (in the square) the correct one was promptly suggested by the sequence so plainly in sight, _OB_, suggesting the word _JOB_, one already used by these people in discussing their mysterious activities. The corresponding cell-numbers, 20-29-30, were found to be on three separate strips — a necessary condition — and when placed together brought out the straight sequences _RID_ and _OLE_, with reversed sequences _AVE_, _NEU_, and _AND_. Another very probable word was suggested by the check-sequence _AVE_ (_HAVE_), and the necessary _H_ was found with cell-number 33, bringing solution to the point suggested roughly in Fig. 27, where attention was promptly focussed on the tetragram _RIDG_, suggesting _BRIDGE_, another word previously used. There were two strips carrying the desired _E_, but both refused to fit; and here the cell-numbers came into play. The last one found, 33, was large and suggested that its letter, _G_, might be the last letter of a unit; afterward, the building was continued on the left, with _B_. Figure 27 Straight Reversed 20 29 30 33 17 8 7 4 R I D G E V A H (Have) J O B A U E N O (one u) O L E A D N A E (e and) 22. By PICCOLA. (Probable word: CRYPTOGRAMS). T S T H E T T U S H O E D G F R D O E O G R I S A A M S N M Q E U G I B R I E L N O S T H S I C L S E T S W A T H A B R Y P A E. 23. By DAMONOMAD and POPPY. (Probable word: RIGHT FLANK). A E K D S P V T O O N N A A O N R O N P R O C T I E H T R E H N E T I A F G S R H T N I L O V T E F F A L M K I E C L A A S N M. 24. By DAMONOMAD and POPPY. (Probable word: SPECIAL MESSENGER). E Y U I S S N S F P A O P E R I S C O A M N R A I R G A A T A L I M N E G E E I S O S N O S A D N B E I T N O N G U E P R H T E E W S R U A S S K V Y P I T O N O U E Y S O C M W O T N S T E U O B D G. 25. By SAHIB. R N I I I N G T F L A I L N N D E E T D R V E U S E S T H R E I G E Y F I A N O U R R D L G Y T N H A E O N R N E K C D E E I S E Y B S E F W Y P G R L O L O E U O F H P A T V E R E H E R A E D G M I T R H N E E I S Y T Q T S I I S A U S G I E A I C A S L L K L L T T X H V H E A R X A X. 26. By NEMO. I K O T H N N E H N E E I R C R A G E L O R N O H K T W T C H O H E I E S S W W T N E T R H A R E O L S P L A A G E A E R L D B R Y E U I T R T R E N I D T H E I A D E I E N D P D A B R A E C R K E M T A O A U T O T S Y N B P E S N U H E S R A H E S U P D. 27. By DAN SURR. O L T L A L I G E R T I V H E L L E R K I E A E I J F E I Y Y O O U U S T H E A V A S G Y A S A W C K E P L U E Z T I Z O S I T. 28. By PICCOLA. (This is not a grille. It's a serious matter!) H S O E S N P T A E T O H I S T W L E D T T F A I B T Y U Y O T C E O I I T R C Y S B T R A H B T E I D O U S C I U O K R O Q N. CHAPTER VI Irregular Types — Columnar Transposition Square units, in actual use, are less convenient than those rectangular encipherments in which only one dimension of the block is restricted, thus permitting that a single key govern messages of many different lengths. We have a more practical cipher in the columnar transposition of Chapter IV, and this can be rendered somewhat safer if care be taken to avoid completing the rectangle. The preparation of such a block is illustrated in Fig. 28, where the key-word PARADISE is being used to encipher the following text: REGRET CHANGE IN SYSTEMS BUT THOUGHT ADVISABLE ACCOUNT INCREASED VOLUME SENT BY AIR. Figure 28 P A R A D I S E 6 1 7 2 3 5 8 4 R E G R E T C H A N G E I N S Y S T E M S B U T T H O U G H T A D V I S A B L E A C C O U N T I N C R E A S E D V O L U M E S E N T B Y A I R X X X X . . . . . First, let us understand the purpose of the four nulls. It is customary, when cryptograms are to be transmitted by wire or radio, to make them evenly divisible into five-letter groups. This usually means the addition of from one to four nulls, and since the nature of the cipher makes it inadvisable that additional letters be added to the enciphered cryptogram, any desired nulls must be added in the block before the columns are taken off. Another precaution usually recommended is the avoidance altogether of key-lengths which are divisible by 5, so that an encipherer is practically never compelled to add a complete five-letter group in order to leave his rectangle incomplete. It might be added that our use of letters _XXXX_ is for emphasis only; a better series would be one of the nature _AAEO_. The decipherer’s only problem is illustrated in Fig. 29. Knowing the key, the decipherer knows that there must be eight columns. The number of letters, 75, divided by 8, results in 9, with remainder 3; thus, the short columns are to contain nine letters, and there will be three which contain ten letters. He lays out an 8 x 10 block, cancels the last five cells, writes his key-numbers across the tops of the columns, and then begins to copy letters, filling the column numbered 1, then the column numbered 2, and so on, finally reading his message by straight horizontals. Figure 29 P A R A D I S E 6 1 7 2 3 5 8 4 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ............... ............... _ _ _ _ _ _ _ _ _ _ _ x x x x x The cryptogram from this block is shown as Fig. 30, and illustrates the manner in which the decryptor will number the letters of practically all cryptograms in order that he may quickly locate any desired letter, or learn, by subtraction, the distance apart of any two letters. The decryptor, of course, does not know how many columns the cryptogram contains, and even after he finds out the key-length, he still does not know exactly the point at which any one column ends and another begins. This form of transposition is among the most fascinating of decryptment problems, and we shall look at it from several angles. The simplest case is that in which the decryptor correctly assumes the presence in his cryptogram of some word or phrase whose length is greater than that of the key; if this probable word is long enough, he is able to learn, not only the key-length, but the order in which to write his columns. Our present cryptogram, for instance, has key-length 8, and contains two nine-letter words, ADVISABLE and INCREASED. These two words, repeated in Fig. 31, will show what happens when a word is long enough to overlap the block. With the word ADVISABLE, the final _E_ falls below the initial _A_, and when this column is taken off, the letters _A E_ will stand in sequence in the cryptogram. Similarly, the word INCREASED will provide, in the cryptogram, a digram _ID_. Should the decryptor suspect the presence of either of these words, he would look at once for sequences of this kind in his cryptogram, and the presence of _AE_ (or _ID_) would tell him that the key-length is probably 8, which is the distance apart of the two letters in his probable word. Figure 30 The Cryptogram Prepared for Examination 5 10 15 20 25 30 E N T H V C C O T X R E M U S O E U Y E I S G A U A M A H Y 35 40 45 50 55 60 T A E I D E X T N B H B N S E I R A S T D A N V N X G G E O 65 70 75 I C R L B X C S U T L T E S R Figure 31 6 1 7 2 3 5 8 4 . . . . . . . . . . . . . . . A D V I S A B L E . . . . . . . I N C R E A S E D V O L U M E . . The ideal case is that in which the probable word is long enough to furnish more than one of these overlapping letters, as shown in Fig. 32 in connection with the “word” INCREASED VOLUME. Suppose that we have suspected the presence of this expression in our cryptogram, and have ascertained that the necessary letters are present for forming it. We consider its letters one by one, in the order _I_, _N_, _C_, _R_ . . . . and go through the cryptogram, underscoring (or otherwise noting) all cases in which the given letter is followed immediately by another of the letters found in the same probable “word.” But, in considering any one letter, say the letter _N_, we ignore such sequences as _NT_, _NB_, _NX_, whose second letters, _T_, _B_, _X_, do not occur in the expression INCREASED VOLUME. Fig. 33 shows exactly what digrams of this kind can be found in connection with letters _I_, _N_, _C_, _R_, _E_, and also the distance (or distances) apart of the two given letters as found in the probable word. Notice that in connection with every letter there is one digram in which this distance is 8, the correct key-length of our present cryptogram. And when these digrams are selected from the tabulation, and set up vertically with top letters in the order _I N C R E_, the lower five letters prove up in the order _D V O L U_. In actual work, the tabulation must sometimes be made, though ordinarily it will suffice to start directly with the “proving up.” Figure 32 I N C R E A S E D V O L U M E I N C R E A S E D V O L U M E I N C R E A S E D V O L U M E Now let us go ahead and solve the cryptogram, as shown in Fig. 34. We will assume, to begin with, that our cryptogram has been prepared at the top of a sheet, and that our various trials are being made on the blank space beneath it. We will assume also that, having discovered key-length 8, we have divided this cryptogram roughly into eight segments, three of which contain ten letters and the rest nine. First, we are in possession of a series of embryo columns, shown at (a), and these can be set up without looking at the cryptogram at all. Having done this, we turn to the cryptogram, find each one of the sequences again, and lengthen the columns of our beginning block by adding to each pair of letters a few of the letters which immediately precede and follow it. Thus, our block begins to build up as at (b); and, for each time that a partial column is set up in (b), the segment which contained it is promptly circled out of the cryptogram itself, which now begins to assume the appearance indicated at (c). Thus some words have automatically formed on the new lines which tell us plainly that the final column must contain a sequence _L T E_, followed by _S_ or _W_, and the appearance of the cryptogram tells us plainly where to look for it; the final segment is the only one having enough letters to furnish another nine- or ten-letter column. Figure 33 Letter Examined & Distance Apart Sequences Found In Word I IS 6 ID 8 IR 3 IC 2 N NS 5 NV 8 C CO 8 CR 1 CS 4 R RE 1 4 11 RA 2 RL 8 E EM 9 (6)* EU 8 (5)* EO 6 (3)* ES 2 (*) Distances from the second E Proving up: I N C R E . . . (8) D V O L U At stage (c), we are practically in possession of the numerical key, and to show this, the cryptogram segments have been numbered. The first one, containing _V C C O T X_, has been set up in the partial block as column 3; thus the third column of (b) should have key-number _1_. The second segment, containing _S O E U Y E_, has been set up as column 5, showing that the fifth column of (b) should have key-number _2_. And so on with the rest, until the eight key-numbers are standing in the order 4-6-1-7-2-3-5-8. This is shown at (d), and directly below this, at (e) is the encipherer’s original key. It can be seen that we are now in very much the same position as the legitimate decipherer; by making a few trials, each time shifting one key-number from the left side to the right, we need do little more than decipher. Usually, however, it is quicker simply to go on and rough out the block we have already started, and then make the necessary adjustments, approximately as shown in Fig. 35. Having noted, in the cryptogram, that there are some unused letters, _E N T H_, on the left side of segment 1, we assume temporarily that all other unused letters belong to the segment which follows them, and add them all, indiscriminately, at the top of the block. Where this is shown, at the left side of Fig. 35, the true key-numbers, as found in the cryptogram, have been added above the original reference numbers, and similarly with the adjusted block on the right. Figure 34 Investigating the Key-length 8 (a) (b) 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 4 6 1 7 2 3 5 8 A D V I S A B . I N C R E A S E E A C C O U N . D V O L U M E ? I N C R E A S E D V O L U M E . E N T B Y A I . (c) X X X X E H R . (1) (2) (3) E N T H/V C C O T X/ ¦R E M U/S O E U Y E/¦ I S G/A U A M A H/Y ¦ (4) (5) (6) T/A E I D E X/T N¦B H/B N S E I R/A¦S T /D A N V N X/G¦G E O (7) (8) /I C R L B X║C S U T L T E S R x (d) Apparent key-numbers: 4 6 1 7 2 3 5 8 (e) True key-numbers: 6 1 7 2 3 5 8 4 With the block roughed out, and knowing that a cryptogram of 75 letters using key-length 8 cannot have columns of any other length than 9 and 10, the first obvious maladjustment is seen in column 1 (key 4), which has only 8 letters. Since this is the 4th segment of the cryptogram, its remaining letter (or its remaining two letters) will have to be found at the end of the third segment or at the beginning of the fifth (keys 3 and 5), that is, at the bottom, or at the top, respectively, of the columns originally set up as columns 6 and 7. The selection of _H_ from the bottom of column 6 leaves this column too short, while the top row of the block shows a gap in sequence, and evidently needs the _E_ at the end of the second segment. The lone _R_ which remains at the bottom of column 7 is then erased and written at the top of column 2, and thus we arrive at the adjustment shown on the right side of the figure, where the only remaining operation will be that of transferring the misplaced nine-letter column to its own side of the block. This final adjustment shows us the segments of the cryptogram in their key order: 6-1-7-2-3-5-8-4. Figure 35 Forming and Adjusting a Tentative Block _4 6 1 7 2 3 5 8 4 6 1 7 2 3 5 8_ 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 E G R T C R E G R E T C A N G E I N S H A N G E I N S Y S T E M S B U Y S T E M S B U T T H O U G H T T T H O U G H T A D V I S A B L A D V I S A B L E A C C O U N T E A C C O U N T I N C R E A S E I N C R E A S E D V O L U M E S D V O L U M E S E N T B Y A I R E N T B Y A I R X X X X E H R X X X X Column 1 must have another letter, top. (Found at bottom of Column 6). (4) (3) Column 6 must then have another letter, top. (Found a bottom of Column 5). (3) (2) Column 7, bottom, then shows an extra letter, which must be transferred to (5) Column 2, top. When these transfers have been made, as shown on (6) the right, all that remains is to transfer the short column (1) (4) to the right-hand side of its block, raising it by one position. Having seen the ideal case, the student will understand how the less perfect example would be handled, or the case in which the probable word is not long enough to overlap at all. For the latter, he would attempt to find some word like CRYPTOGRAM, in which there are letters such as _C_, _Y_, _P_, _G_, _M_, not likely to appear more than once or twice in a short text. We need not discuss this latter case, since we are to see something very much like it before the present chapter ends. Now, as a preliminary to those cases in which we are unable to find a probable word, suppose we turn to the back of the book, and make an inspection of the tool chest. First in importance, and valuable in ciphers of all kinds, is the digram chart which O. Phelps Meaker has been kind enough to prepare especially for this text. To learn how often he encountered any given digram in his 10,000-letter count, note its first letter in the horizontal alphabet, at the top of a column, then note its second letter in the vertical alphabet, at the beginning of a row, and observe the figure which occupies the cell at the intersection of this column and row. If the digram is _TH_, its frequency was 315; if the digram is _JN_, the cell is blank. This does not mean that the digram _TH_ will appear exactly 315 times in any other 10,000-letter text, or that _JN_ will never be found (occurring, say, as initials). It merely shows that the digram _TH_ is of remarkably high frequency, while a digram _JN_ is so rare that it practically never appears. The most commonly occurring digrams of this chart have been listed on another page in the order of decreasing frequencies. A list of the principal reversals is also given, with other data which will be found useful in the majority of ciphers. Meaker’s digram chart shows also the frequencies found for single letters in the same text. These are shown at the extreme right, and were obtained by adding the figures found on the 26 rows of the chart proper. When such counts are made, every letter in the text is considered to be the first letter of a digram, and no attention is paid to the separations between words. Thus the single-letter frequencies can be found by totalling either the columns or the rows, which, except for minor discrepancies, will check against each other. So much for _frequencies_. Now let us take a closer look at _sequence_. Certain letters, ordinarily those of lowest frequency, are peculiar in their _contacts_ with other letters. The shining example, in most languages, is the letter _Q_, followed, almost 100% of the time, by _U_ plus another vowel; and if it seems, in the present text, that the significance of _QU_ is being overlooked, this is simply because the individuality of this digram, like that of the German _CH_ (_CK_), is so well advertised that even the novice encipherer finds a way to avoid using it. It is impossible, however, to avoid all letters having individual preferences. We still have _J_ and _V_, practically sure to be followed by vowels, and _Z_, almost as sure. We have _X_, nearly always preceded by a vowel, but more often followed by a consonant. If these are missing from the cryptogram, we may have letters like _K_, _B_, and _P_, which confine an enormous percentage of their contacts to vowels; or to vowels and liquids; or to letters from the high-frequency group _E T A O N I R S H_. Even among the high-frequency letters themselves we find that _H_ is followed about 75% of the time by either _E_ or _A_, and that it is preceded largely by _T_, with _S_, _C_, and _W_ as the next favorites; or we find that _N_ is inordinately fond of vowels on its left, though with some preference for consonants on its right. All information of this kind is present in the digram chart, and usually is known to the decryptor without recourse to a chart. For the beginner, however, who might like to have it in a more visible form, another chart, of a kind which we believe has never before been published, appears on page 220. This is F. R. Carter’s contact chart, on which every letter of the alphabet has been listed in the center of the page, with its favorite contact-letters beside it. The arrangement here is from the center outward; the letters shown on the left of any given letter are those which most often precede it, with percentages as found in Ohaver’s digram chart; letters shown on the right are those which most often follow, with percentages from the same digram chart. This information was not completed to the end for every letter, since the only information wanted is the actual preferences of each letter, or the fact that it has none. However, the outermost columns will show the complete percentages of vowel and consonant contacts for all letters as these were found in one 10,000-letter text. With such a chart before us, it becomes very easy, in the absence of _Q_, and other particularly vulnerable letters, to make good use of whatever letters we happen to have; and it is hoped that this new “contact chart” will prove sufficiently valuable to justify Carter’s labor in having compiled it for us. As to the other data in the appendix, the student will do well to look it over. The list of trigrams is that of the Parker Hitt Manual, where _THE_ was shown as having been found 89 times in 10,000 letters, the others graduating downward to _MEN_, found 20 times. Now let us return to our columnar transposition. Figure 36 Key-length Columns, 75 Letters Key 5: (Impossible under system) Key 6: 3 columns of 13 3 columns of 12 Key 7: 5 columns of 11 2 columns of 10 Key 8: 3 columns of 10 5 columns of 9 Key 9: 3 columns of 9 6 columns of 8 Key 10: (Improbable under system) Key 11: 9 columns of 7 2 columns of 6 (Etc.) When a digram _QU_ is actually present in a text, or when it is fairly certain that some other digram may be present, such as the _YP_ of CRYPTOGRAM (that is, one composed of two infrequent letters), it is possible to discover (or limit) the key-length by observing the distance apart of these two letters in the cryptogram. To approximate such a case, using the foregoing cryptogram (Fig. 30), we will make use of the digram _VI_, and, in order to be brief, we will assume that the letter _V_, position 5, is the only one in the cryptogram, and that the only _I_’s present are those at positions 46 and 61. In one case the interval which separates _V_ from _I_ is 41, and, in the other, 56. As a preliminary step, we may discard all key-lengths which are factors of 75: 3, 5, 15, 25. In addition, we may discard, for the time being, the key-lengths 10, 20, etc., which are multiples of 5. Of those left, any very short length, as 2 or 4, is very improbable. We may consider, then, possible key-lengths of 6, 7, 8, 9, 11, etc., as far as we care to take them. To make ready for the investigation, we first prepare a sheet of the kind shown as Fig. 36, where each possible key-length has been used as a divisor in order to learn the column-lengths for each one in a 75-letter cryptogram. Figure 37 Q U I T E A F * E W F A N S W I L L B E D E L I G H T E D ** T O S E E *) From F in a short column to E in a long column is an interval of 5; but from E to F is an interval of 4. **) From T to E is an interval of 5; from E to T is an interval of 4. Now let us picture any text written into any block, as in Fig. 37, where long columns have five letters and short columns have four. Considering any digram in the text, as _QU_ at the beginning, its two letters are separated by exactly one column of length, provided the letters are counted straight down the columns and columns are taken in one straight direction, or provided the counting is done strictly upward with columns always taken in one direction. In the case of _QU_, this column of separation is a long one (five letters), while, in the case of _AF_, on the right-hand side of the block, it is a short one (four letters), but in both cases it is a full column. This is true, also, of the digram _FE_, which is on two different lines, presuming that, having counted all the way to the end of the last column, we start again with the first. If both letters are in short columns, the interval which separates them is that of a short column, and if both are in long columns, this interval is that of a long column. But if one letter is in a long column and the other in a short column, the separating interval may be long or short, according to whether the columns are taken in straight order or in reverse order. If the columns of Fig. 37 should be cut apart, and placed in some other order, then other columns might be placed between the one containing _Q_ and its neighbor containing _U_, but these would be _full columns_, never fractional columns, so that the interval from _Q_ to _U_ would always be an exact number of full columns. This is what happens in columnar transposition. If the digram _VI_, which we intend to consider, was actually present in the original encipherment block, then, in the cryptogram, its letters _V_ and _I_ are separated by an exact number of columns, long or short or mixed. Also, if the column containing _V_ was taken off first, the distance from _V_ to _I_ may include the full number of long columns permitted by the key-length, but must fall one short of including all of the short columns; but if the _I_ comes first, the opposite is true. Now, assuming that the only _V_’s and _I_’s in our cryptogram are those appearing at positions 5, 46, and 61, we find that if the first of the _I_’s is considered, the distance from _V_ to _I_ is 41, while, if the other is the one considered, then this distance is 56. We will investigate, first, the interval 41. If _V_ and the first _I_ stood in sequence in the encipherment block, either as _VI_ or as _IV_, then the interval 41 represents a certain number of complete columns, and if the digram was _VI_ (since the _V_-column was evidently taken off first), this interval 41 must not include the full number of short columns, but may include the full number of long ones. Consulting Fig. 36, we find that key-length 6 calls for columns having 12 and 13 letters, and it is impossible to divide an interval 41 into columns of such lengths. The key-length 7 calls for columns having 10 or 11 letters, of which only two columns may have the shorter length; an interval 41 can be divided into the right lengths, but only if three of the columns are short. Thus, if the first _I_ is the correct one, the key-lengths 6 and 7 are totally impossible, as is also key-length 8. The key-length 9, however, calls for columns having 8 and 9 letters, of which six have the shorter length. An interval 41 can be divided to produce four short columns and one long column. Again, the key-length 11 calls for columns having 6 and 7 letters, of which two columns may be short; and an interval 41 will provide five long columns and one short column. These two key-lengths, then, 9 and 11, are possible, presuming that the first _I_ is the one which actually followed _V_. When the other _I_, interval 56, is investigated in the same way, it is found that the only key-lengths possible are 8 and 11. So that if the digram _VI_ is present at all, the key-length must be 8, 9, 11, or something longer. Since the key-length 11 is possible in both cases, this is the one which tempts; when it fails, the remaining two can be tried. The student may decide for himself whether a trigram _IVI_ is possible, considering the distance apart of the two _I_’s. It will be readily understood how this method, in combination with the one first explained, could be used, say, in a cryptogram where the suspected word is CIPHER, with the low-frequency letter _P_ occurring only once. * * * Totally aside from analysis, there are many ways in which the key-length can become known, or suspected. If the correspondence is a military one, it may have been learned by espionage, perhaps through careless talk on the part of an enlisted man; or, because of careless habits on the part of the authority providing the keys, in having confined himself always to certain lengths. Knowing the key-length is two-thirds of the battle. It enables us, as in our former case, to mark off the cryptogram into its approximate column-lengths, making it easier to know the approximate whereabouts of any several letters supposed to form a sequence. It even enables us to prepare a block, which, cut apart to form paper strips, will effect a mechanical solution almost as easily as in the case of the completed unit. Such a block, for our foregoing cryptogram (Fig. 30), can be studied in Fig. 38, and is explained as follows: An 8-unit key, used on a 75-letter text, calls definitely for three 10-letter columns and five 9-letter columns, and these columns have become eight segments in the cryptogram. If all three of the long columns were taken off first, then the arrangement shown at (a) has every letter in its proper column. And if all three of these were taken off last, then the arrangement shown at (b) has every letter in its proper column. With blocks shown for the two extreme cases, it can be seen that the block at (c) is a combination-block, in which one of the two extremes has been superimposed upon the other, so that every column in block (c) shows every letter which it could possibly have contained. By concealing the letters of the “cap,” we have a duplicate of block (a); and by changing the alignment, so as to bring all of the topmost letters into the same row, we have block (b), with a “cap” attached at the bottom. Figure 38 Preparation of Strips for a Known Key-length (a) Long Columns at Left (b) Long Columns at Right E R I T B S G C E X Y A X I X X N E S A H T E S N R E H T R G C T M G E B D O U T E I Y N A G S H U A I N A I T H M S T B S E U V S U D S N C L V U G A H T O T C O A E E V R T C S A E B D I L C E M X I N L E C O U I N A C T O U A T R X B S O E A D S N R E T Y H N A G X R T U M E E V L S X E Y N B R (c) Combination Block (d) Matching Strips 1 2 3 4 5 6 7 8 . . | 8 | . a x i 3 . . . y h t r x . 5 . 4 x e y n a g x y x x a E R I T B S G C e t C h ← N E S A H T E S I n S y T M G E B D O U S B U T H U A I N A I T G H T A V S U D S N C L ** A B L E ** C O A E E V R T U N T I C E M |X I| N L E A S E D O U |A T R X| B S M E S E T |Y H N A G X| R A I R X |X E Y H R T ← Y A N Comparing block (c) with the two above it: If the first column of (a) was actually a short one, then its last letter, _X_, belongs at the top of the second column. The making of this transfer would cause the second column to have eleven letters, so that it would become necessary also to transfer the last letter of the second column to the top of the third; this third column would then have too many letters, and its last letter would have to be transferred to the top of the fourth, which at present has only nine and may have another. But if the second column was also short, then there are two of its letters which belong at the top of column 3. And if this column, too, was a short one, it has three transferable letters at the bottom. To prepare such a block, first write the cryptogram as at (a), and mark off its transferable (uncertain) letters by the following rule: One for the first column, two for the second, and so on, until the number is _equal to the number of long columns_, which is the maximum number possible. But if the final row is more than half filled, _the maximum will not be reached_, and a check may be made by marking off letters from right to left: zero for the last column, one for the next-to-last, two for the third-to-last, and so backward to the number which equals the number of long columns. Having marked off the transferable letters, form the “bonnet” by copying these, in each case, at the top of the following column, preferably making some clear distinction to show the duplication. For this latter purpose, many solvers use red ink. In this kind of work, as we saw in a previous case, the spacing must be accurate both laterally and vertically, since many of the letters belonging to the same sequence are not found on the same row. A few of the strips cut from block (c) have been matched at (d), where the beginning was made from the common suffix -_ABLE_. The duplicated letters _A H Y_ have shown up plainly, partly by the style in which the letters are written, and partly, too, by the fact of consecutive column-numbers, 3 and 4. This same thing is true of the letters _X T N_, column-numbers 4 and 5. These numbers, it must not be forgotten, are also the serial numbers of the cryptogram segments, and thus are the key-numbers. With the eight strips correctly matched, and any misplaced columns transferred to their own side of the block, the strip-numbers as they stand across the top will reproduce the numerical key. The matching of strips is generally a purely mechanical process, in which impossibilities are not considered. However, having before us a block (a) or (b), it is possible to apply the principle used with our former digram _VI_, and find out in advance whether certain letters found on two strips can possibly have stood in sequence. Nor is the cutting apart of the strips really necessary; it is merely a convenient method for dispensing with mental effort. Now suppose we consider this same cryptogram on the theory that its key-length cannot be determined, or restricted to certain possibilities. Our first step is to select, somewhere in the cryptogram, a segment which is to be set up vertically on a sheet of paper to act as a _trial column_. If we select it from the body of the cryptogram, we shall have to make it a rather long segment, since we are uncertain as to whether it represents one column or parts of two. We should do this, however, if the body of the cryptogram shows _Q_, or any other letter or series of letters likely to be vulnerable. Otherwise, we know definitely that one of the columns begins with the first letter of the cryptogram, and that another column ends with the final letter of the cryptogram, and one or the other of these two segments is usually chosen, preferably the one containing the largest number of vulnerable letters. If we have a probable word, and find that its letter _P_, or _M_, or _G_, is the only one in the cryptogram, we select the segment which contains this _P_, or _M_, or _G_. Figure 39 Tests, in Attempting to Judge Column-Length E G 20 ( 15) N G 75 ( 83) T E 94 ( 74) H O 46 ( 42) V I 19 ( 14) C C 12 ( 6) C R 7 ( 12) O L 17 ( 36) T B 14 ( 8) X X - ( -) R C 14 ( 7) E S 145 (115) M U 13 ( 7) U T 45 ( 35) S L 6 ( 9) (First column of figures is taken from Meaker's chart; the second is from Ohaver's). Wherever the trial segment is taken, there is always the question as to how many letters ought to be included. In Fig. 39, the decryptor has decided to take the beginning segment of the cryptogram, and has started with 15 letters. He has written beside it another 15-letter segment, chosen because of _NG_, _HO_, _VI_, and is attempting to tell, by the appearance of his digrams, and their frequencies as taken from two different digram charts, just about how far his digrams are uniformly good. If the nulls in use are actually _XX_, he knows immediately that this is the end of his two columns; otherwise, his digrams are acceptable throughout. If he sets down beside each digram its frequency as taken from Meaker’s chart, he might decide that his digrams are good as far as _UT_, depending somewhat on the letters represented in our _XX_. Using Ohaver’s frequencies, he would feel sure that his digrams are good as far as _OL_. In many cases the frequencies shown for the lower digrams will grow so erratic as to be plainly unlikely; and in other cases, more difficult than the present one, a check on the probable column-length can be had by preparing a similar set-up for the end-segment of the cryptogram, in which the lower digrams are excellent, while those extending upward may grow erratic. This decryptor is safe, however, in accepting as much or as little of the length as he likes; there will be a more definite line of demarcation when he attempts to write beside these a third column of 15 letters. The only cases which ever give trouble are those in which a short text has been enciphered with a long key. Key-lengths, generally speaking, hardly ever run outside of limits 5 to 15, that is, lengths which come from single words. Thus a tentative key-length 10, 11, 12, lying half-way between these extremes, is always safe to try. The key-length 10, applied to 75 letters, gives columns of 7 or 8, and, in the discussion which follows, the tentative column-length was fixed at 8 letters. Figure 40 (The numbers assigned to these set-ups merely indicate the order in which the second segments were taken). 1 8 9 10 11 2 3 E U 7 E Y 17 E B 11 E X 17 E G 20 E S E O* N S 51 N T 110 N N 9 N G 75 N G 75 N O N E T O 111 T A 56 T S 32 T G 1 T E 94 T E T U *H E 251 *H E 251 *H E 251 *H E 251 *H O 46 H U H Y* V U - V I 19 V I 19 V O 6 V I 19 V Y* V E C Y - C D - C R 7 C I 15 C C 12 C E C I C E 55 C E 55 C A 44 C C 12 C R 7 C I C S* O I 13 O X - O S 37 O R 113 O L 17 O S O G 488 508 410 490 290 4 5 (1) (8) (9) (10) (11) 488 508 410 490 290 E E E I H E 251 H E 251 H E 251 H E 251 H O 46 N U N S 237 257 159 239 244 T Y T G* H E H A Ranked in the order: 8, 11, 10, 1, 9 V I V U* ......... C S* C A C G* C M* O A O A Same Test, Using Mr. Ohaver's Digram Frequencies: 6 7 1 8 9 10 11 E S E H* E U 6 E Y 24 E B 24 E X 14 E G 15 N G N Y N S 47 N T 97 N N 8 N G 83 N G 83 T A T T T O 92 T A 64 T S 27 T G - T E 74 H U H A *H E 305 *H E 305 *H E 305 *H E 305 *H O 42 V A V E V U - V I 14 V I 14 V O 9 V I 14 C M* C I C Y 1 C D - C R 12 C I 19 C C 6 C A C D* C E 46 C E 46 C A 36 C C 6 C R 12 O H* O E* O I 15 O X 1 O S 35 O R 99 O L 36 512 551 461 535 282 (Set-up No. 2 (1) (8) (9) (10) (11) would have 512 551 461 535 282 been tested.) H E 305 H E 305 H E 305 H E 305 H O 42 207 246 156 230 240 Ranked in the order: 8, 11, 10, 1, 9 (as before). Usually these trials are made by setting up the trial column (in pencil) several times in succession, so that several of the possible combinations can be seen side by side, in order to determine which is best. Sometimes this can be decided by simple observation. Otherwise, the combinations can be subjected to a digram test. This is made by setting down beside each digram, as formed by each pair of columns, its frequency as taken from a digram chart. These figures are then added in each of the set-ups, and the supposition is that the combination furnishing the highest frequency-total will be the correct one, provided this high total has been produced by all of its digrams collectively, and not by some one or two individual digrams. With short columns, such tests are never conclusive, but with as many as ten or twelve digrams they are nearly always dependable, and even with only five or six digrams they will often select a correct combination. Figure 41 1 2 3 4 Y E 12 D E 39 R E 148 E E 39 E N 101 E N 120 A N 172 O N 145 I T 88 X T 1 S T 121 I T 88 S H 30 T H 315 T H 315 C H 46 G V - N V 4 D V 4 R V 5 A C 39 B C - A C 39 L C 8 U C 17 H C 2 N C 31 B C - A O 2 B O 11 V O 6 X O 1 308 492 836 332 ..... Same Test, Using Mr. Ohaver's Digram-frequencies: 1 2 3 4 Y E 8 D E 64 R E 139 E E 57 E N 120 E N 101 A N 168 O N 162 I T 90 X T 4 S T 119 I T 90 S H 40 T H 377 T H 377 C H 53 G V 1 N V 1 D V 1 R V 6 A C 35 B C - A C 35 L C 1 U C 11 H C - N C 34 B C - A O 2 B O 13 V O 9 X O 1 288 560 882 370 It was decided here to choose as the trial column the first eight letters of the cryptogram: _E N T H V C C O_. This column is filled with consonants, indicating that those which follow or precede it might contain a number of vowels; and of the six consonants present, practically every one could be called a “vulnerable” letter, or, as we say in the Association, a “clue-letter.” If we wish, for instance, to choose a column which will fit well on the right-hand side of this trial column, we can search the rest of the cryptogram for two consecutive vowels to follow, respectively, _H_ and _V_, and these two vowels we should expect to find followed, either immediately or at interval 2 by some letter (usually a high-frequency one) which will follow at least one of the _C_’s. This kind of pattern, unfortunately, was found eleven times. In practice, we should probably abandon it rather than copy down and test eleven combinations; here, however, the eleven set-ups can all be seen in Fig. 40, accompanied by serial numbers to show the order in which their second columns were taken from the cryptogram. Some of these have not been tested. Of the five retained, particular attention is called to the fact that the one having the very lowest total is actually the correct one, as may be seen by turning back to the encipherment block. But when a single row of corresponding digrams (_HE_ in the first four set-ups and _HO_ in No. 11), has been subtracted throughout, it is seen that No. 11 moves upward toward its proper rank, having now the second highest total. In practice, it might even be selected in preference to No. 8, which grows erratic after its fifth digram (frequencies of 0, 55, 0). But the column-length 5, in practice, is not unlikely, so that a test made on the right-hand side of our trial column has not been at all conclusive. Figure 42 Trigram Observation 1 2 3(*) 4 5 REU REY ¦ REB REX REG ANS ANT ¦ ANN ANG ANG STO STA ¦ STS STG STE THE THE THE THE THO DVO DVI DVI DVO DVI ACY ACD* ACR ¦ ACI ACC NCE NCE NCA ¦ NCC* NCR VOI VOX* VOS ¦ VOR VOL (*) Acceptance of combination 3 would entail shortening columns. Postponing the decision, then, let us take a fresh sheet of paper and make some tests for columns which can be fitted on the left-hand side of our trial column. Here, we find that the best “clue-letters” are _N_ and _H_, standing at interval 2. To precede _N_, we should like to find one of the vowels of which it is so fond, and to precede _H_, we hope to find either _T_ or one of the letters _S_, _C_, _W_. That is, we hope to find a pattern in the rest of the cryptogram in which some vowel, other than _Y_, is followed at interval 2 by one of the letters _T_, _S_, _C_, _W_. This time we find only four segments, and when the test is made for these, as shown in Fig. 41, the resulting totals point decisively to the correct combination, which is No. 3. Notice, in both of these tests, that results are identical whether the frequency-figures are those counted by Meaker or those counted by Ohaver: In the test of Fig. 40, the five combinations (using either chart) are ranked in the order 8, 11, 10, 1, 9, while the test of Fig. 41 has ranked its four combinations in the order 3, 2, 4, 1. Selecting, then, combination No. 3 of Fig. 41, let us return to the doubtful tests of Fig. 40 and attempt to effect a combination between our No. 3 and some one of the five previously considered worth retaining. Thus we can make an observation of trigrams, as shown in Fig. 42. Figure 43 /E N T H V C C O/T X R E M U X O E U Y E I S G A U A M A H Y T A E I D E X T N B H B N S E I/R A S T D A N V/N X/G G E O I C R L/B X C S U T L T E S R Here, we must be guided by our judgment, since trigram tests, even with figures available, would never be feasible on columns of this length. The acceptance of No. 3, evidently, would mean the cutting of our column-length to 5 letters, which, as we have said, is not at all unlikely in an actual case. The two highest tests from Fig. 40, however, are those included in Nos. 2 and 5. With reference to No. 2, where the right-hand digrams have the higher total, it is not impossible that the trigrams _ACD_ and _VOX_ were actually in use, or that the set-up should be cut, above the trigram _ACD_; but No. 5 is the one which _carries word-suggestions all the way to the end_. Figure 44 (a) (b) (c) (d) A R E G A R E G R A R E G R E X A R E G R E T H A N G H A N G E H A N G E I C H A N G E I N Y S T E Y S T E M Y S T E M S S Y S T E M S B T T H O T T H O U T T H O U G U T T H O U G H A D V I A D V I S A D V I S A T A D V I S A B E A C C E A C C O E A C C O U L E A C C O U N I N C R I N C R E I N C R E A T I N C R E A S D V O L D V O L U D V O L U M E D V O L U M E ...S ...R (e) /E N T H V C C O/T X /R E M U S O E U/Y/E I S G A U A M/A H Y T A E I D/ E X/T N B H B N S E/ I/R A S T D A N V/N X/G G E O I C R L/B X C S U T L T E S R (f) (g) (h) X A R E G R E T X * R E G R E T * * R E G R E T C H C H A N G E I N C H A N G E I N C H A N G E I N S Y S Y S T E M S B S Y S T E M S B S Y S T E M S B U T U T T H O U G H U T T H O U G H U T T H O U G H T A T A D V I S A B T A D V I S A B T A D V I S A B L E L E A C C O U N L E A C C O U N L E A C C O U N T I T I N C R E A S T I N C R E A S T I N C R E A S E D E D V O L U M E E D V O L U M E E D V O L U M E S E S E N T B Y * I S E N T B Y A I S E N T B Y A I R X R X X X R X X X * R X X X X 6 1 7 2 3 5 8 4 .....(Key)....... With the adding of other columns, which can be done on either side of the set-up, further digram tests can be made (taken only on the two extreme right-hand or left-hand columns), but in most cases no further tests are needed. Considering, for instance, that No. 5 is the combination tentatively accepted, we need a segment from the cryptogram containing the _U_ which ought (apparently) to follow _THO_, then the _S_ or _C_ which ought (apparently) to follow _DVI_; that is, we want to find a sequence _US_ or _UC_ in the rest of the cryptogram; and this (apparently) should be followed by two vowels in succession, to fit after the sequences _ACC_ and _NCR_. In other words, we know exactly what kinds of letters ought to make up the column which can be added on the right side of combination 5, and even the specific letters. Or, if it is the left side on which we have chosen to fit the new column, we need a segment containing the _A_ of the apparent _ADVI_, followed at interval 2 by the vowel, probably _I_, which ought to precede a trigram _NCR_. In Fig. 43, the three segments of set-up No. 5 have been circled out of the cryptogram (to prevent further use of their letters), and the segment chosen to fit on the left side of set-up No. 5 has been underscored, ready to be circled out in case it is found to fit. It is now possible to see the suggested nine-letter words, ADVISABLE and INCREASED, the guessing of which would permit us to apply the easy method first described. With or without these guesses, the rest of the solution, as outlined in Fig. 44, is now plain sailing. At (a), the underscored segment of Fig. 43 is in place. At (b), the column containing the desired _US_ and following vowels has been set up on the right, where we seem to need the _E_ or _A_ of ADVISE or ADVISABLE, followed immediately by the _U_ or _R_ of ACCOUNT or ACCORD. At (c), we have found the segment, and at (d) (usually earlier), we are introduced to the actual lengths of our columns. Figure 45 The OHAVER CV-VC Test: RATEB OWSTT EETOP UUIMC YUAOG AIOIA OBSTB BAKAR YYEDT UWYNT NNFKG FJSOT WYQAR IROIH. TT TO cv TM TE cv WO cv WP WC WD YP vc YU YY YT vc (QU) (QU) (QU) (QU) AU AI AA AW vc RI cv RM RO cv RY cv IM vc IC vc IG vc IN vc 4 2 2 5 The following is the original cryptogram used by Mr. Ohaver for demonstration: TVYIE TRROR EHNIA EUDSR IEONI ORENA EEORP TEALO LTSUH LHQNO UCADD CSAAE TDVFU GNNYC YI. (Reprinted from Detective Fiction Weekly of October 8, 1927, with permission of The Frank A. Munsey Company). This latter can be seen by looking at the cryptogram (e), where all segments, as soon as selected, have been circled out. In finding a column which would complete the very evident word SYSTEM and, at the same time, furnish a letter suitable to precede _HA_, we find that this is the end-segment of the cryptogram, and would leave only two letters — far fewer than the number needed for furnishing another column. At (f), we have extended the rest of the columns by two (and one) letters, except that there is a gap in sequence on the next-to-last line. At (g), we have transferred the letter which will fill this gap, leaving a misplaced _X_ at the top; and, at (h), we have placed this _X_ where it belongs and are now ready to transfer the two misplaced columns and recover the key. This key, as before, is found by numbering the segments of the cryptogram, and assigning these key-numbers to the correct columns in the adjusted block. It is usually possible to go further, and learn the long words on which such keys might have been based. Concerning digram-tests, Ohaver suggests another which is more quickly made than the frequency test, and which the writer, so far, has found fully as reliable. Using “C” for “consonant” and “V” for “vowel,” he speaks of this as his VC-CV or “mixed” test. A digram like _HA_ is a _cv_ digram, one like _AT_ is a _vc_ digram, and others are _vv_ and _cc_ digrams. His theory is this: Since almost two-thirds of the digrams used in the language will be of _mixed_ formation, that is, either _vc_ or _cv_ digrams, it stands to reason that the set-up containing the largest number of “mixed” digrams would probably be the correct choice. The student may look it over in Fig. 45. * * * Figure 46 The Myszkowsky Cipher (a) Keyword: CURTAINS C U R T A I N S C U R T A I N S C U R T A 4 19 11 16 1 7 9 14 5 20 12 17 2 8 10 15 6 21 13 18 3 R E G R E T C H A N G E I N S Y S T E M S Cryptogram: E I S R A S T N C S G G E H Y R E M E N T. (b) Keyword: PARADISE P A R A D I S E P A R A D I S E P A R A D 14 1 17 2 7 12 20 10 15 3 18 4 8 13 21 11 16 5 19 6 9 R E G R E T C H A N G E I N S Y S T E M S Cryptogram: E R N E T M E I S H Y T N R A S G G E C S. As to possible variations, a cipher with a new name is not necessarily a different cipher. Fig. 46 shows a cipher originated many years ago by the cryptologist E. Myszkowsky, and advertised by its inventor as non-decryptable. The key-word here is repeated often enough to furnish one key-letter for each text-letter, nulls being added, when necessary, to prevent the complete unit which would result if key-word and text were allowed to end at the same point. This long series of key-letters is then treated as a single word, and is converted to a numerical key in the usual way, all _A_’s receiving the first numbers, all _B_’s the next numbers, and so on. The message of the figure is very short: REGRET CHANGE IN SYSTEMS. Try enciphering this in the ordinary columnar transposition, using first the key-word CURTAIN, which contains no repeated letters, and afterward the key-word PARADISE, which has a repeated letter _A_. In the second case, what happens to the two columns belonging to the _A_-numbers? Suspecting a Myszkowsky encipherment, how could you go about unscrambling the two? Suppose there were three? Fig. 47 plays another variation on the columnar theme. This cipher, originated by a member of the _American Cryptogram Association_, follows the rules of columnar transposition in all respects except that pairs alternate throughout with single letters (The text is: CHIEF WANTS YOU TO INTERVIEW SMITH). Can you pick out at a glance the really vulnerable feature of this cipher, and formulate a special method for its solution? Figure 47 The "AMSCO" Cipher (A.M.Scott) R A C K E T 5 1 2 4 3 6 CH I EF W AN T S YO U TO I NT ER V IE W SM I T HX Order for taking off: I YO V HX / EF U IE /... Cryptogram: I Y O V H X E F U I..... 29. By NEMO. (A military message). A O T O I N E H T C T O T L I I A W G E L P R V L R I I R I U A D E O W L R R R L C M E O N P E P T A V T S O H O E E N L S N P S S B Y T S L R O P D R G E T S S T S Y A W N E. 30. By PICCOLA. (Hostilities?) T A M L R I T E D W E E D H H N P W O S W R S H C N O I E D O H I L T C S T N I W A A R C D H H D A I E T P T R L R O W A S E E T A K F P W G M A T X E K A H D P I L E O F H W G I N H A K S F S S A A A H E H N D H H E H. 31. By AMSCO. (The "AMSCO" Cipher). N W L E L N T L C S L W D L Y L N S O O I D F I N R U C H A L N D C B S I D E A I T E T I K S T B E E O U T J A T I L I A C O R E A Y E E G A O. 32. By PICCOLA. (Can you recover this nice long keyword from the numbers?) Y K I E T N T H H E X I A E N U B A K E E W S C S I H T N L N E N E A K I E O B O L I E E A M C I F T I N A H S K A N I D L G S O E E I T T S W H L L E U A D H F S H A B E O E N O A N O S C P H S N O D H T X R N H R E A. 33. By PICCOLA. (An easy Myszkowski. Probable words: SOLVE, CIPHER, COLUMN). V I N S R C F E A E O O H S E F H L E T F H U N S T N C L T S L C I A E E S H R H S I R E T T M T S E T E P D T S O I N M R T T H T L O L R U B E. 34. By PICCOLA. (Nothing like a bit of "philosophy" - oyeah?) E L O S W E A H X P N N T R N H L W I E G E I G E A E Q A G L E A R R Q L O N K E S Q L O R N X A R S P X S E E A E I P A G L R E P R Y M T H N K S E I X X A Y. 35. By PICCOLA. (Not so easy; still, it's just another columnar). H R O T E T E T E H I W E O T T D A O D K G DT C E R A I W O S Y N H Y R H T W. CHAPTER VII General Methods — Multiple Anagramming, Etc. In the past few chapters, we have been looking at all of the general methods for decryptment of transpositions. We have seen the use of _factoring_, which determines, for the geometric cipher, what key-lengths are possible, and, for the irregular one, what key-lengths are not. _Vowel-distribution_ has enabled us, in some cases, to determine the length of major units, or has assisted in the restoration of minor units to their original intact groups. _Anagramming_ has been seen throughout: the matching of letters and columns with or without the application of language statistics. So far, we have been materially assisted by advance knowledge as to what the cipher is. Where the type is unknown, and cannot be promptly identified, and assuming, of course, that the decryptor has no probable words, transpositions, taken as a whole, present confusing problems in the very multiplicity of their possibilities. General Givierge, in his _Cours de cryptographie_, remarks of this case that novices, as a rule, display a tendency to recoil from the cryptogram as if uncertain “which end to pick it up by.” He adds that the best advice he can give is to pick it up _somewhere_ and do _something_, rather than be satisfied to sit all day long and admire the cryptogram! As to how a type may sometimes be identified, the difference between the regular and irregular types is ordinarily suggested by the number of letters contained in the cryptograms. Irregular types, intended for practical purposes, are nearly always seen in complete five-letter groups, where the geometric cipher usually results in a broken group at the end of its cryptogram. This, of course, is never mandatory upon the encipherer; it merely happens because the only persons making use of such ciphers are those who do not realize the advisability of doing otherwise. Among the irregular types, a columnar formation can usually be spotted by the “bunching” of vowels at intervals throughout the cryptogram. Then, too, we are still to see those cases in which the exact type of the cipher may not become apparent until after solution is well started. It is usually well, when a new system is encountered, to analyze it and find out what the transposition finally does to the letters. This can be done by preparing actual cryptograms in which the plaintext letters are serially numbered; or, if the question of vowel-distribution is not involved, by using the serial numbers without the letters, as suggested in a previous chapter. Many ciphers, of course, will not require even this amount of analysis, even though their type, accurately speaking, is irregular. For example, the one shown as Fig. 48, whether or not its rectangle is to be completed, is merely another _route_, so that once having seen it, we might try to follow this route again. But the student who cares to give this cipher his careful consideration must notice that its longer cryptograms would be full of reversed plaintext segments; that these would grow longer and longer with a constant rate of increase, and would always alternate with incoherent segments which, in their turn, would grow shorter and shorter; also that these incoherent segments, if set up as columns, would show plaintext. The complete-unit cipher, generally speaking, can hardly present any real complexities. Consider, for instance, the following variation on a Nihilist encipherment, which was proposed by Geo. C. Lamb, the author of Chapter X: The key-length, to begin with, must be divisible by 3, but this is not used for writing-in. The plaintext is written into its block, not in straight order, but following a _route_ which begins in the upper left corner and goes forward for the first three letters, drops down to the second line and runs backward for the next three letters, drops to the third line to run forward for another three, and so on back and forth until the first three columns have been filled with trigrams written alternately forward and backward. It then moves over to the second three columns, beginning this time at the bottom and “snaking” upward to the top. For the third three columns it moves downward again, and so on until the square block has been filled. After this very devious primary transposition, the unit is taken off by means of the key, on the Nihilist principle of transposing both columns and rows with the same key. Figure 48 Cipher Requiring Little Analysis 1 2 3 4 5... T│ H│ W│ S│ E│ ──┘ │ │ │ │ S I│ O│ E│ .│ ─────┘ │ │ │ D L U│ E│ .│ ────────┘ │ │ B O T M│ .│ ───────────┘ │ ← . . .│ ──────────────┘ Plaintext: THIS WOULD SEEM TO BE... Cryptogram: T H W S E S I O E.... We believe that the resulting cryptogram could prove puzzling to any cryptanalyst who has met the cipher for the first time. It is true that he has, in the original square, a large number of intact minor units, provided he can restore them. But these units are very tiny, and the several of them which stand on any one row are not continuous among themselves; thus his vowel-distribution, while approximately normal, would probably not satisfy his expectations. If, however, having failed to find a more satisfactory block arrangement, he attempts to match columns (it being remembered that he is accustomed to reading in all sorts of directions in order to discover plaintext fragments), he will most certainly discover the trigrams and trace their route. Afterward, however, having met and analyzed the cipher, it would probably occur to him to look for exactly this complexity whenever he discovers that he is dealing with a square whose key-length is divisible by 3. We have mentioned before the assistance which may be had from the mere knowledge that a certain method exists. Complete-unit ciphers, of course, may be troublesome, but their complexities are necessarily confined to one small area. An irregular cipher, on the other hand, usually involves the entire text, and its complexities may be real. In this class we occasionally find ciphers in which a single cryptogram is impossible to break; and we find others in which the eventual solution of one cryptogram will not instantaneously provide the key to another enciphered exactly like it. Such ciphers are well worth analyzing, for surely, somewhere, they have their weaknesses; and most certainly any two cryptograms enciphered exactly alike should be decipherable with the same key. The cipher shown in Fig. 49 is of the double-columnar type known in this country as the “United States Army” double transposition, and has, in fact, been authorized for use, under suitable conditions, in the military service of more than one country. As may be seen from the figure, this cipher is, in all respects, the columnar transposition of the preceding chapter accomplished twice in succession on the same text (decipherment being, as usual, the reversal of the encipherment process). The same rules apply here, as in the single columnar transposition, to the use of nulls, and to the advisability of avoiding the key-length which is a multiple of 5. It goes without saying that the block should never, under any circumstances, be allowed to work out as a square; this, in substance, would be the block unit of the Nihilist cipher. While the figure shows a primary cryptogram, taken off from the upper block, this, in practice, is never actually done. The columns of the upper block are always transferred direct to the rows of the lower one, and only the columns of the lower block are taken off as an actual cryptogram. In preparing this cryptogram, both blocks should be laid out at the same time; otherwise, there is danger that the operator may apply the first transposition and forget the second, thus sending out a simple columnar transposition which carries the key to all of his other cryptograms. This cipher, as may be seen, has its points. Yet it will have been noticed that its use for military purposes was not authorized without restrictions. Figure 49 The "United States Army" Double Transposition 1st Encipherment P A R A D I S E 6 1 7 2 3 5 8 4 R E G R E T C H Primary Cryptogram A N G E I N S Y S T E M S X X X (Not usually X taken off) 2d Encipherment ENT, REM, EIS, HYX, TNX, RASX, GGE, CSX. P A R A D I S E 6 1 7 2 3 5 8 4 E N T R E M E I S H Y X T N X R A S X G G E C S Final Cryptogram: X N H S R X, G E T G I, R S M N E, E S A X T, Y X E X C. The special hazards of military correspondence have already been mentioned: the huge volume of interceptable cryptograms; the ever-present knowledge as to probable subject-matter and more-than-probable words, including numbers and dates; the personal habits of individual operators; above all, the fact that much of the enciphering is necessarily done by operators who are not, in the first place, trained for their work, and who, very often, must perform this work rapidly under conditions which are far from conducive to clear thinking. These, however, are chiefly the hazards of the firing line. Back of the lines, where hazards are reduced, there may be a chance that a cryptogram will not be intercepted at all. It becomes possible, for many purposes, to make use of a cipher in which a single cryptogram, though probably read in the end, will resist the decryptor for the necessary length of time, several hours or several days. The double columnar transposition can be very resistant, especially when the key is long and the columns short, and can be made even more complicated by carrying it through still a third block, perhaps using a different key with each new block. Why, then, would it not be possible to use such a cipher for general communication? To this, there are two answers. For transposition cipher, taken as a whole, has two very serious drawbacks. First, a transposition, in order to be a good one, must be a transposition of the whole text, and not a series of short individual transpositions. Thus, it becomes possible that an error, either in the encipherment or in the transmission, will not be confined to one small area, but will garble the whole message. In this way, we have not only the delay during which the legitimate decipherer is attempting to decrypt his own message, but, should he fail, the danger which lies in having it repeated. The decryptor who has been provided with both the correct and the incorrect version of a same cryptogram, is often able to figure out both the system and the key. The other drawback is the danger which lies in the fact of so very many cryptograms. These, originating at many different sources, and all enciphered with the same key, will invariably include many of _identically the same length_. The nature of transposition cipher makes it inevitable that when any two texts of exactly the same length are enciphered with the same key, they will follow exactly the same route. The first letter in both messages will be transferred to exactly the same serial position in both cryptograms; the second letter in both will be transferred to another same serial position, and so on. If we are able to match correctly any two or three letters in one of the cryptograms, the two or three corresponding letters of the other cryptogram will also be correctly matched and will serve as a check. This being the case, any two or more cryptograms which are found to have the same length can be written one below another so as to place corresponding letters in the form of columns, and the problem is reduced to one of _geometric_ columnar transposition. With ciphers of the complete-unit type, the same thing can be done having several of the major units. We have, say, a single cryptogram accomplished with a Fleissner grille, and taken off by spirals. It may be that nulls were added in the final group, or at the beginning, or the final unit may have been left incomplete (by blanking out the unwanted portion of the final grille-block). In spite of these possibilities, the unit-length, known to be a square based on an even number, can be determined — _or assumed_ — and the placing of the several units one below another provides columns made up of corresponding letters. It is even possible, at times, to apply this process, with suitable modifications, to several cryptograms whose length is only approximately the same. It has been done, for instance, with cryptograms from Sacco’s indefinite grille, mentioned in Chapter III (General Sacco himself has explained the modifications). Such a process is ordinarily referred to as multiple _anagramming_, and we have already seen, in the case of the grille, how it may be modified so as to take full advantage of any inherent weaknesses when the cipher is known. For discussion of the general case, suppose that we have intercepted a number of cryptograms (seen, by their letter-frequencies, to be transpositions), and that among these we have been able to find five in which the length is 25 letters. Since all of these have been coming from the same two stations, and within a comparatively short period of time, it seems reasonable to suppose that at least a portion of them have been enciphered with the same key, and, upon this assumption, we have written the five cryptograms one below another so as to set up the 25 columns shown in Fig. 50. We wish now to rearrange the 25 columns in such a way as to bring out plaintext on every row, or, failing that, on some of the rows. Once the set-up has been prepared, we may arrive at our goal by any road that suits our fancy. The majority of solvers will simply cut the columns apart and start matching strips at random; and this, probably, is a good enough method, especially when columns are so short. The writer, personally, prefers to leave the set-up intact, at any rate until solution is well started, trying out in pencil the various possible column-combinations, and circling out accepted columns from the set-up in the same way in which segments were circled out of cryptograms in the preceding chapter. Figure 50 A series of five cryptograms prepared as columns: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 C D D N C A A R T H L O I K A O E R T L S N A N O D A I T E L O C W A I U X D N T Y M I N M O E Y O B T O A T T U T O C F L I Y K X N E I O S B F Y Y T A R O T O R E I L N A O H R I O N M D S R J Y S W E K L N C H T S T S I E G E I H O O P D T N A O For those who like this method, we repeat a suggestion which has already been made: Many columns are usually present in such a set-up which contain _more than one_ of the “clue-letters,” as here, for instance, column 14 is practically made up of them. Such a column makes a good point of beginning, since we may search the set-up, not for some single letter, but for a pattern made up of several. For column 14, specifically, we might examine the top row of letters, pausing whenever we come to one of those letters frequently preceding _K_, and examining the rest of its column to find out what letter would have to precede _H_ on the fourth row. We may fail with the first such column, but not with all. Another particularly good method, and one which might work in the present case in spite of the very brief columns, is that of finding the particular column which contains the first letters of all the messages. Well over half of the initials used in the language will be found in the group _T A O S W C I H B D_, and with a frequency in somewhat that order. Any column made up entirely of these particular letters may be the one which begins the messages; and when this can be found, it pays to remember that a vowel is practically always present among the first three letters of each message. As to finding the end-segment, it seems that this would be of little value except in those cases where final groups are not completed. However, the letter _E_ has a great fondness for final positions, with terminals restricted largely to the group _E S T D N R Y O_; and it is also true that many encipherers make a habit of completing their final groups with such letters as _X_ and _Q_. Aside from the general case, each individual case carries clues of its own, and the finding of these must depend upon the detective ability (or experience) of the decryptor. Here, for instance, we find that the letter _K_ has appeared three times in only 125 letters of text. This letter, normally, has one of the lowest frequencies in the language, and often is not found at all in 125 letters of text. Finding it three times, then, rather suggests the presence of some one word, a word so important to the subject-matter that it has been used in three different messages. When considering the letter _K_, the first combination which comes to mind is a digram _CK_ preceded by a vowel; and the letter _C_, also, is not a letter which we expect to find in confusing numbers. When an examination of the set-up shows that, for each of the _K_’s, there is a _C_ present on the same row, we are inclined to accept the hypothesis of a repeated word. In practice, we should pick out the three columns containing _K_, place beside each one a column which will set the digram _CK_ together, and _build on all three combinations simultaneously_ to the point at which the supposed word appears or is proved non-existent. Following out only one of these, let us consider column 14, where _K_ is on the top row. On this row we find that _C_ has appeared twice. Both of the _C_’s are tried with _K_, as shown in Fig. 51; we find that both combinations will provide acceptable digrams, but there is little doubt as to which we would select. Combination 1-14 is merely acceptable, while combination 5-14 provides a very accurate description of the column which would fit best on its left. There should be a vowel on the top row, to precede _CK_, and another on the bottom row, to precede _NG_. After that, perhaps another vowel should be found on the fourth row, to precede _TH_, or perhaps, in this case, an _S_, since the list of frequent trigrams includes a sequence _STH_; and, finally, something suitable to precede _TY_, which appears to be a syllable, but may belong to two different words. The five columns which will meet these requirements have been added in Fig. 52. In this figure, two combinations may be discarded, because of trigrams _KTY_ and _YTY_. The others appear acceptable. At this point, however, the sequence _XTY_ of combination 16-5-14 begins to draw attention because of its very few possibilities (SIXTY, NEXT YEAR, etc.), making it likely that one of these will quickly select or discard the entire combination. For building SIXTY, row 3 of the set-up contains two _I_’s and one _S_. The two _I_’s, columns 13 and 19, when inspected visually, are found to bring out, on the top row, the two sequences _I O C K_ and _T O C K_, while the _S_, column 21, brings out, on the top row, another _S_, which would extend these, respectively, to read _S I O C K_ and _S T O C K_, the latter surely the more acceptable. The results of these additions, with subsequent development, can be examined in Fig. 53. The completion of the word SIXTY has brought out also: STOCK, _MITED_, SMITH, DOING. The presence of the word STOCK suggests extending the sequence _MITED_ to read LIMITED, and the addition of two more columns on the left brings out another CK, suggesting another appearance of the word STOCK. The chances are that we have already been building on this other word STOCK, but if not, we may build it now to the point shown in the figure, where the top row suggests RAILROAD STOCK, the third row, FIFTY TO SIXTY, and the second may or may not suggest MEXICO. Thus we are well on our way to solution, and have not once had recourse to a long prepared list of probable words: _division_, _regiment_, _battalion_, _attack_, _advance_, _report_, _forward_, _artillery_, _ammunition_, _communication_, _enemy_, _signal_, _retreat_, _troops_, and so on. Figure 51 1-14 5-14 C K C K D D E D B Y T Y T H T H W G N G Figure 52 12-5-14 13-5-14 15-5-14 16-5-14 25-5-14 O C K I C K A C K O C K O C K U E D X E D N E D T E D O E D L T Y I T Y K T Y X T Y Y T Y A T H O T H R T H I T H S T H I N G E N G E N G I N G O N G Figure 53 11 8 25 6 3 21 19 16 5 14 L R O A D S T O C K I C O L I M I T E D F T Y T O S I X T Y N E S O R S M I T H S T O C K D O I N G Naturally, there are times when the matching of the columns, for one reason or another, proves troublesome. We are thrown off by errors, by the presence of nulls, initials, abbreviations, etc., or by the encipherer’s use of cover-up devices, such as the writing of _YH_ instead of _TH_. Or we find that the handling of many paper strips, caused by message length, is awkward and confusing. But if, in the eyes of the decryptor, there is any good reason for finding out the contents of such messages, he can always succeed, even with only two letters per column. So far, nothing has been said about helping ourselves to the serial numbers of the columns, which, during the rearrangement of letters, are automatically forming in a certain sequence across the top of the set-up. Regardless of the cipher, it can do no harm to examine these, and find out what information, if any, they are able to give. In some cases, they will provide us with both the system and its key, enabling us to throw away the strips and start deciphering. Suppose, for instance, we have correctly matched sixteen columns, and find their numbers in the following order: 31-10-24-37-17-3-32-11-25-38-18-4-33-12-26-39. A careful examination shows that the numbers are running in sets of six. After the first six are passed, the next six have repeated them with an increase of 1, and another six appear to be forming up which will repeat them with an increase of 2. We may verify this by finding the columns which have numbers 19-5-34-13, etc., and, if the set-up continues to show plaintext, we know that we are dealing with a simple columnar transposition. Notice that if the above series were marked into segments of six numbers each, and the segments placed one below another, we should have _six columns_, each one made up of numbers which are consecutive. Thus, we may sometimes learn from a series of numbers: (1) the system, which is straight columnar transposition; (2) the key-length, which is 6; and (3) the key itself, which, taking the six numbers according to size, is 5-2-4-6-3-1, possibly with the wrong numbers coming first, though it happens that in this case they do not. This is our old friend SCOTIA, used on forty numbers, in case the student cares to verify it. The trail of the columns is not so plain where a second transposition has done something to the first. But it is still present; the most complex of ciphers has method of some kind, provided we can find it. Consider, for instance, the series of numbers, 11-8-25-6-3-21-19-16-5-14, which has been forming in Fig. 53. Examination here shows pairs of consecutive numbers, 11-8, 6-3, and 19-16, all having the same numerical difference of 3; that is, the plan of our present encipherment, whatever it is, has, on three separate occasions, caused some plaintext digram to appear in the cryptogram reversed, and with its letters three positions apart. Irrespective of the type of transposition, this constant numerical difference of 3 might be found again; perhaps we can set some two columns together correctly simply by _reproducing this numerical difference_ in the two column-numbers. A glance ahead at the next figure will show that we actually could, by setting together columns 12-9 or columns 20-17. Where we cannot discover a repeated numerical difference, perhaps we can discover a progressing difference, or some other signs of regularity. Now, returning to the particular case, let us pass on to Fig. 54, in which the matching of the 25 columns has finally been completed, and make a careful comparison between the two numerical series 12-9-10-15 and 20-17-18-23. What can these represent but the _fragments of four columns_, belonging to a _first encipherment block_, which have been laid down along the _rows_ of a _second encipherment block_, and taken out in slices? And since the lineal distance apart of any pair of numbers, as 12 and 20, is seen from the figure to be six positions, it would be possible, by writing the series of numbers in lines of six numbers each, to place each pair of corresponding numbers in a same column. The trail, usually, is not so wide, but there is little doubt here that we have been dealing with a case of double columnar transposition in which the key-length of the original block was 6. We shall come back to this in a moment. Suppose, now, we give our attention to the various series of numbers which appear in Fig. 54, and make sure that we understand what they are. The numbers running across the tops of the columns were, originally, the _serial numbers of cryptogram letters_ (or columns). When we restored these letters to their plaintext order, we disarranged their serial numbers, causing these to come out in the order 1-7-24-22-12-9, etc. This series, then, is made up of _cryptogram serial numbers_. But it is also a _key_, since it shows us exactly the order in which we might _take off a plaintext_ in order to form a cryptogram. It is a key of the Myszkowsky type, according to which every letter in the text has its individual key-number, as we saw in Fig. 46 (imagine that encipherment accomplished twice in succession). We do not desire, however, to take off plaintext. And, to use this same key on a cryptogram, we should have to use it in the _writing-in_ manner; that is, first lay out the series of key-numbers, and then, taking the cryptogram letters in their 1-2-3 order, place them, one by one, below their key-numbers. But once the plaintext has been restored, the _plaintext letters_ (or columns) _may also have serial numbers_, and these new serial numbers, in the figure, have been added at the bottoms of the columns. Should we now restore these columns to the order in which we found them, that is, to their cryptogram order, each column taking with it its new serial number, we should find, running across the bottom of the set-up, another mixed series of numbers in the order 1-10-20-9-24, etc., which is a different order from that of the cryptogram numbers, and this new series is made up of _plaintext serial numbers_. This is the other key, having the same relationship to the first as that explained in connection with the short Nihilist key. Applied to the plaintext, it would have to be used in the _writing-in_ manner; used on the cryptogram, it serves for _taking-off_. Thus we are able to recover from our reconstructed plaintext two long keys, either one of which will serve to decipher additional cryptograms, _but only on condition that these new cryptograms contain exactly 25 letters_. Figure 54 The Columns of Figure 50, After Solution by Multiple Anagramming: 1 7 24 22 12 9 10 15 4 2 20 17 18 23 13 11 8 25 6 3 21 19 16 5 14 C A N N O T H A N D L E R A I L R O A D S T O C K D O Y O U W A N T A N Y M E X I C O L I M I T E D B U Y B L O C K A T O N E F I F T Y T O S I X T Y T R Y R A I L R O A D O N J O N E S O R S M I T H W H A T I S T E L E P H O N E S T O C K D O I N G 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 (Plaintext serial numbers, added at bottoms of columns) (Appearance of the plaintext serial numbers, if the above columns should be restored to their cryptogram order) 1 10 20 9 24 19 2 17 6 7 16 5 15 25 8 23 12 13 22 11 21 4 14 3 18 If, then, we hope to decipher cryptograms of other lengths, which originally were enciphered with exactly the same key as our present five, it is still necessary that we take one or the other of these long Myszkowsky-type keys and reduce it to the short columnar form. The theory on which this is done should not be at all difficult to understand if it be kept in mind that both of our long keys are actually the serial numbers of letters, and that each individual serial number accompanied its letter throughout the encipherment process. This will explain any references which are made to FIRST and SECOND encipherment blocks, with their respective columns and rows. Whichever of the long keys we decide to reduce, our first objective, always, is that of determining the _length_ of the shorter key; after that we restore its _order_. The first process, summed up in Fig. 55, was originally published, so far as the writer knows, by M. E. Ohaver, and makes use of the cryptogram numbers which were the first series obtained. The discovery of the shorter key-length is made by searching the set-up for some numerical difference (between any two numbers whatever) which is repeated by corresponding pairs of numbers at some regular interval. For convenience in making the search, Ohaver suggests that the mixed cryptogram numbers be written, with uniform spacing, on two strips of paper, in one case repeated. One strip can then be moved along beside the other so as to place pairs of numbers in actual contact. It is immaterial what numerical difference is used; the difference 1 pointed out in the figure seemed a little more visible than others. This difference 1 has been noted between the numbers 9 and 10, and the next difference 1 has been found _six positions away_ between the numbers 17 and 18, but is not found again between the numbers 25 and 6, which stand at the next interval of six positions. This may be a clue, but it is not what we had hoped to find. The clue is strengthened, however, by the observation that a difference of 5 occurs just at the right of the original difference 1, and is also repeated at the lineal interval 6. Figure 55 Finding the Original Short Key from the CRYPTOGRAM Serial Numbers - M.E.OHAVER Finding the key-length: 1 7 24 22 12 9 10 15 4 2 20 17 18 23 13 11 8 25 6 3 21 19 16 5 14. 1 7 24 22 12 9 10 15 4 2 20 17 18 23 13 11 8 25 6 3 21 19 16 5 14 1 7 x . . . . . x (Repeat series) A difference of 1 occurs again at the interval 6. The two series 9-17 and 10-18 are fragments of columns from the first encipherment block. The key-length necessary for placing either pair in a same column is 6. Replacing cryptogram numbers in first encipherment block: (As PLAINTEXT)... 1 7 24 22 12 9 10 15 4 2 20 17 18 23 13 11 8 25 6 3 21 19 16 5 14 COLUMNS of the FIRST encipherment block are converted to ROWS of the SECOND: (a) (b) (c) 1 10 18 6 14 1 10 18 6 14 22 1 - 3 - 5 - 2 - 4 - 6 22 2 11 19/ 7 15 23 3 2 11 19 7 15 23 12 20 8 16 3 12 20 8 16 24 1 10 6 24 4 13 21/ 9 17 25 5 4 13 21 9 17 25 2 . 7 5 3 8 4 9 5 At (a) the columns of the first block are (C O S M O S) arranged so as to make the cryptogram numbers At (c) the order is run consecutively in each of the new columns. shown in which the columns At (b) this block has been adjusted, so as of (b) would be taken off. to form six columns. This order is the KEY. To find a good clear example, using the strips as they stand, let us go back toward the left, and look for a difference 2. We find it first between the numbers 24 and 22; exactly six positions away, we find it again between the numbers 4 and 2; another six positions, and we find it between the numbers 13 and 11; still another six positions, and we find it for the fourth time between the numbers 21 and 19. Thus we have two series of numbers, 24-4-13-21 and 22-2-11-19, which run parallel to each other with their numbers always separated by interval 6. Sequences of this kind came from the _columns of a first encipherment block_, and can all be placed back in these columns by re-writing the mixed cryptogram numbers in lines of _six numbers each_. Sometimes we find such columns broken to bits, as would be the case should we continue moving the strip until we have completely exhausted the possibilities for difference 1; and we never find them complete, since these columns of the first encipherment block were taken out in irregular order and written continuously upon the rows of a _second encipherment block_, and after that were sliced through in the taking out of columns from the second block. We found traces of them once before, where a difference of 8 was found throughout four consecutive pairs of numbers 12-20, 9-17, 10-18, 15-23, always at an interval of 6 positions. The key-length, then, is 6, and the cryptogram numbers (in their plaintext order) if written into a block of that width, will reproduce the first encipherment block. From this, we wish to carry the numbers, column by column, into their second encipherment block, from which they may then be taken out, again by columns, in such a way as to bring them back to their cryptogram order 1-2-3. If this is to happen, the numbers must run consecutively in the new columns, and the number 1 must be on the top line. We select, then, from the restored plaintext block, the column which contains the number 1, then the column containing the number 2, and so on, writing these columns horizontally on the rows of the new block, in such an order as to make the numbers consecutive in every column. This may or may not require the adjustments indicated in the figure at (a) and (b). When block (b) is completely adjusted, the order in which it would be necessary to take its columns so as to produce the cryptogram numbers in their original 1-2-3 sequence, is the order of the original short key. Our key-word COSMOS, incidentally, could have been better chosen. In Ohaver’s process, we have taken the _cryptogram numbers_ and _enciphered_ them. By the process of General Givierge, summed up in Fig. 56, we do the opposite: we take the _plaintext numbers_, in their cryptogram order, and _decipher_ them, so as to bring them back to their correct plaintext order 1-2-3. For learning the key-length, General Givierge endeavors to find that number which, when added or subtracted throughout the series of numbers, will most often cause one of its segments to repeat another. The portions which repeat are the columns, or partial columns, not from a first encipherment block, but from a _second_, since the process here is to follow out a decipherment. In the figure, the left-hand block (not strictly necessary) represents the plaintext, written as a cryptogram, and the one on the right represents it in what is known to have been its first encipherment block. To develop the second block: either take columns from the right-hand block and lay them on the rows of the central one in such an order that its columns can be taken out to form the cryptogram; or, write the cryptogram arrangement into the columns of the central block in such an order that its _rows_ will show the columns of the plaintext block on the right. The order in which columns must be taken from the right-hand block to form the central one (or that in which columns must be taken from the central block to reproduce the cryptogram arrangement) is the order of the original short key. The condensed presentation here is also drawn from the writings of M. E. Ohaver. General Givierge, who seems first to have published the method, was chiefly concerned with exposing the possibilities of _analysis_, as applied to numbers generally, and explains to us the reason of the increase 6 which betrays the key-length in the plaintext series of numbers. The width of the original block being 6, each number is larger by 6 than the one just above it, making every one of the columns an arithmetical progression in which the constant difference is 6. These columns, still retaining their regular increase of 6, are laid down on the rows of a second block, and, for at least a portion of their length, some two or more of them always continue parallel, with progressions of 6 running side by side. Thus the taking out of columns from the second block will, at times, select _one each_ from two or more different progressions of 6, and the new columns, throughout some portion of their length, will differ from one another by exactly 6, the original key-length. Figure 56 Finding the Original Short Key from the PLAINTEXT Serial tumbers - GIVIERGE To find the key-length: Try adding (or subtracting) possible key-lengths (4, 5, 6, 7, etc.) to the whole series until some one of these added numbers causes portions of the series to repeat. 1 10 20 9 24 19 2 17 6 7 16 5 15 25 8 23 12 13 22 11 21 4 14 3 18 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 7 16 26 15 30 25 8 23 12 13 22 11 21 31 14 29 18 19 28 17 27 10 20 9 24 The portions which repeat when the correct key-length, 6, is added, are columns, or part-columns, from the SECOND encipherment block. Plaintext Serial Numbers S E C O N D F I R S T In CRYPTOGRAM Order: Encipherment Block Enoipherment Block / 1 10 20 9 1 7 13 19 25 4 1 2 3 4 5 6 24/19 2 17 10 16 22 2 8 14 7 8 9 10 11 12 6/ 7 16 5 20 5 11 17 23 3 13 14 15 16 17 18 15/25 8 23 9 15 21 6 12 18 19 20 21 22 23 24 12/13 22 11 24 25 21/ 4 14 3 18 The ROWS of the CRYPTOGRAM BLOCK, (approximately of column-length), must be written back into the COLUMNS of the SECOND ENCIPHERMENT BLOCK in such an order that the ROWS of this SECOND encipherment block could have been taken off as a primary cryptogram from the COLUMNS of the FIRST ENCIPHERMENT BLOCK, extreme right, known to be the original order of the numbers. The original short KEY can then be found by observing (in the central block) the order in which columns have been taken from the right-hand block. That is, find the small numbers which were on the top row; these are standing in the order 1, 4, 2, 5, 3, 6 (a writing-in key), and the columns which are headed by these receive key-numbers in the order 1-3-5-2-4-6. * * * We have seen, then, the general case in which the “enemy” decryptor, having several cryptograms of the same length, enciphered with the same key, is able to use a purely mechanical method in order to restore the plaintext, and afterward, by observing traces of a known cipher, to extract their key. For the solution of single cryptograms enciphered in complicated systems, the writer knows of no other method than straight anagramming, in which the single letters, accompanied by their serial numbers, are written on individual cardboard squares (or imagined to be so), and the attempt made to match them up. Attention has already been called to some possibilities which may lie in the serial numbers whenever the sequences or probable words are thought to be correctly matched. But with absolutely nothing known or suspected as to source or subject matter, and with nothing discoverable from serial numbers or possible routes (and taking it for granted that any accumulation of letters represented in about the normal frequency-proportions can be made to yield dozens of different solutions), it would hardly seem that the decryptor, even should he find the correct solution, would have a means of distinguishing it from any other. Figure 57 A Single Cryptogram in Double Columnar Transposition: L H D L A O D D H L H E E U I X D F P I U T A E R O I T Q A E T E R L N I E N A U D K L I E E H Y N M S J L C N H P B O A D G R N. The Solution, Enciphered by a Method Mentioned in Chapter III: M T Q P I N A I E N E I T H R G E K D U U D L L I R I H F R T E C L O L N J L A S H A A U Y D O E E L N E N D H P D H D E A B O. For the student who may care to struggle with a case of single anagramming, we have appended a problem in Fig. 57, together with a means for finding out the solution and perhaps even the key-word. It has come from the Philadelphia headquarters of a band of revolutionists, and our stool-pigeon tells us that the leaders of this movement are to be called together for consultation during the coming summer. * * * The finding of a _key-word_, after recovery of the numerical key, is not, of course, necessary to the decipherment of further cryptograms. However, this recovery will afford us the same convenience which it gave to the encipherer; that is, a simple mnemonic device for reproducing the numbers at will. And to recover the actual original key-word may, at times, provide some insight into the habits or mental make-up of the person who selected it, and who may select others like it, or might, conceivably, make use of this same key-word in some other kind of encipherment. If the key is short, it is practically always possible to recover more than one word; but with long keys, we seldom, if ever, recover more than the one word on which the numbers were actually based. In this connection, however, it must be remembered that key-words are not necessarily taken from any one language; thus, their recovery becomes largely a matter of combined information, intuition, guesses, trials, and determination, so that an exact method for accomplishing it is hard to give. But, presuming that key-numbers have been derived in the usual way, those which are small are, in general, likely to have derived from the earlier portion of the alphabet, which contains _A_, _E_, _I_. So long as they increase toward the right, they may continue to represent a same letter, and when they do, this letter is usually a vowel, When an increase occurs on the left, the new number has certainly derived from a new letter, coming later in the alphabet. Whatever the language, then, it is very easy to determine the two extreme alphabetical limits outside of which no one of the letters can possibly be found. This can be seen at (a) of Fig. 58. The numbers 1, 2, 3, might all have derived from _A_, but the number 4 cannot have derived from a letter coming earlier in the alphabet than _B_. Similarly, the numbers 4, 5, might, by possibility alone, have derived from _B_; the numbers 6, 7, 8, might all have derived from _C_, the numbers 9, 10, from _D_, and, finally, the number 11, from no letter earlier than _E_. When these earliest possible limits have been established for every key-number, and it is seen that the range is five letters, then the last five letters of the alphabet, _V_, _W_, _X_, _Y_, _Z_, may be used to establish the limits at the other end of the alphabet. It is seen now, that the key-number 6, must have derived from some letter between _C_ and _X_, inclusive, and similarly with the others. But when we come to the particular case, it becomes necessary to make assumptions; for instance, were these numbers derived from a common English word or from a Russian proper name? The person who selected it, so far as we know, is accustomed to speaking English, and in all of his past cryptograms we have been able to recover common English words rather than proper names. Assuming, then, as at (b) of the same figure, that we are to recover his usual common English word, we set down _A_ as a possible letter for the key-numbers 1 and 2. But when we arrive at the number 3, we see that we cannot assign here a third _A_, since common English words of this length do not contain a doubled _A_. The earliest letter possible, then, is _B_, and, upon noting the consecutive letters _AB_ at this particular point, we think at once of the common English terminal sequence -_ABLE_. Figure 58 (a) Limits: (b) Assumption of English word: 6 9 1 4 11 7 10 2 3 8 5 6 9 1 4 11 7 10 2 3 8 5 C D A B E C D A A C B A A B L E X Y V W Z X Y V V X W (FL (MY A C (NZ (FL (MY A B L E D E (New limits) To find whether this is possible, we make sure that the new letters, _L E_, alphabetically considered, do not run contrary to their supposed numbers, 8 5. Then, having accepted these four letters as entirely possible and likely, we work back to the missing number, 4, and find, now, that it has new limits; it must have derived from _E_, _D_, or _C_, and from nothing else, and of these, we are inclined to discard _E_, which would give a sequence _AE_. We then work back to other missing numbers, 6 and 7, and find that these, too, have acquired new limits; they must be found somewhere between _F_ and _L_, inclusive. All numbers which follow 8 have attained a new limit in the earlier portion of the alphabet, but not in the latter portion. These are all shown in (b). At this point, any knowledge at all of English prefixes will suggest what the first two letters are and will narrow the limits still further. The student, perhaps, has already guessed the word. Of the keys which follow, (a) and (b) were derived from English words, one of which has been used in the present chapter. The remaining four are derived from proper names, respectively (c) German, (d) Italian, (e) Spanish, and (f) French. (a) 1-9-2-4-11-3-7-8-6-10-5. (b) 2-7-8-3-4-1-6-5-9-10. (c) 2-5-11-3-9-13-6-12-8-1-4-7-10. (d) 9-1-10-6-5-2-8-7-4-3. (e) 2-11-3-6-7-9-1-5-8-4-10. (f) 5-1-4-6-2-3-9-8-7. 36. By TITOGI. (a) U O Y M E E T E N A W H T I M C I C T I J I U S O G N H Y F. (b) Y T M I L L E M L E W U A A J T W O N F O R T A H L H T G I. (c) R O P U L E A E E B A H F T K O D T S C I L T T M R Y T I H. (d) U M H T S E U O K S I H W T R A N C I O W A O H T Y O S S Y. (e) E C E R L T A D A R M R E A O G P O Y M E E A A T N I B S A. (f) R E U O T K N A E H E H H L Y W D E L E E E E O M N W S L L. (g) I H L P U H T T G I Y T T A S N E R T E O R Y T A H N J D S. (h) E S E F K A C A P E E O L S A M E J N S T E O M S L E O T I. (i) T E N E W O H S K I I N S G T M O O H T A A T H U E U T O B. (j) H T P R A H L E R E E R E T A T L E E H S T T T E H B N B S. 37. By EFSEE. (a) I U E G N M O W H X T A N O I P D I L S F P I A R - (b) F N E E T X I E T O N O T S M G R T R Y V G P A C - (c) S F U F N I C E Q E S C U N R I L T M Y I O I P T - (d) B T E E S N B I H I E T L N X O E S N R E I E G T. 38. By SIR ORM. (This has a keyword!) T A S H L E C P W E T C I H A O T N R A O O H L W D O Y I L E O H R L E V A T E A O M N L E V N W I W I E I H S M H E T H N W O I O L S V I I F S S O W A S O T F I L E H N M G O F I E R A L O C G N N. 39. By DAMONOMAD. (And he calls this a "Nihilist" !) A H H S E S T I H D I S O M E A T H I O O H D I O U T T I K M I E S O F G S N E R W U G T S G Y I S L A T I T T A A N H O G E N Y L A W E A L E R T M I W T O E D. 40. By FRA-GRANT. (A military message sent by General Calamity to Major Catastrophe). T E H A N E M G S L L I W S N E T T A C K Y E I A A E B P S O U R P E M O C E E T U N R I S T E R S A F O E T O R T D A E R T E F D I N C A S E R E T T U O P W A R U R E F F O Y A E E D F O R D R C R. No. 40 can be decrypted by the multiple-anagramming of its units. Afterward, if you are unable to reconstruct the system, No. 41 will tell you all. 41. By PICCOLA. (Single block - completed unit - with columns transposed. The key to this transposition may amuse you, provided you can reconstruct it in letters!) A O U U P D M C A N I O G T R S A A Y N K N C A B M N A O A T L E C H Q S D O R E E W W D N C K E E S T S H N I E T E U H K N I F D I T Y F U X G I V L T A I P H R C S N R R E H S B M E E A R M T A I U T E W O P I R S M H O O E V R W F N X S D A H I E T S S U F C N N E E S N F S E O O L T U A E A O F T V L T E E O E C. 42. By TITOGI and PICCOLA. (General information - nothing more). (a) I H S E W D O X H D H T S E O E H R N E C T O O A G A R S A N O E A O S O H U W R T C A U R E N T T O M S O C N Y N P G S H A P P N F S N E R T E H E P M A W S M E G I A E A P O R Y D T A A S S A F M I H S R C H E C W N E I T A T R X E I S O A C F A T I C E N I R T E U Y H T E R T S R S E L S T E G P A H R W. (b) S R H J I A X E C A N E Y P K A N D A T S D L I L A S L N T G E A D Y E B L Y T S C C I D T C S G A M C E E N W A T I E A E N H L A B D Y A G H C H E G I H O I L P O N P A S E D N T T W E S Y E F I M L A R E R H N E D I O T E L R O S I T D S S R I S N I R R F S S P E C T R E I F B G O M R X S E N A H A R N L. (c) A E G Y B A T Y N S R I D T O O S D N E Y E E E O G N I U U T W S N L H E I I S C G H H W D R R U W E A H E T K C T W V O E H H I. 43. By TITOGI. (Keerful, Si! All is not gold that glitters). C T I H N A I E S O R M F Y E E C T H U W I S L A E D K R L B E R N M J I T S D A N D O O H T V A T H T E R Y G A U N O T S A P E M O E S U R I L T E D I E O N E N R C A F I N P O L H O E A G R B X S. 44. By ALII KIONA. (Nou hooda thawt it uvvim?) E N W N O T N S E N Y U H O I K H N O E W A O T I U S S A L B W S F R M I E I D I H R W N T F N D S E E O T U E Y B N O T W E W Z E E D I B A E R Y I P L R N P Z R S M U T A S O I S U S D T D T R N H N O A S A F E Z. CHAPTER VIII Substitution Types Substitution cipher presupposes the selection of a set of symbols which can represent the letters or words of messages. As to what these symbols may be, there is practically no limit; we meet substitution in our every-day life: the dots and dashes of the Morse alphabet, the pot-hooks of shorthand, the combinations of Braille, and so on; and we hear of its use in the sign-language of Indians and Gipsies, or in the drum-language of the African jungle. These, of course, are not cipher, yet in each case the plain language has been replaced with symbols. Considering the use of symbols for cipher purposes, there are doubtless many among us who played, as children, with the alphabet of the “Masonic” cipher, based upon a design like the one used for ticktacktoe. Lord Bacon’s alphabet has already been mentioned. The use of printers’ symbols, and similar characters, can be seen in the works of Edgar Allan Poe. Charles I of England is said to have used a cipher alphabet in which letters were represented by a series of dots, placed in certain positions with reference to the line of writing. An endless number of queer symbols is met with in fiction, such as the use of the little dancing men by Sir Arthur Conan Doyle. Cipher alphabets of the nature mentioned do not produce ciphers in any way different from those produced by substitution with letters and numbers; as a matter of fact, the decryptor who must deal with a cryptogram made up of arbitrary signs usually begins the work by making a substitution of his own, replacing each unfamiliar symbol with some one letter (or number). We will confine our discussion, then, to those characters which are transmissible by Morse. * * * Substitution ciphers may be classified under four major types, each having its subdivisions and variations, and its intercombinations with other types: 1. _Simple substitution_ (also called _monoalphabetic substitution_) makes use of only one cipher alphabet. 2. _Multiple-alphabet substitution_ (also called _double-key substitution_, _polyalphabetic substitution_, etc.) makes use of several different cipher alphabets according to some agreed plan. The term “multisubstitutional” is sometimes applied to the multiple-alphabet cipher, but more correctly refers to a certain form of the simple substitution cipher, in which the single alphabet is so designed as to provide optional substitutes for all or part of the letters. 3. _Polygram substitution_ provides a scheme by means of which groups of letters are replaced integrally with other groups, which may be of letters or of numbers. 4. _Fractional substitution_, which requires a certain type of cipher alphabet, breaks up the substitutes for single letters, and subjects these fractions to further encipherment. More often than not, the result is a combination cipher, rather than a purely substitutional one. CHAPTER IX Simple Substitution — Fundamentals Simple substitution is ordinarily defined as a cipher in which each letter of the alphabet has one fixed substitute, and each cryptogram-symbol represents one fixed original. When this cipher is used for puzzle purposes, as we find it in our newspapers and popular magazines, the substitutes (which are invariably letters of the alphabet) may be chosen at random, and the cryptograms must follow certain arbitrary rulings which are designed to make them “fair”: Word-divisions and punctuation must follow religiously those of the original text; a certain minimum of length must be provided; no letter may act as its own substitute; foreign words are not permissible; and so on. Aside from the observance of such rules, however, no holds are barred; the constructor of such a cryptogram, totally unconcerned with the meaning of his plaintext (except that it must have one), sometimes gives his chief attention to distorting the normal language characteristics in an effort to baffle the analyst, and often will carefully search his dictionary for words like _yclept_, _crwth_, _syzygy_, _pterodactyl_, _ichthyomancy_, not infrequently producing a plaintext which is almost as incomprehensible as its corresponding cryptogram. Our study here will be confined to the simple substitution cipher as applied to normal English text. When a substitution key (a pair of alphabets) is being used for cipher purposes, the letters which make up the cipher alphabet cannot be chosen at random; the key must be of such a nature that any one of the several correspondents, desiring to make use of it, will have it at his disposal. Word-divisions are usually concealed, or, occasionally, falsified. Punctuation, if used at all, must don the apparel worn by the rest of the text; no limitations can be placed on length, and no word whatever can be barred, where the intention is that of conveying actual messages; and it is not at all uncommon to find that one or more letters are serving as their own substitutes. In discussing keys, we will make some arbitrary rulings of our own, but only in the interests of clarity. We will assume, for all cases, that the two necessary alphabets are always written horizontally, as several are shown in Fig. 59; that wherever the two complete alphabets appear, the upper of the pair is always the one in which plaintext letters must be found, so that the lower one is always the cipher alphabet. Thus, whenever the two alphabets are written out in full, the substitute for any given plaintext letter will be the letter standing immediately below it; and the original of any cipher letter will be the letter standing just above it. Wherever it seems advisable to show a distinction, the cipher letters will be expressed as capitals and the plaintext letters will appear in lower case. Among the oldest cipher alphabets ever used for practical purposes are those of the type called “Caesar,” one such alphabet having been used by Julius Caesar, and another by Octavius. As may be seen at (a) of Fig. 59, this type of cipher alphabet is no more than a simple _shifting_ of the normal alphabet to a new point of beginning. Using this particular example, the word “Caesar” will be enciphered as _F D H V D U_; or, if the word _R Y H U_ is found in a cryptogram, it deciphers as “over.” At (b) of the same figure, we have a pair of _inverse_ normal alphabets. Here, it is not necessary to specify that one of the pair is a plaintext alphabet and the other a cipher alphabet; whenever a plaintext alphabet is merely reversed and allowed to serve as its own cipher alphabet, the encipherment becomes _reciprocal_; that is, whenever _Z_ is the substitute for _A_, then _A_ will also be the substitute for _Z_, and so for other letters. Thus, we need not write down more than half of the key shown at (b); and, in any other case of reciprocal alphabets, only enough of it to make sure that we have all 26 of the letters; after that, we may find them where we please, both for encipherment and for decipherment. Simple reciprocal alphabets are also ancient. The one just mentioned, and also the one shown at (c), are both said to have been used in parts of the Bible. The two inverse alphabets of (b) may, of course, be _shifted_ with reference to each other; that is, one or the other may be caused to begin at any desired letter, just as is done with the ordinary alphabet in deriving one of the “Caesars.” It is also possible, as indicated at (d), to divide the normal alphabet into its two halves, and shift one of the halves; in this case the encipherment would be reciprocal whether or not the shifted portion runs in reverse order. At (e) and (f), we have mixed (or interverted) alphabets which, though crude, are more in line with modern practice than those which precede them, since both of these are based on the key-word CULPEPER. Figure 59 Some Simple Substitution Keys (a) A shifted, or "Caeser," alphabet: Plaintext: a b c d e f g h i j k l m n o p q r s t u v w x y z CIPHER: D E F G H I J K L M N O P Q R S T U V W X Y Z A B C (b) A pair of inverse alphabets: A B C D E F G H I J K L N N O P Q R S T U V W X Y Z Z Y X W V U T S R Q P O N M L K J I H G F E D C B A Other examples of the RECIPROCAL alphabet: (c) A B C D E F G H I J K L M (e) C U L P E R A B D F G H I N O P Q R S T U V W X Y Z Z Y X W V T S Q O N M K J (d) A B C D E F G H I J K L M (f) C U L P E R A B D F G H I T S R Q P O N Z Y X W V U J K M N O Q S T V W X Y Z The usual plan for deriving cipher alphabets from key-words is as follows: First, all repeated occurrences of any same letter, such as the second _P_ and the second _E_ of the word CULPEPER, are discarded. The unrepeated letters of the key-word, as _C U L P E R_, are placed at the beginning of the cipher alphabet, and the rest of the 26 letters are made to follow these, usually in their normal alphabetical order. If an adequate key-word be chosen, for instance the word UNCOPYRIGHTABLE, a well-mixed alphabet results; but, in order to have a cipher alphabet which is truly incoherent, and hard for the decryptor to reconstruct, we may write this already-mixed alphabet into block form and subject it to a transposition of some kind. Several examples of this may be examined in Fig. 60. In example (a), the repeated letters of the key-word have merely been discarded, while example (b) retains these two positions in order to produce more and shorter columns, with three different lengths. In both cases, the columns of the block have been taken out by descending verticals to form cipher alphabets (a) and (b), but the transposition may follow any desired route or other process. Example (c) suggests further uses for key-words. Still another process (not shown) consists in writing the key-numbers above a block, exactly as in example (c), and allowing them to govern the _lengths of rows_. In the writing-in of the alphabet, normal or mixed, the first row of letters is made to end under key-number 1, the second row under key-number 2, and so on, so that the completed block contains rows of different lengths; it may then be taken off by columns, or otherwise. Numerous other devices exist, but it should be plain from the foregoing that we have an unlimited field in which to derive well-scrambled cipher alphabets, so that there is no need whatever for forming one at random and later being unable to set it up again. Figure 60 Some Methods for Forming a Keyword-Mixed Alphabet Keyword: CULPEPER (a) (b)* (c) C U L P E R C U L P E * * R C U L P E P E R A B D F G H A B D F G H I J 1 8 4 5 2 6 3 7 I J K M N O K M N O Q S T V A B C D E F G H Q S T V W X W X Y Z I J K L M N O P Y Z Q R S T U V W X *)(An OHAVER Method). Y Z (a) Plaintext: a b c d e f g h i j k l m n o p q r s t u v w x y z CIPHER: C A I Q Y U B J S Z L D K T P F M V E G N W R H O X (b) Plaintext: a b c d e f g h i j k l m n o p q r s t u v w x y z CIPHER: C A K W U B M X L D N Y P F O Z E G Q H S I T R J V (c) Plaintext: a b c d e f g h i j k l m n o p q r s t u v w x y z CIPHER: A I Q Y E M U G O W C K S D L T F N V H P X B J R Z For the _encipherment_ of substitution cryptograms, the plaintext is first written out in full with enough space between its lines to allow for the later insertion of cryptogram-letters. The correct substitute for each letter is then written below it, after which, these substitutes are nearly always marked off into five-letter groups, and the groups are taken off on another sheet to form the finished cryptogram. It is sometimes recommended that plaintext and cipher letters be written in two different colors, so as to avoid any risk of taking off portions of plaintext along with a cryptogram. Figure 61 "Running Down the Alphabet" Cryptogram: Y B P R O B Q L... Z C Q S P C R M... A D R T Q D S N... Plaintext: B E S U R E T O... For _decipherment_, the plan is the same, except that the cryptogram is written first, and the two alphabets of the key exchange their functions. Often, when the cipher alphabet in use is so incoherent that its letters are not quickly found, the decipherer will prepare for himself a special _decipherment key_, in which he places the letters of his cipher alphabet in straight alphabetical order, and allows the plaintext alphabet to grow mixed. In taking up the _decryptment_ of simple substitution, we may dispose summarily of the Caesar alphabets by pointing to Fig. 61. If we suspect that one of these has been used, we may verify the suspicion by taking some ten-or-fifteen-letter segment of the cryptogram, and, with each of its letters as a beginning, extend the ten or fifteen alphabets, a few letters at a time, until we come to the line which is purely plaintext. This process is popularly known as “running down the alphabet,” and whenever it results in a row of plaintext, we may quickly determine the amount of “shift,” set up the cipher alphabet, and start deciphering. The same thing is true of a pair of _inverse normal alphabets_ which have merely been _shifted with reference to each other_. But in this case, the cryptogram (or that segment of it which is being investigated), _must first be enciphered in the same kind of alphabet_. To explain this, suppose that our cryptogram fragment is _B Y K I L Y J O_. If we encipher this with the pair of inverse alphabets which was shown at (b) of Fig. 59, we obtain a new cryptogram fragment _Y B P R O B Q L_. This new fragment is now a “Caesar,” and we may “run it down the alphabet” until we find its plaintext. This particular fragment was done with a pair of inverse normal alphabets in which the lower one began at _C_, instead of at _Z_. Most decryptors, in dealing with any kind of substitution, will make these two tests before trying anything else. When the guess proves correct, a great deal of paper work can be saved. Concerning decryptment in the case of the less simple alphabets, the true vulnerability of simple substitution can be seen when the word “battalion,” enciphered in alphabet (f) of our Fig. 59, becomes _T S B B S M Z E P_. Since each letter of the alphabet may have only one substitute, the pattern of -_atta_- shows up clearly in its enciphered version -_SBBS_-. The decryptor knows instantly what kind of pattern it represents, since the letters _S_ and _B_ can have only one original each. The frequency with which these two letters have been used in his cryptogram will tell him approximately what their two originals ought to be, and, by making a few trials, he loses little time in arriving at a solution. As a matter of fact, a simple monoliteral substitution, given fewer than a hundred letters of text and no information whatever as to source or subject-matter, can be decrypted purely through the frequencies and other characteristics of its letters; and if, in addition, the original word-divisions have been preserved, we have the lengths and patterns of these words, plus the knowledge that individual letters have their favorite positions in words. * * * _The “Crypt” with word-divisions_. — Not infrequently, the cryptogram which retains its word-divisions can be read at sight, without putting pencil to paper, and this regardless of how short it may be. Again, even though based on normal text, it will prove more troublesome; and thus, in dealing with this type of simple substitution, we attack each individual example according to what appears at first glance to be its greatest weakness. The cryptogram shown in Fig. 62, for instance, would be attacked through its many _short words_, probably the simplest of the available methods. The words in question are those numbered 3 (_RD_), 4 (_MD_), 9 (_QYR_), 11 (_RKV_), 13 (_DF_), and 15 (_DN_). Among the two-letter words, it is noticeable that every one of these includes a letter _D_, used indiscriminately as the initial or final letter. We do not need to know much of cryptanalysis to guess that this letter represents the _o_ found in such words as _to_, _no_, _do_, _go_, _of_, _on_, _or_. A comparison of the two three-letter words shows that these, also, have a common letter, _R_, which ends one of these words and begins the other. Of all words in English, the commonest is _the_. If _RKV_ be assumed as _the_, then _RD_, already thought to contain _o_, will check as _to_, another extremely common word. Thus we are able to begin work by _tentatively assuming_ that the four cryptogram letters _R_, _K_, _V_, and _D_, are the substitutes, respectively, for plaintext letters _t_, _h_, _e_, and _o_. These assumptions are tested by actually making the necessary substitutions directly on the cryptogram, as seen at (a) of Fig. 62. And we may be sure that they are correct when we see the 12th word clearly outlined as _other_. This word gives a new substitution: cipher letter _T_ evidently represents _r_, occurring in three different words; the actual making of this substitution will cause the 8th word to show a very common ending: -_tter_. If we now consider the other three-letter word, the 9th of the cryptogram, we see that _QYR_ cannot represent any one of the common words _not_, _got_, _out_, _yet_, since the substitutes for _o_ and _e_ have already been determined. It may, however, represent the common word _but_, especially if we care to investigate the frequency in the cryptogram of its first letter, _Q_. This letter has been used only once; and its assumed original, _b_, is normally of very low frequency, and, in addition, is known to have a fondness for initial positions. The assumption of this word as _but_ gives us the substitute for _u_, which appears to be _Y_. Figure 62 Making Substitutions (a) 1 2 3 4 5 6 7 F D R J N U H V X X U R D M D S K V S O P J R K Z D Y F Z J X o t e t o o h e t h o 8 9 10 11 12 13 G S R R V T Q Y R W D A R W D F V R K V D R K V T D F t t e t o t o e t h e o t h e o 14 15 16 17 S Z Z D Y F R D N N V O V T S X S A W V Z R. o t o e e e t (b) ...D F S Z Z D Y F R D N... ...Z D Y F Z J X... o n a c c o u n t o f c o u n c . . 13 14 15 7 In addition to the points mentioned, it is not unusual to find that short words, by their very positions with reference to some longer word, will identify a whole sequence, as might happen with the sequence shown at (b) of the same figure. Good examples of this are: _as well as_, _as soon as_, _in order to_, and so on. In this particular case of (b), we began with only the identified _o_, and immediately were able to identify _t_; this alone should serve for spotting the whole sequence _on account of_, taking into consideration the doubled _c_. Notice what the identification of the word _account_ will do toward identifying the 7th word. Among methods which do not seem indicated in the given example, there is a very fertile field for research in the examination of _terminal sequences_. When two or more of the affixes -_tion_, -_ing_, _in_-, and _con_- are present in the same text, as they practically always are, they will serve to identify one another, and may, in addition, be cross-compared with many of the short words, as in, _on_, _no_, _not_, _into_, _upon_, _can_. The prefix _sub_- may serve to identify the word _but_. There is a whole group -_ment_, -_ence_, -_ance_, -_ency_, -_ancy_; another group _pre_-, _re_-, -_er_, _de_-, -_ed_, etc.; or a good comparison in _be_-, -_able_, -_ible_, etc. Still a third road to solution, especially popular with those who solve the “aristocrats,” is found in _pattern words_, that is, words having one or more letters repeated. The puzzler, examining a dictionary, prepares lists for his permanent use, one list for each “pattern”; such a list, for instance, would contain PATTERN, FALLING and all other words in which the third and fourth letters are the same and all others different, another would contain all words having the pattern STATE, DEFER, ROBOT, still another all words of the pattern BANANA, ROCOCO, and so on. The solver, having thus armed himself in advance, begins work by searching his cryptogram for words having repeated cipher letters, and attempts to identify these from the proper lists. He may provide himself, also, with non-pattern lists, on which words have given lengths but contain no repeated letters; and with “transposal lists” containing pairs of words (as NIGHT and THING) which use the same letters but not in the same order. It is true that such lists are troublesome to prepare, but they are extremely effective; they will break the most resistant of the “aristocrats” or the shortest example of legitimate cipher. No matter how resistant the cryptogram, all that is really needed is an _entry_, the identification of one word, or of three or four letters. The experienced solver knows well that persistence will find this entry, and trusts largely to instinct and perseverance; the beginner, however, may feel at a loss for a “system,” and, if so, may, perhaps, be able to find suggestions for one in the next few paragraphs. Figure 63 A Favorite Form of Frequency Count Combined With CONTACT Data A D S 2/4 R W B C D F R M Z W W V T Z R 10/11 R M S Y A F R F Y N E F * Y D D Y 5/6 D Z V S R G X 1/2 S (Etc.) Concerning the numbers: A has a frequency of 2, and a variety-count of 4. D has a frequency of 10, and a variety-count of only 11. (Yet D, with so little variety of contact is a vowel!) First of all, in any substitution problem, there should be a counting of the letters in the cryptogram in order to find out their frequencies. This is called a _frequency count_, and is usually accomplished as follows: The decryptor first lays out the normal alphabet — either horizontally or vertically. He then begins with the first letter of his cryptogram, taking letters one by one just as he finds them, and for each time that he finds a letter in his cryptogram, he places a tally mark beside that same letter as found in his prepared alphabet. The result of such a count, taken on the foregoing cryptogram, will be shown further on, when the same cryptogram appears again without its word-divisions. If the problem seems likely to prove really difficult, there should also be a _contact count_; that is, a list showing every letter, together with the two which have flanked it right and left each time it was used. Such a count is partly shown in Fig. 63. This, like the frequency count, may be prepared either vertically or horizontally; and, just as in making ready for the frequency count, an alphabet may be laid out in advance ready to receive the contact letters, taken from the cryptogram as they happen to be found. Specifically: The letter _F_ comes first in the cryptogram; it has no left-hand contact, but is contacted on the right by _D_. We find the _F_ of the prepared alphabet, and place beside it its contacts: *-_D_. The second letter of the cryptogram is _D_, flanked by _F_ and _R_. We find the _D_ of the prepared alphabet, and place beside it its contacts: _F_-_R_; and so on to the end of the cryptogram. Some solvers do not prepare an alphabet in advance, but simply put down the main letters as they happen to come across them in the cryptogram. It should be added, too, that the few contacts included in Fig. 63 were taken from the _undivided_ cryptogram. When word-divisions exist, and are known to be the correct ones, a great many solvers do not include any contacts which involve two different words. Here, for instance, the second appearance of _D_ is shown with contacts _R_-_M_. These solvers, knowing that this _D_ stands at the end of a word, will leave the _M_-contact blank: _R_-* It will be noticed from the figure that the contact-count is, in itself, a frequency count; it shows that _A_ has been used twice (frequency 2), that _B_ and _C_ have not been used at all, that _D_ has a frequency of 10, and so on. We may also make it a _variety-count_, by noting down beside each letter the number of _different_ letters present among its contacts. Ordinarily, the vowels have more variety in their contacts than do the consonants, and take part in more reversals. The uses of contact data will be examined more closely later on. Now, giving our attention to English frequencies: No matter what frequency table we examine, we always find that the letter _E_ tops the list, with a frequency of over 12%. Except in telegraphic text, the letter _T_ always has the second frequency, near 10%. After that, the frequency tables will disagree as to whether _A_ or _O_ should have the third frequency, or whether _I_ should come before _N_, or _S_ before _R_; but always the same nine letters, _E T A O N I R S H_, will constitute the _high-frequency group_ of letters. These particular letters will make up about 70% of any English text, and it is almost impossible to prepare one, no matter how short, without using them in about that proportion, though in the shorter texts, _L_ and _D_ will sometimes creep up into the high-frequency class, taking the place of _H_. Following the high-frequency group, we find a group of letters which are always of _moderate frequency_; and a third group made up of _low-frequency_ letters. Since the frequency tables themselves are not duplicates throughout, we could not expect, even having a 10,000-letter cryptogram, to make substitutions by simply following the frequency table and be absolutely sure of coming out with the correct solution, though we might very nearly do so, and might, to some extent, succeed in doing this with a cryptogram of 2,000 letters. The “aristocrats,” however, are arbitrarily confined to lengths which run between 75 and 100 letters. Even without manipulation, a text of this length will not always show _E_ as a frequent letter, and may, for some reason, show _Z_ or _X_ with a fairly high frequency. However, the “class distinctions” among the letters are always, to some extent, dependable. High-frequency letters, moderate-frequency letters, and low-frequency letters, all tend to be very exclusive. They will exchange frequencies with letters of their own class, but all three classes are disinclined to welcome outsiders. The vowels, also, as we have seen, have their fraternity; if the frequency of _E_ is lowered, some other vowel, even _U_ and _Y_, will insist upon making up the difference, rather than yield this privilege to a consonant. The high-frequency group, as mentioned, includes the nine letters _E T A O N I R S H_. Even in this exclusive circle, there are cliques — not ironclad, but clearly noticeable: _Class I_. The letters _T O S_ appear frequently _both as initial letters and as final letters_ in their own words, with terminal _O_ confined largely to short words. All three of these are very freely doubled. _Class II_. The letters _A I H_ appear frequently as _initial letters_, but far less frequently as finals, especially _A I_. Not one of these is readily doubled. Class III_. The letters _E N R_ appear frequently as _final letters_, but far less frequently as initials. The letter _E_ is very freely doubled; the other two not so often. The following further observation might be made: When one of these letters changes its class, the least likely exchange is one occurring between classes II and III. * * * Now let us return to the foregoing cryptogram and consider the application of this information. A frequency count taken on this cryptogram will show that when its letters are rearranged according to their frequencies, they divide automatically into three rather clearly-defined groups, much like those of the normal frequency table. There are eight letters which outrank the rest, and these, named in the order of decreasing frequencies, are: _R_, _D_, _V_, _S_, _F_, _Z_, _K_, _X_. Presumably, then, most of these are substitutes for letters of the class _E T A O N I R S H_. If an examination now be made of the terminal letters in the cryptogram, it will be found that, of the eight considered, the letters _R D F_ have appeared at least once in both positions. These we may label class (a), as being good material for the originals _t_, _o_, _s_. It is found that the letters _S Z_ have appeared at least once as initials, but not at all as finals. These we may label class (b), that is, good material for the originals _a_, _i_, _h_, except for a point which will be mentioned in a moment. The remaining three letters, _V K X_ are found at least once as finals, but not at all as initials; these we will call class (c), good material for the originals _e_, _n_, _r_. Thus, we are enabled to begin our work by noting down the following possibilities: (a) _R D F_ might represent (I) — _T O S_. (Compare the facts: _t_, _o_, _n_). (b) _S Z_ might represent (II) — _A I H_. (Compare the facts: _a_, _c_). (c) _V K X_ might represent (III) — _E N R_. (Compare the facts: _e_, _h_, _l_). While such a classification is probably never 100% accurate, the writer has still to find a cryptogram (unless among the very badly manipulated “aristocrats”) in which at least part of the assumptions are not correct. We are dealing, however, with the _very short cryptogram_, in which a single occurrence of a letter in a given position can be regarded as of some importance. Ordinarily, the most frequent letter of (c) will represent _e_, as it does here. This letter is famous as a final letter, and any printed page will show it at the end of 17 or 18 words in every hundred. There is not so clear a distinction between _T_ and _S_ of class I. The most vulnerable of the groups, however, is (b). Of the three letters which may be represented here, two are vowels, concerning which we are to hear more, and not one is readily doubled. When _Z_, tentatively included in this group, is found to have been doubled near the beginning of a word, it is seen to be wrongly classified. This method, as mentioned, is intended merely as a suggested means for effecting an entry. The correct identification of only four letters, as we have seen, will make enormous inroads into the contents of a cryptogram. Other points which will at times prove helpful are as follows: In words of three and five letters, the central one is nearly always a vowel, taking it for granted that the words _the_ and _and_ will never be present in any difficult cryptogram. In the longer words, the favorite positions of the vowels are the two positions which follow the initial letter and the two positions which precede the final letter. The favorite position of _I_, in fact, is well known as the third-to-last. About half the words used in any written text are of the type called _negative_, or _empty_; that is, the pronouns and auxiliary verbs, and particularly the various kinds of connectives _without which_ _no sentence can be put together_. If your cryptogram is an “aristocrat,” you will probably find that most of your prepositions begin with _A_: _amongst_, _amidst_, _adown_, etc. Every sentence contains a verb, and these are more or less limited in their possible terminations. Any letter used only two or three times, and always followed by the same letter, is good material for _Q_. With what has been said, the student should have no trouble in dealing with the first fifteen “aristocrats” which follow the next chapter. As to the remaining thirty-five of Mr. Lamb’s collection, we need say only this: It is impossible to avoid every characteristic of the English language and still write English. * * * _The General Case_. — Now let us examine carefully Fig. 64, where the foregoing cryptogram is repeated without its word-separations, and is followed by its frequency and contact data. The various devices indicated in this figure are all of a more or less optional nature. Concerning the preparation of the cryptogram itself, the chief requirement is that it be done in ink, or typewritten, on paper which will suffer a great deal of erasure. The placing of its frequency figure above each letter is highly recommended, but not vital. Many solvers will underscore all possible repeated sequences, and will indicate in some other manner all reversals of digrams; others will underscore only the repeated trigrams and longer sequences; and still others do not underscore at all, being content to have all of these repetitions and reversals listed before them in the contact data. Figure 64 5 10 11 3 3 2 1 9 4 4 2 11 10 1 10 6 4 9 6 2 1 3 10 4 F D R J N U H V X X U R D M D S K V S O P J R K 5 10 3 5 5 3 4 1 6 11 11 9 3 1 3 11 3 10 2 11 3 10 5 9 Z D Y F Z J X G S R R V T Q Y R W D A R W D F V 11 4 9 10 11 4 9 3 10 5 6 5 5 10 3 5 11 10 3 3 9 2 9 3 R K V D R K V T D F S Z Z D Y F R D N N V O V T 6 4 6 2 3 9 5 11 S X S A W V Z R Ordinary Frequency Count: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 2 10 5 1 1 3 4 1 3 2 1 1 11 6 3 2 9 3 4 3 5 Contact-Information: (High-frequency symbols) R D V S F Z K X D.J F.R H.X D.K ..D K.D S.V V.X U.D R.M K.S V.O Y.Z F.J R.Z X.U J.K M.S R.T G.R D.V S.Z R.V* J.G S.R Z.Y* F.R F.Z D.S Z.D R.V* S.S R.V W.A K.D T.X Y.R V.R Y.W W.F K.T X.A A.W V.R N.O V.K T.F O.T (Low-frequency symbols) D.K Z.Y* W.Z F.D R.N G H M P Q Z.. X.S U.V D.D O.J T.Y (Moderate-frequency symbols) J N T W Y A O U R.N J.U V.Q R.D* D.F* D.R S.P N.H P.R D.N V.D R.D* Q.R S.W V.V X.R Z.X N.V V.S A.V D.F* As to the preparation of the contact data, most of the expert decryptors seem to prefer the vertical arrangement of Fig. 63 to the one shown here. But, in simple substitution, a full listing, made for all letters, is not necessary in dealing with the average cryptogram. Usually, it will serve the purpose to make a frequency count first, and then prepare a listing of contacts which includes only chosen letters, those of very high frequency and those of very low frequency; with many cryptograms, no listing at all need be prepared. The contact data, however, are valuable. Each pair of contact-letters actually indicates a trigram. Examining, for instance, the listing under _R_: The first expression, _D.J_, represents a trigram _DRJ_ in which the central letter was omitted in order to conserve time and space. When we find, lower down in the same listing, another letter _D_, we see in this a repeated digram _DR_. Considering the right-hand side of the same listing: When we find _K_ used three times, we see this as a digram _RK_ used three times. _By finding its duplication, under K_ (left side), we are able to see that two of these repetitions are continued as parts of a repeated trigram _RKV_. In the list of contacts for _D_, we find a repeated trigram _ZDY_, which may be traced, under _Y_, as part of a longer repeated sequence, _ZDYF_. It is usually best to underscore these longer repeated sequences on the cryptogram; often, they can be identified from the list of frequent trigrams. But repeated digrams, as a rule, are so numerous as to be in the way when noted on the cryptogram itself. With digrams, only those which are repeated oftenest need be underscored; they can nearly always be identified directly from the list of frequent digrams. The solver, then, prepares his cryptogram and sequence data to suit himself, varying his method according to the difficulty of the given example. With this done, his usual method of solution follows the process popularly known as “vowel-spotting.” * * * _The Vowel-Solution Method_. — Using this process, the first step is that of separating the vowels from the consonants; the second is that of assigning identities to the selected vowels, and afterward to the most recognizable of the consonants. For assistance in applying this method, suppose we extract certain information from the digram chart and have this concretely before us in a series of numbered “pointers”: 1. The vowels _A E I O_ are normally found in the high-frequency section of the frequency count; the vowel _U_ in the section of moderate frequencies, and the vowel _Y_ in the low-frequency section. 2. Letters contacting low-frequency letters are usually vowels. 3. Letters showing a wide variety in their contact-letters are usually vowels. 4. In repeated digrams, one letter is usually a vowel. 5. In reversed digrams, one letter is usually a vowel. 6. Doubled consonants are usually flanked by vowels, and vice versa. 7. It is unusual to find more than five consonants in succession. 8. Vowels do not often contact one another. If the letter of highest frequency can be assumed as _E_, any other high-frequency letter which never touches _E_ at all is practically sure to be another vowel, and one which contacts it very often cannot be a vowel. (This will apply equally to other vowels, wrongly assumed as _E_.) With a text of reasonable length, say 150 letters, it is sometimes possible to determine with certainty just which of the cryptogram-letters represent the six vowels; with shorter cryptograms, we can usually find four; sometimes only three. But once the separation has been made, individual vowels can usually be established as follows: The most frequent one is ordinarily _E_. The one which never touches it is most likely to be _O_. Both of these are very freely doubled, and for that reason are often confused with each other, but seldom with any other vowel. They rarely touch each other. The vowel which follows _E_ and almost never precedes it, is _A_. The vowel which reverses with it is _I_. The same two observations will apply to the vowel _O_; but a distinction occurs when the vowel _U_ can be found; this vowel precedes _E_ and follows _O_. The only vowel-vowel digrams of any real frequency are _OU_, _EA_, _IO_. Three vowels found in succession may represent _IOU_, _EOU_, _UOU_, _EAU_. As to identification of the consonants: Those letters still remaining in the high-frequency section of the frequency count will usually include _T N R S H_. Of these, the most easily identified is _H_, which precedes all vowels and seldom follows one; it may be identified often as part of repeated sequences _TH_, _HE_, _HA_. Next to _H_, the most recognizable of the consonants, aside from frequency, is probably _R_, which reverses freely and indiscriminately with all vowels, and has a strong affinity for other high-frequency letters. The consonant _T_ can usually be identified by its frequency, by its tendency to precede vowels rather than follow them, and by its almost inevitable combination with _H_ on more than one occasion. It is also notably difficult to distinguish from the vowels. The letter _N_ has characteristics which are to some extent the opposite of those mentioned for _H_; it prefers to follow vowels and precede consonants, and, to a lesser extent, the same is true of _S_, according to some charts. However, _N_, _S_, and _T_ are all readily reversible with vowels, and are sometimes hard to tell apart. The only frequent reversals of two consonants are _ST_-_TS_ and _RT_-_TR_. The doubles _TT_ and _SS_ are among the most frequent in the language. Having this information, together with what we know of frequent digrams and frequent trigrams and very common short words, we are well armed against the longer cryptograms. Those which are shorter will give more trouble; but it takes a very short cryptogram indeed to be really resistant. Our foregoing cryptogram contains only 80 letters. Figure 65 (Cryptogram Frequencies:) R D V S F Z K X 11 10 9 6 5 5 4 4 E T A O N I R S H (Normal Grouping) To apply “pointers” in this case, let us begin by considering the individual frequencies of the letters _E T A O N I R S H_. Their frequencies per 100, according to our own chart, are about as follows: _E_, 12; _T_, 10; _A_, 8; _O_, 8; _N_, 7; _I_, 7; _R_, 6; _S_, 7; _H_, 5. Thus, when frequency alone is considered, _E_ and _T_ have a tendency to draw away from the others and form a private high-frequency group of their own. The distinction among the others is not so clear, and not always the same in all tables; we can only say of these that _A_ and _O_ will always outrank the rest, and will be closely followed by one of the others, usually _N_, and that _H_ will always rank last. Thus, the high-frequency group itself tends to sub-divide more or less clearly into three minor groupings: _E T_ — _A O N_ — _I R S H_. Of these, the first minor group shows one vowel, the second shows two, and the third shows one; the vowels _U_ and _Y_ are not present. Now if the eight leading letters of our cryptogram, already listed as _R D V S F Z K X_, be examined in this respect, it is found that these, also, have a tendency toward separation into groups of differing frequency, which more or less correspond to the normal groupings, as indicated roughly in Fig. 65. Normally, we expect the highest of these subdivisions to contain one vowel and one consonant, specifically _E_ and _T_. When we find that the corresponding subdivision of the cryptogram contains three letters, the supposition is that one of the vowels, _O_ or _A_, has moved up into this section; in that case, it has taken part of the frequency of _E_, making it not at all unlikely that the most frequent letter of the cryptogram will not represent _E_, and will not, in fact, represent a vowel. And if, as we believe, there are two vowels in the highest section, then we are not likely to find more than one in the central subdivision, especially when we note that it contains only three letters. This would leave the fourth vowel to be found in the third subdivision. Thus, we have applied pointer No. 1. For the application of pointer No. 2, we turn to the contact data. Comparing first the three letters _R D V_, and making a careful inspection of all cryptogram letters whose frequency is 3 or lower, we find that, of our three letters, the letter _R_ has 7 contacts with low-frequency letters, the letter _D_ has 9, and the letter _V_ has 8. Thus, the letter _R_, though having a higher frequency than the other two, has fewer low-frequency contacts than either, and so begins to draw away and assume the aspect of a consonant. The application of pointers Nos. 3, 4, and 5, provides no satisfactory distinction. But in pointer No. 8, we find a very clear distinction: _D_ and _V_ have touched each other only once, while _R_ has contacted both with a total of six contacts — a great many for a cryptogram of this length. We decide, then, that _R_ is a consonant, and that _D_ and _V_ are vowels. Considering the central subdivision, where we expect to find one vowel: Application of pointer No. 2 shows that _S_ has four of the low-frequency contacts, while _F_ has two and _Z_ has only one. Further examination of _S_ by pointer No. 3 shows that it has an unusual variety in its contact-letters. Thus, _S_ would appear to be the vowel here. As to the third section, there is so little difference in frequency between these letters and some others not included in the high-frequency class, that any distinction found would not be convincing. The individual cryptogram, however, has happened to contain the sequences _VXXU_, _SRRV_, _SZZD_, _DNNV_. Application of pointer No. 6 confirms our previous selection of _D_, _V_, _S_, as vowels, and suggests that the letter _U_ might also represent a vowel. Since the frequency of this letter is only 2, we cannot feel so confident in drawing conclusions about it; however, a glance at the contact data shows that it has touched four different letters, which is 100% variety, that one of these four letters is an accepted consonant, and that none of the other three, so far, is an accepted vowel (pointers 3 and 8). The chances are that this letter _U_, with its low frequency, represents _y_ in some such formation as _ally_, _ully_, _etty_, etc. With four vowels tentatively isolated, we are now in a position to apply pointer No. 7, and this we may do by returning to the cryptogram and marking for attention each appearance of each supposed vowel. This is usually done by circling each one with a pencil mark. In Fig. 66, a small letter “v” has served the same purpose, and a few serial numbers have been added for convenience of reference. Now let us examine Fig. 66. At (a), watching the small “v’s,” we find a fairly uniform distribution of vowels except for three long segments beginning, respectively, at the 20th, 27th, and 37th letters. For convenience, these have been copied out at (b). The two of these which are longer, and therefore most likely to contain at least one of the missing vowels, are both found to have included _Z_ and _J_. Of these two letters, _Z_ is one which was previously discarded (from the central section of the high-frequency group) during our preliminary investigation. Examining it again, to make sure, we find it now as a double between two supposed vowels, and having two additional contacts with supposed vowels (pointers 6 and 8). But _J_, we find, has never contacted any supposed vowel; it reverses with a supposed consonant, and shows as much variety as could be expected of a letter appearing only three times. Figure 66 (a) v ? v v v v v v v v ? 25 F D R J N U H V X X U R D M D S K V S O P J R K Z v ? v v v v v 50 D Y F Z J X G S R R V T Q Y R W D A R W D F V R K v v v v v v v v v v v 75 V D R K V T D F S Z Z D Y F R D N N V O V T S X S v 80 A W V Z R (b) 20-25 27-32 37-41 O P J R X Z Y F Z J X G T Q Y R W ? t ? t (c) F D R J N U H V X X U R D M D S K V S O P J R K Z e t i y o y t e e a h o a i t h D Y F Z J X G S R R V T Q Y R W D A R W D F V R K e i a t t o t e t e o t h V D R K V T D F S Z Z D Y F R D N N V O V T S X S o e t h o e a e t e o o a a A W V Z R o t (d) Preliminary assumptions: y t e . e a h o a . t h o e t h o . CORRECTIONS: y t O . O a h E a . t h E O t h E . ...to go ahead... ...the other... (e) F D R J N U H V X X U R D M D S K V S O P J R K Z o t i y e y t o o a h e a i t h N F G D W Notify *e**y to go ahead with....... The acceptance of _J_ provides five of the vowels, with frequencies of 10, 9, 6, 2, and 3 — a total of 30 out of an expected 32. In a longer cryptogram, we should probably look for the sixth vowel among those letters having approximately the correct frequency for making up the expected 40%. As to the present case, we should have no trouble selecting it from the five-letter segment at (b); but this would cause us to spot also the short word in which it is used, and our immediate concern is that of spotting vowels only through their known characteristics as vowels. We will assume, then, that the last vowel cannot be found. The next step demands that we assign to the most frequent of the supposed vowels the value _e_, which happens to be a wrong assumption. Concerning this, it may be well to repeat here something which has already been said: In dealing with the simplest of cryptograms, there is often a short detour into trial and error. Also, the average decryptor, accustomed to the work, and fully aware of what he may expect from only 80 letters of text, will usually pause at this point and make some further observations before filling in any of his substitutions. However, there is value even in the making of wrong substitutions; the actual placing of supposed plaintext values in their supposed positions puts the plaintext possibilities before us _in visual form_, causing us to note easily those very points for which the experienced decryptor examines in advance. Figure 67 1. F D R J N U H V X X U R D M D S K V S O P J R K Z D Y F Z J X G S R R V T Q Y R W D A R W D F V R K V D R K V T D F S Z Z D Y F R D N N V O V T S X S A W V Z R. (80 letters). 2. H V X X U T V W D T R A Z D Y F Z J X T V S O U R D S Z R N S E D T S Q X U L K S E V O T D W W V O D R K V T G S R R V T Q Y R A Y M M V A R P V A K D Y X O H V V W K S G G V T J F M S R R K J A R K T D Y M K T J Z K S T O A L R K J F H R K V U G S U M T S F R R K V A Y Q A J O U R K S R U D Y A W D H V D N. (155 letters. - Total for both cryptograms: 235). At (c), then, we have made our substitutions. We have assumed that the most frequent vowel, _D_, is representing _e_. Having noted the v-v digrams _DS_, _VD_, _VS_, we have selected _S_, rather than _V_, as the substitute for _a_, preferring a digram _oa_ (_DS_) to a digram _ao_ (_VD_). This leaves the vowel of second frequency, _V_, to represent _o_. This will cause the third of the v-v digrams (_VS_) to represent _oe_, not frequent, but better than the digram _ao_ previously mentioned. _J_, then, probably represents _i_, and _U_ may represent _y_. As to consonants, we have assigned the value _t_ to the most frequent one, _R_, and there has been no difficulty in identifying _h_ in the letter _K_, which three times has followed _R_. But our present cryptogram is too short to provide any clear distinction among letters which might represent _n_, _r_, _s_. With the seven substitutions made, as shown at (c), notice how quickly it becomes possible to spot the incongruity of sequences _tho_, more than once, in a short text which contains not a single occurrence of _he_ or _ha_. Notice again, at (d), how quickly the mere exchanging of the values _e_ and _o_ will bring out word-suggestions. At (e), the first line of the cryptogram is repeated, as it would appear after the making of this exchange. The beginning of the message can almost be read: The first word appears to be _notify_, furnishing two new substitutes. Three more can be furnished in the suggested sequence _to go ahead with_. And here, the word _with_ would be tried in any case, because it is a common word, and because the frequency of the letter _P_ is suggestive of _w_. Arrived at this point, we begin to notice patterns: _postpone_, _council_, _account_, _matter_, and so on; so that the rest of the solution is largely a matter of filling in framework. In the given example, it would also be noticed that _F_ and _N_ have resulted from reciprocal encipherment; this may not be the case with other letters, but it presents a possibility which is always well-worth investigating. Figure 68 Digram Count for the Longer Cryptograms (First-Letters) A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A 1 1 1 1 2 1 3 1 A 11 B B C C D 1 1 1 1 1 3 3 1 2 4 3 D 21 E 2 E 2 F 2 2 1 3 F 8 * S G 1 1 1 1 1 G 5 e H 1 1 1 1 H 4 * c I I o J 1 2 1 1 2 2 J 9 n K 1 1 1 10 1 1 1 K 16 d L 1 1 L 2 {. M 1 1 1 1 2 M 6 L N 2 1 1 1 N 5 * e O 1 2 1 3 1 O 8 t P 1 1 P 2 t Q 1 2 1 Q 4 e R 3 3 2 1 1 1 4 4 1 3 1 2 2 R 28 * r S 2 1 3 4 1 1 3 2 1 S 18 s T 2 2 1 1 1 1 6 1 T 15 U 1 2 1 1 1 3 U 9 V 1 1 1 4 6 1 1 1 1 2 2 1 2 V 24 W 2 1 2 2 1 W 8 X 2 1 1 2 2 1 X 9 Y 2 6 2 Y 10 Z 1 2 1 1 2 1 1 Z 9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 9 5 4 27 Most Frequent Digrams RK, 10 KV, 6 WD, 4 SR, 4 VT, 6 DY, 6 RR, 4 KS, 4 HV, 4 * * * _The Digram-Solution Method_. — This method, representing another of our many debts to M. E. Ohaver, may be used either in conjunction with the vowel method, or independently, as the fundamental method of attack. For a satisfactory demonstration, however, we need more material, and Fig. 67 shows our cryptogram again, together with a suspected reply. Thus we have a length of 235 letters, so that the preparation of contact-notations, which we found sufficient in the preceding case, becomes here an irksome task. For these longer cryptograms, it is usually best to put all of our data into the form of a _digram-count_, as indicated in Fig. 68. This is most easily done as follows: Using a sheet of cross-section paper, mark off the limits of a 26 x 26 square; write the normal alphabet across the top, so that each of its letters will govern a column; and write it again along one side, so that each letter will govern a row. For added convenience, these two alphabets may be repeated, as they are shown in the figure. Now, remembering that each letter in the text is the first letter of a digram (except the two which are finals), our two texts, with their total of 235 letters, are to provide a count on 233 digrams. Taking letters one by one, just as they come in the cryptograms, find each letter in the upper alphabet; find, in the side alphabet, the letter which immediately follows it in the cryptogram, and count this digram by placing a tally-mark in the cell at which the column and row governed by these two letters are found to intersect. In the figure, the tally-marks have been replaced with numbers showing their totals. It will be noted that the process described is identically the method which would have been used by Meaker in preparing the digram chart; and, just as in the case of the digram chart, the counting of the digrams has automatically counted the single letters. To obtain their frequencies, we may total either the columns or the rows, taking the larger figure in those few discrepancies caused by initial or final letters. With the chart understood, the digram-method of solution can be shown in a nutshell. An inspection of this chart enables us to find quickly that the leading digrams are those listed: _RK_, _VT_, _KV_, _DY_, etc. These, almost certainly, are the substitutes for digrams ranking high on the normal list, and many others, having a frequency of 3, are very likely indeed to be substitutes for digrams from that same high-frequency class. Our text, of course, is still short, even with 235 letters, and we do not invariably find, in texts of this length, that the ranking digram (in this case _RK_, frequency 10) is the substitute for _th_, though the chances are, at all times, that it is. And should it prove here that _RK_ does not represent _th_, then we may be quite sure that _th_ is represented in one of the digrams _VT_, _KV_, _DY_, having the next frequency, 6. With the single exception of _RR_, each digram of the nine which are listed below the chart can be checked against three other digrams: Its own reversal; the doubling of its first letter; and the doubling of its second letter. In addition, it may be checked through the individual frequencies of its two component letters. These points of comparison, made for each of the nine leading digrams, have been tabulated in Fig. 69, so that the discussion may be easily followed. Examining _RK_, assumed to represent _th_: Its reversal, _KR_, has not appeared on the chart, which is satisfactory for a digram of no greater frequency than its supposed original, _ht_. The doubling of its first letter, _RR_, has appeared four times, which is satisfactory for _tt_, one of the leading doubles of our language. The doubling of its second letter, _KK_, has not appeared, which is eminently satisfactory for a digram as rare as _hh_. Its first letter, _R_, has a frequency of 28, the highest in the cryptogram, which is not at all unusual in the case of _t_; and its second letter, _K_, has a frequency of 16, a little high for _h_, but not unsatisfactory. Thus, we find nothing, so far, to contradict the supposition that the digram _RK_ is the substitute for _th_. But if _K_ represents _h_, it should be possible to find digrams beginning with _K_ which will check equally well as the substitutes for _ke_ and _ka_. We do, in fact, find _KV_ and _KS_. But which is which? Examination of Fig. 69 shows that one of these, _KS_, has a reversal, _SK_, frequency 1; but this is not informative, since it would be equally expected of _eh_ or _ah_. Further examination shows that _V_ has been doubled, which is far more characteristic of _e_ than of _a_. Also, the individual frequency of _V_, 24, is the second highest in the cryptogram, and more likely to be that of _e_ than that of _a_. Thus we may assume that _KV_ represents _he_ and that _KS_ represents _ha_. This automatically identifies the digram _SR_ as _at_. As to _VT_, this, apparently, involves the only reversal of any prominence in the cryptogram. Its first letter has already been identified as _e_, and the outstanding reversal of the language is _er_-_re_. This is not so certain as in the preceding cases, but the frequency of _T_ is satisfactory as that of _r_. Thus we have identified the letters _t_, _h_, _e_, _a_, _r_, which is as far as the tabulation has been carried. Having the substitute for _h_, we may now bring in the vowel-solution method through examination of digrams _KD_, _KJ_, _KT_, _KZ_; or continue with the digram-solution method by looking over the field for some of the other _h_-digrams: _sh_, _ch_, _wh_, _ph_, _gh_, and so on. The first of these should be easily identified by the frequency of _s_, and, in addition to the regular three check-digrams, we might check this against a possible _st_, another of our leading English digrams. With the process explained, we need not go further; the substitution of letters _t_, _h_, _e_, _a_, _r_, _s_, will surely break any simple substitution cryptogram. Possibly, enough has not been said as to the use of the trigram list, the consideration of common affixes, common short words, and so on; but these are all points which the student can best develop for himself. Figure 69 Digram Doubled Letter Letter Frequency Supposed Identity Original Reversed 1st 2d 1st 2d R K 10 K R... R R 4 K K... R 28 K 16 t h V T 6 T V 2 V V 1 T T... V 24 T 15 e r K V 6 V K... K K... V V 1 K 16 V 24 h e D Y 6 Y D... D D... Y Y... D 2l Y 10 ? W D 4 D W 1 W W 1 D D... W 8 D 2l ? S R 4 R S... S S... R R 4 S 18 R 28 a t K S 4 S K 1 K K... S S... K 16 S 18 h a R R 4 .... .... .... R 28 t t H V 4 V H... H H... V V 1 H 5 V 24 ? (-e) Another point, however, must not be overlooked: _the long repeated sequences_ _HVXXU_, _ZDYFZJX_, _DRKVT_, _GSRRVT_. Repeated sequences of these lengths will usually come from _repeated whole words_, making it possible, to some extent, to attack the cryptogram by word-division methods. It is, in fact, the repetition of sequences, these and many others, which, in the beginning, has led us to assume that both cryptograms are using the same key. As to the recovery of this key, we need not wait until solution is complete. Even in simple substitution, it is well, during the identification of substitutes, to have before us a sort of skeleton key, in which the plaintext alphabet has been written out in normal order, so that the substitutes, as fast as their identities are discovered, can be placed below their originals. Thus, having identified as many as twelve letters in our present cryptogram, this skeleton key, or framework, might begin to assume the appearance which is indicated in the upper tabulation of Fig. 70. Here, we are able to note a reciprocal encipherment between _A_ and _S_, _F_ and _N_, _R_ and _T_, and _U_ and _Y_, suggesting that the whole encipherment may have been reciprocal; if so, we have the identities of four additional substitutes: _O_, _I_, _H_, _E_, representing _d_, _j_, _k_, _v_, respectively. If they are present in the cryptogram, these four substitutions may be tried; but with or without their presence in the cryptogram, they can be added to the skeleton key, as in the lower tabulation of the figure. Notice that when this has been done, the cipher alphabet is beginning to show alphabetical sequences (reversed). We find _H I J K_, and, just before this, _D F_, which is an alphabetical sequence if the letter _E_ has been taken out for use in a key-word. Between _DF_ and _HIJK_ of the cipher alphabet, we need only _G_ to fill out the sequence; therefore either _l_ or _m_ must belong to the key-word; comparing this with what is found at the other end of the sequence, we find that either _L_ or _M_ would be the substitute for _g_. Between _NO_, we find _V_, evidently misplaced; and, following _O_ and preceding _S_, we find two positions which may be occupied by two of the letters _PQR_, of which _R_ has already been placed (under _t_). That is, where the encipherer has used a key-word-mixed alphabet without troubling to carry it through a transposition process of any kind, we are often able to build it up again, and make it help us in the solution. This is especially true if he has used reciprocal encipherment; with the substitutes which may actually be found in our foregoing cryptograms, a little rearrangement is all that is needed in order to discover exactly what the original key was. When the cipher alphabet has been carried through a transposition block, it is not so easy to recover during the actual process of solution; afterward, however, it is not usually difficult to treat it by one of the transposition processes, just as if it were a transposition cryptogram of 26 letters. In the examples which follow, the key-word-mixed alphabets were used as they stood, though we believe that none of the encipherment was reciprocal. In one case, however, the plaintext and cipher alphabets were both mixed, according to different key-words, so that the recovery of this key may prove troublesome. Figure 70 Supposing 12 substitutes to have been identified: Plaintext alphabet: a b c d e f g h i j k l m n o p q r s t u v w x y z CIPHER ALPHABET: S V N K J F D T A R Y U Assuming reciprocal substitution: Plaintext alphabet: a b c d e f g h i j k l m n o p q r s t u v w x y z CIPHER ALPHABET: S O V N K J I H F D T A R Y E U Q?P? * L? G? C?B?* * T? M? 45. By PICCOLA. S C Y J T O P N R M J T U E A W S R O R O A E P Q R J C R O A R M P H Q K J Q S R S J H A X P F K E A Q R M Y S R P Q P M P S E C A H G A W S R O P E E E S H A Q O P V S H I R O A Q P F A E A H I R O P H N P Q R J H T F U A M C J M R Y R O M A A W A E E B T Q R W M S R A S R J H A I M J T K U A E J W P H J R O A M P H N Q A A W O P R Y J T Q A A L. 46. By PICCOLA. (Plaintext and Cipher Alphabets have each a key-word). J C W E H S N D F S B N J I V T E A G V D H O C Q Q I Q F R P H F K Q E A R F Q A R F A H F Q E J C B N J N H B E O C B N L N O V H B L F Q J B N A B L F V H C A J I V B N W N S T B L E A G V A J N S R F W N S Y R V S S C A E H V A Q F C J E A G J N A W N S O V B V C Q Y D C S P H E H O C S P E A G B E O N A F R L C A G N E A K C S O N S H A C B E F A C Q X. 47. By PALOMITA. (No key-word). B O Y B A N K I L L A P K R I Y A P Y Y U P B L Y E R P B P L G Y G M H L A B O Y K J A K L P Y L H H J A C R P O R C Q U Y N B H L A B O Y G N A Z N Y L H B O Y K N A N P R B R W O J C B R C Q D N P K. 48. By PICCOLA. (Of these two, one has normal word divisions; the other has not). W T E I C H E P P C A E P T J W P O Y D Q P R M E L U E I N D E P Q T C Q D Q D P C P D H K G E P U O P Q D Q U Q D J I C. I S Y E Q T C P V E M Y R E W M E K E C Q E S P E L U E I N E ? P D Q H U P Q C G P J T C V ! E O E E I Q M C I, P K J P E S X Q T E Q M C I P K J P D Q D J I D P U P U C G G Y J R Q T E V E M Y P D H K G E P Q F D I S. 49. By PICCOLA. P B K L A B E I C D J D B I L Y P K L D O I X L Y I P K V Y A L ? A G F Y A M I L K L Y I K I D C A G G L D O I X V D J R K L Y I C P B R P B N X D Q A J I ? Q K J I S P B R K L Y A L A B R M X Q F P L F P E O L D I B R V Y P E Y O B D V X D Q P C E G I A J F I J C I E L G X P K S I A B P B N P L K. A J P K L D E J A L A B B D L P K L Y P K B D ! CHAPTER X The Consonant-Line Short Cut _A Method for Attacking Difficult Cases_ By George C. Lamb Several routine methods have been evolved for special use on the very difficult “aristocrat” — that fascinating form of simple substitution with word-divisions in which the message is of no importance whatever and the encipherer’s full attention has been given to manipulation of letter characteristics. Of the several such methods which have proved workable over a long period of years, the author’s favorite is the “consonant-line” method, the exact value of which has been tested in a special analysis of 130 very difficult cryptograms. However, it should be stated clearly that no method is a mechanical crypt-solver; these devices merely serve to bring out clues which to the haphazard worker are totally invisible. For discussion, we will consider an example by M. E. Bosley which appeared as No. 19 Aristocrat in _The Cryptogram_ for June, 1936. This is shown at Fig. 71. The work must be initiated by isolating a small group of consonants, and the problem of selecting these with certainty is one which for years has baffled the shrewdest solvers of both the National Puzzlers’ League and the American Cryptogram Association. Many successful solvers have based their selection on frequency alone, rearranging the letters of a frequency count in the order of decreasing frequency and marking off a section of low-frequency letters which will presumably include only consonants. But the clever manipulator is able to distort frequencies out of all resemblance to the normal table, and here we will base our selection on _variety of contact_ — something which the constructor cannot successfully manipulate. Figure 71 U W Y M N X K A E H X R B Z U V X M U W B Z O Y Z T W H V C X Y A C Y A U Z D B R A H V K B A; Z W S V A H K U Z B K C, M S C X C Y X B S, X V Z Y T R Y C X P. Fig. 72 sums up the entire process. At (a) we have a list of contacts taken in the order of appearance of the letters, and at (b) a rearrangement of the cryptogram letters _in the order of decreasing variety of contact_. Immediately above each letter is its “variety count” and directly above this is its frequency figure. In this set-up, a certain number of letters taken at the extreme right may confidently be marked off as a group of consonants. As to just where the line of demarcation may be set, recent analysis has shown that it is safe to include 20% of the total variety-count. In this case, the sum of all variety-figures is 104, and 20% of this, roughly, is 21. If we begin with _P_ at the extreme right and add numbers backward for a count of 21, we find that the line of demarcation falls between _R_ and _C_. However, we have at this point four letters, _M_, _R_, _C_, _S_, whose variety-count is uniformly 5, and any two of which might have occupied the places of _C_ and _S_. To accept a vowel at this stage would mar the effectiveness of our system, and either we must discard all four of these letters, or we must find a means of differentiation other than their variety of contact. At this point, letter-frequencies come into play. Examining the set-up just as we have it prepared at (b), note that the two figures just above _M_ are 3-5. This is a “step-up” of 2 points. Note that just above _R_ we have the same two figures 3-5, another step-up. Above _C_, we find the two figures 6-5, this time a “step-down” of 1 point; and above _S_ we again find 3-5, a step-up. According to years of observation, confirmed by investigation of special cases, a vowel nearly always shows a tendency to step up, while consonants are prone to step down. Thus among our four doubtful letters, there are three, _M_, _R_, and _S_, of which one will probably be a vowel. But the remaining letter, _C_, has the step-down peculiar to consonants; and while a step-down of only 1 point would not be definitely informative when found at the left end of the set-up, it almost certainly indicates in the present position that _C_ is a consonant. Thus, we are able to include seven letters, _C T N E O D P_, in our group of “sure-fire” consonants, but have to dispense with several points of our 21-count. Figure 72 (a) List of Contacts U6 W7 Y9 M5 N2 X10 K7 A7 E1 H6 R5 B8 Z6 V8 O1 T4 C5 D1 S5 P1 -W U-Y W-M Y-H M-X N-K X-A K- -H E-X X-B R-Z B- U-X -Y Z-W V-X -B W-V X- -V U-B O-Z X-U H-R V-B Y- W-V B-A W-Z B- H-C Y-R -Y M-C M-W T-H X-A -S V-M H-D Y-U A-V T-Y D-R Y-T H-K K- B- A-Z Z-S C-A C-Y B-C R-H A-K K-A U- S-A S-X K-Z C-X C- B- Z-K -W X-Z -Y Z-T Y-B V-H X-S U-B Y-X R-C -V V-Y C-P (The figures give the "variety-count," or number of different letters contacted. Roversals may be indicated by circling letters. Note that in dealing with normal word-divisions, we may omit contacts falling between one word and another). (b) Basis for Primary Isolation of Consonant-Group: Letter-frequencies: 8 7 6 5 4 4 6 5 4 7 3 3 6 3 2 1 1 1 1 1 VARIETY OF CONTACT: 10 9 8 8 7 7 7 6 6 6 5 5 5 5 4 2 1 1 1 1 (104) X Y B V W K A U H Z M R C S T N E O D P (c) (d) (e) (f) 3d word: FIRST CONSONANT LINE SECOND CONSONANT LINE THIRD CONSONANT LINE x . x x x C T N E O D P C T N E O D P A U C T N E O D P A U W Z U V X M U W B Z │ │ │ H v│ vv│v vvv│v x│xxxx x│xxxx x│xxxx (Vowel) (g) 7th word: yy│yyy yyyy│yyy yyyyy│yyyyy (Vowel) k│ kkk│ kkk│ x x x x x x . x s│ s│ s│s Z W S V A H K U Z B K C z│ z│zz zz│zz (Consonant) │w │www │wwww (Consonant H) (h) 4th word: │r r│r r│r m│ mm│ mm│ x . x x x x x . . x │h │hhh │hhhh O Y Z T W H V C X Y A │b b│b bbb│bbb (Vowel) H │ │u uuuu│u (Consonant) a│ s│ (Consonant) │ t│t (Consonant) │ At (c) we have the beginning stage of the actual investigation, while (d) and (e) are amplifications of the first stage. In these the original consonants are used to determine other consonants, progressing from stage (c) to stage (e). First, the original group of consonants is set down on a sheet of paper, and the space below it is bisected by the consonant-line. Consulting (a), we then find the letters of this group one by one, and all contacting letters which precede any one of them we set down on the left side of the consonant-line, and all those which follow any one of them we set down on the right side, always once for each time that the contacting letter appears. Thus we have stage (c). While we do not often encounter doubled letters in this form of cryptogram, it may be well to say here that while a doubled letter would be counted among the frequencies of letter appearance, its contacts with itself would not be entered on the consonant-line. That is, a doubled _L_ would add a frequency of 2 to the general count, but contacts _L_-_L_ would be ignored. At (d) we have the first step in amplification, for which we are indebted to Chester A. Griffin. If there is any letter in the cryptogram which _does not appear_ _at all in (c)_, such a letter is practically sure to be another consonant. In this case we find _A_ and _U_, and in (d) these two letters have been added to the consonant group and their contacts placed on the consonant-line. From this point onward, the work becomes more tentative, and, as a detail of operation, Mr. Griffin suggests that further additions to the consonant-line be made in another color of lead; if it then becomes a matter of necessity to erase, only the new letters will be included in the erasing. Figure 73 1 2 3 4 x x . x x . x x x . . x . x x x . x x x . x x . x x x . x x . . x U W Y M N X K A E H X R B Z U V X M U W B Z O Y Z T W H V C X Y A h h h 5 6 7 8 x . x x x x . x x . x x . x x x . x x . x x x . x x x . x . C Y A U Z D B R A H V K B A; Z W S V A H K U Z B K C, M S C X h 9 10 x . . . . . x x . x x . x . x C Y X B S, X V Z Y T R Y C X P. Further work includes the application of the “force method.” That is, we turn our attention to the cryptogram itself, marking with a small cross, or otherwise, all letters determined as consonants, and placing a dot, or other indication, over all letters determined as vowels. Some vowels become evident as early as stage (c), as here we find both _X_ and _Y_ freely contacting our preliminary group of consonants, and if confirmation is needed, a glance back at set-up (b) will show that both of these are step-up letters. They may be labeled vowels without hesitation. As to consonants, there are two clear text letters, _h_ and _n_, which, owing to their many contacts with other consonants, and particularly with the low-frequency consonants (as in the digrams _CH_, _GH_, _PH_, _WH_, _NG_, _NC_, _NK_, _NQ_, etc.), will often show up clearly on the consonant-line. Of these two, _n_ will appear largely upon the left side of the line, and _h_, the more reliable of the two, upon the right side. Examining (d) we find _W_ and _H_ appearing exclusively on the right side of the line, and since, under the rules of the game, no letter may be its own substitute, we may assume here that _W_ represents _h_. Further concerning _h_: An examination of the cryptogram shows that _W_ has occurred twice as the second letter of a word, and the second-position is particularly characteristic of _h_. Then, assuming that _W_ actually does represent _h_, we have in the seventh word of the cryptogram an intimation that the letter _Z_ is also a consonant (since formations like AHEAD, AHA, are very rare, and seldom, if ever, occur in long words). Thus, we have two new consonants, _W_ and _Z_, to be added to the consonant-line, with their contacts below, extending operations to stage (e). If desired, the spotted consonants may now be crossed off on the line itself, or merely indicated as in (e). It seems evident from (e), confirmed by (b), that _B_ is our third vowel, and the supposition can be strengthened by inspecting the third cryptogram word, which, at this time, will have appeared as in (f). It also appears from (e) and (b), confirmed by the aspect of the tenth cryptogram word, that _R_ is a consonant. Similarly, _M_, which, on three appearances, has twice contacted a vowel, may be placed as a consonant. These two new consonants, _R_ and _M_, are added to the group of known consonants, and all of their contacts are placed on the consonant-line. Our next victim is _S_, evidently a vowel in spite of (e) because of its position in the seventh cryptogram word (g), which, otherwise, must begin with five consonants in succession. Presuming that a fifth vowel is to be found, the same word suggests either _K_ or _H_ as the candidate. The choice falls on _H_, according to the fourth cryptogram word (h); and thus continuing the force method with one eye on the consonant-line and the other on the cryptogram, the v-c formation of the cryptogram is finally established as in Fig. 73. Actual identification and solution follow the usual path of patterns, cross-comparison of words, and inspiration, where all systems are subordinate to the solver’s own perspicacity . . . or “cipher brains.” Chapter IX has given some methods for identifying letters from their characteristics, and also mentioned the preparation and use of pattern-word lists. Figure 74 A text prepared by RUFUS T. STROHM: H Y N W B D │ OMRI, UNKEMPT HELP, BRISKLY SCYTHED BUCKWHEAT ee│eeee t│t CROP. PANICKY SKYLARK UPSHOT; BUMPKIN SHOWED w│ ss│ SMIRK. o│oo l│l Frequency: 8 6 5 4 5 3 4 5 4 6 5 3 4 4 4 3 2 3 2 c│ Variety: 10 8 7 7 7 6 6 6 6 6 5 5 5 5 4 4 4 2 1 kkk│k K P E M R A C I O S H L T U Y N W B D u│uu x x x x x x a│ i│i │h Amplification at step (d) adds P and M. │r │ At this point, it might be well to mention the “vowel-line” method, whose appearance was antecedent to that of the consonant-line. This earlier method was conceived by Erik Boden, and in principle works in reverse to the consonant-line method. Its set-up is like that of the consonant-line except that vowels, instead of consonants, are placed at the top. The contacts made by the determined vowels are listed fore and aft as is done with the consonants in the consonant-line method. The vowel-line shows several letters by certain characteristics . . . a letter appearing exclusively on the left might represent _h_, and one appearing solely on the right can be taken for _n_. The liquids, _l_ and _r_, straddle the line about equally. On the supposition that you have located three vowels, the list of contacts on the vowel-line will not include, or only rarely, any other vowels as yet unidentified. A good suggestion is to use the consonant-line as specified, and then follow up with the vowel-line, using the vowels you have _definitely_ identified as such. The result will be thus: The letter appearing exclusively to the right of the consonant-line will appear solely on the left of the vowel-line, and vice versa. If such appearances are noted, then you have spotted _h_ and _n_ . . . . . identified as suggested in another part of this chapter. * * * The workability of the consonant-line system in unravelling the mysteries of the “Dizzy” crypt is best judged by making a series of preliminary sheets from clear text. In Fig. 74, for instance, we have the solution to one of the most skillfully manipulated cryptograms in the collection of 130. This was prepared by Rufus T. Strohm as No. 17 Aristocrat of the April, 1932, _Cryptogram_. The total variety-count is 104, 20% of which is about 21. The line of demarcation thus falls in the group _H L T U_, each with a variety-count of 5 and no step-down. _H_, with figures 5-5, could be grouped with the remaining letters, giving us _H Y N W B D_ as consonants, with _P_ and _M_ to be added at step (d). We thus include _Y_ among our sure-fire consonants, and, in fact, it often is a consonant, but this is a problem no solver has yet been able to overcome. However, the letter _Y_ can usually be spotted by _position_. Note that except for _Y_, every vowel here is a step-up letter. Figure 75 A text prepared by J. LLOYD HOOD: D C M P B F Q W J K │ GARGANTUAN MESTIZO ESCORTS JUNOESQUE NEGRO aaaa│aaaa oo│ooo WOMAN ADOWN NIGHT CLUB AISLE. DARK HUED │eeee n│n AMAZON HAD BEAUTIFUL LAPIS-LAZULI PENDANT. ss│ │l Frequency: 14 9 8 6 10 7 6 6 6 4 4 5 3 3 2 3 2 2 1 1 2 1 1 i│i Variety: 12 11 11 9 8 8 6 6 6 5 5 4 4 4 3 3 3 2 2 2 2 1 1 u│uuu A E U I N O L S T G R D H Z C M P B F Q W J K r│ x x x x x x x x x x Amplification at step (d) adds T, G, H, and Z. The above two examples have represented the “tough” case. In Fig. 75, where the text is the solution to a crypt by J. Lloyd Hood published as No. 9 in the February, 1932, _Cryptogram_, we have the average comparatively simple case. The total variety-count is 118, making the isolation count about 23 and throwing the line of demarcation into the group _D H Z_, where _D_ is the only step-down letter. Every letter in the isolated group is actually a consonant, and step (d) adds the letters _T G H Z_. On the consonant-line, _A_, _O_, and to a lesser extent _U_, stand out clearly as vowels. _E_ might be mistaken for _H_ until we apply the force method, while _I_ shows a step-up of three points, in addition to whatever shows up on the cryptogram. So up and at ’em! Edgar Allan Poe spoke truly when he suggested that whatever the human mind can devise, the human mind can also untangle. * * * Note: For additional methods of analytical attack on this kind of cryptogram, the student is referred to the booklet “Cryptogram Solving,” by M. E. Ohaver. This can be purchased directly from the author (Columbus, Ohio) for twenty-five cents, or may be purchased from the Frank A. Munsey Company. The textbooks of the National Puzzlers League also include chapters devoted to the solving of cryptograms; further information concerning these may be had by writing to R. T. Strohm, 1328 E. Gibson Street, Scranton, Pa. H. F. G. 50. By ROBO. POUYH IBQUAV PUKO M EGUHAC MK KOH POUKH OBLJH, KOHBSBGH GBBJHNHYK GHSHUNHC MA UAWLGR KB BAH HRH POUSO SMLJHC IYUACAHJJ. 51. By SUE DE NYMME. IDFURSF UJBDOC UJY NEGNXDNOWN IDFU FUN CXJKGDOC JOY RGGXNKKDBN AJO IN WJOORF JGGXNWDJFN FUN JZZJHDMDFL RZ FUN URONKF JOY CNONXRSK." --RXDNOFJM JYJCN. 52. By I TAPPA KE. B HCN FBA IOA CAXW PBXLSBW RAMC MPJ SCCHK. BLMJI MPBM PJ RK IOAARAN COM CL MPJ SCCHK. 53. By TRYCHS. ZAXABAPRSANL CDRLT ZNLZDLSERSANL NQ WNWFBRSANL, ZBNTD FSABAPRSANL NQ SKD BRLU, TWEDRU NQ ALUFTSEV -- RBB UEAXD HABU BAQD RHRV. 54. By DECIBEL. KTJ UZ WJIWNLUFZA, RNUJW FV NYYWZQFBNUJCP ZAJ IZTWUG KJJYJW UGNA FU NYYJNWV UZ MJ RGJA CZZDFAH FAUZ FU. 55. By B. NATURAL. GBAM BP NCLBGMC: -- IBAM FDCCDIH HKULC BP DSBD, RBGE BP BPTBLPL, AGDKC BP RBVSBULP, FLEMH VLEM BP BGGBPDBH. SKHFLPT LNM BN BP RBHHDKCB, UDN BPTBUMHNBDP BP NMPPMHHMM, NDDE FBVLCF BP EMPNKVEW. 56. By POSIUS. SHTOADDCTUD TO SLIHCTICDP LHA XCZA IHALICAD TO SALFA -- IEAR TUXR KCUB ICXX VA LHA DIHTUM AUTNME IT KHALZ IEAP. -- ABPNUB KNHZA. 57. By LIGHTNING. QFY. NZZDO, YOFLAVU HAVVOF NVVBCVSOY: "FOSAZO RBF YBCZ AY RFBQ DNKO QFY. HCQZDAVU; BCK BR FOYZOSK RBF WOF, A YCUUOYK YBCZ GO ONKOV AV YADOVSO!" 58. By BOUNCING BOB. ACGLCRW BDHMW AHSXGE. "XI EHN TCYD DH WBDCFSXBO GMWVXD OWMW, EHN ZNBD FW CD SWCBD WXRODE EWCMB HSV CYV CGGHZACYXWV FE EHNM ACMWYDB." 59. By MISISEEG. "PC KFJJW LF LPAS YG KF CYNE FH WFYJ LRCS," KPRI MYITS, RDOSLSJPLS PHLSJ-IRDDSJ KGSPASJ, PK ES KSDLSDNSI CPD LF DRDSLW-DRDS WSPJK. 60. By EEGH. EZVPJHOW HJWZB JZKRCHSPO HRRCHAOF OZAPEFE CSTF JHWFBRSCCHB JBHVCSPL ZNFB RFBOSHP BAL VISCOW VFHBSPL BAQQFB OIZFO. 61. By MERLIN. ABDZYX UYDU ZA VYWZCE FBGH DBVTYCF SJJX YU RBVJ, JKJC URBGER FBG LZAR URJF LJHJ. 62. By P. A. BEE. "ZHN TCJP VDTK QHWWQF CLTDRP NDTX; ZHN CLGFP VDTK QHWWQF WTF LTDRP NDTX." MSHLJ VTQJP ZB VCJFP LCR GTCA WGF PQTX. LDBEW ITJFP VDTK PSLG HOFCP NDTX! 63. By SHORTY. ABCDEFB XYGF HXYNEP OF QNHA BDRXA SYB SDPRFAZ XYNHFKDSF KXY EDTFH VXCURDUR SNBUDANBF CBYNUP FIFBZ KFFT YB AKY. BYNRX PFAYNB KYNEP ANBU AXF ABDVT. 64. By AH TIN DU. ABCD ABEFGHJ KGLA: -- MKNNDOH PBOLA, FBPDE AMBNNGHJ, ARBON PBOLA KHL KSSGTDA. PRDH NRDAD SKGE, NOW XRKON KHL CGLHGJRN BGE. T I P O F F S For the benefit of the beginner a list of "tip-offs" are given below. By comparing these groups, affixes and single letters it is possible to find combinations which fit. For instance: ABC compared with ABCD, ABGA, GA, DHA might result in "the", "then", "that", "at", "not", etc. 50. M, MK, KB, KOH, BAH, MA, PUKO. 51. FUN, IDFU, IN, IDFURSF. 52. B, MPJ, MPBM, PJ, RA-, -RAN. 53. AL-, -SANL, ZNL-, SKD. 54. UZ, FAUZ, FU, -FAH, -UFZA, FV, ZAJ. 55. BP, BP-, -NBDP. 56. IT, TO; IEAR, IEAP, AUTNME. 57. A, AV, -AVU; BR, RBF, RFBQ. 58. DH, CD, CYV, HSV; identify W through its frequency. 59. Note Pattern group; DRDSLW-DRDS. 60. SPL; O; EFE, word 5, last word. 61. Use of J, LJHJ, JKJC, -ZCE, ZA. 62. WGF, QHWWQF, WTF. 63. AXF, KXY, AKY; FIFBZ, YB. 64. -GHJ, KHL. 65. By KING SLY. KING NERO PRVBY KHNC AVCL, FHYYVY CAVRDLK CHFN. DEAF TFENGY IC; DHULY ERBV YCHTL. RIBY XHFF, ERTFIKERD FHYYEL. 66. By THE SHADOW. FJ CIGBHQ KDDH, LDQ FJJPHLC DXXCIGBHQ CAP. LDQQDHP BCCAP: EBQMJ DXX; JPHLC KDDHEBQMJ BC QDHP. 67. By "33". OXVXAKZDKY KYKOMSQXDI DIAB ABOQSXIZW ZWIALBV BVXQDO. DOSQDOXASZ SZSOPXYQ YQSOQZBY BYQLBO, BOOSQXA XADIDAZSYQ. 68. By BUBBLES. SBCWFK VWUKPI FCRSX PFNUKVSB. VWZGRE XZKRP ZBTFV. WPGU SFGDJ DPERBFGP; VPIFZ TPASX JKPVA IKOBCU OGPRIV. 69. By DEAN RELAX. XYZABCD ZEFZGBAZHDBHI JBDY KGLMZOCNHBDZ OBCXNMZGC XKPXBQA KABO SPKXT ANHNXPBHBX FPZNXYGNBX FGBCAC. 70. By WEHANONOWIT. ZYXWVXUTSRQUXO PXWVTW ZWNZXMXRTL XOOTKQXRQKT YNWRQUSORSWT: ZWNJSUTL RXIXUTRSV, ONHTOQX, YTJTNVX, JQMQRXOQL, TR UTRTWX, XJ QIPQIQRSV. 71. By CURLY. WINIWKB OWBWO KRSRKVRV CRSRC NWEWN WCTPXVQBR XWKWXR. AWKWARD TJJRKV VQPQVDRK DZKRWD. KRSRKRPD BWOVRC AKWEV, GWKKQRB HE JCTTB DZKM BQSQBR. 72. By GALUPOLY. LKMEGDIMJ, LHFABCGNKEF, LSNJJDI, LBMNKCJ, LBMEFJP MJR LBTNIG GMVN RDSSDAXTK RNADLBNEDJI SCE AEFLKCIEMLBNE. 73. By SABIO. WILD PANGRAMS RDMB ALCW EFFRRD HLFEM INJW. HAKNLLO QLNTNW. INJW TFFRRD NIIRD UGUGVWG, WJGORTX RDMB PAYWV XDOMAT ROZAVD. 74. By GINHUTS. OLDMADE OVID SLATILK, ZLOMLX VWXYB, WERK SLMB LERVI, NLI CLRO EVRS GKTV OTAHB ADGV TVWEY, YBLTO LISWR RLDEWLEB. 75. By CIPHERMIT. ABZYC DXXZBF, GYZBHVDX SZBHC, SGYBZTH VRZBS JKZBVXQ FBZUB YDWZBY, WXZBYF, BZTRV WZBF, RDHCEBYMRZBS, FZBIB, YBZHF, HBMEVZB; MRZBS YBVYZBIBF QZBXC. 76. By A. D. CODER. ABCDEFB GHICD CJKLIC MNHHSJ OPCIQG MNJRBD PLFGSPLBR, EILQ KICDTSCIR KICJRAC HL PLDRSJ GOFBBSIDQCNR. 77. By ROVING VIC. MOCKMOCK ZPLY KPYO RSRI-RSRI FIPTSU FLIPFLIP. NERTS-NERTS WICHWICH, SHPYSHPY TCYL, SILLSILL, MREX UPMD XRT. APTS-ACTS WEPMWERM OLIREZU WPTRE MHIL. 78. By AMSCO. ABWKGLWB ELTFTELHEG, SENGLMTUG FTELSABWKGLTF, LGBTGXGU KHLCTHK DHTF BTOG HFATFH DGKESLTU. 79. By M. G. M. ABCDECBFA, GHDIJKLF, HFBMD, NLHMO IEDHOBF OPPMGHR, SMPDBIDBO UR VPHD, OMHGUMEONB, SPMDILFFEA. 80. By SIMPLICIUS. VKJPE PBSCKZ RLHRTGM HJALCGSBR TLCG; RKPHCLRHM NLMHGJCGAAKMBM; LIUJCGM NJCMJBH KQ CKZGPHM. 81. By KRIPTOBENS. DYFR SWCX VHZS WMLB TMLB CZYO PHUT WKHT, JKOS MOSY PHOB, NHTK IKAR AMLW WHCU, DUKT! LMSR LYZV ECMQ XKOS, DMOT VHNK, VMLB, PUCK! VHDK YZKO, GHLB UYVS! WHAT BOYS, YOUR LUCK! 82. By PHONEY. ABCDE FEGHI, GEJBI; KLBGI MDCEH NDEST IEKRD DREIN UMELV. TLHNR RGHBD HLWJI SRMHN, VESTI JHEKB, XBDJI LDENB YRDIB; PDRGV ZRDSI, BKLWNI OEDJF WYBEN. CEGOF EOLBM. 83. By ARROWHEAD. ABCDEF GHIJK, LMN OPQR, STU VWXY. ZWHTAJ, FBIDEB PEWCUH VHAXMP, HJQD BHXEJ XHUTA, EQGIF GTJE IHWREJMP. 84. By THE GRIFFIN. TWDOIUESMA DMPOIREXYK TRXAWEKMLI XRYMUOLSED AMIEXKUGNO MUTRYOLSDH YMKAGRXEIO GZPRKAESOY WHTOXZGDMA TDEHBXMIWS. 85. By SOUR PUSS. OYESK PACHYDERMS AOPFL UXFD MHZOY XFBR PLMBS OZPL. ZUFPLBAGH LBYCF QZDYPX YDLM GZQFBD ADLYJ RZUD. 86. By LIVEDEVIL. PREVIOUSLY BDACL YOEL YFOCG, FLHCY, EHJJPOVLB GHKRCL, UCOFMJ APCR EONQ MOIQCHBAPJ. 87. By NEOTERIC. RXUGUZLQTVFR, CNSQRLQTVFR OTDALN RB MVFTQQRX QSTQ. TFXUTSLCGSFZJ FTVXLVQNZ FTOSQ GUFLVOU DRTQDRX TRF. 88. By ZERO. KROLGDB FURZGV ZDWFK BRXWKV VSULQW DORQJ GLUW WUDFN. VZDUWKB FXEDQ MXQLRU MXELODQWOB ZLQV. 89. By JOKEL. JPLX VUNKOM MLKDUB FUGHVP VKHCX VUPD FWHMVP; LQUMDPBV, VWJKPLMNB; ULKFUGIKB, QKDHGP; VUXPLCMJ, AMJPVUD. 90. By LEE ANDER. CLOUDY BERG-SLHVEC BECTR, UI BECT, FVRAKMY MGRAK-HVEC BUDNR-VRGL BUZCLI EY BDAAEDA. NEKYDNLC; GEESE PUNFUY; BETT ESTDNLC. 91. By TRYIT. LSYKCTLSTRYITAB, MCDSLMLE, ZSRBWLX IUOLSC UWLAC BMTUZYLAB YRUYHU GTKVBC KPMDSCASWUWVD PLANKX UCLM WSKCHBXU WVUBCB VUITSRPLBD STUMBLER JSLP BHLMDVXU. 92. By DIZZY. ABCDEFG, DZEIBJK LMFDBCN, MNTLYEA PRZBGSF TSBIURP IECLSBJ, UKFIZBS, PNFLARB; EVLKZRO PWELMBK VTXPLNZ TPXOBZG. 93. By ZANYCODAB. ODZNERITFNM VNDRR BNOFDSK PNIODRHE EVMCDTIS EVANZTOS FNQRZO HCRI PVEOHE. RZROHIK, URFRES CNISLVZTF AZSBE HGAZNLS. QNCTK OZRUNI ASFRGSE GTERLVITEO. 94. By I. D. CIPHER. JBMDVKJVMBTD AWTHVQBLTQV VGLBQWFXH FXBJWTHVQNM VCWYBLGX. BDGWCDWKZ, DKWYFWKMB RNMBJCDPCY, GZCBQWFDP. 95. By NEON. CDFGH, JHKLM NPQLR, SDTVW XMZDW PATVF LRXBV CDTWE QRIGH. TKHFO XRDIP NHILW EFDQL, JMUVW MRPES, VHFAW NRAPW. 96. By TWISTO. FJKXZA, ETXZQ, ZCHUQP QPZUF, ZLLKUPTW QBTJPZ EDGN, PQZM BTJMN QPZDU, MTUIWXJ ZXGJUW ZPFEWU DUQBTW IBTQUWHJX. 97. By NUMERO. BCBDBEBFC GHIBEK UGVBQW BRWPF OPFQR STDGPBQ -- EFHIKA YBQWYTZW BLGUGZR LKFQCGZUZGTHCYKZI. 98. By WHIZZ BANG. PGZPAPBPGZP? AZFHIDEPXOA AFISTP YOEN BPYC PBFISX PJDOBK PKLPOT. BWXDYOPA AFEYWI LOIN BFKTDEOP TWRI WFDI. BWLF BLPZR ESPAD HZDJOBWK ZWHPKI. 99. By INVICTUS. PDOKX ZEVR MOLTA. MPNDR-NEX NPKWTM FACHX PSGTLUR PGPGEVU CPUFAD. CZBPAQEUTCV TAMR TAOLPG BPVUC. HAEUWD KONRUYC RBENZCMR MVEYOR. CHAPTER XI Simple Substitution with Complexities Concerning the numberless variations and complications which have been applied to the simple substitution cipher, our discussion here will have to be along general lines, with perhaps a brief mention of some analytical principle. Decryptment, for the most part, involves no principles other than those already discussed, and can only be demonstrated on very long texts. All such ciphers, however, will yield readily to the “probable word method,” and the student, in considering each case, should not lose sight of the one method which applies equally to all. If the _probable word_ is a pattern word, so much the better; but _every word carries a pattern in the normal frequencies of its letters_. For instance, the word CIPHER, considered in relation to a text of 100 letters, has, roughly, the frequency-pattern 3-7-2-5-12-6; or, considered in relation to a 200-letter text, a pattern which is approximately double the first: 6-14-4-10-24-12. A cryptogram supposed to contain this word may be prepared as recommended in Chapter IX, with a frequency-figure written above each letter. The frequency-pattern of the word CIPHER, based on approximately the same amount of text, may then be written on a slip of paper and passed along below the frequency-figures shown for cryptogram-letters, in the hope of finding points at which the two sets of figures are, to some extent, alike. Wherever such points can be found, the suspected word can be assumed to be present there. So long as the method remains that of simple substitution, any substitutes which can be found in this way can have no other originals than those first determined; thus, their substitution throughout the cryptogram will serve to bring out other possibilities. For the multiple-substitute cases, that is, those cases in which all or part of the letters may have more than one substitute, the frequencies of such letters as _I_, _H_, _E_, _R_, may be left blank (or cut in half, dependent upon just what the cipher is), and only the frequencies of _C_ and _P_, standing two positions apart, need be considered. Particularly helpful, in this case, would be a probable word such as CRYPTOGRAM, in which five infrequent letters are standing at known distances apart. The frequency-pattern of this word, based on 100, can be expressed roughly as _3 - 2 2 - - 2 - - 2_, and the attempt made to find points in the cryptogram at which five letters of somewhat these frequencies are standing at the given intervals apart. The foregoing is based on the supposition that while the encipherer, having several substitutes per letter, will be able to conceal the true frequencies of his high-frequency letters, _there is not much that he can do toward concealing his low frequencies_. He can, of course, produce any frequencies that he likes by swamping his text with nulls; and this, in the hands of a clever operator, can be very effective, especially if the circumstances are such that he can keep his method a secret. But for the average practical purpose, the time consumed in the encipherment, and the increased length of the cryptograms, are highly undesirable features, especially if it be kept in mind that there are many other ciphers than simple substitution. As to attack by analytical methods, the one device which is more likely than any other to prove applicable in all cases is the preparation of a digram count of exactly the kind we saw in Fig. 68. Such a chart will afford the means for studying carefully the _contacts_ of any given letter; just what its _variety_ seems to be; whether or not this seems disproportionate to its apparent frequency; whether or not it shows a tendency to touch letters of lower frequency, or to be present in reversals; and so on. Many of these ciphers, however, make use of two letters to represent one. With these, it is the single-letter frequency count which is best made on a chart. That is, the cryptogram is first marked off into its pairs, and these pairs are counted in the same way as that described for digrams. But digrams, in this case, will be represented by four letters, and usually the number of different pairs is so large that the examination of digrams will have to be done by listing. For any cipher whatever in which the substitutes are two-digit numbers, a frequency count taken in chart form is usually far more convenient than one made by listing the numbers in advance. With only the ten digits, the 100 cells can be made larger than the 676 cells needed for letters, and the chart still be small and compact. The pairs of digits would be counted in exactly the same way as so many digrams. With numbers, it is sometimes possible to take the subsequent digram count, also, on a chart. Solution, in many cases, involves pure guess-work. The decryptor, perhaps, has begun his examination by testing his cryptogram for some variation of the “Caesar” encipherment. He has counted the first hundred or so of his letters, and has discovered that his frequency count is not going to be that of an ordinary simple substitution; that is, it is evidently not going to be one which he would be able to mark off into sections of high, medium, and low frequencies (usually with several letters missing), which would certainly be the case had each plaintext letter been replaced always with a given substitute throughout the cryptogram. Perhaps he has then marked his cryptogram into pairs of numbers or letters, and finds that these, also, are not likely to furnish the kind of frequency count which betrays simple substitution or some other cipher with which he is familiar. At this point, he is likely to pause and consider the source of the cryptogram. Is this the work of an expert, or the work of an amateur? Is it worthwhile to make up the statistics? Or shall I try for some one of the novelties which I have met many times before? One device which is particularly popular with amateurs is that of assigning to each letter the numerical value which represents its serial position in the normal (or reversed) alphabet, _A_ having the value 1, _B_ the value 2, and so on, and afterward representing each plaintext letter with two (or more) others which will express some arithmetical process. For instance, the letter _C_ (value 3) might, in some one of these systems, have the substitute _AB_ (1 plus 2), or the substitute _DA_ (4 minus 1), or the substitute _YD_ (25 plus 4 equals 29; and 29 minus 26 equals 3); and so on to infinity. Other simple devices, hardly worth calling ciphers, which have been used in the columns of _The Cryptogram_ under the title “Simple Substitution with Frills,” have included: (1) The use of false word divisions. (2) The simple reversal of an otherwise unmanipulated cryptogram. (3) The use of two given digrams, placed alternately at the ends of words. (4) The use of a new cipher alphabet for each new sentence. The first of these, of course, should have been suspected after examination of the apparent terminal letters. The second, theoretically, ought to be spotted if the method of solution includes a close investigation of digrams. As to the third device, any two digrams, used in the manner described, will attain impossible percentages; our leading digram, _TH_, in normal text, remains fairly close to three or four percent. It was the fourth device, however, which caused the greatest consternation among the younger solvers; in this case, the making of the frequency count will show what the trouble is: It begins very well, with the expected resemblance to a normal count, and suddenly begins to grow erratic. Not every variation encountered in dealing with simple substitution is employed with the deliberate intention of creating difficulties. Those correspondents, for instance, who select some one letter, as _X_, and place it after each word as a word-separator, do so because they find it difficult to read their texts unless the word-divisions are present. As to whether or not this device does actually create difficulties: The person who is content to make use of simple substitution as his means of secret communication, is not usually inspired to employ more than one such letter. The length of an English word being somewhat shorter than five letters, any single letter placed religiously after each word will attain a frequency (based on the new length) of not less than 18%, where the letter _E_, at its very maximum, can rarely attain 15%. The decryptor, taking his preliminary frequency count, quickly discovers this one letter of enormous frequency. He might suspect German, or even French, and look for other characteristics of those languages. But having reason to believe that the language is English, he recognizes this letter instantly for what it is; he first makes sure that it is distributed throughout the cryptogram at an average interval of five or six letters, then calmly circles it out and deals with a case of word-divisions. Figure 76 "Alphabet" for Encipherment of Numbers "Plaintext" .. 1 2 3 4 5 6 7 8 9 0 "CIPHER" ... A B C D E F G H I J Text ready for encipherment: WE HAVE WCBEW BALES. Considering something of a more practical nature, there is another very common device, used with every conceivable kind of cipher, which is not in the least intended for the purpose of creating difficulties, yet invariably does in short cryptograms. The ordinary practice, when dealing with numbers, necessary punctuation marks, and so on, is to write these out in words: _three hundred twenty five_; _quote_; _dollars_. But where a given correspondence is likely to involve a great many of these, so that the ordinary practice is very wasteful, the encipherer is nearly always provided with a little “cipher alphabet” of the general kind indicated in Fig. 76, in which the ten digits, any desired punctuation marks, and any other needed symbols ($, %, @) have each a single substitute. In the “alphabet” of the figure, the number 325 will be enciphered _CBE_. But if this enciphered group _CBE_ is always to be cleanly distinguishable from the rest of the text, a means must be found for making this distinction, and this is usually done by reserving some one letter to act solely as an _indicator_ and never using this letter for any other purpose. This indicator-letter, as _W_, may then be placed at the beginning and end of the enciphered group _CBE_, and the resulting group, _WCBEW_, may be placed in the plaintext message, ready to receive whatever kind of encipherment is given to the rest of the letters. These groups, used in short cryptograms, can give about the same amount of trouble as would so many nulls. But where cryptograms are longer, with a great many such groups, the decryptor invariably spots them by means of the recurrent indicator. Sometimes one letter is used, and sometimes two (_W_. . ._W_, or _K_. . ._W_); but in either case, the indicator always appears as a pair of correlatives, and wherever the first of the pair is found, its companion is never far away. Some provision must, of course, be made for replacing the indicator letter in the plaintext alphabet. In English, we ordinarily select _J_ for any such omission; this is a letter which is rarely used, and, on those scattered occasions when it does occur, it can be replaced with _I_. Among the Latins, it is commoner to make use of _K_ and _W_; these two letters are not used at all in their native languages, and can be replaced, respectively, with _Q_ and _VV_. It is also possible to omit _X_, replacing it with _KS_, or _V_, replacing it with _U_. The fact that it is possible to shorten the message alphabet without appreciably impairing the clearness of its messages has given rise to what is probably the most practical of the simple substitution variations: two or three letters, as _J_, _K_, _V_, are omitted from the plaintext alphabet, while the cipher alphabet retains its full 26, and in this way some extra substitutes are provided which can be given to the more frequent letters. It is possible to dispense with as many as five letters, replacing _J_, _K_, _X_, _V_, _W_ with _I_, _Q_, _QS_, _U_, _UU_, and assign the extra substitutes to _E_, _T_, _A_, _O_, _N_. Fig. 77 illustrates an alphabet of this kind. Here, the letters _I J_ are to have the same substitute, and the letters _K Q_ are to have the same substitute. This releases two extra substitutes which may be given to _E_ and _T_. Figure 77 j q Plaintext: a b c d e f g h i k l m n o p r s t u v w x y z E T CIPHER: C U L P E R Z Y X W V T S Q O N M K J I H G F D B A Encipherment: w e m u s t h a v e b e t t e r c o v e r a g e ... H E T J M K Y C I B U E A K B N L Q I E N C Z B ... The foregoing is one of those cases in which the decryptor can learn a great deal by taking his frequency count in the form of a digram chart. And he knows, of course, that his cryptogram contains some two letters whose combined frequencies will reproduce the frequency of _E_, or of _T_. In Fig. 78, we have a “checkerboard” which, primarily, is intended as a _transformation device_; that is, a means for replacing single letters with syllables, and, consequently, for replacing five-letter incoherent groups with ten-letter pronounceable groups; under the European agreement, the price of transmission is the same for both, and the pronounceable groups are less likely to result in transmission errors. The alphabet is first reduced to 25 letters (in this case by the omission of _X_), and is written into a 5 x 5 square. The five vowels, written at one side, will then serve to designate the five rows, while five other letters, written across the top, will designate columns. Any letter found inside the square may thus be pointed out by naming the two letters which will indicate its column and row. In the given example, _A_ can be replaced with _EN_ or _NE_; _T_ with _UL_ or _LU_, and so on. Figure 78 L N R S T b a t t a l i o n A C U L P E ER NE UL LU NE AR RI OR NO E R A B D F I G H I J K O M N O Q S Regrouped: U T V W Y Z ERNEULLUNE ARRIORNO. The fact that two interchangeable substitutes have been provided for each letter of the alphabet has led many persons to use this device, absolutely without modifications, as a simple substitution key. Yet it must be plain that any decryptor, taking his preliminary frequency count, will discover, before going very far, that this count is being made on only ten different letters, and thus can represent only one possible kind of encipherment. A frequency count taken on the pairs, with no distinction made between a given digram and its reversal, will afford the necessary proof; after that, the average decryptor will usually replace the pairs with single letters (or numbers), just as he would in dealing with printers’ symbols, or other inconvenient characters. The checkerboards which are actually intended for encipherment purposes ordinarily use digits for pointing out columns and rows. Where the digits at the side are the same as those across the top, it becomes necessary to observe an order, as column-row, or row-column, and this, using only five digits, is ordinary simple substitution, in which every letter has one substitute. But if the five digits at the side are different from the five written across the top, then the order is immaterial, and any number may be interchangeable with its reversal; that is, 17 or 71 can represent the same letter. This encipherment might not be spotted so promptly as the case in which only ten letters are present out of a possible 26. But if the count is made on a chart, as recommended at the beginning of the chapter, it is very readily detectible that there are two separate groups of digits, _neither one of which has ever formed any combination within itself_, every number in the cryptogram being composed of one digit from each group. Thus we see plainly the trail which is left by co-ordinates. Figure 79 The KEY-PHRASE Cipher (a) Plaintext: a b c d e f g h i j k l m n o p q r s t u v w x y z CIPHER: O N E W H O H A S P A S S E D O N I S A M O N G U S (b) CIPHER....... O M S S May represent: A U I I Full F L L Fuss P M M Fuzz V S S Pull Z Z Puss Checkerboards, of course, can be used to better advantage. But, before leaving the simple for the complex, we must not overlook the celebrated _key-phrase cipher_, which discards the idea of multiple substitutes in favor of multiple originals! This cipher, shown in Fig. 79, is said to have been used for serious purposes. Its only difference from the ordinary simple substitution lies in the nature of the cipher alphabet, which must be a plaintext sentence, or phrase, containing the necessary 26 letters. The mysterious pronouncement, “One who has passed on is among us,” is the earliest example of which the writer has any recollection; those of later years have been largely proverbs, or other familiar sayings: “Journeys end in lovers’ meeting”; “Prosperity is just around the C.” As any cryptogram-letter may have five or six different originals, it is readily understood why the cryptograms of the key-phrase cipher are seldom seen without their word-divisions; yet, curiously enough, their translations are almost never ambiguous. As to their decryptment, the student who cares to try the appended example will find that it is hardly more difficult than one of the simpler “aristocrats.” The method is about the same for both, keeping in mind that the frequency shown by any cryptogram-letter is either the frequency belonging to one letter or the exact sum of the frequencies belonging to several. Here, however, the reconstruction of the key simultaneously with the identification of substitutes is a very important adjunct to solving; the cipher-alphabet, being pure plaintext, can often be built up long in advance of solution. It might be added that this cipher, with or without word-divisions, is readily distinguished from all others by the make-up of its frequency count, which, as a rule, consists chiefly of the high-frequency letters in unusual numbers. Passing now to the more difficult cases, we will glance at a few of those ciphers which are truly multisubstitutional; that is, which provide multiple substitutes for all or most of the plaintext letters. This is usually accomplished by the use of two-digit numbers, of which one hundred are possible: 01-02-03. . . . . .98-99-00. These one hundred numbers may be assigned as substitutes to the twenty-six letters, in proportions roughly approximate to their normal frequencies, as suggested in Fig. 80; or most of them may be so assigned, and the rest reserved as substitutes for digits, punctuation, and so on. For security, however, they must never be assigned in regular order, as in the figure, or even by any methodical process, but absolutely in incoherent order. Thus, while the form indicated in Fig. 80 will be convenient enough for encipherment purposes, it is much less so for decipherment, and ordinarily there will be two separate tables, the second of these making it more convenient to find numbers. This _deciphering key_ can be prepared as a list, running in numerical order; but a much more usual and convenient method is that of preparing it in the form of a chart; that is, the ten digits are written across the top and along one side of a 10 x 10 square, exactly as if making ready to take a number-count, and the letters, or other characters, are then distributed in the 100 cells so that the correct digits will serve as co-ordinates for pointing them out. Such a key is changeable, but not readily communicated and remembered without written documents; and to overcome this very serious defect, many mnemonic devices have been conceived, of which the following is perhaps the most practical: Simply treat the one hundred numbers as if they were a plaintext message, and encipher the series by any one of the irregular transposition processes. Figure 80 A 11, 12, 13, 14 B 15 C 16, 17 D 18, 19 E 20, 21, 22, 23, 24 (Etc.) The two commonest of the checkerboard keys are shown in Fig. 81. When digits are used, as in (a), an order must be observed in reading the two co-ordinates. The letter _L_, for instance, may have any one of the substitutes 13, 18, 63, or 68, but may not also have their reversals, since these, using the same order, row-column, would all be substitutes for _G_. Using letters, however, it is possible to have two entirely different series at top and side, as in (b); in this case, no order need be observed, and the letter _L_ may have any one of eight substitutes: _KE_, _KF_, _LE_, _LF_, _EK_, _FK_, _EL_, or _FL_. By including the still unused letters _U V W X Y Z_, it can be arranged to provide yet more substitutes for some of the letters. For either of these cases, the external numbers or letters (preferably in mixed order), could constitute a semi-fixed key — that is, one not changed every day — while the mixed alphabet of the square could be changed as often as desired. Innumerable other keys of this type are found. For the most part, they are based on rectangles of 35, 36, or 40 cells, the extra cells being used for digits, or other desired symbols, and especially for extra appearances of the more frequent letters. Figure 81 (a) (b) 1 2 3 4 5 A C E G I 6 7 8 9 0 B D F H J 1-6 C U L P E K-L C U L P E 2-7 R A B D F M-N R A B D F 3-8 G H I J K O-P G H I J K 4-9 M N O Q S Q-R M N O Q S 5-0 T V W Y Z S-T T V W Y Z One such key, the Grandpré cipher shown in Fig. 82, uses 100 cells. The filling of the square with ten ten-letter words provides letters in somewhat the normal frequency proportions, and an eleventh ten-letter word, composed of the ten initials, serves as a sort of mnemonic device for stringing the first ten together. The words, of course, must be chosen in such a way as to include all 26 of the letters. General Sacco, dealing with fractional substitutions (Chapter XXII), shows the same idea in a checkerboard which he describes as “frequential.” This square is simply filled with letters, used in proportions roughly approximating their normal frequencies; for ready finding, all repetitions of a letter are placed close together, but filled in on diagonals, which, to some extent, will prevent their being represented by consecutive numbers. Figure 82 The GRANDPRÉ Cipher 1 2 3 4 5 6 7 8 9 0 1 E Q U A N I M I T Y 2 X Y L O P H O N E S 3 H A L F O P E N E D 4 U N B L O C K I N G 5 M O V A B I L I T Y 6 A D J U R A T I O N 7 T H E O R I Z I N G 8 I G N O R A N T L Y 9 O W N E R S H I P S 0 N O V I T I A T E S In Fig. 83, we have the checkerboard again, with a modification. If the key used is exactly the one of the figure, those letters which are standing on the first three rows may have twelve substitutes each, and those which are standing on the fourth row may have eight. In all of these cases, the substitute for any letter is a pair. But the final row, including here the letters _V W X Y Z_, is not enciphered with a pair of co-ordinates; each letter may represent itself, or each may represent the one on its left or right, but in any case, the substitute is a _single letter_. Thus we have cryptograms in which most of the letters are represented by pairs, but a few are not. Such words as _ever_, _you_, _with_, _when_, _by_, _have_, and so on, will occasionally occur; or, if not, then the encipherer may insert a few nulls at strategic points. Thus, the decryptor, taking his count purely on pairs, is expected to take some of them correctly and “straddle” the rest. Such a device is described by Givierge, also the following similar device. The cipher alphabet consists only of two-digit numbers, but includes no number coming from the 40’s. With all of the 40’s omitted, a sequence 44 becomes impossible; and the encipherer, having first prepared his cryptogram, looks it over, and, here and there, inserts a digit 4 beside another digit 4, producing the impossible sequence 44. The decipherer, wherever he sees this, need merely erase one of the 4’s, and since the digits, in Morse, have their own distinctive symbols, there is no great danger of errors in transmission which the decipherer will be unable to straighten out; but the decryptor, as before, is expected to “straddle.” Concerning decryptment, in all of these cases, there is little that we can say here except that, given sufficient material, these ciphers can all be decrypted with comparatively little trouble.* The “straddling” devices, perhaps, would represent the most difficult case, presuming that the decryptor has no probable words and none of the information which comes through espionage or from that even more fertile source, the carelessness of the encipherer. In dealing with one of these, the decryptor, who normally expects a certain amount of uniformity in the frequency counts made from different portions of a same cryptogram, is likely to find that his count is showing altogether new substitutes, or the same substitutes with altogether new frequencies. He suspects, then, that he may be “straddling” between two pairs, and tries making his count _in sections_ until he finally discovers what letters (or digit) are causing the trouble. *For a clear and detailed exposition of the decryptment method ordinarily used in multiple-substitute cases, see _Secret and Urgent_ (Bobbs-Merrill), page 64 et seq. For dictionary cipher and simple codes, see _The Solution of Codes and Ciphers_, by Louis C. S. Mansfield (Maclehose), page 56 et seq., or _Cryptography_ (Langie-Macbeth; Dutton), page 88 et seq. Figure 83 K L M N O F G H I J A-E-S A B C D E b a X t t a l i o n B-P-T F G H I K AG EF Y NR DI SK KU TI CN HQ C-Q-U L M N O P = D-R Q R S T U V W X Y Z The use of co-ordinates, in those cases where row and column are interchangeable as to order, shows up very plainly when the pair-count has been made on a chart; as previously mentioned for a case of digits, the letters will divide automatically into two groups, neither of which ever forms any combination within itself. With the other case, where an order must be observed, there are not so many substitutes per letter. But in either case, it is possible to _pair the letters_ which belong together. Here, for instance, are the letters _E_ and _F_. The frequent combinations of both _E_ and _F_ are always formed with the same letters; and both have avoided the same letters; _these two must have been paired_. Their combinations with _G_ and _H_ are much more frequent than their combinations with _I_ and _J_; thus _G_ and _H_ must have been paired, and _I_ and _J_ must have been paired. This combination _EG_ (and its equivalents), has been frequently followed by this other combination (and its equivalents) and so on. When a great many pairs can be considered equivalent to one another, it is possible to begin setting up the checkerboard. Some such devices, of course, are safer than others. But the mere fact that they double the lengths of the cryptograms renders them unfit for any purpose where speed is a requirement; nor can the added time and expense of transmission be tolerated for any purpose whatever unless there is some very definite gain in secrecy. Figure 84 An Example of BOOK CIPHER 4-1 1-5 3-16 4-11 1-3 1-6 2-2 6-21 1-4 3-2 4-25 4-2 3-3 l-l 2-12 5-22 4-10 6-7 6-2 5-6 5-7 2-7 1-2 1-8 6-1 3-7 5-4 3-6. (Key "volume": 23d Psalm). One great objection to any device offering optional substitutes is that the encipherer himself seems unable to take full advantage of his system. Even having at his disposal five different substitutes for _E_, he falls into the habit of using one of these in preference to the other four; or, determined to avoid this, he uses them meticulously according to rotation, so that when a frequency chart is prepared from his cryptograms, this chart, which is, after all, a _graph_, will show the five uniform frequencies sticking out like a sore thumb. Even _book cipher_, notably secure, however unwieldy in use, has been decrypted because of the encipherer’s very human tendency to use a substitute more than once rather than search for a new one among the hundreds at his disposal. In book cipher, any agreed book, or other written or printed document, will serve as a _key-volume_, so long as it is one that is sure to be at hand when wanted. Words, or letters, can then be represented by a series of numbers usually indicating: page, (column), line, serial position. One letter or one word may thus have a substitute such as 20-1-4-32. An example is provided in Fig. 84, which the interested student may puzzle out for himself. The particular key-volume was issued in 1848, but we think this should cause no trouble. When the key-volume selected happens to be the ordinary dictionary, identically the same cipher becomes known as _dictionary cipher_, which is, to all intents and purposes, a very insecure form of _code_. Perhaps the two names together, book cipher and dictionary cipher, might be said to represent the maximum and minimum degree of safety found in the code family. We leave undiscussed the subject of those alphabets which are based on phonetics, with digraphs _TH_, _SH_, _CH_, having their individual symbols, and each vowel capable of having several. The student who desires to prepare one may find the necessary suggestions in any shorthand manual; his substitutes can be two-digit numbers, and his encipherment may be any one of those intended for the normal alphabet. Having made mention of several processes which, to the younger student, may present frightening possibilities, we hasten to add that the four appended examples are all of a type which he should be able to solve without a great deal of difficulty. 100. By PICCOLA. (Key-Phrase Cipher - intercepted by a "Royalist" spy). N H H K O H W A E H M A U I H U U H S T U S A S T U N H U M H N I W A H T. N H H H S A D T H H I A I I E I A M H K M U W A H O L W N W H T M A M D S T H A J T E S U T O T K N W I E W A O O. O U H K M W A H M N U I H U U H S T N W T O I K H K M W A H A H O A N W T O I K A W O. 101. By PICCOLA. (Probable words: CIPHER, SUBSTITUTION, ALPHABET, etc). D K I U O C Z P V C L U Z I Q U W Y V B V I N C D U U L C U K U Z I I U O C Z P V C L U Z P Y N U S Q S C Z I U L Q T U K H I C Z I K L U Z P Y N N Y J Q Y L U P L U Z I Q J S C U L U S U E Y G U Z I Q I U T Q N U F S U Z F L U I C V F Q S W Q I I S U Y S U G S Q N B L U G U O V V Y F S Q Y I H I Y I K O H K U V P T Y K Q I J U Y V P P C E S Y U O F Q S U L C Z N Y Z F K E S Y Z I U Z I R Q V V C. 102. By PICCOLA. (Probable words: COLLECTION, GALLERIES, FIGURINE, etc). Y C G U T H M P Y B X S K R M G X U F P C M I B C J G R M K X L X S Z N Q V V U N I X Q S Q E E X Z H M X S R L E Q M L C V U D Y C G R N Q S E X J U S K X C V X S E Q M T C I X Q S K Y C I I Y R K C S C Z M C L I Q V U S E M Q T K Y R T Q M Z C S Z C V V U M X R L F C L L U R S M U N R S I V B X S C N U M K C X S W H C M I R M D Y C L L X S N U J X L C P P R C M U J D T C B O R X S K Y X L E U V V Q F L N Q V V R N I X Q S S Q F X X X. 103. By EFSEE. (Probable words: PEOPLE, PERSON, CIRCUMSTANCES, etc). B E C O M I C I Q U E X P A Y O T I A N S I Z I P I A N D O A B U M Y O R E A N U S Q U I M O N I P M A M A M I F O X E G A O K A Z U K I S G O V I X A W A Z A I T H I N A I L M O S U I S H E A T R U A L E M O F A T I C A G I D O Y E M B E Y O L E N A C O S E K E E L S O G I Z A C O O L S I D I O R Q U A Z O W A G E S D I B U S I V I P U A Z A M E S I D A R T A C O O Y A P E S L I A R S E W O A L O N I K O L O M B A R I L A Z A L O W I A V U M A K A T L O F I C I N A I M I L N A Q U I M O N I P S A W O G A P A V I H I S U E C A N O S M O L E T A M E K O W A I V S I A R T E Z E I R S I L A Z E G A S A M I V E E P. CHAPTER XII Multiple-Alphabet Ciphers — The Vigenère The theory of polyalphabetical substitution is as follows: The encipherer has at his disposal several simple substitution alphabets, usually 26. He uses one such alphabet to encipher only one letter; for the next letter, he may use another cipher alphabet; for the third letter, a third alphabet; and so on, until some preconcerted plan has been followed out. The earliest known ciphers of this kind, the Porta (1563) and the Vigenère (1586), made use of a chart, or _tableau_, on which all of the available cipher alphabets were written out in full one below another. The Gronsfeld cipher (1655) used a purely mental encipherment plan; but the Beaufort ciphers, arriving two hundred years later (1857), again made use of a tableau, and something of the same idea survives in the use of _strips_; that is, a set of long narrow cards, each card carrying a simple substitution key. Slides, however, must have been in use near the time of Beaufort, since the best-known of the slide-ciphers, the Saint-Cyr, was being taught in 1880 at the French military school from which it takes its name. As to cipher disks, these appear to have been known even in Porta’s time, and have passed through many complications, though it has not been a great many years since a very simple disk was in use in our own army. (A drawing of the United States Army Cipher Disk may be seen in Webster’s New International Dictionary.) To know thoroughly any one of these ciphers is to understand the fundamental principles of all, and we are going to base our studies chiefly upon the Vigenère, most perfect of the simpler types, and the basis upon which others have been founded. Fig. 85 shows, in full, the Vigenère tableau, or “alphabet square.” The alphabet standing horizontally across the top of this figure is the plaintext alphabet, and serves for the whole tableau. Below this, and parallel to it, are the 26 “Caesar” alphabets, the first one being a duplicate of the plaintext alphabet, while the remaining 25 have been _shifted_, one letter at a time, until the last one begins with _Z_. These are the 26 available cipher alphabets, and each one is named according to its first letter, which is also spoken of as its _key_. Thus, the key-letter _A_ points out the _A_-alphabet; the key-letter _B_ points out the _B_-alphabet, and so on. The alphabet standing vertically on the left side of the tableau is merely a list of these key-letters, and so is called the key-alphabet. Except where cipher machines are employed, the ordinary plan of encipherment does not make use of the full 26 available cipher alphabets; only a few of these are used, and these few are taken always in a given rotation, so that the cipher becomes _periodic_. If the rotation includes, say, twelve of the cipher alphabets (whether or not these are all different), the cryptograms are said to have a _period of 12_. (The word “cycle” is also used in this connection.) Since each letter of the normal alphabet is the key to one of the Vigenère cipher alphabets, the encipherer, wishing to make use of several different cipher alphabets, is able to remember their sequence by means of a key-word, in which each letter will point out one particular cipher alphabet. If today’s key-word is BED, only three cipher alphabets will be used, the _B_-alphabet, the _E_-alphabet, and the _D_-alphabet, and the cryptograms will all have a _period of 3_. But if, tomorrow, the key-word is changed to CONSTANTINOPLE, the complete rotation will include fourteen alphabets, and the cryptograms will have a _period of 14_. Figure 85 THE VIGENÈRE TABLEAU A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A A B C D E F G H I J K L M N O P Q R S T U V W X Y Z B B C D E F G H I J K L M N O P Q R S T U V W X Y Z A C C D E F G H I J K L M N O P Q R S T U V W X Y Z A B D D E F G H I J K L M N O P Q R S T U V W X Y Z A B C E E F G H I J K L M N O P Q R S T U V W X Y Z A B C D F F G H I J K L M N O P Q R S T U V W X Y Z A B C D E G G H I J K L M N O P Q R S T U V W X Y Z A B C D E F H H I J K L M N O P Q R S T U V W X Y Z A B C D E F G I I J K L M N O P Q R S T U V W X Y Z A B C D E F G H J J K L M N O P Q R S T U V W X Y Z A B C D E F G H I K K L M N O P Q R S T U V W X Y Z A B C D E F G H I J L L M N O P Q R S T U V W X Y Z A B C D E F G H I J K M M N O P Q R S T U V W X Y Z A B C D E F G H I J K L N N O P Q R S T U V W X Y Z A B C D E F G H I J K L M O O P Q R S T U V W X Y Z A B C D E F G H I J K L M N P P Q R S T U V W X Y Z A B C D E F G H I J K L M N O Q Q R S T U V W X Y Z A B C D E F G H I J K L M N O P R R S T U V W X Y Z A B C D E F G H I J K L M N O P Q S S T U V W X Y Z A B C D E F G H I J K L M N O P Q R T T U V W X Y Z A B C D E F G H I J K L M N O P Q R S U U V W X Y Z A B C D E F G H I J K L M N O P Q R S T V V W X Y Z A B C D E F G H I J K L M N O P Q R S T U W W X Y Z A B C D E F G H I J K L M N O P Q R S T U V X X Y Z A B C D E F G H I J K L M N O P Q R S T U V W Y Y Z A B C D E F G H I J K L M N O P Q R S T U V W X Z Z A B C D E F G H I J K L M N O P Q R S T U V W X Y To make use of a cipher alphabet, say the _B_-alphabet, we may lay a ruler across the tableau in such a way that this one alphabet is pointed out. Then, to encipher any letter, as _S_, we may find this letter, _S_, in the plaintext alphabet at the top, and trace down its column as far as the _B_-alphabet which is being pointed out by the ruler; we find that the substitute, in this alphabet, is _T_. Or, wishing to decipher _T_, we find this letter in the _B_-alphabet and trace upward to the plaintext alphabet in order to find that its original is _S_. While the foregoing explains the principle, it has not been expressed in the usual language. Where we have mentioned the use of the _B_-alphabet, it is much commoner to hear that a certain letter has been enciphered or deciphered “with key-letter _B_,” and the usual description of the encipherment will be somewhat as follows: To encipher _S_ by _B_, find _S_ in the plaintext alphabet, find _B_ in the key-alphabet, and use the substitute which is found at the intersection of the _S_-column with the _B_-row. Or: To decipher _T_ by _B_, first find the key-letter _B_, trace horizontally to the right as far as the cipher-letter _T_, then trace upward to its original, _S_. This, we believe, is the original description, as explained by Blaise de Vigenère himself, and the original encipherment plan was that indicated in Fig. 86. The message of this figure is SEND SUPPLIES TO MORLEY’S STATION. The key-word, BED, has been repeated often enough to pair one key-letter with each text-letter, and these pairs are handled _one at a time_: _S_ is enciphered by _B_, _E_ is enciphered by _E_, _N_ is enciphered by _D_, and so on, following the original description. Figure 86 Original Method of VIGENÈRE Encipherment Key: B E D B E D B E D B E D B E D B E D B E D B E D B E D B Message: S E N D S U P P L I E S T O M O R L E Y S S T A T I O N Cipher: T I Q E W X Q T O J I V U S P P V O F C V T X D U M R O Figure 87 Modern Enciphernent B E D B E D B E D S E N D S U P P L T I Q E W X Q T O I E S T O M O R L J I V U S P P V O E Y S S T A T I O F C V T X D U M R N O 5 10 15 20 25 30 T I Q E W X Q T O J I V U S P P V O F C V T X D U M R O X X The modern method would be that of Fig. 87. Knowing that a great many letters are going to be enciphered by _B_, a great many others by _E_, and a great many others by _D_, and having no wish to preserve word-divisions, we begin by writing our plaintext into three columns (or by grouping it conveniently), and then encipher at a single writing all of those letters which are to be enciphered by any one same key-letter. That is, we apply one cipher alphabet at a time, as first explained. The modern practice will also require that the cryptogram be taken off in five-letter groups, and that the final group be made complete. This is another of those cases in which the decryptor will number his letters, as shown in the figure. The student who has not previously met the Vigenère cipher is urged to perform the two operations of encipherment and decipherment and thus familiarize himself with the use of a tableau; it is possible that in most of his subsequent reading he will find explanations based on the “columns” and “rows” of a “tableau,” when, as a matter of fact, no tableau has been used. To understand how this might be, suppose we take a look now at the Saint-Cyr cipher. Figure 88 THE SAINT-CYR SLIDE ┌─────────────────────────────────────────────────────┐ │ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z │ ┌───────┴┬───────────────────────────────────────────────────┬┴──────────── │ A B C D│E F G H I J K L M N O P Q R S T U V W X Y Z A B C D│E F G H I J..\ └───────┬┴───────────────────────────────────────────────────┴┬─────────────┘ └─────────────────────────────────────────────────────┘ (To Y.) In Fig. 88, we have the principle of the sliding device by means of which this encipherment is accomplished. The Saint-Cyr slide is very easily prepared of cardboard, or of any other flexible and fairly strong material, but may also be prepared of wood, or may be set up for any temporary purpose on two strips of paper. Its details, also, may be varied to suit the operator’s own convenience. As shown, however, the upper and single alphabet, which is the plaintext one, is written on a card, and slots will be cut in this card at two points: Just below and to the left of _A_; and just below and to the right of _Z_. This plaintext alphabet is considered stationary. The lower and double alphabet, which is to furnish all of the substitutes, is written on a long narrow strip, the two ends of which may be inserted into the slots of the other card. This strip, or slide, may then be moved back and forth at will. However prepared, the spacing must be uniform throughout both alphabets. The Saint-Cyr cipher also makes use of a key-word in which each letter is the key to a cipher alphabet, and which is applied exactly as in Fig. 86 or Fig. 87. To apply the key-letter _B_, we adjust the slide in such a way that the _B_ of the sliding alphabet will stand directly beneath _A_ of the stationary one. This gives us exactly the same set-up which we used in Chapter IX for cases of simple substitution; that is, we have a plaintext alphabet with a cipher alphabet standing just below it; each plaintext letter is standing directly above its substitute, and each substitute directly beneath its original. The cipher alphabet just referred to, in which key-letter _B_, found in the sliding alphabet, is standing directly below the index-letter, _A_, found in the stationary alphabet, is identical with the _B_-alphabet of the Vigenère tableau, and is even called by the same name. Should we move the sliding alphabet, so as to place key-letter _C_ directly beneath index-letter _A_, we reproduce the _C_-alphabet of the Vigenère cipher, again called by the same name. In the figure, we have the _E_-alphabet in position, with key-letter _E_ standing directly beneath index-letter _A_. And since the sliding alphabet may be placed in 26 different positions, each time reproducing one of the Vigenère cipher alphabets, having the same key and the same name, it appears that our Saint-Cyr “cipher” is merely a duplication of the Vigenère. The chances are, then, that even though we call our cipher by its original name, and even make references to its tableau, our actual work of encipherment and decipherment will have been accomplished by means of the more convenient and rapid Saint-Cyr slide. But where a slide is possible, a _cipher disk_ is also possible, and many will prefer to use the disk. To prepare one of these, we might proceed as follows: First, cut out from cardboard (or other desired material) a pair of disks, one smaller than the other. Divide the peripheries of both disks into 26 equal segments, and write the 26 letters of the alphabet in a circle around both of the peripheries, causing both alphabets to run in the same direction. Place the smaller disk on top of the larger; and, finally, stick a drawing pin through the exact center of both disks, to serve as a pivot. The smaller disk may now be rotated to 26 different positions, so that any desired key-letter can be caused to stand beside index-letter _A_ of the outer disk, and will place in position the cipher alphabet of which it is the key. The use of this revolving alphabet in place of a sliding one does away with the necessity for doubling its length. Now let us examine carefully Fig. 89, with its two examples of decipherment. At (a) of this figure, a short cryptogram fragment, beginning _T I Q_. . . . , is being deciphered with the original key-word, BED, and is bringing out the message, SEND SUPPLIES. . . . . This, of course, is to be expected of any cipher. But at (b), it is this _message fragment_, SEND SUPPLIES, which is acting as a _trial key_; exactly the same process is being used as if applying the true key, and this decipherment is bringing out the original key, repeating over and over. The Vigenère cipher, then, works equally well in reverse, and in this respect it differs from some of its kindred ciphers. To understand this peculiarity, we have merely to consider the tableau. Concerning this we have said that the horizontal alphabet which stands across the top is the plaintext alphabet, and that the vertical one at the left is merely a list of keys. Suppose we decide to look at it the other way round, and say that the vertical alphabet at the left is the plaintext one, and that all 26 of the cipher alphabets are standing on end with their key-letters at the top, so that the horizontal alphabet, written across the top, is merely a list of these keys. Will there be any difference in the encipherment? Might the slide, also, be prepared in a vertical position? Does it make any difference in the results whether we encipher plaintext _SEN_ by key BED, or encipher plaintext BED by key _SEN_? One road to decryptment, then, is clearly indicated. If we have a probable word, we may use this word exactly as if it were the key, and, if it is actually present, it will bring out the true key. Or, if we have no probable word, we may try probable sequences, or make use of the trigram list. Here, however, we have two separate cases: The simplest, in which the probable word is long enough to bring out the key-word _repeating_; and the most difficult, in which the sequence, or probable word, is very short, and will bring out only a short fragment of the key-word. Figure 89 (a) Deciphering with the KEY: Key: B E D B E D B E D B E D....... CRYPTOGRAM: T I Q E W X Q T O J I V....... Plaintext: S E N D S U P P L I E S....... (b) Deciphering with the MESSAGE: Trial Key: S E N D S U P P L I E S....... CRYPTOGRAM: T I Q E W X Q T O J I V....... True Key: B E D B E D B E D B E D....... The simpler case is readily explained. We have, say, a cryptogram beginning _U S Z H L W D B P B G G F S_. . . , in which we suspect the presence of the word SUPPLIES. We decipher the first eight letters, _using this probable word as a trial_ _key_, and obtain a jumbled series of letters _C Y K S A O Z J_, which is not satisfactory. We leave off the first cryptogram-letter, _U_, and decipher the next eight, obtaining another jumbled series of letters _A F S W L V X X_. We start again at the third letter, then at the fourth letter, and still there is no information. But at the fifth trial, beginning at the fifth cryptogram-letter, we obtain a series _T C O M E T C O_, and this is satisfactory, not necessarily because we have recognized the word COMET, though this, of course, is a very desirable happening, but because the last three letters, _T C O_, are repeating the first three. _The series is beginning over_. The student should practice doing this, using both the tableau and the slide (or disk), until he is sure that he understands the process. The exact details of his work are immaterial; if he is sure that his key will be a recognizable word, it will be satisfactory to make decipherments directly on the cryptogram, erasing as he goes. Sometimes, however, the key is incoherent, or apparently so, and a jumbled series like _C Y K S A O Z J_ might actually be the correct key; for this reason, it is well to follow a routine of some kind which will preserve all of the decipherments. One such plan is illustrated in Fig. 90. Here, the cryptogram, or a substantial portion of it, would be written across a sheet of quadrille paper, and the probable word would be written at one side, where each of its letters will govern one row of decipherments. The first letter, _S_ in the figure, has been used to _decipher the whole row of cryptogram-letters_, giving every possible key-letter which can produce _S_. The second letter, _U_, has been used to decipher them all again (except the very first letter; we do not expect a word UPPLIES). The third letter, _P_, has been used to decipher them all a third time; and soon. The resulting rows of decipherment include all key-letters which could have produced _S_, then _U_, then _P_, and so on. To read them consecutively, beginning at any cryptogram letter, start immediately below that letter, and read diagonally downward to the right. The first diagonal gives key _CYK_. . . , the second gives _AFS_. . . , and so on to the fifth diagonal, showing the key as _T C O M E T C O_. (If it is desired that these possible keys should come out standing in a horizontal position, then the _decipherments_ may be made diagonally.) F. R. Carter, the originator of this scheme, does not necessarily make all of the decipherments which are included in the figure. He begins with the assumption that his key will be a recognizable word; having deciphered in full the first three rows, he abandons all of those diagonals which cannot develop into words. If, in the end, he is forced to conclude that his key was incoherent, _no decipherments have been erased_; he may still go back and develop the rest of his diagonals, in the hope that one will begin repeating. Figure 90 Deciphering with the Probable Word SUPPLIES - Routine of F.R.CARTER Cryptogram fragment: .... U S Z H L W D B P B G G F S ......... Probable word: S C A H P T/ E L J X J O O N A ......... U Y F N R C/ J H V H M M L Y ......... P K S W H O/ M A M R R Q D ......... P S W H O M/ A M R R Q D ......... L A L S Q E/ Q V V U H ......... I O V T H T//Y Y X K ......... E Z X L X C//C B O ......... S O// (Key: COMET) The more difficult of our two cases, that in which we have no probable words other than _the_, _and_, _which_, _that_, _have_, _but_, etc., can follow exactly the routine outlined in Fig. 90; but in this case there must be two separate work-sheets. Here, it is usually better to forget words and start at once with the list of normally frequent trigrams, _THE_, _AND_, _THA_, _ENT_, _ION_, _TIO_, etc. The key-fragments which are deciphered by these will be very short, and very numerous; a great many of them will be very good usable sequences, and perhaps the correct key-sequence will not look quite so inviting as others which are incorrect. It becomes necessary, then, to have a second work-sheet on which we may take these fragments one by one and try them as keys. If any one of them is a fragment of the original key, _it must bring out fragments of plaintext, and must bring them out at some regular interval_. If the scheme of Fig. 90 is the one preferred, the second work-sheet may be prepared exactly like the first, and used in the same way. The only difference is as follows: On the first work-sheet, where the figure shows the word SUPPLIES, a supposed trigram (_THE_, _AND_, etc.) will have been used to bring out supposed key-fragments; on the second work-sheet, one of these supposed key-fragments will have been used. These new rows of decipherment may then be examined to find out whether any of the new diagonals contain apparent plaintext fragments, and, if so, whether these occur at a regular interval. For this kind of work, however, Ohaver has offered us another routine which requires somewhat more preparation than Carter’s but which is well worth the extra trouble, especially if it be remembered that a trigram-search is never necessary except with the shortest of cryptograms. For the longer cryptograms, we have easier methods. Ohaver’s plan can be examined in Fig. 91. The cryptogram, shown at the top of this figure, contains 26 letters; therefore, remembering that each letter, except the final two, may begin a cipher-trigram, it contains 24 trigrams. The preparation of the two work-sheets requires that these 24 cipher-trigrams be written out in full on both sheets. This work should be done in ink, or on the typewriter. Then, too, for a reason which will be explained in a moment, it is well that the first of these work-sheets be prepared with a great deal of space, say seven or eight lines, between its rows of trigrams. Now, considering the first work-sheet, shown at (a) of the figure: The upper row shows the 24 cipher-trigrams as originally written out. We have been working down the trigram list, using every normally frequent trigram as a trial key, and have failed to find _THE_, _AND_, _THA_, or _ENT_, which means that we have done quite a lot of tedious work. We have now reached the normally frequent trigram _ION_, and this we have applied as a trial key, assuming one by one that each of the 24 trigrams represents _ION_. We have, then, 24 decipherments on the second row, and _any one_ of these 24 deciphered trigrams might be a fragment of the original key. However, it is natural to assume that a trigram _FRI_ or _WAY_ is more likely than one such as _XHR_ or _NQB_, and those fragments which look like usable sequences have been underscored in the figure. These are to be tested first. At (b), we have the other work-sheet, the upper row, as before, showing the 24 possible cipher-trigrams. Here, we have already failed in our tests for key-fragments _FRI_, _WAY_, _DZI_, _NYE_, which means that we have done some more tedious work, and we have now arrived at the possible key-fragment _EDA_. If this sequence, _EDA_, is actually a portion of the original key, it must not only bring out fragments of a plaintext message, but must bring them out at some constant distance apart. The point at which we found this is the tenth trigram, and here it may be advisable to remind that this begins at the tenth cryptogram letter; that is, _every trigram presents only one new letter_, so that to find a completely different trigram in either direction, we must count backward or forward a distance of three trigrams. Figure 91 L N F V E O L N V M R N G Q F H H R N H I R V F E B, (a) Trial Sheet No. 1 ION LNF NFV FVE VEO EOL OLN LNV NVM VMR MRN RNG NGQ AZS FRI XHR NQB WAY GXA DZI FHZ NYE EDA JZT FSD GQF QFH FHH HHR HRN RNH NHI HIR IRV RVF VFE FEB YCS IRU XTU ZTE ZDA JZU FTV ZUE ADI JHS NRR XQO (b) Trial Sheet No. 2 EDA LNF NFV FVE VEO EOL OLN LNV NVM VMR MRN RNG NGQ HKF JCV BSE RBO ALL KIN HKV JSM RJR ION NKG JDQ GQF QFH FHH HHR HRN RNH NHI HIR IRV RVF VFE FEB CNF MCH BEH DER DON NKH JEI DFR EOV NSF RCE BBB (c) Testing out the Period 5 D A E D A E D A E D A E D A E D L N F V E O L N V M R N G Q F H H R N H I R V F E B I N . . A L L . . I O N . . B E H . . D F R . . A Y (TION?) (FRIDAY?) Beginning, then, at the tenth trigram, and examining every third trigram in both directions, we find that our key-fragment has given us the following decipherments: _HKF_, _RBO_, _HKV_, _ION_, _CNF_, _DER_, _JEI_, _NSF_. These are largely incoherent; but, in addition, it must not be overlooked that on the continuously-written cryptogram, these would be consecutive, giving us a message _H K F R B O_. . . Applied at interval 3, then, our key-fragment _EDA_, will not decipher us a message; therefore, the period of this cryptogram, using this key, cannot be 3. To examine for the possibility of a period 4, we start again with our tenth trigram, and examine every fourth decipherment in both directions; our series, this time, is _JCV_, _KIN_, _ION_, _MCH_, _NKH_, _NSF_. Most of these are usable, and the first one might be due to nulls, initials, and so on; but here again we have the reminder that with each trigram representing only one new letter, these are _almost consecutive_, starting at the second cryptogram letter, so that our message, with each fourth letter missing, will be as follows: _* J C V * K I N * I O N_. . . . Unless we can think of some letters which would fill these gaps and provide plaintext, our period is not 4. Trying again, however, beginning at the tenth trigram and examining each fifth decipherment, we find something more satisfactory: _ALL_, _ION_, _BEH_, _DFR_. If these are correct, the period is 5. At (c), we have gone back to the continuously-written cryptogram in order to try these in their places; and since a period 5 would mean that each of the letters _E D A_ is used regularly to encipher each fifth letter, we are able to include two shorter decipherments at the two ends of the cryptogram. The next step in logical order is to try deciphering _T_ in front of _ION_, since the trigram _TIO_ would have been the next one on our trigram list. This brings out key-letter _C_, which, if correct, will decipher correctly at each interval 5, and which extends our key-letters to _C E D A_. We can see, too, that this is not the beginning of the word; the sequence we have is _D A * C E_. In the given example, it is not difficult, also, to guess a probable word, FRIDAY. Now, having twice called attention to the fact that the trigram-search can grow quite tedious, we hasten to point out that it need not be made more so by deciphering each trigram individually. If your trial key is _THE_, set your slide at the _T_-alphabet (or point this out on the tableau), and decipher every first letter on the sheet. Then set the _H_-alphabet in position, and decipher every second letter on the sheet. Finally, set the _E_-alphabet in position and decipher all of the remaining letters. The foregoing few paragraphs have illustrated the worst case in almost its worst form, but will show the principle. Now let us consider this work in a much more usual case. As mentioned earlier, the first of the two work-sheets will be prepared with a great deal of space between the rows of trigrams. The full number of decipherments will be made for the first trigram _THE_, but _not erased_. Just below these, a second row of decipherments will be made for _AND_, and these, too, will be left standing. (_THA_ can be omitted.) A third row of decipherments is made for _ENT_, a fourth row for _ION_, and so on down the list, until there are six or eight rows of possible key-fragments. These are all examined and compared with one another, in the hope of finding duplications. Perhaps _THE_ and _AND_ have _both_ brought out a key-fragment _EDA_, or one has brought out _CED_ and the other _EDA_, having _ED_ in common. It is far from unusual, in some of these cases, to find a whole series of these overlapping key-fragments, for instance, _CON_, _ONS_, _NST_. This will explain why many persons consider the trigram-search the simplest and most direct way of attacking a Vigenère cryptogram. For the benefit of the novice, we end the chapter at this point in order that he may have some practice. Example 104 comprises a thrilling serial with all the trimmings, gripping and original title, smashing climax, and a brave hero, John Miller. The key to the title is STRANGE. Part I repeats a word found in the title; part II repeats a word of part I; and somewhere are the trigrams _NOT_, _CON_, _YET_, _ING_, _TEN_, _THE_. We have heard, too, that an amateur encipherer will occasionally encipher the nulls which he adds in his final group. Example 105 is easily investigated through short common words. As to the remaining examples, while it is true that they can be attacked by the trigram method, the student will probably prefer to leave them until he has seen the methods outlined in Chapters XIV and XV. 104. By PICCOLA. (For trigram practice. A new key for each fragment). Title of Serial: S L K R N T K W W Z S N V T W T I A A I I X X X X. Part I: R I G Z V Z K I U O M H J L B W F P K S R Z T R H E J T W I O S W I O S G Q I I. Part II: H H T X T N E O L V R M T U L C L P P X T Y R X K U K B U W U O J Z H X M Z K H. Part III: S Y Z Y R T N F U R K C U S I I R Q U X W U F K C J N R L Q N F O K V X M P U O N H J A X J H V O P. Part IV: X B V P Y S X C J J Y U R X O T S P I N Y I L U P A V M X M M F C I B S T I T O O T B R O. 105. By PICCOLA. (For investigation of short words. - Still Vigenère!) V Y I D J G I E J S N V R J H J F J D B G E K O W U Y A R F F Z W V O K U X R P G R J U O E K M R B U Y S U H Q W J L J G C I W H G I W. 106. By NEON. (Any repeated trigram is worth watching!) P Q X E J F V E G Y M N Y N Y I U F R D S G V R I L P S G Z T M E S I R K N Y I G P E R W G R R N D L O J N T Y I D X O T Y C I P C R E V C E S G O I R L I S I R Z Q E U C G L T C I X H Y I X H E L E K Y J E K P X I E Y R R S L H D L I F Y G P R J G S D I C E. 107. By THE ADMIRAL. (Numbers are always possible!) L V P R V S F P T Y J S P H L F R C E U S B O S Z P H J F Z N S O A P K T T V V Z C F R J X C C T P W W R H K E W Y U K W G L N U X C C T P X W G E R F R Z N V Z O W F J W Q Z N U K W Y O E W M P A I. 108. By NEON. (This cryptogram, circulated in April, 1935, caused great consternation among solvers. Do you see any reason why?) T W G J C N I U J X C S L S K K B N V G W I P S U Q I U J A U L J U Z H B E V J V M A O H G G L T P D G L E Y S S L A F I M J S W Q I U M O N N F L V H I U I Z D Q K V Y R T W H I M R F E U K P N O V Y T K E F N V Q N O T. 109. By PICCOLA. A X S E H G O I W W F O I A L G E M Q W E E N B W R E I K L S H Z Z Q X L G A H V P Z K L D L G G D W T C M H Q D J N W K E H M V V A B M A. CHAPTER XIII The Gronsfeld, Porta, and Beaufort Ciphers Now let us have a brief look at other classic ciphers of the multiple-alphabet type, and see to what extent these will differ from the Vigenère. The Gronsfeld cipher, as may be seen from the specimen encipherment of Fig. 92, uses a number-key. Its ten alphabets are governed by the ten digits. To encipher _S_, using key-digit 2, simply begin at _S_ and count forward 2 in the normal alphabet; the substitute is _U_. To encipher _E_ with key 8, begin at _E_ and count forward 8 in the normal alphabet; the substitute is _M_. For decipherment, count backward in the alphabet. A very superficial investigation will show that the Gronsfeld key of the figure, 28105, and the Vigenère key _CIBAF_ will produce identically the same cryptograms. The key-digit _zero_ governs the _A_-alphabet of the Vigenère, the key-digit 1 governs the _B_-alphabet, and so on to the _J_-alphabet. If it is found convenient to use a tableau (as it may be for the decipherment), the first ten cipher alphabets of the Vigenère tableau can be ruled off from the rest, and the key-digits, in the order 0 to 9, can be added beside the key-letters _A_ to _J_. Or, if the slide is the preferred method, these digits can be written beneath the first ten letters of the sliding alphabet; it is then possible to slide them into position below the index (the stationary _A_), in the same way as the letter-keys. The Gronsfeld cipher, then, is no more than a minor variation of the Vigenère, and requires no separate discussion other than a simple reminder that its possibilities are far more limited than those of the Vigenère proper. That is, it covers a range of only ten cipher alphabets where the Vigenère covers 26, and this limitation more than compensates for the fact that its key is not a plaintext word (presuming, that is, that we know what cipher has been used. Otherwise, the difficulties are about the same for both). To understand how this limitation may modify the case, let us examine the work-sheet shown in Fig. 93. Figure 92 GRONSFELD Encipherment Key: 2 8 1 0 5 2 8 1 0 5 2 8... Plaintext: S E N D S U P P L I E S... Cryptogram: U M O D X W X Q L N G A... Here, we have exactly the routine of Fig. 90, except that our search must be made for probable trigrams, and not for a probable word. We have begun with the most likely trigram, _THE_. But here we do not find it possible to do as we did in Fig. 90; that is, _decipher every letter_, first as _T_, then as _H_, then as _E_. Of the twelve cryptogram-letters present, only seven can be deciphered as _T_; the rest are too far away from it in the normal alphabet, and would require keys larger than 9. Of the six letters which immediately follow the possible _T_’s (the seventh is not shown), only three can be deciphered as _H_. And of the three letters which immediately follow a possible _TH_, only two can be deciphered as _E_ or as _A_. It is often possible, in these ciphers, to investigate simultaneously the trigrams _THE_ and _THA_. So far as the cryptogram is shown, then, there are only two points at which a trigram _THE_ can be present, while a Vigenère cryptogram of the same length would have presented ten possibilities. Thus, we have no real need for a second work-sheet; the only possible key-fragments, 114 and 790, can be tested by any hit-or-miss method which happens to be quickest. Figure 93 Decrypting a Known Gronsfeld Cryptogram Fragment: X U I I A Q E U U Y J W....... Trigram tried: T 4 1/ 7/ 1 1 5/ 3 H 1/ 9/ 2/ E 4/ 0/ The sequences U I I and A Q E are the only points at which the trigram T H E could possibly be present, so that only the key-sequences 1 1 4 and 7 9 0 are to be tried. The digram T H alone may be present at Y J. This cipher is often decrypted in much the same way as a “Caesar” simple substitution (shown in Fig. 61). The cryptogram, or a convenient portion of it, is copied on a single line of writing; then, with each letter as a point of beginning, a series of alphabets is extended (written in reverse order), but only for a distance which includes ten letters. That is, the ten possible decipherments for each cryptogram-letter are written in the form of a ten-letter column. The decryptor may then inspect the ten rows of decipherment to see what he can find. At any point where it is possible to find _T_, _H_, and _E_ in three consecutive columns, the correctness of this possible _THE_ can be checked by finding out whether or not it has a series of companion-trigrams standing at some regular interval on exactly the same three rows. * * * In Fig. 94, we have the tableau of Giovanni Battista della Porta, adjusted to suit the modern 26-letter alphabet. Here we have only thirteen cipher alphabets, each of which may be governed by either of two key-letters; these pairs of keys may be seen at the left of their respective alphabets. In all thirteen of these cipher alphabets, the encipherment is _reciprocal_. In the _AB_-alphabet, for instance, which is the first one on the chart, the substitute for _A_ is _N_, and the substitute for _N_ is _A_. The Porta cipher, the oldest known of its kind, employs a key-word, applied as in Vigenère. If the key-letter in use is either _A_ or _B_, the topmost alphabet is the one to be used; if the key-letter is either _C_ or _D_, the second alphabet must be used; and so on. Where this encipherment is illustrated in Fig. 95, it may be of some interest to observe that it is not totally impossible for two different key-words to produce identical cryptograms. As to decipherment, we have already mentioned the fact of reciprocal substitution. Whenever the alphabets are reciprocal (in any cipher), the decipherment is identically the same process as encipherment. Figure 94 The PORTA Tableau AB A B C D E F G H I J K L M N O P Q R S T U V W X Y Z CD A B C D E F G H I J K L M O P Q R S T U V W X Y Z N EF A B C D E F G H I J K L M P Q R S T U V W X Y Z N O GH A B C D E F G H I J K L M Q R S T U V W X Y Z N O P IJ A B C D E F G H I J K L M R S T U V W X Y Z N O P Q KL A B C D E F G H I J K L M S T U V W X Y Z N O P Q R MN A B C D E F G H I J K L M T U V W X Y Z N O P Q R S OP A B C D E F G H I J K L M U V W X Y Z N O P Q R S T QR A B C D E F G H I J K L M V W X Y Z N O P Q R S T U ST A B C D E F G H I J K L M W X Y Z N O P Q R S T U V UV A B C D E F G H I J K L M X Y Z N O P Q R S T U V W WX A B C D E F G H I J K L M Y Z N O P Q R S T U V W X YZ A B C D E F G H I J K L M Z N O P Q R S T U V W X Y The Porta tableau, being smaller than the Vigenère, is not at all inconvenient to prepare and use as it stands. It can be made still more compact: The upper half being alike for all thirteen cipher alphabets, this half can be written _once only_, at the top of the chart. The lower halves can be written below this on thirteen parallel lines, with their pairs of keys at the left. A ruler may then be used, as suggested for Vigenère, to point out any given lower half. But when it is noticed that these lower halves are identically the same series of letters, with its point of beginning shifted one letter at a time, it is promptly seen that a slide is possible, on which the _N_-to-_Z_ half of the normal alphabet, if written twice in succession, could be placed in 13 different positions with reference to the _A_-to-_M_ half; and a slide is more convenient still. The slide shown in Fig. 96 is another of Ohaver’s devices. The only new feature in connection with the Porta slide lies in the handling of the key-letters, which, in this cipher, are no longer the first letters of their cipher alphabets. Mr. Ohaver has added them on the sliding portion of the device, each pair of keys being placed directly below the letter which must stand beneath the index (_A_) whenever one or the other of the pair is the key-letter in use. Figure 95 Porta Encipherment Keyword: E A S T E A S T Plaintext: S E N D S U P P... Cipher: D R E Z D H G G... (Compare:) Keyword: F A T S F A T S Plaintext: S E N D S U P P... Cipher: D R E Z D H G G... The Porta cipher, aside from its purely historical interest, provides a most interesting decryptment study in the formation of its alphabets. Notice that because of the encipherment scheme itself, it becomes totally impossible that the substitute for any letter, in any cipher alphabet, can ever be taken from its own half of the normal alphabet. This limitation is far more visible than that of the Gronsfeld. We have, say, a cryptogram sequence _H E P_. Can this represent the trigram _THE_? No, because _E_ cannot represent _H_; for the same reason, it cannot represent _THA_. Can it represent _AND_? No, because _H_ cannot represent _A_. Can it represent _ENT_? No, because _H_ cannot represent _E_. Can it represent _ION_? _TIO_? _FOR_? _NDE_? _HAS_? It is not until we reach _STH_ that we find a normally frequent trigram which could have the substitutes _HEP_. But to gather the full significance of this Porta limitation, and also a suggestion concerning the detail work when taking advantage of it, let us picture the case of a probable word: INFANTRY. Figure 96 A Slide for PORTA - Devised by OHAVER ┌─────────────────────────────────┐ │ A B C D E F G H I J K L M │ ┌───────────┤ ┌───────────────────────────┐ ├───────────┐ │ N O P Q │ │ T U V W X Y Z N O P Q R S │ │ V W X Y │ │ │ │ │ │ │ │ │ │ (Keys) │ │ │ │ A C E G │ │ M O Q S U W Y │ │ │ │ B D F H │ │ N P R T V X Z │ │ │ └───────────┤ └───────────────────────────┘ ├───────────┘ │ │ └─────────────────────────────────┘ Using digits 1 and 2 to mean, respectively, the first and the second half of the normal alphabet, this probable word INFANTRY has the alphabetical pattern 1 2 1 1 2 2 2 2. And, since every substitute must have been taken from the other half of the normal alphabet, it will certainly be represented in any Porta cryptogram by eight letters having the opposite alphabetical pattern: 2 1 2 2 1 1 1 1. Moreover, a pattern as long as this is not going to be found very often in any one cryptogram. The decryptor, then, may proceed as in Fig. 97. Each cryptogram letter is marked I or 2, or imagined to be so marked, and this series of digits is examined in the hope of finding a sequence 2 1 2 2 1 1 1 1. If it cannot be found, the word is not present; if it is found, it can be assumed to represent the word INFANTRY. Here, we meet with a slight difference between the procedure for Vigenère and the procedure for Porta. Figure 97 THE PROBABLE WORD METHOD IN PORTA Pattern of word INFANTRY: 1 2 1 1 2 2 2 2 Pattern of substitute: 2 1 2 2 1 1 1 1 The cryptogram, with pattern: F J I D T U V S S L F F I T X M S T M E D L 1 1 1 1 2 2 2 2 2 1 1 1 1 2 2 1 2 2 1 1 1 1 Determining the KEYWORD: .....X M S T M E D L..... I N F A N T R Y E C A M C E C A F D B N D F D B D A N C E In Vigenère, we found it possible to discover the key by simply taking the probable word and deciphering with it. In Porta, we cannot do this. We must first pair the two letters, that is, a supposed substitute with its supposed original, and then find out what key would cause this. In the figure, for instance, we have a sequence _X M S T_, assumed to represent _I N F A_. The first corresponding pair is _X_ = _I_. If we are using the tableau of Fig. 94, one of these letters, _I_, is never found anywhere except in the 9th column. We find the _I_-column, and trace down until we find _X_; the key, in this case, must be _E_ or _F_, The next corresponding pair of letters (_M_ representing _N_) demands that we find the _M_-column and trace down to _N_; key _C_ or _D_. The third pair (_S_ representing _F_) demands that we find the _F_-column, and trace down to _S_; key _A_ or _B_. The fourth pair (_T_ representing _A_) demands that we find the _A_-column, and trace down to _T_; key _M_ or _N_. Using the slide of Fig. 96: Place _X_ and _I_ together, and note that the key-letters standing below the index (stationary _A_) are _EF_. Place _M_ and _N_ together, and note key-letters _CD_. Place _S_ and _F_ together, and note key-letters _AB_. Place _T_ and _A_ together, and note key-letters _MN_. From the recovered pairs of key-letters, we are to select one each in order to recover the key-word, using somewhat the logic we might apply in dealing with a key-phrase cryptogram. In the given case, where we need the two vowels to form any word at all, it is not difficult to surmise that the key-word was DANCE. It might not be so easy to decide as between EAST and FATS; but key-words, as a rule, are seldom so short as those we have been using, and the longer the word, the fewer the possibilities. Concerning keys, however, there is one contingency which may have to be considered: The various modernized versions of this tableau are not always duplicates. The cipher alphabets will be the same as those given here; but where we have caused these to shift in the normal direction, another tableau may show them shifting in reverse. The first alphabet will be the same as here, but the second, still showing key-letters _CD_, will show its lower half beginning _Z N O P_. . . ; the third, still showing key-letters _EF_, will show its lower half beginning _Y Z N O P_. . . ; and so on. The recovery of the key-word, of course, is not vital. * * * Coming now to the two ciphers which are called Beaufort, we return to a tableau so closely resembling Vigenère’s tableau that the two can be used interchangeably. Fig. 98 shows only enough of the Beaufort tableau to bring out the difference in form. Here, we find no separate plaintext alphabet and no separate key-alphabet. Those which form the square have been lengthened by repeating their first letters; and a 27th alphabet, added at the bottom of the tableau, repeats the alphabet shown at the top. In this way, we have a 27 x 27 alphabet square in which _all four of the outside alphabets are exactly alike_. These ciphers, also, make use of a key-word, applied as in Vigenère and in Porta. As Sir Francis Beaufort himself is said to have used the tableau, the encipherment of a given plaintext-letter, using a given key-letter, was accomplished as follows: To encipher plaintext _S_ with key _C_, find the letter _S_ in any one of the four outside alphabets, trace into the square along the _S_-column (or row) as far as the key-letter _C_; at that point, turn a right angle, in either direction, and trace outward along that row (or column), emerging from the square at the substitute, which, in the given case, is _K_. Or: To _decipher_ _K_ with key _C_, begin with _K_, and _follow identically the encipherment process_, emerging this time at the plaintext letter, _S_. This process we have called the _true Beaufort_ cipher. Notice that we have _reciprocal encipherment_; encipherment and decipherment are identically the same thing. Figure 98 Upper Portion of the BEAUFORT Tableau A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I J K L M.... (Etc.) ....W X Y Z A B C D E There are no external alphabets. The four outer alphabets of the square are exactly alike, with A in each of the four corners. TRUE BEAUFORT Encipherment VARIANT BEAUFORT Encipherment Key: C O M E T C O M E T C O Key: C O M E T C O M E T C O Plaintext: S E N D S U P P L I E S Plaintext: S E N D S U P P L I E S Cipher: K K Z B B I Z X T L Y W Cipher: Q Q B Z Z S B D H P C E As to the companion cipher, the student will promptly have guessed this for himself: Instead of starting with the plaintext-letter, _S_, and tracing inward to the key-letter, it is entirely feasible to begin with key-letter _C_ and trace inward to the plaintext-letter _S_, emerging at _Q_ instead of at _K_. This cipher, too, is called Beaufort, since its method of accomplishment is Beaufort’s method. But there is a difference in the two resulting ciphers; notice here that the encipherment is no longer reciprocal; should we start at key-letter _C_, trace inward to the new cipher-letter, _Q_, and then trace outward, we do not emerge from the square at the plaintext letter _S_, but at _O_, an entirely new letter. In order to distinguish the two ciphers, we have referred to this second process as the _variant Beaufort_, or sometimes, more briefly, as “the variant.” There is some justification, also, for calling it the “Vigenère-Beaufort.” To see why, the student may turn back to his Vigenère tableau, and actually perform the encipherment, using only the two sides of this tableau in which the alphabets run from _A_ to _Z_. In applying the variant encipherment, in which key-letters are found first, he need find a given key-letter but once, then lay a ruler along the row (or column) indicated by that key-letter, and encipher at a single writing all plaintext letters which are going to have that particular key. But if, as previously recommended, he has familiarized himself with the use of the Vigenère tableau, he will see instantly that the operation which, in the variant Beaufort he is calling _encipherment_, is identical, in every particular, with the operation which, in Vigenère, he would have called _decipherment_, and that, in order to decipher the variant, he must perform the operation which, in Vigenère, is called encipherment. Neither of these operations provides a reciprocal substitution; instead, they are reciprocal to each other. Once it is seen that this is true, it becomes equally plain that the Saint-Cyr slide serves just as well for the variant as for the Vigenère. To make use of it in applying the variant encipherment, set key-letters below index-letter _A_, exactly as if making ready to encipher in Vigenère, but reverse the functions of the two alphabets; that is, find all plaintext letters in the lower one, and take their substitutes from the upper one. Figure 99 How to find the C-alphabet of each Beaufort TRUE BEAUFORT VARIANT BEAUFORT Key: C C C C C C C C Key: C C C C C C C C Plaintext: A B C D E F G H... Plaintext: A B C D E F G H... Cipher ALPHABET: C B A Z Y X W V... Cipher ALPHABET: Y Z A B C D E F... Now, consider the true Beaufort cipher: Here, plaintext letters are found first, and keys are found by tracing into the square, so that encipherment is more or less a letter-by-letter process, and hardly so convenient as in the other two ciphers. It is true that every ascending diagonal in the tableau is made up of only one key-letter, so that a ruler, laid diagonally across this tableau, will point out a whole line of _C_’s, or _O_’s, or _M_’s. But practically every one of these diagonals is broken into two portions, so that in attempting to encipher by one key-letter at a time, we find it rather confusing to make the necessary adjustments. Is there not, then, a more convenient method for applying the Beaufort? Every cipher of this family, remember, provides a certain number of individual simple substitution cipher-alphabets. For every key (whether it is a letter or a number) there is some kind of cipher alphabet showing a substitute for _A_, a substitute for _B_, a substitute for _C_, and so on. To isolate one of these cipher alphabets, and find out what it is like, we have merely to take some one key-letter (or some one key-number) and discover what these substitutes are, and what their order is; that is, we need merely _encipher the normal alphabet_, using this one key. This is true of every cipher of the multiple-alphabet type. The process can be seen in Fig. 99, where the _C_-alphabet (that is, the alphabet governed by key-letter _C_) is being isolated for each of the Beaufort ciphers. In the Beaufort proper, we find that the _C_-alphabet will begin with _C_ and come out in the order _C B A Z Y X_. . . . , which is merely the normal alphabet reversed. Should we investigate the _D_-alphabet, we should find that this begins at _D_ and comes out in the order _D C B A Z Y_. . . . , again the normal alphabet reversed; or, investigating the _E_-alphabet, we should find _E D C B A Z_. . . . , always the normal alphabet written backward, and always beginning with whatever letter is called the key. This being the case, it becomes quite evident that a slide is possible, and the formation of this slide is clearly indicated in the left-hand tabulation of the figure: Its upper alphabet must run in one direction and its lower alphabet in the other; if one of the two is made of double length, it becomes possible to place any one of the 26 key-letters in juxtaposition with index _A_, thus bringing into position any one of the 26 cipher-alphabets which are governed by these keys. Nor does it make a particle of difference which of the two _A_’s, the upper or the lower, is regarded as the index-letter; when _C_ is standing below _A_, then _A_ is also standing below _C_. We saw, in the tableau itself, that the true Beaufort encipherment gives reciprocal substitution. This, however, was not our first meeting with one of the Beaufort alphabets; in Chapter IX, we met the _Z_-alphabet. We saw there that whenever a cipher alphabet is merely the plaintext alphabet written backward, it makes no difference which of the two is called a cipher alphabet; we may see here that this fact is not altered by shifting one of the alphabets. Since a slide is possible, it follows that a disk is also possible. This particular cipher disk, on which one alphabet runs forward and the other backward, was used long ago in our own army, and is widely known in this country as “The United States Army Cipher Disk.” Most persons, apparently, prefer the slides, on which the letters are always right-side up, and the preparation of which does not involve the division of a circle into 26 equal arcs. Of those who prefer the disks, practically all will make the smaller disk _reversible_, with the normal alphabet on one side and the reversed alphabet on the other. Figure 100 A Pair of COMPLEMENTARY Alphabets: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A Z Y X W V U T S R Q P O N M L K J I H G F E D C B By doubling the length of one or the other of these two alphabets, we may use them to form a slide which will encipher and decipher the true BEAUFORT. Now, returning to our Fig. 99, and examining its right-hand tabulation: We find that, in isolating the _C_-alphabet of the variant Beaufort, we have merely reproduced the _Y_-alphabet of the Vigenère. Should we now isolate its _Y_-alphabet, we should find that we have obtained the _C_-alphabet of the Vigenère. Further investigation will show that the _D_-alphabet of one is the _X_-alphabet of the other, that the _E_-alphabet of one is the _W_-alphabet of the other; and so on. Only their _A_-alphabets and their _N_-alphabets are keyed alike. Thus we seem to have here a case of “reciprocal” key-letters. These particular pairs of corresponding letters, _B_ and _Z_, _C_ and _Y_, _D_ and _X_, and so on, are called _complements_, one letter of each pair being _complementary_ to the other. Since the letters _A_ and _N_ have no complements (or serve as their own complements), the normal alphabet will furnish only twelve such pairs, and these are shown complete in Fig. 100. In this same set-up, it can be seen that the _A_-alphabet of the Beaufort cipher is the complement of the normal alphabet. Thus, having provided ourselves with a Beaufort slide (or disk), we have always at hand a means for finding out the complements of letters. Once it is clearly understood that the chief difference between a Vigenère cryptogram and a variant cryptogram lies in the names of their respective cipher alphabets, it becomes evident that we might decrypt a variant, believing it to be a Vigenère, and have no trouble whatever in reading its message, though finding that it has an _incoherent key_. Vigenère keys, of course, can be incoherent; occasionally they are based in some way on numbers, following the Gronsfeld scheme. But usually, this is not true; the incoherency is only apparent, and a little investigation will discover what the trouble is. In the case just mentioned, the variant key-word COMET will come out in Vigenére as _Y M O W H_, or vice versa; all that is necessary, in order to discover the original key-word, is to set the Beaufort slide at the _A_-alphabet, and perform a bit of simple substitution. Another cause for the apparently incoherent key lies in the use of some other index-letter than the stationary _A_. Say, for instance, that the encipherer has used the key-word COMET, but has placed his key-letters beneath index _D_. The key recovered by the decryptor is _Z L J B Q_; to find the original key-word, he need merely “run it down the alphabet.” Figure 101 Applying a PROBABLE WORD to BEAUFORT (a) Cryptogram, TRUE BEAUFORT: K K Z B B I Z X T L Y W T Q Probable word.......... S C C R T T A R P L D Q O L I U E T V V C T R N F S Q N K P O Q Q X O M I A N L I F P Q . . . M I A N . I . L E I T E C S O Use the word SUPPLIES as a trial key, exactly as in Vigenère, but make use of the VARIANT method, and not tho TRUE BEAUFORT. *** *** (b) Cryptogram, VARIANT BEAUFORT: Q Q B Z Z S B D H P C E H K Probable word............. S Y Y J H H A J L P X K M P S U W H F F Y H J N V I K N Q P M K K D M O S A N P S V P . . . . O S . N . P . L W I H E Y S M This was deciphered as a Vigenère, and showed the repeating of a scrambled key: Y M O W H. Had it been deciphered with the BEAUFORT SLIDE, suggested in Figure 100, it would have reproduced the plaintext keyword, C O M E T. Of the ciphers we have seen, then, those three which are complete, that is, which employ a full 26 alphabets, are curiously interrelated to one another. In the matter of substitution (encipherment and decipherment), the Beaufort stands alone, in that it is reciprocal, while the other two ciphers are reciprocal to each other in this respect. But in the matter of keys, it is the Vigenère which stands alone, in that it can be deciphered indifferently by key-letter or message-letter, where this is not true of either Beaufort. _In this respect, these two ciphers are reciprocal_. To see this plainly, we may examine our three encipherments, each one showing a different cryptogram obtained from the plaintext fragment SEND SUPPLIES, using key COMET. The Vigenère version was seen in Fig. 90. If this be _deciphered with its message_, SEND SUPPLIES, the result is a repeating key-word COMET COMET CO. The other two cryptograms were those of Fig. 98. Here, the Beaufort cryptogram, beginning _K K Z B B_, if deciphered with the key COMET, gives the message-letters _S E N D S_. But when we attempt to decipher it using _S E N D S_ as our key, we obtain: _I U O C R_. It becomes necessary, in order to find out our key-letters, that we proceed as we did for Porta: Assuming that the slide is being used, place message _S_ beside cipher _K_, and find out what key-letter is standing beside the index _A_. Place _E_ and _K_ together, and find the next key, and so on. That is, change the position of the slide for every decipherment. In this same figure, the variant cryptogram begins _Q Q B Z Z_. If it be deciphered with the correct key-word COMET, we obtain the correct message-letters, _S E N D S_. But if we attempt to decipher it with a key _S E N D S_, we obtain the same series as in the other case: _I U O C R_. To decipher it as a variant, we must again proceed letter by letter. How, then, are we going to apply a probable word as we did with the Vigenère in Fig. 90? How are we going to decipher a whole row of letters, first as _S_, then as _U_, then as _P_, and so on? Must we do this letter by letter, shifting the slide for every letter on every row? And suppose it is a page of trigrams, where we wish to decipher every trigram on the page as _THE_? Is there no way in which we can decipher all first-letters as _T_, all second letters as _H_, and all third letters as _E_, with only three settings of a slide? The answer is simple. _Switch the slides_. We have said (and shown) that in this respect the two Beauforts are reciprocal. Where the cryptogram is true Beaufort, and you desire to use your probable word as a trial key, do this with your Saint-Cyr slide (used in reverse, that is, as if enciphering in Vigenère). If your cryptogram is variant Beaufort, use the Beaufort slide (or treat it as a Vigenère, and obtain the key later). Both cases can be looked at in Fig. 101. The cryptogram at (a) is our same Beaufort cryptogram; that at (b) is our same variant. In another chapter, we shall look a little more closely into this odd triangle of Vigenère-variant-Beaufort. Meanwhile, the interested student might like to investigate for himself a few of the curious angles: Would it be possible to prepare a tableau for the true Beaufort, and use it in exactly the manner described for Vigenère? Recalling the appearance of the Vigenère tableau (Fig. 85): Suppose we should add to this another vertical alphabet, this time on the right-hand side, causing this new alphabet to begin at _A_ and run backward, _A Z Y X_. . . . Could this new alphabet be made to serve any useful purpose? More than one? What about the reversible cipher-disk? Is there any way at all in which it would be possible to encipher and decipher Vigenère cryptograms with a Beaufort slide, or Beaufort cryptograms with a Vigenère slide? Could you make a cipher disk for the Porta? 110. By NEON. (Gronsfeld). J Q Q Y P I R S F Q Y J N E U R U V E F V W P E B Q F G T E M K U K G R W E T Z I D V I Q Q S Z I H K W M C E K B F J Q Q X T R F V R J K O A T E E N J U M S N G L P I B S O A S R Y S A X R U O J G W M V R U S V D Q Q R D P P K P L I C. 111. By B. NATURAL. (Gronsfeld). L N P L G S Y R U A I R I Q X R E N D I U U N H D Y M S U U O Q N S T I T U G L W R E R V B Z D U Q S I C T U Q B T F X J F E H J W N I K U N H A Y H I E P R G X K W M P U K U L F N G Q P R B X Z R E T E U U W T R X J F N H J Y O J U V S P N W O Z G S O Q C J N W K G E B X Z R I P U N X B N A W O - 112. By B. NATURAL. (Porta). I O U K J G F Y S M Q S X H W W D P K M M J E S P Y W Y L B X B V U D X T V L V O G Q K S L W W Q S E U D K W J I A M G W Z C W F O U I M M V Z F U Q K S O X D S E L E E P T I O T U L U L W W P K Q K S Z E U. 113. By KRIS KROST. (Beaufort. Probable word: AMERICA). N D L H T I E Y R K F M F H L C S Z Q A H B H T Y H A F P I V I D C S X P Z E X N K W Q R M S A H E Q X G R E H A U H G D S O O A G X U G D W G T I L S A P D V H A Q W E W Z M I M Y Y Q O B F E K C M M T F N E V H W Z Y B G P W V E H R Z V U O O N B K X F O Z J A Z I Q N Z T T O P R V I T. 114. By WHOSIT. (Variant Beaufort). K O A S Y B B S G P A R Y A T F R F D U L W H J A R G H S G U W D B C J R V M C U P S T Q W M B Y S I W Y I F H B A A F I A N Y H J L S B T J O C Z E E N N R U A S R U I E J N O E P S G C G W V U M E A K W R L Y H N S R G H B A H. 115. By PICCOLA. (Short Simple Substitution. - No keyword). O F T D A F F B E H Z H W G W F O M; M F W R J D E D N V F P Z K W F D Y F M Z Q K K Z T. CHAPTER XIV The Kasiski Method for Periodic Ciphers Prior to the 1860’s, the ciphers of the past two chapters had been regarded as entirely safe. A radical change of opinion took place in 1863, when Major F. W. Kasiski, a German cryptanalyst, was so indiscreet as to publish certain of his observations. The student will surely have noticed, among the examples of Chapters XII and XIII, the happening which is suggested in Fig. 102. Some sequence, usually a digram, is repeated in the plaintext, and happens to be enciphered more than once by exactly the same few key-letters; the result is a _repeated sequence in the cryptogram_. What he may have failed to notice is the _periodicity_ of such repeated sequences. In order that the same few key-letters be used again, _the key-word must have been repeated an exact number of times_, so that, in these cases of repeated cryptogram-sequences, the distance from first-letter to first-letter is _evenly divisible by the key-length_ — or period (in the figure, the distance from _V_ to _V_ is 10, which is twice the key-length, 5). This does not mean that all repeated sequences found in Vigenère cryptograms are periodic. Often, they are purely accidental; oftener still, they will be due to the repetition of alphabets in the key itself, especialiy if it is such a word as CORCORAN or DESDEMONA. But a distinct majority of them, according to Kasiski, are caused by periodicity; and if all of the repeated sequences found in a given cryptogram be examined to find what the separating interval is in each case, and if all of these intervals be factored, _the factor which predominates will betray the period of the cryptogram_. Figure 102 A common happening in all PERIODIC ciphers: Vigenère key: C O M E T C O M E T C O M E T C O M Plaintext: T H E R E I S A N O T H E R Q U E S REPEATED SEQUENCE: V V Q V . . . . . . V V Q V . . . . In order to have a look at the Kasiski method, we will consider the cryptogram shown in Fig. 103; and, to approximate a more troublesome case, we will assume that no repeated sequences can be found except those few which have been underscored in the figure. With the cryptogram-letters serially numbered, in the manner shown, the distance apart of any two of them is readily learned by subtraction. The digram _CH_ is found beginning at the 1st letter and again at the 46th letter; 46 minus 1 equals 45, their distance apart. Thus, if _CH_ is one of the periodic repetitions, the period could be 15, 9, 5, or even 3. The trigram _UBF_, 8th and 63d letters, shows an interval 55; here, the period could be 11 or 5. Notice that a period 5 has been indicated by both. Now let us look at Fig. 104, where the method of presentation is once more a debt to M. E. Ohaver. In this figure, the repeated sequences have been listed, and each one is accompanied by the two serial numbers of its two first letters, together with the interval which was obtained by subtraction. Ohaver’s process provides a column for each possible factor, beginning with 2 and carried as far as desired. Opposite each interval, its various possible factors may then be noted in their correct columns. In the average case, the correct period will be pointed out by _the column showing the largest number of entries_. But in this connection, it must be taken into consideration that _small_ factors 2 and 3, and even factors 4 and 5, are usually present in considerable numbers, partly as accidentals, but also because they are factors of the period itself; that is, if the period is 6, there will surely be factors 2 and 3 for every factor 6, and there will usually be a few extra appearances due to accidental repetition. Figure 103 5 10 15 20 25 30 C H G S L F A U B F X U P H S J D A G Y X M N Z U W W J P D 35 40 45 50 55 60 J S U P L G C G F K R N I M F C H K O A Q A V X O N N U I L 65 70 75 80 85 90 N S U B F N D V P K A I P L S N M Q O H M E U I L B L K Q W 95 100 105 110 115 120 N D V I Y X U I I A Q E U U Y J W C O K O E N M P W W J J J 125 130 135 140 145 150 Q I U O V C M W D O X F C O L F S K U L V B W U N R V G T B 155 160 165 170 B S Q N L U E P H A Q T Q X V A K Q O E Now, considering our tabulation, and ignoring the fact that short periods like 2 and 3 are seldom encountered, we find that factors 3 and 5 are present in equal numbers. Often, we are faced with exactly this problem. Here are two factors which have appeared in approximately equal numbers. Which one of these actually represents the period? Ohaver’s recommendations include these: Where two factors seem almost equally prominent, select the larger if it is a multiple of the smaller. If one factor is not a multiple of the other, try to select a period which is a multiple of both (as 15 here, includes both 3 and 5). He points out also that the factor which is the correct key-length will usually be accompanied, in the tabulation, by quite a number of its own multiples, growing gradually fewer and fewer as their size increases. In this respect, our factors 3 and 5 are both disappointing. If we consider factor 5, we find factors 10 and 15, but not growing fewer; instead the number increases. We find no factor 20, but we do find a factor 25; another increase. Or, if we consider factor 3, we find factors 6 and 9, but no factor 12, and then a sudden increase in the number of factors 15. This is a case in which the decryptor would play safe by selecting the period 15. Figure 104 Tabulation for Finding Period M.E.OHAVER Repeated Positions - POSSIBLE FACTORS of INTERVALS Sequence Intervals C H 46 - 1 = 45 3 5 9 15 U B F 63 - 8 = 55 5 11 U P 33 - 12 = 21 3 7 21 S U 62 - 32 = 30 2 3 5 6 10 15 P L 73 - 34 = 39 3 13 W W J 116 - 26 = 90 2 3 5 6 9 10 15 18 N D V 91 - 66 = 25 5 25 The factors found in the largest number of DIFFERENT intervals are 3 and 5. The student who cares to examine this matter more closely may do so by preparing for himself a less haphazard listing of the cryptogram’s repeated sequences. Perhaps the most satisfactory way of doing this is to begin by making a general frequency count. Then, in order to have the more reliable information at once, start the tabulations by examining those letters whose frequency is only 2; follow this with an examination of those having a frequency of 3, and so on. The theory is that letters of these frequencies are much more likely to belong to only one alphabet, while the letters of higher frequency have probably been enciphered in several different alphabets, so that their repeated sequences are not so sure to be periodic. For other cases in which there may be some doubt, the writer’s advice is to select large factors in preference to small factors. Or, if the decision must be made between two factors such as 6 and 7, where a period of 42 would be necessary in order to include both, simply select the handiest and give it a trial. With the longer cryptograms, as we shall see in a moment, an error in the choice is very speedily discovered; as to the shorter cryptograms, there is one rule which invariably holds good: _If you meet with any resistance at all_ in dealing with the kind of ciphers which were shown in the past two chapters, you have probably selected the wrong period. Figure 105 Individual Frequency Counts - PERIOD 5 Alphabet 1 Alphabet 2 Alphabet 3 Alphabet 4 Alphabet 5 A 11 11 1 111 B 11 1 11 1 C 111 1 11 D 111 1 1 E 1111 1 F 11 1 1 111 G 1 111 1 H 11 11 1 I 11 11 1111 J 111 11 1 1 K 1 111 111 L 1 1 11111 11 M 1 111 11 N 11111 11 11 1 1 O 1 11111 1 11 P 111 111 1 Q 1111 1111 1 R 11 S 1111 1 11 T 1 1 U 1 11 11111 11 111 1 V 1 1 111 11 W 11 111 11 1 X 1111 11 Y 111 Z 1 Often, however, where one clue is missing, there will be another present to take its place. Repeated _trigrams_ are less likely than repeated digrams to be accidental, and longer repeated sequences are still less likely to be so. In the present tabulation, we find that three of the repetitions are trigrams; in all three cases the period 5 is suggested, while only one suggests also a period 3. That is, if we use a period of 15, two of these trigrams will have to be considered accidental. If the period here is 5, then we are dealing with _five simple substitution alphabets_. These five alphabets have been used over and over again, always in a given rotation; therefore, if the cryptogram be rewritten into _five columns_ (it is already conveniently grouped), the letters in each column will belong to one same alphabet, and it becomes possible to _take a separate frequency count on each one of these five alphabets_. These individual frequency counts may be seen in Fig. 105. Originally, we had a length of 170 letters, and, if the student desires to take a frequency count on the complete cryptogram, he will find that he has no truly predominant letters which could represent some of the letters _E T A O N I R S H_. Instead, he has a series of frequencies which are all fairly close to 4% of the text (6 or 7), and which, should he rearrange them in decreasing order, would have somewhat the following appearance: 10-10-10-9-9-9-8-8-8-7-7-7-7. . . . . .3-2-2-1. He will probably find, also, that every letter of the alphabet has been used at least once, something which would be very rare indeed in any normal English text of 170 letters. But in these five individual frequency counts, each belonging to a separate alphabet, matters are different. Here, the alphabets represented have a length of only 34 letters each, and yet, in the third, fourth, and fifth alphabets, there is one predominant letter, which could represent _E_, or some other letter which has taken the place of _E_, while, in the first and second alphabets, there are some few letters distinctly more prominent than others. Also, each alphabet has shown some gaps in sequence, where letters of the class _J K Q X Z_, and possibly also some letters like _B P V W_, would surely be missing in a normal text of only 34 letters. A frequency count made on columns is not, of course, normal. We saw this in dealing with transpositions, when we considered vowel-distribution. Yet, as length increases, we find that the letters present in columns begin to approach more and more the proportions found in normal text; here, with only 34 letters, it would be possible, in any one of these frequency counts, to assign the letters to groups of high, moderate, and low frequencies. _Whenever our frequency counts do not have this general aspect, the period cannot be correct_. (There are, of course, the very short cryptograms, in which the actual frequencies are not apparent.) So far, we are dealing with any cipher whatever of the periodic type, and many of these ciphers do not make use of simple shifted alphabets, or even of alphabets which are in any way related to one another. Now let us consider the one case in which the alphabets are all “Caesars.” In this case, whether the cipher is Vigenère, Beaufort, or Porta, we have only to identify one letter in order to identify a whole alphabet. Suppose we examine, first, alphabet 5, in which the one outstanding letter, _L_, has appeared 7 times. Does this letter represent _e_? If _L_ of alphabet 5 represents _e_, then, counting backward (that is, upward), we find that the letter _a_ will have to be represented by _H_; this alphabet, then, will be the _H_-alphabet if the cipher is Vigenère. The letter _H_ has a frequency of only 1, which, in normal text, is not particularly satisfactory as the frequency of _a_, but this frequency count has not been taken from normal continuous text; suppose we examine the rest of the alphabet, and find out what the frequencies would be for other letters. Beginning at _H_, and calling letters in the order _a_, _b_, _c_, we find that this fifth alihabet, provided it is the _H_-alphabet, will contain: 3 _d_’s, 7 _e_’s, 2 _h_’s, 2 _l_’s, 2 _o_’s, 3 _r_’s, 3 _t_’s, and 3 _y_’s. That is, each letter present which shows a frequency greater than 1 will represent some plaintext original which, normally, is of some frequency, the only exception being _y_, which is a vowel. This is the best we can expect of any columnar frequency count made on only 34 letters; but more convincing still, and more reliable, is the fact that out of the entire group _j k q x z_ we find only _x_, represented once. Alphabet 5, then, is entirely acceptable as the _H_-alphabet of the Vigenère cipher. Let us see what we can find out about alphabet 3. Here, the strongly predominant letter is _U_. But when we attempt to identify this as _e_, we find that we should have to accept an alphabet containing 3 _q_’s, 2 _x_’s, and 3 _z_’s, all occurring in only thirty-odd letters of text. We meet with similar trouble when we attempt to identify _U_ as _t_, as _a_, as _o_, and so on. It is not until we try it as _s_ that we have good luck, finding only a series of blanks to represent the letters _b_, _j_, _k_, _q_, _v_, _w_, _x_, and _z_. And if _U_ represents _s_, this alphabet begins at _C_. Alphabet 3, then, is entirely acceptable as the _C_-alphabet of the Vigenère cipher, and we have two of the key-letters: * * _C_ * _H_. In alphabet 1, the leading letter, _N_, is not so strongly predominant, and yet, when we assume it as the substitute for _e_, we find that the rest of the count is satisfactory. Alphabet 1, then, is acceptable as the _J_-alphabet of the Vigenère cipher and we have three of the key-letters: _J_ * _C_ * _H_. In alphabet 2, we find no one leading letter, but the two most prominent frequencies are standing opposite _E_ and _S_, as if this count might represent the normal alphabet itself. The absence of _O_ and the presence of only one _T_ is hardly significant in a columnar count; but further examination shows an excess of _M_’s and _W_’s, and this is more disturbing. However, a single _K_ has appeared as the only representative of the group _J K Q X Z_; the low-frequency letters _B_ and _V_ have appeared but once each; and there is an absence of _Y_’s to counterbalance those which were too numerous in one of our other alphabets. So that a detailed examination, and the failure to identify this as any other alphabet, will lead to its tentative acceptance as the _A_-alphabet of the Vigenère cipher. (We can know definitely when we attempt to decipher with it.) With alphabet 2 accepted as the _A_-alphabet, we now have four of the key-letters: _J A C_ * _H_. We shall return in a moment to consider the one which is still missing; but according to those present, it does not look as if our key is going to develop into a recognizable word. Alphabets of the kind we saw in No. 2 can be much more satisfactorily identified by means of a _graph_. This graph, when the cipher is Vigenère, is no more than a picture of the normal frequency table. Ordinarily, it will be a strip of paper on which the normal alphabet has been written twice in succession, with a straight line standing at right angles to each letter, this line being long or short according to the normal frequency of its accompanying letter. A description of one such graph, suggested by L. H. Patty, will serve to explain them all: Assuming that the several frequency counts are standing in a vertical position, as we see them in Fig. 105, and that the work has been done on quadrille paper, the graph will also be prepared vertically, and the strip of paper will be quadrille paper with squares of the same size, so that the spacing, vertically, will be the same for graph and frequency counts. The graph, however, will be twice the length of the frequency counts, and will carry the normal alphabet written twice in succession (except that the final _Z_ can be omitted). The basis for frequencies can be 200, 100, or any other basis desired. If the basis is 200, each small square might represent a frequency of 5, so that a horizontal line placed beside _E_ (frequency 24), would have a length of nearly five of the small squares. Or, if the basis is 100, each small square might represent a frequency of 2, and the horizontal line placed beside _E_ (frequency 12), would have a length of six of the small squares. Or, if this same graph is being made on a typewriter, we might dispense with the horizontal lines and use a series of diagonals (or 1’s, or asterisks), after the manner of tally-marks, using whatever number of these is the actual frequency of the letter per 200, or per 100; this will give a good clear picture of the normal frequency count. It is understood that the upper and lower halves of the graph are to be prepared exactly alike, and that there is to be no skipping of extra spaces between them. Thus the graph, being twice the length of the frequency counts, and spaced to match them, can be moved up and down beside each one of these until some point is found at which the _pattern_ of the given frequency count bears some resemblance to a pattern found somewhere on the graph. If no such pattern can be found, the conclusion is that the frequency count was not made on one of the simple shifted alphabets; however, due allowance must be made, as in the case of our alphabet 2, for the difference in length and for the fact that frequency counts of this kind have been made on columns. Patty’s graph, so far, is representing only the shifted normal alphabet; that is, the cipher alphabets belonging to Vigenère, variant, and Gronsfeld ciphers. If its horizontal lines be made very heavy, and retraced on the opposite side of the strip, and if the letters be written on that side, opposite exactly the same horizontal lines as before, the reverse side of the strip will furnish another graph for identifying the reversed alphabets of the Beaufort cipher. Other graphs can be prepared for other kinds of alphabets. For instance, a graph suitable for examining a series of Porta frequency counts could be made in two halves, each of double length; the _A_-to-_M_ half would serve for comparison with the _N_-to-_Z_ halves of the frequency counts, and vice versa. Figure 106 Another Tabulation for Finding the Period EDWIN LINDQUIST Repeated Interval List of all PRIME Factors..... Sequence 2 3 5 7 11....(Etc.) J C V 24 111 1 C V 13 D D V 36 11 11 D S 12 11 1 S S 8 111 D T J 60 11 1 1 T J 48 1111 1 This was based on a cryptogram whose period was 12. The PRIME FACTOR 2 is obviously included twice, and the PRIME FACTOR 3 once. * * * The Vigenère cipher, and, in particular, the Kasiski method of solution, have given rise to much research among members of the American Cryptogram Association. We doubt that any of this research has ever resulted in any new or valuable discovery. Yet it is interesting in that it shows a body of amateurs arriving at devices which are fully as effective or convenient as those proposed by seasoned cryptanalysts. Carter’s “discovery,” for instance, which we saw in Fig. 90, was purely his own device; at that time, he had never heard of the “probable word method” proposed by Commandant Bazeries, one of the greatest of modern cryptanalysts. A great many of the first suggestions were directed at methods for making the trigram-search less tedious; these were largely duplications of a same idea, involving the use either of a tableau or of a slide; one example will be shown in the next chapter. The use of graphs, also, was a sort of simultaneous “invention.” As to Kasiski processes, while Ohaver’s tabulation had been published, it had been out of print and was not available for several years. The only information to be had was the fact that a period could be discovered by factoring intervals between repetitions, and Edwin Lindquist, finding this rather vague, devised for his own use the tabulation which is shown as Fig. 106. This tabulation was made from a cryptogram in which the period was 12. Lindquist, instead of preparing columns for all possible factors, prepared them only for _prime factors_, the repeated sequences and their separating intervals being listed in about the same way as in Ohaver’s tabulation. Now, taking one of the intervals, as 24: Tally in column 2, and the interval is reduced to 12. Tally again in column 2, and the interval is reduced to 6. Tally again in column 2, and the interval is reduced to 3, which is itself a prime factor. Tally a final time in column 3, and the interval 24 has been reduced to its prime factors. This process is almost entirely mental, and _very rapid_. Examining the results: Columns 2 and 3 are very full, indicating that prime factors 2 and 3 are both included in the period. But in column 3, the tallies are largely single, indicating that this factor is included only once in the period; while, in column 2, the tallies are largely in pairs, indicating that this factor is probably included twice in the period; had it been included three times, it would have shown up oftener in threes. Conclusion: The period is 2 x 2 x 3, which is 12. This tabulation will be found fully as convenient as Ohaver’s, and its results fully as accurate. Figure 107 The "SHIFT" Method for Identifying Alphabet 4 EDWIN LINDQUIST Letters apparently of the high-frequency class: I O P U Their possible originals................E T A O N I R S H Amount of SHIFT if I represents.. 4 15 8 20 21 0 17 16 1* " " " " O " .. 10 21 14 0 1* 6 23 22 7 " " " " P " .. 11 22 15 1* 2 7 24 23 8 " " " " U " .. 18 1* 20 6 7 12 3 2 13 A SHIFT of 1 (the B-alphabet) makes all four of these letters the substitutes for high-frequency originals. It almost certainly the shift which was made. Mr. Lindquist also developed his own method for identifying alphabets. This method, which, in theory, is _graphic_, is not particularly applicable to the kind of alphabets we have been considering; that is, it would not be needed when there is so much material. But for shorter examples, where alphabets contain only ten or fifteen letters each, it comes close to being that magical thing referred to by Lamb, a “mechanical crypt-solver.” This method can be examined in Fig. 107, where it is being applied to our so-far unidentified alphabet 4. An examination of this alphabet 4 (of Fig. 105) shows that it has four letters of more prominence than the rest: _I_, _O_, _P_, _U_. These letters, or most of them, should represent high-frequency originals; and our method consists in examining them collectively in order to find out what amount of “shift” must have taken place in order that some four of the letters _E T A O N I R S H_ would have resulted in these four particular substitutes. The word “shift” is best understood by picturing the movement of the lower alphabet on a Saint-Cyr slide. If the two _A_’s are together, this is the starting position, and the “amount of shift” is zero. If the _B_-alphabet be moved into position, we have a _shift of 1_; if the _C_-alphabet be moved into position, we have a _shift of 2_; and so on. These “shift-numbers,” 0 to 25, can be written below the letters of the sliding alphabet. Now, considering only one of our letters, _I_: If this is the substitute for _e_, the normal alphabet was shifted 4 positions; if it is the substitute for _t_, the amount of shift was 15; if it is the substitute for _a_, the amount of shift was 8; and so on through the rest of the nine letters belonging to the high-frequency group. Finally, having considered our letter _I_ as the substitute for all nine of these possibilities, we arrive at a _series of nine shift-numbers_: 4-15-8-20-21-0-17-16-1. And unless one of these is the correct shift, the cryptogram-letter I does not represent a high-frequency letter at all. In the figure, this examination has been made for all four of the letters _I_, _O_, _P_, and _U_, and opposite each of these we have the resulting series of nine shift-numbers. A comparison of the four series of numbers will show that _each one includes a shift of 1_. A shift of 1, then, that is, the _B_-alphabet, would have caused all four of our cryptogram-letters to become substitutes for high-frequency originals. This is almost certainly the shift which was made; but should the assumption prove incorrect, then a shift of 7 has appeared in three of the lines, and the _H_-alphabet would be the next choice. Lindquist’s method was found so effective for cases of scant material, that two members of the Association, M. R. Collins and Helen S. Pearson, decided, independently of each other, to set it up in permanent form, so as to avoid fresh computations for each new cryptogram. Figure 108 Tableau Showing SHIFTS for Each Letter of the Alphabet - (MORRIS R. COLLINS) For VIGENÈRE For BEAUFORT E T A O N I R S H E T A O N I R S H 22 7 0 12 13 18 9 8 19 A 4 19 0 14 13 8 17 18 7 23 8 1 13 14 19 10 9 20 B 5 20 1 15 14 9 18 19 8 24 9 2 14 15 20 11 10 21 C 6 21 2 16 15 10 19 20 9 25 10 3 15 16 21 12 11 22 D 7 22 3 17 16 11 20 21 10 0 11 4 16 17 22 13 12 23 E 8 23 4 18 17 12 21 22 11 1 12 5 17 18 23 14 13 24 F 9 24 5 19 18 13 22 23 12 2 13 6 18 19 24 15 14 25 G 10 25 6 20 19 14 23 24 13 3 14 7 19 20 25 16 15 0 H 11 0 7 21 20 15 24 25 14 4 15 8 20 21 0 17 16 1 I 12 1 8 22 21 16 25 0 15 5 16 9 21 22 1 18 17 2 J 13 2 9 23 22 17 0 1 16 6 17 10 22 23 2 19 18 3 K 14 3 10 24 23 18 1 2 17 7 18 11 23 24 3 20 19 4 L 15 4 11 25 24 19 2 3 18 8 19 12 24 25 4 21 20 5 M 16 5 12 0 25 20 3 4 19 9 20 13 25 0 5 22 21 6 N 17 6 13 1 0 21 4 5 20 10 21 14 0 1 6 23 22 7 O 18 7 14 2 1 22 5 6 21 11 22 15 1 2 7 24 23 8 P 19 8 15 3 2 23 6 7 22 12 23 16 2 3 8 25 24 9 Q 20 9 16 4 3 24 7 8 23 13 24 17 3 4 9 0 25 10 R 21 10 17 5 4 25 8 9 24 14 25 18 4 5 10 1 0 11 S 22 11 18 6 5 0 9 10 25 15 0 19 5 6 11 2 1 12 T 23 12 19 7 6 1 10 11 0 16 1 20 6 7 12 3 2 13 U 24 13 20 8 7 2 11 12 1 17 2 21 7 8 13 4 3 14 V 25 14 21 9 8 3 12 13 2 18 3 22 8 9 14 5 4 15 W 0 15 22 10 9 4 13 14 3 19 4 23 9 10 15 6 5 16 X 1 16 23 11 10 5 14 15 4 20 5 24 10 11 16 7 6 17 Y 2 17 24 12 11 6 15 16 5 21 6 25 11 12 17 8 7 18 Z 3 18 25 13 12 7 16 17 6 Collins’ device took the form of a tableau, as shown in Fig. 108. In this figure, the vertical alphabet running through the center is a list of possible cryptogram-letters. On the side marked “Vigenère,” the four lines of numbers standing beside the letters _I_, _O_, _P_, and _U_, are the same as those included in Fig. 107. It will be noticed that only the first line of numbers (opposite _A_) need be found from the slide; after that, each column is a series 0 to 25. The same is true with reference to the Beaufort shifts. These, incidentally, were computed on the assumption that the Beaufort keys, _A_, _B_, _C_, _D_. . . . . . . are passing in their normal alphabetical order beneath the stationary _A_ (as most of us prepare the Beaufort slide, this is backward). Fig. 109 shows a similar tableau prepared for the Porta shifts. The zero-position here is the _AB_-alphabet, a shift of 1 is the _CD_-alphabet, and so on. Collins, however, did not use the shift-numbers. _He increased these by 1_, using numbers 1 to 26, which represent the 26 positions of the slide, or, better, the serial positions in the normal alphabet of the 26 key-letters. Others who have since prepared similar tableaux have dispensed altogether with numbers, and have used the key-letters themselves. Doing this, the first row of the Vigenère portion will show the nine key-letters _W H A M N S J I T_, the second row will show key-letters, _X I B N O T K J U_, and so on. If the letters appearing on the slide have been numbered, one method is fully as convenient as the other, though in dealing with a plaintext key one would probably prefer the letters. In any case, where some four letters, such as our _I O P U_ of the foregoing alphabet, have been found more than once in a given frequency count, it is merely necessary to find these four letters one by one in the vertical alphabet and _copy_ their accompanying numbers. It is even possible, having these three tableaux, to decide whether the frequency counts taken from a periodic cryptogram represent the alphabets of the Vigenère, the Beaufort, or the Porta. Figure 109 Tableau Showing SHIFTS for PORTA E A I H T O N R S 9 0 5 6 N 6 1 0 4 5 A 10 1 6 7 O 5 0 12 3 4 B 11 2 7 8 P 4 12 11 2 3 C 12 3 8 9 Q 3 11 10 1 2 D 0 4 9 10 R 2 10 9 0 1 E 1 5 10 11 S 1 9 8 12 0 F 2 6 11 12 T 0 8 7 11 12 G 3 7 12 0 U 12 7 6 10 11 H 4 8 0 1 V 11 6 5 9 10 I 5 9 1 2 W 10 5 4 8 9 J 6 10 2 3 X 9 4 3 7 8 K 7 11 3 4 Y 8 3 2 6 7 L 8 12 4 5 Z 7 2 1 5 6 M Miss Pearson’s device took the form of _strips_, a set of 26 for each of the three ciphers. Fig. 110 shows the first five of her Vigenère set as she originally prepared them, using the “position-numbers,” which are all larger by 1 than those of the tableau. Aside from this, each strip represents one row from the Vigenère half of Collins’ tableau. But where Collins had arranged his numbers according to the frequencies of the nine possible originals (so that possibilities found on the left might have more significance than others found on the right), Miss Pearson arranged hers in straight numerical order, and spaced them in such a way that No. 1 is always in the first column, No. 2 is always in the second column, and so on. Had she used key-letters, all _A_’s would have been in the first column, all _B_’s in the second column, and so on. As to the use of these strips: Presuming that the four leading cryptogram-letters are the same as before, simply pick out the four strips which are headed by the letters _I_, _O_, _P_, and _U_, and set them together. If any of the numbers are duplicated, _you will find them standing in the same column_. These, remember, are the devices of amateurs, and both will be found very effective. It will be noticed that the basis is the finding of key-letters (or numbers) and not the identification of cipher alphabets. Now compare these devices with a method proposed by an expert, in which the basis is the identification of cipher alphabets, and not their keys: With this method, a tableau is prepared (which could be arranged like the one of Fig. 85) in which the only letters shown on any one line are the substitutes for the nine high-frequency letters. If, for instance, the tableau is intended for the Vigenère cipher, the top row will contain only the letters _A E H I N O R S T_, _and the other 17 positions will be left blank_. The second row will contain only the letters _B F I J O P S T U_, the third will contain only the letters _C G J K P Q T U V_, and so on. Or, if the tableau is intended for the Beaufort cipher, the top row will contain only the letters _A W T S N M J I H_, the second row only the letters _B X U T O N K J I_, and so on. Thus, after having taken a series of frequency counts, we may find out, in each of these frequency counts, which are its leading letters, then consult the prepared tableau to find out which of its alphabets will show these same leading letters. An added suggestion is as follows: Prepare the tableau, as described, using black ink. Then, using red ink, add to each alphabet the substitutes for _J K Q X Z_ (perhaps, also, for _B P V W_); that is, the substitutes for those letters which ought to be largely _absent_. This makes it much easier to decide between two alphabets in which the more frequent letters have made it seem that one is as likely as the other. It will be found that letters of low or moderate frequency are ordinarily as helpful in these ciphers as those of high-frequency; an instance has been pointed out in which those of the cryptogram can be more so: Where the question is one of deciding between two possible periods, a new tabulation can be made using only the sequences found in connection with those letters which are less frequent in the cryptogram than others, and thus not so sure to belong to more than one alphabet. Figure 110 Strips for Determining SHIFTS HELEN S. PEARSON SET FOR VIGENÈRE --------------------------------------------------------------------------------- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ A 1 _ _ _ _ _ _ 8 9 10 _ _ 13 14 _ _ _ _ 19 20 _ _ 23 _ _ _ ================================================================================= _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ B _ 2 _ _ _ _ _ _ 9 10 11 _ _ 14 15 _ _ _ _ 20 21 _ _ 24 _ _ ================================================================================= _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ C _ _ 3 _ _ _ _ _ _ 10 11 12 _ _ 15 16 _ _ _ _ 21 22 _ _ 25 _ ================================================================================= _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ D _ _ _ 4 _ _ _ _ _ _ 11 12 13 _ _ 16 17 _ _ _ _ 23 24 _ _ 26 ================================================================================= _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ E 1 _ _ _ 5 _ _ _ _ _ _ 12 13 14 _ _ 17 18 _ _ _ _ 24 25 _ _ --------------------------------------------------------------------------------- NOTE: The numbers here are POSITION-numbers, instead of SHIFT-numbers. A shift of zero is "position 1" of a slide. This is also the numerical, or serial, position of A in the normal alphabet. Most members of the American Cryptogram Association prefer to dispense with numbers, and use key-letters. We have seen, then, what can be done in place of the trigram-search in the case of those longer cryptograms. Having one of only 170 letters, we first found out its period, and then (presuming that we accepted the _B_-alphabet in the case of alphabet 4), found out all five of its key-letters _J A C B H_, and even the type of encipherment (obviously Gronsfeld), _without having deciphered a single letter of its message_. We are now in a position to go back and investigate any which are still unsolved. With Vigenère methods and principles thoroughly understood, the student is fully in possession of methods for dealing with any periodic cipher whatever _in which he knows what the cipher alphabets are_. All that remains, then, is to pick up a few loose ends, and observe a few variations from the strictly periodic encipherment, after which we may consider the case of the unknown cipher alphabets. 116. By NEMO. (A Vigenère? Or a snare and a delusion?) W L P C V M O G K E E I F M U R W W F H V M F F W E Y X A V U B I C Z O J M L C H V X Y F K S C U S X I L M G B Q I D B W I F G B I Q Z G Z H F J Y P M K I G V P T W Y K W Z H W M Z H W I F A P S D N W F H E D S C X A V O E B Y Y O K C O Y U I H U J L H U D X P P W V V H P F W Y L G F B V E J M A A G B P I E B A V U V Q L Z N L P W A J W. 117. By NEON. (U.S.Army Cipher Disk. Surely not an advertisement?) D J T X J M H L M K O M F D T F N E U I G D D N A A U S N S A C F G Y M Z Y A Q A N M W U W S R B R F J J Q S K A Y B A N B L T O J E R K S N W X A G T J L Z Y S T V A R B X L K N R L V D U U F O F A K Z L W Y T E E W. 118. By TITOGI. (What! Another Vigenère? Some collusion here!) D W P W Z T C G H H Z B B V W F B H I F W Q B L L J D Z R G U M M E S W B D W L J K X I F Y Z D G K Y I O I K D W P M F H C M S F Q G C E L J I I H W A M I W L J Z I W S W K V W E. 119. By THE ADMIRAL. (Vigenère). N S R V K D K S I W J W Y C E C E G K C E B D K N Q Y S J U L X Z O L X P S U V U T F B S O I N P C R R E U Y O N U F K H K Z D D O J P Q Z C K J I E N A F J D W B U S J U R C L C J C E P C O K T V F A F P Y X G K K Y Z V. 120. By THE ADMIRAL. (Beaufort). Z N J L N Y H C Z D A U D D Z I N H R C Z Y Z K H G B P E C L M L W Y R O I J Q D T L Q O Z H Q S N D V E S E P E J O Y L S Z O J U P G T K J F K C U W N S H G W F D T M G K K D W E H L Z R N S B G V E S R A U K K U M J Z M T K N K F Q L G K C U P Z U S D L W D E Z U B D Y F O D. 121. By DOR. (Another "Aristocrat." - Not hard. No keyword). A B C D E F G C H G I J A K G F D J F B L M E D M M I M G B A N F L C L O G J P N F D R F C L N. O G P I M S D A N T D L I F U. F C B G N B P J E G J F C L E F, K C G A I E D V B F. CHAPTER XV Miscellaneous Phases of Vigenère Decryptment When a Vigenère cryptogram is very short, its alphabets are no longer readily identified by their graphic appearance. But its period, in the majority of cases, can still be determined, and it still remains true that the identification of one letter identifies a whole alphabet. The example of Fig. 111 contains only 30 letters. With this cryptogram in the form shown at (a), we are still dependent upon the search for trigrams and short words, but the case is modified by the presence of a repeated trigram. Unless this repetition, _ZIL_, is accidental, it indicates a maximum period of 12, and the cryptogram is long enough to provide another interval 12, with another trigram, _EUK_, upon which any key-fragment brought out at _ZIL_ can be tested in order to see whether or not it will bring out another good sequence. When it finally does, the intermediate trigrams (those at intervals 6 or 4) can be tried, in the hope of finding a shorter period. Figure 111 (a) (b) Z I L T F R U I Y T J R Z I L 1 2 3 4 5 6 x x x Z I L T F R U I Y T J R K A R O I E A O A E U K L W K. Z I L K A R x O I E A O A E U K L W K But assuming a case in which we have no repeated sequences at all, we almost never meet with a Vigenère cryptogram in which there are no _repeated single letters belonging to a same cipher alphabet_. These repeated single letters can be tabulated with their separating intervals, _and these intervals factored in exactly the same way as intervals between repeated sequences_. The evidence, perhaps, will be less clear, and less reliable, than that obtained through repeated sequences; as with sequences, the less frequent letters will usually be more informative than those which are leaders. To illustrate, with our given example, the single letter _I_ has shown the interval 6 three times, the single letter _R_ has shown it twice, and the single letters _L_ and _Z_ have shown its multiple. In the average case, the period will not be so clearly evident as here; however, the example was not in any way manipulated in order to produce this evidence. Once the cryptogram of (a) can be rearranged as at (b), we no longer have before us the piecemeal decipherments and piecemeal tests which are necessary where a period is likely to be anything at all. Whatever key-fragments can be brought out at _ZIL_, or on another trigram, need be tested only on the three columns which contain the trigram. Even presuming that the evidence has been inconclusive between two or more periods, the cryptogram, necessarily a short one, can be written into each of these probable periods, and the two or more resulting blocks, standing side by side, can be considered more or less simultaneously. Here, with our period determined as 6, the columns of (b) are very short, and the number of trials and erasures should not be many. For this kind of case, however, many solvers have a preference for the purely mechanical method which is detailed in Fig. 112. _Sheet 1_ of this figure has been prepared from the first column of our cryptogram, which included the letters _Z U Z O E_. _Sheet 2_ has been prepared from the second column, which included the letters _I I I I U_; and _sheet 3_ has been prepared from the third column, which included the letters _L Y L E K_. In each case, the column of cryptogram letters, as it first stands, is also the _A_-decipherment. With each letter used as a point of beginning, a series of normal alphabets may be laid out, as in the figure, and the resulting 25 new columns on every sheet will show the other 25 possible decipherments. But if these decipherments have been caused to progress in the normal alphabetical direction, and if the cipher is Vigenère, the key-letters which produce these deciphered columns will have to run backward in the alphabet. These can be added at the tops or bottoms of their columns, and can, if desired, be written in red ink, or otherwise distinguished. Figure 112 Sheet No. 1 (For Column 1 of b, preceding figure) KEYS: a z y x w v u t s r q p o n m l k j i h g f e d c b Z A B C D E F G H I J K L M N O P Q R S T U V W X Y U V W X Y Z A B C D E F G H I J K L M N O P Q R S T Z A B C D E F G H I J K L M N O P Q R S T U V W X Y O P Q R S T U V W X Y Z A B C D E F G H I J K L M N E F G H I J K L M N O P Q R S T U V W X Y Z A B C D Sheet No. 2 (For Column 2 of b, preceding figure) KEYS: a z y x w v u t s r q p o n m l k j i h g f e d c b I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H U V W X Y Z A B C D E F G H I J K L M N O P Q R S T Sheet No. 3 (For Column 3 of b, preceding figure) KEYS: a z y x w v u t s r q p o n m l k j i h g f e d c b L M N O P Q R S T U V W X Y Z A B C D E F G H I J K Y Z A B C D E F G H I J K L M N O P Q R S T U V W X L M N O P Q R S T U V W X Y Z A B C D E F G H I J K E F G H I J K L M N O P Q R S T U V W X Y Z A B C D K L M N O P Q R S T U V W X Y Z A B C D E F G H I J Fig. 113 shows what modifications would be necessary if the sheets were being prepared for one of the Beauforts. For the variant Beaufort, the only difference lies in the fact that key-letters must progress in the same alphabetical direction as their decipherments. With the true Beaufort, however, the making of an _A_-decipherment does not mean a simple copying of cryptogram letters, as in the other two ciphers; this _A_-decipherment must first be made; after that, the series of normal alphabets can be extended as before, and the key-letters will progress in the same alphabetical direction as their deciphered columns. Now, assuming that these sheets have actually been prepared, say on quadrille paper, the various columns of decipherment may be examined, and a check-mark placed beside each column in which the series of letters appears to represent a “good” decipherment. With longer columns, those may be checked which contain the largest percentages of letters _E T A O N I R S H_, without too many of the letters _J K Q X Z_; with shorter columns, perhaps those are “best” in which any repeated letters are chiefly vowels, it being remembered that when the cryptogram contains repeated sequences, as well as repeated single letters, the possible identity of these repeated digrams or trigrams must also be taken into consideration. With all of the apparently good columns checked for attention, _sheet 1_ may be creased vertically so as to place any desired column on the extreme right, and this column may then be laid directly against any desired column of _sheet 2_ for an observation of the resulting digrams. If these appear to be satisfactory, then _sheet 2_ may also be creased vertically, and the series of apparently good digrams may be laid directly against any desired column of _sheet 3_ for an observation of the resulting trigrams. And so on, if desired, to a possible _sheet 4_, or _5_, or _6_, though, as a rule, the first three sheets will be found sufficient. While the method, as indicated, is intended to be mechanical, that is, largely visual, it would be possible, where uncertainty exists between two given combinations, to copy these and subject them to a digram test. But this should not be necessary in a case where key-letters, as well as their deciphered columns, are expected to set up good combinations in order to form a plaintext key-word. Figure 113 If column Z U Z O E were VARIANT: If column Z U Z O E were BEAUFORT: KEYS: a b c d e f g ..... KEYS: a b c d e f g ..... Z A B C D E F ..... Z - B C D E F G H ..... U V W X Y Z A ..... U - G H I J K L M ..... Z A B C D E F ..... Z - B C D E F G H ..... O P Q R S T U ..... O - M N O P Q R S ..... E F G H I J K ..... E - W X Y Z A B C ..... An interesting version of this method, as shown by Admiral Elliott Snow, included the following variations: To begin with, in extending the alphabets, the decryptor omits altogether the letters _J K Q X Z_, and perhaps one or two others of extremely low frequency, simply leaving the blank spaces which indicate their alphabetical positions. This makes the work more rapid, and, in addition, the presence of these blank spaces in any column of decipherment, advertises at once that the column is probably not a very good one. But Admiral Snow’s columns were not columns; they were _rows_. A given series of letters: as _Z U Z O E_ of our foregoing _sheet 1_, is laid out horizontally, and its decipherments are extended vertically. The spacing on each row is arranged to correspond with the period; that is, the letters _Z U Z O E_, instead of being continuous, are spaced six columns apart if the period is 6, and their decipherments, of course, are spaced in the same way. The sheets may now be creased horizontally between rows, and one sheet placed against another in such a way that the resulting digrams are all standing on diagonals, but have appeared at exactly their cryptogram distance apart. The student should experiment with both arrangements and decide which one he likes. It has been pointed out by C. A. Castle, another of our members, that the foregoing method will find its chief application, not on a single cryptogram, but as applied to a case which, so far, we have not considered in connection with the substitution ciphers: One in which the decryptor has in his possession five or six cryptograms, all very brief, but all enciphered with the same key. Here, we have the common practical case, to be handled in somewhat the same way as the last of our transposition examples; the cryptograms can be written one below another, thus forming a series of columns in which every column has been enciphered with the same cipher alphabet. If this case happens to involve a comparatively short period, it is possible to take intervals between repeated sequences found in two different cryptograms, using the intervals indicated by the number of columns between the first letter of one sequence and the first letter of its repetition. Castle’s example, however, was not based on a short key, but upon an extremely long one, and his five or six messages were merely fragments, each one of which was _known to be the beginning of an English sentence_. In the English language, about half of all initial letters used are found in the group _T A O S H I_ and more than another one-fourth are found in the group _W C B P F D M_. Thus, having a series of beginnings in which the first column will include only initial letters, the number of truly acceptable decipherments on any _sheet 1_ will usually be quite limited. In addition, with vowels known to have a fondness for second and third positions in words, there should be little difficulty in selecting decipherments from _sheets 2_ and _3_. * * * While we have described this device as having been written out on sheets of paper, there are many persons who prefer to have at hand a series of cardboard strips which will set up the “sheets” mechanically. If each of the strips carries the normal alphabet written twice in succession, it is possible to adjust five of the strips so as to place the letters _Z U Z O E_ one below another in the form of a column and automatically set up the other 25 columns. The strips can be loose, or may form part of a slide. Slides, in fact, may be used for many purposes, and are well worth preparing for any kind of cipher which the decryptor expects to encounter a great many times. The members of the American Cryptogram Association, who solve a great many Vigenères, Beauforts, and so on, as a matter of recreation, have practically all “invented” slides (or tableaux) which will, to some extent, do away with the irksome task of carrying out a trigram-search. These are prepared in various ways, and variously used, though the principle for all is about the same as that indicated in Fig. 114. They are usually referred to as _decrypting slides_, and the single stationary alphabet, sometimes a list of key-letters and sometimes not, will be called “the decrypting alphabet.” C. Stanley Lamb, who is by no means the only “inventor” of the device illustrated, has this in several different forms, according to the purpose for which he intends to use it. Notice that the card, as we have placed it, shows the stationary single alphabet running contrary to the others, for use on the Vigenère cipher, and that this card need merely be reversed in order to have a single stationary alphabet running parallel to the others, for use on the two Beauforts. As to the sliding double alphabets, there may be as many of these as the operator feels like setting up; if the device is being used to assist in the trigram search, three will be needed. Figure 114 One Form of "DECRYPTING SLIDE" C. STANLEY LAMB For VIGENÈRE, the "Decrypting Alphabet" runs backward: | a z y x w v u t s r q p o n m l k j i h g f e d c b | ( A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H ... ( A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E ... ( A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I ... | z y x w v u t s r q p o n m l k j i h g f e d c b a | As this is shown, it has been set for the decipherment of a trigram H D G, and every possible decipherment can be read from the slide without changing its present adjustment. The entire list of frequent trigrams can be used as trial keys: Trial Keys: T H E A N D T H A E N T I O N T I O F O R (Etc.) H D G Fragment of True Key: O W C H Q D O W G D Q N Z P T O V S C P P (Etc.) To explain its use: The decryptor here is dealing with a sheet of trigrams. Each one of these trigrams is to be deciphered as _THE_, _AND_, _THA_, and so on, following the list of normally frequent trigrams, and the resulting key-fragments are to be written down for comparison with one another, in the hope that some two or more will be duplicates, or will contain overlapping letters. The first of these cipher trigrams is _HDG_. These three cipher-letters, found on the three slides, are placed, in order, below _A_. Now, on the first of the slides, every possible decipherment for _H_ is standing opposite its key-letter, found in the “decrypting alphabet”; on the second slide, every possible decipherment for _D_ is standing opposite the the proper key-letter; and on the third slide, every possible decipherment for G. To know, then, what key-letters will be deciphered by _THE_, find _T_ on the first slide and note key-letter _O_; find _H_ on the second slide and note key-letter _W_; find _E_ on the third slide and note key-letter _C_; the complete key-fragment is _OWC_. This may be written down, Then, _without changing the adjustment of the device_: For _AND_, key-fragment _HQD_, and so on down the list. Where the cipher is Vigenère, the text-letters may be found in the “decrypting alphabet” and their keys on the slides, without changing results. But with either of the Beauforts, a key is specifically a key and not a text-letter. Thus, when the card is reversed, and the same process applied for one of the Beauforts, the student must be careful as to where he finds his letters _T H E_ in each of the two ciphers. This peculiar relationship of Vigenère-variant-Beaufort is not hard to untangle if all three of the encipherments are considered to be purely mathematical operations of addition and subtraction. If we must add two numbers, as 5 and 10, it makes no difference whether we call it the sum of 5 plus 10 or the sum of 10 plus 5. But where we must perform a subtraction, there are two separate cases. In straight Vigenère encipherment, the process is _addition_, in which text-letters may be considered to have the values 1 to 26 (their serial positions in the normal alphabet), while key-letters may be considered to have the values 0 to 25 (the amount of alphabetical shift represented by each one). Thus, the encipherment of _J_ by _P_ (10 plus 15) will not result differently from the encipherment of _P_ by _J_ (16 plus 9); in both cases, we obtain _Y_, alphabetical value 25. In variant Beaufort, we have one of the _subtractions_: _Message minus key_, with the occasional necessity for “borrowing” 26 in order to make a subtraction possible. Thus, _J_ enciphered by _P_ (10 minus 15) does not give the same result as _P_ enciphered by _J_ (16 minus 9). In the first case (after borrowing 26), we obtain _U_, or 21, while in the other case we obtain _G_, or 7. In the true Beaufort, we have the other _subtraction_: _Key minus message_. This time, we value the key-letters 1 to 26, and the text-letters 0 to 25. Thus, _J_ enciphered by _P_ (9 taken from 16) results in _G_, or 7, while _P_ enciphered by _J_ (16 taken from 9) results in _U_, or 21. Our results, then, are exactly the reverse of those obtained in the other subtraction. If these mathematical comparisons be understood, or simply kept in mind, it will always be possible, whenever a decryptment process has been explained in connection with only one of the encipherments, to examine its “mathematical” details and learn from these in just what respects it would have to be modified in order that it may be applied with equal success to the other two encipherments. There is another interesting possibility which may have escaped the student’s notice. If he will turn back to Fig. 98, in which the same message, using the same key, was enciphered in both of the Beauforts, one encipherment coming out as _K K Z B B I Z_. . . . . and the other as _Q Q B Z Z S B_. . . . . , he will notice that these two cryptograms are complementary from beginning to end. If we saw any reason for doing so, we might convert either one of the Beaufort cryptograms to the other form, and apply its probable word with its own slide. * * * Now, having seen the great vulnerability of the famous “indecipherable cipher,” suppose we glance at some of the devices which have been used for doing away with its periodicity. One such device, that of _auto-encipherment_ (_autokey_, _autoclave_), has been given its own separate chapter (the one immediately following), not because of its value as a cipher, but because of the very interesting decryptment problem it presents. A second device, the details of which may be examined in Fig. 115, consists in the use of a very long nonrepeating key, the popular name for which is “running key.” The value of such a key, for practical purposes, we have already seen; it was a key of this kind which Castle had used on his five or six cryptogram-beginnings. In single examples, however, it gives more trouble. Unless there is a probable word, its message and key must be dug out bit by bit, and if the encipherment is Vigenère, any recovered fragments can belong equally well to the message or to the key. However, with its key known to be purely plaintext, no fragments need be considered except those which are usable combinations, and since the “running key cipher” makes a fascinating puzzle, a specimen has been included among the practice cryptograms. The original of this, apparently, was the Hermann cipher. This employed a slide which was identical with the Saint-Cyr slide except that the stationary alphabet carried an extra cell (position) marked “index” to be used instead of the Saint-Cyr index _A_. As the writer saw this, the index-cell was standing just ahead of _A_, so that the resulting encipherment would have been that of a Saint-Cyr slide on which the letter _Z_ was serving as index-letter. Figure 115 Vigenère with a "Running Key" Key-letters: M Y C O U N T R Y T I S ... Plaintext letters: S E N D S U P P L I E S ... Cryptogram: E C P R M H I G J B M K ... Of other devices aimed at destroying periodicity, quite a few have been based in some way on _key-interruption_. A key-word is selected, as INDEPENDENCE, but the encipherer breaks off before completely using his rotation, so that the completed cryptogram will be enciphered very irregularly by such a key as INDEP INDEPEND I IN INDEPENDENC IND INDEPEN. . . . . . Sometimes this is found as a word-spacing device, the key beginning over with each new word, though naturally not with word-separations showing in the cryptograms. But in the average case, the key-interruption takes place at the discretion of the encipherer; sometimes the agreement with his correspondent allows him to break off as he pleases without any sort of signal, leaving the decipherer to discover the interruptions through the fact that he can no longer decipher; again, he may use an indicator, as _J_. In the latter case, he must encipher any _J_’s which may happen to occur in his message by using the _I_-substitute; then, whenever he decides to break the key, he first enciphers a _J_. Thus, whenever the decipherer brings out the letter _J_, he knows that his key is to begin over with the encipherment of the next letter. It will be noticed that in all of these cases, the decipherer will have to do his work one letter at a time. There is another of these devices which apparently destroys periodicity and is aimed at throwing all of this onerous work upon the shoulders of the decryptor without at the same time punishing the legitimate decipherer. This consists in shortening the two alphabets of the key, so as to leave some extra letter, which will never be used in any cryptogram. Encipherment, in this case, is accomplished in the regular way, producing a periodic cryptogram. The extra letter may then be inserted at points throughout the cryptogram wherever it can do the most harm. The decipherer, knowing that this one letter is always null, need merely erase it. But if this device is to be really useful, the omitted letter must not be always the same, and this trouble can be overcome as follows: In the shortening of the plaintext alphabet, we omit always the unwanted letter, as _J_. But in shortening the cipher alphabet, we omit first one letter and then another, according to agreement, and insert _J_ in its place. The decipherer, knowing what letter is null, erases it; but the decryptor, granting that he knows what the process is, will still have to experiment with various letters before he learns which one (or more) of the 26 is the null of the moment. Shortened alphabets are not uncommon in ordinary use. We meet with 25-letter alphabets in European examples, the letter _W_ having been omitted for telegraphic reasons. This case can usually be distinguished from the one which precedes by the fact that the letter _W_ is never found in a frequency count, and it presents only the minor trouble that the ordinary 26-letter slide will not make the decipherments, so that it becomes necessary to prepare another on which the letter _W_ is not present. This case can, of course, be simulated by making use of a 24-letter alphabet. These devices, taken as a whole, have added little, if at all, to the security of the straight-alphabet ciphers, though, for the most part, they have succeeded admirably in rendering their ciphers totally unfit for general purposes. Considered as single examples, they can, of course, prove troublesome. We trust that this will not be the case with some one or two of the appended practice cryptograms, but if so, we recommend that the student postpone them for a later investigation. Concerning example No. 122, he may find that some of the material presented in Chapter XVI applies also to the “running key” encipherment; with others, a trigram-search may assist in developing the interrupted key-word; and in one case, a clever decryptor should find a way for applying his Kasiski method. 122. By SABIO. (Vigenère with Running Key. SENT, AGENT, STOP, IMPREGNATED). A R U N N I N G K E Y S O Q M A V Q X K L U E R S Z S S R F A H A I V X W E T N K Z Q N V R A G W V E T F W N L K A T A I B S Z U H P E X U B W W A S P N F F C. (These are a trifle tedious, but not inhuman). • • • • • •• •• •• 123. By NEON. (Porta, with key-interruption. Plenty of trigrams!) A P V K W T P K P V Y G Q P G A K J Z W J N I X J U Q O U K P V W F U R F X N K C K P R K Q K W F U R G J O V Z O K G X J V Q S W T F K D L L Y Q L X Z E F L Y U J V Z C X G Q L J M T X W K K P V T V B Y K X P F J Z Q X B V C O V V H X Z K J Z U Y. 124. By WHOSIT. (Beaufort, with key-interruption. THEY, WHEN, IN, ON, UP, etc). M X Y F U H P M J B C X O C K A L Q E D B Q A E P R B Z L G L W M J B Z Z C S A A L A O E K K C W L L J B P H U W B L F Q O R B Z L A O E M A L O K F P V H Y U Y H Y J L X O L X Z. 125. By B. Natural. (Gronsfeld, with key-interruption). S O W H Z G H O C V V W L F F F X O F H H X Q S I H S O Y P P H K T Q H Z F Y J Q G Q H O B X V X O F L R J L F W E A E F H O G G V O F E T Y M U X O F T H S N F B U A O B W H V C V V H V A O F Q M A G V N H S S C F U X O F V H E L O A O J O E C V V E Y F A V S N I P L E O U P W T A G P Q K E T. 126. By TRYIT. (Gronsfeld, with interruptors. MY, TO, THE, OF, IS, BE, WHICH). R H X G A P A S R E C Z T R T W Z A J Z S G Q A Z M T P E A U X G K Y Z F W Z S G Q Y O E Y F C T P W B G K O D P W N D X Z A W F O W H T Z B M O H K Q P K V K S Q N D J Z S L Z X L C R T T N H S H W. 127. By B. NATURAL. (Vigenère. One letter reserved as interruptor. Look out!) P N B Y C A N D V N P N F Y Z G V N W E J N S I T T T Z B L N O S L N X R N I L Z H N H M D X D X B Z N B I K W Z H N D J N B M D T N O I K N E I I H T W Q M F A T N P Q U N T J W D C X N G I C X P Z B L N O S L N O I J N O S L G N H S C K T Q D N X W N R I I I L M J T R N U M D T. CHAPTER XVI Auto-Encipherment The term _autokey_ (_autoclave_; “the autokey cipher”), as commonly used, refers to the kind of encipherment shown in Fig. 116, in which a message becomes its own key for applying some one of the multiple-alphabet ciphers — usually the Vigenère. It will be noticed from the figure that the auto-encipherment must be “primed” with a conventional key; and whenever the words _key-length_, _period_, and so on, are used in connection with auto-enciphered cryptograms, their actual reference is to the short initial key. A more accurate term would seem to be _group-length_. But that a term is needed for referring to something akin to the period of the ordinary Vigenère cryptogram can be seen when we consider the mechanics of decipherment: Figure 116 Vigenère Autokey: C O M E T/S E N D S U P P L I E S T O M O R L E Y S Plaintext: S E N D S U P P L I E S T O M O R L E Y S S T A T I CRYPTOGRAM: U S Z H L M T C O A Y H I Z U S J E S K G J E E R A Our present initial key, COMET, _key-length 5_, serves to decipher only one _group_ of that length. The five key-letters obtained from this first decipherment will serve to decipher only one more _group_; from this, another five key-letters are obtained, and will decipher a third _group_, and so on. But our _group-length_, sometimes referred to as “period,” includes five individual series of letters, any one of which can be enciphered and deciphered independently of the rest. That is, beginning with _C_, or _O_, or _M_, or _E_, or _T_, and taking each fifth letter, it is possible to proceed straight through to the end, enciphering or deciphering only this one series, or “column.” It will be noticed from the foregoing that the decipherer gets the short end of the bargain. The encipherer knows in advance what the key is, and, to some extent, can apply one cipher alphabet at a time; the decipherer knows only the key to the first group; the rest he must ferret out for himself. There is, however, a second form of autokey encipherment in which the respective difficulties of encipherer and decipherer would be reversed. This form of auto-encipherment, which can be seen in Fig. 117, makes use of a preliminary key, as in the regular form, but follows this with the enciphered text instead of with the plaintext. Such an encipherment results, occasionally, from the mechanical construction of a cipher machine, and in this case, where the 26 cipher alphabets are in mixed order, and unknown to the decryptor, may present an interesting decryptment problem. But where the cipher is Vigenère (or any other in which the decryptor possesses the full set of cipher alphabets), it can hardly be argued that there is any great problem about a cryptogram which carries its key in full view. We will confine ourselves, then, to the usual form of autokey, as first explained, beginning our studies with a brief glance at the two common practical cases, that of accumulated cryptograms, and that of probable words. Procedure, in the former case, is self-evident. Possessing several cryptograms all initiated with the same preliminary key, we may write their beginnings one below another to form columns, and the first few of these columns will constitute an ordinary case of Vigenère in which every message is known to be the beginning of a sentence. With beginnings discovered, a little industry accomplishes the rest. The case of probable words, on the other hand, presents some interesting possibilities inherent in the auto-encipherment itself. When the probable word is short (or if a search is to be made for normally frequent trigrams), the task of bringing out and testing the possible key-fragments is made much less onerous by the fact of the purely plaintext key. Being sure of an abundance of excellent sequences, we need consider none but the very best of the deciphered fragments; and for any one considered, the trials need be made only within a very short range of the spot at which it was found. All of this work may be done directly on the cryptogram. A correct sequence, correctly applied, can be followed out in both directions, and will yield, in full, several of the “columns,” and several consecutive letters of the initial key. But if it so happens that the probable word is longer than the initial key, _its first few letters must become the keys for enciphering its last few_. Consider, for instance, the word SIMPLICITY, which has a length of ten letters. If the preliminary key contains only five letters, then, beginning at -_ICITY_, the keys _SIMPL_- will begin to encipher, causing a certain long cryptogram-sequence which, for Vigenère, will always be _A K U I J_. If the preliminary key has six letters, the same word causes a sequence _U Q F N_ when the cipher is Vigenère; if it has seven letters, the cryptogram-sequence will be _A B K_; and even an eight-letter key brings out one certain digram, _L G_. Thus, knowing what the cipher is, and having at our disposal any comparatively long probable words, we may write out these sequences _in advance_ and be ready to look for them in the cryptograms. In addition to whatever words we consider probable, it is obvious that any other long word may encipher itself in the same way, and, if it is one important to the subject matter, is likely to be repeated, causing the cryptogram to show a _long repeated sequence_. Thus, if we find a long repeated sequence in a cryptogram, we are able to try this as a common suffix, _TION_, _MENT_, _ENCE_, _ABLE_, etc., in the expectation of bringing out some common prefix, _CON_, _PRE_, etc. Figure 117 Key: C O M E T/ U S Z H L O H O S T ..... S E N D S U P P L I E S T O M ..... U S Z H L O H O S T ..... Note that the cryptogram itself is the key, except that the first five letters are missing. To decrypt, With any alphabet, need merely find where to begin using it! More fascinating, by far, than its practical aspects, however, are the possibilities presented by the autokeyed cryptogram for analytical attack. The devices immediately to follow are described by General Givierge in his _Cours de cryptographie_, and are credited by him to Commandant Bassières. First, it is possible to discover the length of the short preliminary key, or, at any rate, to confine this to certain definite probabilities. This key, as we have seen, governs a definite group-length, or “period.” If this group-length, say, is 5, then, barring the first and final groups, every plaintext letter will be enciphered by the letter standing five positions to its left, and will, in its own turn, serve to encipher the one standing five positions to its right. Since all plaintexts are filled with repeated letters, roughly half of them separated by even intervals, it stands to reason that there will be many occasions on which the letter standing five positions to the left and the one standing five positions to the right will be the same letter. That is, we must often find the encipherment pattern of Fig. 118. Some one letter, as _S_, is repeated at an interval of exactly twice the group-length, with some other letter, as _R_, standing at exactly the group-length interval from both of the _S_’s. The first _S_ enciphers _R_, and _R_ enciphers the second _S_. Or, if the repeated letter is _T_ and the intermediate one is _L_, then _T_ enciphers _L_, and _L_ afterward enciphers _T_. Where the cipher is Vigenère, the result, in the cryptogram, is _a repeated letter standing at_ _exactly the group-length interval_. If the cipher is one of the Beauforts, the same pattern produces _a pair of complementary letters separated by exactly the group-length interval_. Figure 118 S . . . . R T . . . . L S . . . . R . . . . S T . . . . L . . . . T J . . . . J E . . . . E Now, in order to consider the value of this observation, let us examine the cryptogram of Fig. 119, an autokeyed Vigenère, which, for convenience, is presented in groups of the correct length, 7. According to Bassières, should we inspect this cryptogram for repeated single letters, noting, in each case, the interval of separation, the correct group-length, 7, will be present among those intervals which are noted oftenest, and, in many cases, will be the one which predominates. For making such an examination, perhaps the simplest plan would be that of listing the possible group-lengths at the tops of a series of columns, beginning with group-length 1 and carrying them as far as desired. The counts could then be made by placing a tally mark in the proper column for each time that a given interval is noted. The results of this examination, as compared with the Kasiski examination for a period, may be studied in Fig. 120. At (a), where the leading intervals of our cryptogram have been listed with their frequencies, it is noticeable that the correct group-length, 7, is not represented by the predominating interval or even by the one which is second in frequency; it is merely present among the five leaders. But we find other cryptograms, not necessarily of great length, in which some one letter, as _V_, will be repeated five or six times in succession at exactly the group-length interval, and its evidence amply confirmed in other repetitions. Then, as at (b), we may find some fairly good clue, leading us to give the first trial to the correct group-length; and again we are left, clueless, to try out five or six different group-lengths before striking the correct one. Results, then, are variable, and the only certainty, at any rate in a short cryptogram, is that of being able to limit the group-length to a given few. With the group-length determined, or with one selected for trial, we may take our choice of two processes. Figure 119 L C N D M E E L C N O Y G T B G X V N D G S S H W A W J Q E V L H O W Y I J W L E X A P V E C L B H D Q E K U W W G R H X J F B D Y P I P K Q D W A R G U W R L G N I Q S L V L E S P H E U T X B O N D H V X D C O U D S J T F J N U Q N Q L A A I L M Z U X I E W O B Y I W E H P D Q * * * _Process 1_ (_Bassières_). With group-length 7, as we have seen, our cryptogram includes seven independent series, or “columns,” of letters. By beginning at the 1st letter, and taking the 1st, 8th, 15th, 22d, etc., letters, we may decipher _series 1_ independently of the others; or, by beginning at the 2d letter, and taking the 2d, 9th, 16th, etc., letters, we may decipher _series 2_; and so with the other five series. Many persons, before doing this, will rewrite this cryptogram into seven _columns_, which permits that the decipherment of a series be done straight down its column, and for that reason the word “column” is sometimes used to describe what we have called here a “series.” In order to understand the first of the Bassières processes, we need consider only _series 1_, it being understood that whatever applies to any one of the seven series applies equally well to the other six. Figure 120 (a) (b) Interval 8, found 8 times Possible Reason for L C N " 16, " 8 " " 4, " 6 " T H E o r e m/G E T t i.. " 5, " 6 " G E T t i n g T H E b a.. " 7, " 6 " Z L Y . . . . Z L Y . . Now, considering Fig. 121: If the unknown first key-letter was _A_, then the first plaintext letter, found by deciphering with key _A_, was _L_, and this became the key for enciphering the eighth letter. If the key which enciphered the eighth letter was _L_, then the eighth letter, found by deciphering with key _L_, was _A_, and this became the key for enciphering the fifteenth letter. Following out this decipherment to the end of _series 1_, we find that the plaintext letters must have been _L A B R Z Z B_, etc., as given in full in the figure. A glance at the complete series will show that this decipherment is not a particularly good one. If another decipherment be carried out, on the hypothesis that the original first key-letter was _B_, we obtain the series _K B A S Y A A_, etc., which starts out fairly well, but which, when completed, will contain two _K_’s, one _Z_, two _B_’s, and one _P_. If a third decipherment be carried out, on the hypothesis that the original first key-letter was _C_, we obtain the series _J C Z T X B Z_, etc., which is a poor decipherment from the beginning. A trial and error method might consist in making these decipherments one at a time directly on the cryptogram, erasing one when it is obviously poor, and trying to add the next series whenever one proves acceptable. Figure 121 Keys: A L A B L C N D M E K L C N O Y G T B G X V N D G S S H W A W J...... Plaintext: L A B R Series 1, (Key A): L A B R Z Z B G Q L F R B G H H C Y Z J. The Bassières process, however, consists in setting up the entire 26 possible decipherments as these are shown in Fig. 122. In this figure, the original cryptogram-letters of _series 1_ are standing in a column at the extreme left. The 26 possible decipherments are also standing in the form of columns, each decipherment headed by the key with which it was initiated. If the group-length 7 is correct, then one of these 26 columns shows the original plaintext letters. Now let us examine, not the columns, but the rows, of this tableau, and find out just how troublesome it is going to be to prepare tableaux of the same kind for _series 2_, _series 3_, and possibly others. The key-letters, across the top, constitute a normal alphabet, and below this each row contains the 26 decipherments for some one letter of _series 1_. On the odd-numbered rows, the decipherments for the odd-numbered letters are alphabetically arranged, but progressing in a direction contrary to that of their keys, as if these odd letters represented Vigenère encipherment. On the even-numbered rows, the decipherments for the even-numbered letters are also alphabetically arranged, but are progressing parallel to their keys, as if these even-numbered letters might represent variant Beaufort encipherment. Evidently, then, the _A_-decipherment is the only one which must actually be carried out; afterward, the preparation of the tableau is a matter of extending alphabets. With similar tableaux prepared for the remaining six series, we have seven sheets, and on each one of these there is one column showing the correct decipherment of the series, headed by the correct key-letter. Thus, our solution is to be the mechanical one of the preceding chapter. On each one of the tableaux, the apparently “good” decipherments may be checked for attention; the sheets may be creased between columns, and the “good” decipherments of one tableau may be placed directly in contact with those of another. Figure 122 SERIES No. 1, Prepared as a Tableau. (Corresponds to SHEET No. 1 of Figure 112). THE CIPHER The 26 Decipherments, with Keys LETTERS A B C D E F G H I J K L M N O P Q R S T U V W X Y Z (Keys) L L K J I H G F E D C B A Z Y X W V U T S R Q P O N M ← L A B C D E F G H I J K L M N O P Q R S T U V W X Y Z → B B A Z Y X W V U T S R Q P O N M L K J I H G F E D C ← S R S T U V W X Y Z A B C D E F G H I J K L M N O P Q → Q Z Y X W V U T S R Q P O N M L K J I H G F E D C B A Y Z A B C D E F G H I J K L M N O P Q R S T U V W X Y A B A Z Y X W V U T S R Q P O N M L K J I H G F E D C H G H I J K L M N O P Q R S T U V W X Y Z A B C D E F W Q P O N M L K J I H G F E D C B A Z Y X W V U T S R B L M N O P Q R S T U V W X Y Z A B C D E F G H I J K Q F E D C B A Z Y X W V U T S R Q P O N M L K J I H G W R S T U V W X Y Z A B C D E F G H I J K L M N O P Q S B A Z Y X W V U T S R Q P O N M L K J I H G F E D C H G H I J K L M N O P Q R S T U V W X Y Z A B C D E F N H G F E D C B A Z Y X W V U T S R Q P O N M L K J I O H I J K L M N O P Q R S T U V W X Y Z A B C D E F G J C B A Z Y X W V U T S R Q P O N M L K J I H G F E D A Y Z A B C D E F G H I J K L M N O P Q R S T U V W X X Z Y X W V U T S R Q P O N M L K J I H G F E D C B A I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I * * * _Process 2_ (_Bassières_). Fig. 123 shows the second of the Bassières processes. With 7 decided upon as the group-length, we make up a _trial key_ having the right number of _A_’s, and decipher the cryptogram. The new cryptogram, produced in this way, is _periodic_, and its period, for Vigenère, will be twice the group-length, in the present case 14. In Fig. 124, where this new cryptogram has been repeated, written into its period, it is possible to check its periodicity: It has two repeated sequences, _C J B_ and _W G_, at suitable intervals, and while these are very few, their evidence is amply supported by the fact of repeated single letters in every column. When the periodicity is not confirmed in this way, it can be assumed that the chosen group-length was not correct. The make-up of this new cryptogram is not hard to understand if it is noticed that what we have done is to carry out simultaneously the seven _A_-decipherments of seven tableaux like that of Fig. 122. We saw there that the odd-numbered letters of a series react as Vigenère encipherment and the even-numbered letters as variant Beaufort. With seven _A_-decipherments made at once, the same will apply to odd-numbered and even-numbered _groups_. Thus, our new cryptogram has seven columns enciphered in Vigenère and another seven enciphered in variant Beaufort. The original seven-letter initial key-word will decipher both sets of columns; for the first seven, it must be applied in the Vigenère manner, and, for the other seven, in the variant Beaufort manner. Figure 123 a a a a a a a L C N D M E K A A A L M C J B G X K B B X R M K M Z V M L C N D M E K L C N O Y G T B G X V N D G S S H W A W J Q E V L H O W L C N D M E K A A A L M C J B G X K B B X R M K M Z V M Z S L Z I T K Z S L Z I T K Z Q Y X D L N B Z X H Z A O G E T X L U I Q C Y K M P X Y I J W L E X A P V E C L B H D Q E K U W W G R H X J F B D Y P I P K Z Q Y X D L N B Z X H Z A O G E T X L U I Q C Y K M P X L B A F W A N L B A F W A N F C W V V G H R P P L S C J B W G A M Q G G I O T L L I Q D W A R G U W R L G N I Q S L V L E S P H E U T X B O N D H V X D C F C W V V G H R P P L S C J B W G A M Q G G I O T L L I H V T C M S U H V T C M S U H Z K Q X B L C O K A Q P A Y M Y L W K U Z W G L S R E O U D S J T F J N U Q N Q L A A I L M Z U X I E W O B Y I W E H P D Q H Z K Q X B L C O K A Q P A Y M Y L W K U Z W G L S R E J A Y W X M M New Cryptogram: L C N D M E K A A A L M C J - B G X K B B X...........(Etc.) As to why this encipherment reduces to alternate Vigenère and variant Beaufort groups, this is best understood by resorting once more to the “mathematical” aspects of the Vigenère cipher. In a previous discussion, we have said that Vigenère encipherment consists in the “addition” of key to message, and that variant Beaufort encipherment (which, in Vigenère, would be _decipherment_), consists in the “subtraction” of key from message. In the beginning, our plaintext is a series of groups, as _A_, _B_, _C_, _D_, _E_, etc. and the first encipherment operation consists in the _addition_ of a key, as _X_, but only to the first group, _A_. To encipher group _B_, we add _A_; to encipher group _C_, we add _B_, and so on, so that when the auto-encipherment is complete, we have a cryptogram in which the groups are made up as follows: _1st_: _2d_: _3d_: _4th_: _5th_: _A plus X_ _B plus A_ _C plus B_ _D plus C_ _E plus D_. . . . . . (etc.) Figure 124 The New Cryptogram from Figure 123 L C N D M E K A A A L M C J B G X K B B X R M K M Z V M Z S L Z I T K Z Q Y X D L N B Z X H Z A O G E T X L U I Q C Y K M P X L B A F W A N F C W V V G H R P P L S C J B W G A M Q G G I O T L L I H V T C M S U H Z K Q X B L C O K A Q P A Y M Y L W K U Z W G L S R E J A Y W X M M 1 2 3 4 5 6 7 1 2 3 4 5 6 7 (Vigenère) (Variant Beaufort) Now, remembering what the mathematical valves were for key-letters, the trial key, made up entirely of _A_’s, is made up entirely of _zeros_. When we subtract zero from the first group, we leave it unchanged, that is, the first cryptogram group is still _A plus X_ (plaintext _plus key_, or Vigenère). When we subtract _A plus X_ from the second group, this cancels the _A_ of both, and leaves _B minus X_ (plaintext _minus_ _key_, or variant). When we subtract this from the third group, we cancel the two _B_’s, leaving _C plus X_, again Vigenère. When we subtract this from the fourth group, we cancel the two _C_’s, leaving _D minus X_, again variant Beaufort. And so to the end. Always we come out with the original plaintext group plus or minus _X_, the key. Those groups which are _plus X_ are Vigenère, and those which are _minus X_ are variant. And _X_, in all, is the same: the original preliminary key. A comparison of the same kind applied to the two Beauforts (or a few trials made on actual groups, if the student is not mathematically disposed) will show whether or not the auto-enciphered Beauforts can also be reduced to periodic form, and, if so, what their period is likely to be. In the case of the true Beaufort, it may be necessary to straighten out a quirk as to the application of the _trial key_. Figure 125 Tables of High-Frequency Co-Efficients PHILLIP D. HURST VIGENÈRE (Cipher Letters) A B C D E F G H I J K L M N O P Q R S T U V W X Y Z E a e h i n o r s t T h i n o r s t a e K A a e h i n o r s t e O n o r s t a e h i y N n o r s t a e h i s I s t a e h i n o r S i n o r s t a e h H t a e h i n o r s R n o r s t a e h i 6 4 1 - 4 4 4 4 4 2 3 4 3 2 3 2 1 4 4 2 2 6 4 2 2 4 BEAUFORT (Cipher Letters) True Beaufort: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z ...VARIANT... A Z Y X W V U T S R Q P O N M L K J I H G F E D C B E e a t s r o n i h T t s r o n i h e a K A a t s r o n i h e e O o n i h e a t s r y N n i h e a t s r o s I i h e a t s r o n S s r o n i h e a t H h e a t s r o n i R r o n i h e a t s 9 4 1 2 4 3 3 3 2 3 3 3 3 4 3 3 3 3 2 3 3 3 3 2 1 4 PORTA (Cipher letters) A B C D E F G H I J K L M N O P Q R S T U V W X Y Z E r s t n o a e h i T n o r s t e h i a K A n o r s t a e h i e O n o r s t h i a e y N t n o r s h i a e s I r s t n o a e h i S n o r s t e h i a H r s t n o a e h i R n o r s t h i a e 3 3 3 2 4 4 3 2 3 4 6 5 3 4 2 3 4 4 - 2 3 3 3 3 3 2 * * * While the foregoing methods are intensely interesting as an example of what can be learned by analyzing the structure of a cipher, most members of the American Cryptogram Association, in practical work, prefer methods of their own which are quicker in giving results. These methods, for the most part, have subordinated other considerations to certain original observations concerning the use of the purely plaintext key. Where message and key, as in the case of the autokey and “running key” encipherment, are each made up of normal text, with both members including the normal 70% of high-frequency letters, it becomes inevitable that high-frequency letters in the key and high-frequency letters in the message will be paired again and again as the co-efficients of cryptogram-letters, so that cryptograms enciphered with this kind of key must contain a great many letters caused by this kind of co-incidence. For convenience in making use of this fact, each member has his own ideas. Phillip D. Hurst, for instance, prepared a set of tables of about the kind shown in Fig. 125, one table for each multiple-alphabet cipher with which he expected to deal. As these are shown, the alphabet across the top of any table is a list of possible cryptogram-letters, each cryptogram-letter heading its own column; and each column contains only those letters which are themselves members of the high-frequency group _E T A O N I R S H_, and which, if enciphered by another letter from the same group, would result in the cryptogram-letter standing at the top of the column. The key, in each case, can be found at the left. Hurst says that he always attacks a cryptogram at the _second letter_, on the theory that this particular letter is likely to have been a frequent one in both the message and the key. He then attempts to follow out _series 2_, or, if the group-length has not previously been determined, to find this series. To explain, without going into too much detail, the second letter in our foregoing autokeyed Vigenère was _C_. A glance at the table for Vigenère shows that this letter can result from only one pair of high-frequency co-efficients, _O_ enciphered by _O_. Hurst will make his first trial on _series 2_, beginning with initial key-letter _O_, and come out with the correct decipherment at his very first attempt! With other letters, as _V_ or _A_, it might be necessary to make as many as six trials, but, as we have seen, it is hardly ever necessary to carry a trial very far in order to see that the decipherment is going to be a poor one. The second letter, of course, will not necessarily give results; but the cryptogram, remember, is filled with these vulnerable letters, and a decipherment may be started with any letter whatever and carried out in both directions. Figure 126 Where the KEY is a Segment of Ordinary PLAINTEXT: Estimated Rank of the Cryptogram Letters and Their Frequencies Per 10,000 Figured by C. Stanley Lamb From Table of Ohaver. VIGENÈRE V A I S ERL WHB XGM FOZ K N T P U J Y C Q D 344 314 304 296 (Intermediate) 150 112 84 84 84 72 72 64 49 -- BEAUFORT & VARIANT A N E W O M Z BQK JRT HVF GUDX P L S I Y C 480 262 246 246 196 196 191 (Intermediate) 121 121 104 104 57 57 PORTA K N L E RMF TWP UYQ XGC AVI BJZ D H O S 329 300 282 275 (Intermediate) 132 113 97 -- Another method, originated by C. Stanley Lamb, differs from Hurst’s chiefly in that his observations were made from _digrams_ and not from single letters. Originally, Lamb had been collaborating with Admiral Snow in establishing frequency counts for various kinds of ciphers, so that when the system was unknown, it would be possible to tell one from another. Fig. 126, for instance, gives a rough estimate as to what the rank and frequency should be for each letter in the kind of cipher we have under consideration. Finding a reasonably long cryptogram in which the letters _D_ and _Q_ have ranked among the last, with letters _V_, _A_, _I_, and _S_ ranking among the first, we have a fairly good reason for suspecting that the encipherment was accomplished with a very long Vigenère plaintext key. Figure 127 (a) Preparation of the mixed alphabet............ C U L P E • • R A B D F G H I J K M N O Q S T V W X Y Z C A K W U B M X L D N Y P F O Z E G Q H S I T R J V 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 (b) ENCIPHERMENT - Auxiliary Key X, or 8: Plaintext: S E N D S U P P L I E S T O M O R FIRST Substitution: 21 17 11 10 21 5 13 13 9 22 17 21 23 15 7 15 24 AUTOKEY (Addition): 8 21 17 11 10 21 5 13 13 9 22 17 21 23 15 7 15 C R Y P T O G R A M... 29-38-28-21-31-26-18-26-22-31-39-38-44-38-22-22-39- ════════ ══════════════ L E Y T O M O P R O W S T O P 9 17 12 23 15 7 15 24 24 15 4 21 23 15 13 24 9 17 12 23 15 7 15 24 24 15 4 21 23 15 33-26-29-35-38-22-22-39-48-39-19-25-44-38-28. ══════════════ ════════ xxxxxxxxxxx xxxxx (c) Detail of DECIPHERENT: Cryptogram Numbers: 29 38 28 21 31 26 18 26 ... AUTOKEY (Subtraction): 8 21 17 11 10 21 5 13 ... PRIMARY CRYPTOGRAM...... 21 17 11 10 21 5 13 13 ... Re-Substitution......... S E N D S U P P ... (d) Vigenère Autokey - What Happens to REPEATED SEQUENCES with a ONE-LETTER KEY: Key... X/ T H E M O N T H E X T Text... T H E M O N T H E X T E A L A L But for short cryptograms, Lamb did not find these characteristic frequency counts half so convincing as the presence in a cryptogram of certain _digrams_, which appeared to be characteristic for each cipher, since he was always able to find from 7 to 10 of them in each 100 letters. By making use of the high-frequency digrams (_th_, _he_, _er_, _in_, _an_, and so on), he then established lists of cipher digrams which were very characteristic indeed for each type of encipherment. Thus, in attacking an autokey, it is possible to make a good beginning with such a digram as _VV_ (_er_-_re_) or _XK_ (_th_-_ed_), if the cipher is Vigenère, and work in both directions. “_Key-Length 1_.” — Many writers are inclined to make a special case of the autokey in which the “priming” is done with a single letter, not that this actually constitutes a different cipher, but because of the decryptment curiosities which can be brought to light in connection with it. For instance: Having a cryptogram fragment . . . . . . ._W S Y Q L A H T G B_. . . . . known to be Vigenère autokey, initiated with a single letter, can you find instantly the trigrams _SAY_ and _HAT_? Would you have any reason for trying the word _WAS_? Of the many interesting observations which have come the writer’s way with reference to the one-letter initial key, only one has seemed to present the germ of an additional decryptment method. This observation was one made by Ohaver in connection with a cipher in which the substitutes were numbers. The cipher itself can be examined in Fig. 127. The first step, (a), consists in the preparation of a simple substitution key in which the plaintext alphabet is in mixed order and the cipher alphabet is made up of the numbers 1 to 26. The encipherment, shown at (b), involves two steps. First, there must be a simple substitution, using the key of (a), and this results in a _primary cryptogram_. Afterward, this primary cryptogram, preceded by an initial key-number, is _added to itself_. In the discussion to follow, our objective will be that of _recovering the primary cryptogram_ (and not the plaintext, which would have to be found later by simple substitution methods). Decipherment, indicated at (c), consists in reversing the two steps of the encipherment: A series of subtractions restores the primary cryptogram, and is followed by the resubstitution of letters. At (d) we have a Vigenère fragment for comparison. The essential fact to be noticed in (d) is the behavior of repeated sequences when the group-length is 1. Any repeated sequence in the plaintext continues to show a repetition in the cryptogram which is shorter by one letter than the original. Even the repeated digrams will give repeated single letters. Figure 128 A TRIAL-Decipherment (M. E. OHAVER) The Cryptogram: 29 38 28 21 31 26 18 26 22 31 39 38 44 38 22 22 39 9 20 18 10 11 20 6 12 14 8 23 16 22 22 16 6 16 20 18 10 11 20 6 12 14 8 23 16 22 22 16 6 16 23 ════════ 33 26 29 35 38 22 22 39 48 39 19 25 44 38 28 23 10 16 13 22 16 6 16 23 25 14 5 20 24 14 1O 16 13 22 16 6 16 23 25 14 5 20 24 14 14 ════════ Now, putting aside the fact of the mixed plaintext alphabet (since we do not intend to recover the letters) we have here a cipher which, to all intents and purposes, is the Vigenère autokey initiated with a single letter. In place of the letters _A_ to _Z_ we have numbers 1 to 26, and the encipherment is a series of additions. In the corresponding Vigenère case, the group-length 1 will usually show up plainly in the number of doubled letters — “letters repeated at interval 1.” And with the group-length determined as 1, it is possible to begin with some given initial key, as _A_, and either reproduce the plaintext or convert the autokeyed cryptogram to a periodic one in which the period is 2 (twice the group-length). Considering the analogy between the two cases, it should be possible to do the same thing here. That is, it should be possible to take the autokeyed cryptogram of (b), initiate its decipherment with some number chosen between 1 and 26, and either reproduce the primary cryptogram or convert the autokeyed cryptogram to a periodic one in which the alternate numbers will belong to two cipher alphabets. Where this reduction has been carried out in Fig. 128, the initial decipherment was made with key 9 in order to avoid a discussion of negative numbers. Also, the fact of numbers will usually limit the range of the trial keys: here, the first number, 29, was not enciphered by adding any number smaller than 3. Now, looking at Fig. 129, let us compare the new cryptogram of Fig. 128 with the primary cryptogram of Fig. 127(b), and see whether or not it has the expected formation. Between the two cryptograms (the supposedly periodic one obtained from the trial decipherment and the one we hope to recover), there is a constant numerical difference in the pairs of corresponding substitutes, and this difference, throughout, is alternately plus and minus. Further comparisons can be made, if the student so desires, by initiating other partial decipherments with trial-keys 10, 11, 12, etc. Always, the constant numerical difference persists, and always it is alternately plus and minus. Moreover, for every time that the initial key-number increases in size, there is a corresponding decrease in all numbers occupying the odd serial positions and a corresponding increase in all numbers occupying the even positions. Figure 129 Comparison of TRIAL DECIPHERMENT with TRUE DECIPHERMENT True decipherment - (See Figure 127): 21 17 11 10 21 5 13 13 9 22... Trial decipherment of Figure 128: 20 18 10 11 20 6 12 14 8 23... CONSTANT DIFFERENCE: 1 -1 1 -1 1 -1 1 -1 1 -1 We have, then, a periodic cryptogram whose period is 2, and two cipher alphabets, consisting of numbers, in which the only difference is one of size. But these substitutes, unlike those of the Vigenère, will not be placed in normal alphabetical order; to complete the solution by one of the general methods, it may become necessary to take a number of frequency counts. For instance, considering the first of the two Bassières processes, it would be possible to set up the same tableau (Fig. 122), causing numbers to run alternately backward and forward (and beginning again at 1 whenever the number 26 is reached). In this way, one of the columns would contain the primary cryptogram, and a frequency count taken on the numbers of that column should resemble a simple substitution frequency count. Considering the second of the Bassières processes, the autokeyed cryptogram is already reduced to a period of 2; the subsequent solution of the periodic cryptogram belongs to the general case of the next chapter; that is, a case in which the cipher alphabets are in mixed order but parallel. But we have, here, a special method, and a short-cut. The only difference between our two cipher alphabets is a matter of size in all corresponding substitutes. If we can find out what this numerical difference is, we have only to increase or decrease the size of the numbers in one of the cipher alphabets and bring it to the level of the other. Our short-cut, as pointed out by Ohaver, lies in repeated sequences (or even repeated single letters) in the autokeyed cryptogram. A glance back at the plaintext of the foregoing example will show that two repetitions were pointed out: _STO_ and _TOMOR_, and that these were still present in the primary cryptogram as 21-23-15 and 23-15-7-15-24. In the autokeyed version, they were still repeated sequences, but shorter in length: 44-38 and 38-22-22-39. Had we initiated our trial decipherment with the correct number, 8, these two repetitions would, of course, have worked back to their original length. But where this trial decipherment was made with a different initial key-number (Fig. 128) we find that only one of the sequences, _TOMOR_, has done this; the other, _STO_, has disappeared. The explanation for this has been summed up in Fig. 130. One sequence was repeated at interval 8, which is _even_. When the autokeyed cryptogram is converted to one having period 2, any interval which is divisible by 2 will contain a certain number of periods; thus, any repeated sequence at interval 8, will appear in the periodic cryptogram as one of the ordinary periodic repetitions. The other sequence, _STO_, was repeated at interval 17, which is _odd_, and thus cannot show up as a repetition in any cryptogram whose period is 2. It is this repeated sequence found at the odd interval which is to give us our short-cut. We have only two cipher alphabets, each one having a substitute for _S_, a substitute for _T_, and a substitute for _O_. When the repetition occurs at the odd interval, we obtain _both_ substitutes for _S_, _both_ substitutes for _T_, and _both_ substitutes for _O_. By subtracting one sequence from the other, we may learn the numerical difference between the two cipher alphabets. Notice that the difference is _constant_, is _alternately plus and minus_, and is _divisible by 2_. (One alphabet is larger than the original, and the other is smaller by the same amount.) Our special method, then, for a cryptogram known to have been enciphered in this way, is as follows: First, underscore all repeated sequences which occur at odd intervals, or, in their absence, the repeated single letters. Those which are long will almost surely represent repetitions in the plaintext. Then, selecting a suitable number, make a trial decipherment and examine the resulting sequences. If, by any chance, those repetitions found at the odd intervals have worked back to longer repeated sequences, then the trial key and the original initial key must have been the same. If not, try subtracting one result from the other. If both have represented the same plaintext sequence, the result of the subtraction will be a constant difference, alternately plus and minus, and divisible by 2. To restore the primary cryptogram, split this uniform difference, adding half of it to the numbers of one alphabet, and subtracting half of it from the numbers of the other alphabet. This, as mentioned in the beginning, will leave a simple substitution cryptogram still to be investigated. Figure 130 Respective Behavior of the Cryptogram's Two Repeated Sequences Sequence 38-22-22-39 Sequence 44-38 Repeated at interval 8 Repeated at interval 17 Trial Decipherments: 1st occurrence: 22-16- 6-16-23 1st occurrence: 22-22-16 2d occurrence: 22-16- 6-16-23 2d occurrence: 20-24-14 2 -2 2 (This interval was EVEN) (This interval was ODD) Our explanation, perhaps, has been a little rapid, but the student who has read carefully will be able to discover the “germ” originally referred to, and to make his own laboratory tests. Also, there may be an interesting answer to the following question: When the cipher is one of the Beauforts (using letters), and the auto-encipherment is initiated with a single letter, does a trial decipherment, initiated with some other single letter, result in a period of 2? 128. By ELIA, JR. (Variant, Autokeyed). O O U J V J M K N C B U Q L P F U L A S A Z F T G M P B V A Y V S Q J L F A W S P C H A E I U N R S M F V W S S O O H M E B E A M K F A A X R H K Z R J Q A O I A V M E I B T O P D J G P R J N F R X T I I G X F K D H X A F T H J Q H L A R K T G D L P S B M V Y E E V A O A C S M U V U W C V C T S K S M W L O N P A O O H M W W P Y P O H I L G A Z Q B Q U Z B Q P K M B O V K W J H P J A G D C H X G W Q B K O G Y A K S I W N W E X Q N U S U C V O E Y H Y J J C B T B V J Q M N S P A R V P X O A G T A V L V C Z B D I X N F M W U E Z L N N N W B M O X G T C P K. 129. By ELIA, JR. (Beaufort, Autokeyed). O A N C Q R O Q N Y Z G K P L V G P A I A B V H U O L Z F A C F M A V Z J H T I L L X V B C Z M M T O W Z W A O Q V P M M Q D L Q K O H K F G O B T L R A U X Y T Y S F N O C Y G R P M U U H T H E W P O O S R G R Z Z S L Y G K I A N K M M T O W Z W A O Q V A B E U X W T C T J I O G L P H T E F U F B R X M U Z V L D B P K N S Y A Q B I V M O H P V L G Z Y F C C W C O M C A W N A A A E V A W M P E B Q X O D O V P X A T E M A J A T P M J E A Z Z M D S B B N A A A F G L I D N X A M K H K P D B B P Q Y. 130. By ELIA, JR. (St. Cyr, Autokeyed). T B F N Q X E F D G F W E A F X S Q U N I G A H E U N B B J L O B Q P H F A K A S N X G B P E E J W W L Z J O M L L A P R V Y T N M X H Y V O S E S Q V O A Q M O G V P A J K P Y I U Z F Q G Y J Y T L D F E L Q Z L W Y Y U Y Z N E P P F W B R W M E E F R W X J W E P R V Y B U M P Z Z M T S B U K K B A L K Z I L Q A L Z K K F S X Z U S T G J T H A R G S B X I W V L Z B Z M P I K Y I U R H R V W C V A U F V L W F Q Z U D I G F W H T Z M S F B K T Z U T R K I V F Z X W L C A U J P A N V S E O Z U X G I X D S X M G Q E L Q T V B L E I D I A L L A I N O E N L V J I O I S W Q T D E C T M. CHAPTER XVII Some Periodic Number-Ciphers The use of numbers in a periodic cipher does not, in itself, create a problem essentially different from that of the letter-ciphers. Numbers may, in themselves, cause weakness; we saw such a case in the last of our autokey examples, where a complete disarrangement in their order did nothing to conceal their size. But oftener than not, the weakness lies in the construction of the cipher or in the manner of its application, and while this is fully as true of letter ciphers, the numbers, for some reason, appear to be more inviting for certain kinds of misuse. In order to observe a weakness which need not have existed, let us consider the slide partially shown in Fig. 131. The use of two-digit numbers will furnish a hundred substitutes; but a strip of that length is awkward to handle, and the constructor of the present slide has confined its length to forty numbers. Then, since he has only fifteen different cipher alphabets, and wishes to make use of word-keys, he has adjusted his 26 key-letters to fit the number of alphabets. Now if the alphabet of the slide (that is, the _cipher alphabet_, or series of numbers) is written in straight 1-2-3 order, and if it is considered that letters may have two or more values, so that _A_ has the values 1, 27, 53, etc., _B_ the values 2, 28, etc., _C_ the values 3, 29, and so on, a slide of this kind is exactly the equivalent of the Saint-Cyr slide, since any cryptogram accomplished with it could be promptly converted to a Vigenère cryptogram by substituting letters for numbers. The keys, of course, might differ. The constructor of the slide has desired something more difficult. But instead of carrying his forty numbers through a transposition block, and really mixing them, he has been content to group them, in regular order, by their tens. We shall see in a moment what happens to his cryptograms. But he neglects also an opportunity: Presuming that his circumstances are such as to make the use of numbers practical at all, why waste the opportunity to use the full one hundred substitutes? The remaining sixty numbers might have been placed on the next two rows, and thus, in every position of the slide, he could have had two or three optional substitutes for every letter — a much more difficult case than the simple periodic. Figure 131 A Slide Carrying a NUMBER-Alphabet (and Keys) ( Plaintext Alphabet - Stationary ( ( A B C D E F G H I J K L M ..... ( 10 20 30 40 50 60 70 80 90 00 11 21 31 41 51 61 71 ..... Sliding Cipher-Alphabet: Key-letters may be added: A B C D E F G H I J K L M N O) ( * P Q R • S T U * V W X Y Z *) The addition of key-letters makes it possible to employ a keyword. For the present forty-number slide, it was necessary to double them up as in Porta. A slide having fifty-one numbers would have accommodated all twenty-six of the key-letters. The cryptogram of Fig. 132 was enciphered with the slide of the preceding figure, using the key-word CABLO (equivalent to the numerical key 30-10-20-21-51), and its period, 5, can be determined in the usual way. However, we have already seen the Kasiski method; suppose, here, we look at another, originated by Ohaver; and, since Ohaver himself, explaining his method in connection with a number-cipher of much the kind we have here, illustrated with single numbers instead of with sequences, it seems fitting that it be illustrated again in the same way. Figure 132 Cryptogram Enciphered with the Slide of Figure 131 32 41 31 61 33 12 32 60 91 91 30 81 70 92 92 51 52 61 23 43 71 01 90 61 71 71 41 12 92 51 01 52 12 91 91 80 50 30 92 53 30 81 62 72 62 30 41 00 02 43 71 20 60 41 51 01 81 00 61 81 71 12 12 31 93 61 50 00 32 33 70 41 00 52 33 22 50 20 51 92 80 31 61 92 23 11 91 01 13 92 81 51 12 91 91 01 30 90 21 82 90 50 01 21 23 70 20 60 01 82 90 31 20 51 91 22 51 12 91 32 12 50 51 51 33 71 10 01 13 92 40 50 91 61 51 60 52 42 91 91 61 01 90 61 43 11 31 60 41 92 51 50 01 02 92 81 21 60 21 33 70 21 60 13 72 70 80 60 21 23 01 90 80 91 43 30 32 20 63 32 80 01 90 61 23 70 90 01 21 82 72 51 30 12 91 50 01 00 62 82 40 50 40 21 53 12 50 12 91 32 12 90 01 81 92 11 41 80 13 92 22 10 21 61 43 11 31 60 21 82 60 32 60 51 92 61 01 42 21 82 22 10 51 63 22 11 01 40 91 51 22 01 90 61 62 30 91 12 42 32 61 12 12 61 33. As pointed out more than once, those characters having the highest frequencies in periodic cryptograms will nearly always have derived these high frequencies because of their occurrence in more than one of the cipher alphabets; while those having the lower frequencies will more often represent repetitions in some one cipher alphabet. Thus, when we find, in the present cryptogram, that the numbers 02, 53, and 63, have each a frequency of 2, it seems reasonable to suppose, for each number, that its two occurrences were in a single cipher alphabet; that is, that each one is a periodic repetition. Now, considering Fig. 133, and confining our observations, for the moment, to the number 02, we find that this number, in the cryptogram, occupies serial positions 49 and 154. Having first laid out a series of columns headed by the various possible periods, 2, 3, 4, 5. . . . . , we use each possible period in turn as a divisor, first applying them all to the serial number 49, and then applying them all to the serial number 154, each time setting down, in the proper column, _the remainder from the division_. This remainder tells us, each time, into what cipher alphabet the number 02 would fall, should the cryptogram be rewritten into the period indicated at the top of a given column. Still confining our observations to the number 02: It is seen, under possible period 2, that if this were the period, then the two occurrences of the number 02 would be in different alphabets. The same can be seen under possible periods 4, 6, 8, 9, 10. But if the period were 3, both occurrences of our number would fall into alphabet 1; if it were 5, both occurrences would fall into alphabet 4; if it were 7, both occurrences would fall into alphabet 7 (remainder zero indicates the final alphabet of the given period). Here, then, it would appear that possible periods 3, 5, and 7, are more likely than the rest, as far as the tabulation goes. When exactly the same observations are made for the number 53, it appears that the most likely periods are 3 and 5. And when these observations are made again for the number 63, only the period 5 is indicated as a likely one. Since the period 5 has been indicated oftener than any other, this is probably the correct period, as we happen to know that it is. When the same method is applied to repeated sequences, the serial numbers can be those of the repeated first number. And it may, of course, be applied to letters, just as the Kasiski method might have been applied here. As to why Ohaver might have preferred this method in dealing with numbers, let us examine, in the figure, the entire column under possible period 5. The Ohaver method, unlike the Kasiski, not only indicates the period, but, in addition, shows the exact alphabet of that period into which a repeated number will fall. The number 02 is shown as belonging to alphabet 4 ; the number 53 as belonging to alphabet 5; and the number 63 as belonging to alphabet 4. It is thus possible to see that the very small number 02 and the very large number 63 belong to a same cipher alphabet; and since a range of over sixty numbers cannot correspond to only twenty-six letters, we may conclude at once that the numbers on the slide were not in consecutive order. Often, our information is exactly the opposite. Figure 133 An OHAVER Method for Finding Period P O S S I B L E P E R I O D S Substitute Serial Position 2 3 4 5 6 7 8 9 10 ... 02 49 1 1 1 4 1 0 1 4 9 ... 154 0 1 2 4 4 0 2 1 4 ... 53 40 0 1 0 0 4 5 0 4 0 ... 205 1 1 1 0 1 2 5 7 5 ... 63 179 1 2 3 4 5 4 3 8 9 ... 244 0 1 0 4 4 6 4 1 4 ... X X * * * Returning, now, to our cryptogram: In the beginning, we probably made a general frequency count; if not, we now have the five individual counts to be taken. And, as previously mentioned, a frequency count made on numbers is much more conveniently accomplished on a 10 x 10 chart than by sorting and listing the numbers. The moment our five frequency counts are made, in the present case, two facts become evident: Each count includes only fifteen or twenty _different_ numbers, with about the frequency-distribution of simple substitution; and, while the tens-digits have included a full series, the units have never run beyond 3. The cipher, then, is a simple periodic; had multiple substitutes been used, the frequency counts would have included more different numbers, and with frequencies more uniformly distributed. As to the series of numbers, two probabilities are suggested, and these, in effect, are the same thing: The numbers may have run in straight order into the thirties, and with each number reversed; or: the numbers may have been grouped by tens. It is further possible that the whole series runs backward, or that the tens do, or the units, or sections of a certain length; and some uncertainty may arise as to the rank, in the series, of the digit zero; this digit is ordinarily last, but occasionally is ranked first. It is, of course, possible that the series of numbers is well mixed, but the chances are that it is merely methodized; the person who uses numbers in a simple periodic cipher is not usually one who knows the dangers of regularity in a cipher alphabet. Figure 134 A Series of PARALLEL Frequency Counts Which Can Be LINED UP By PATTERN 10 . 111 . . . 20 . 11 111 . . 30 11111 1 11 . . 40 11 . 11 . . 50 1 11111 1111 . . . 60 11 . 11111 1111 . . 70 11111 . 1 . . 80 111 1 11 . . 90 11 111 11111 . . 00 . . 11111 . . 11 11111 . . . . 21 . 11 1 11111 111 . 31 . 1111 1 1 . 41 . 11111 . 11 . 51 11 111 11 1111 1111 61 1111 . 11 11111 1111 . 71 11111 . . . 1 81 11 111 . 1 1 91 . 11 1 11111 111 11111 1 01 1111 11111 11 11111 1 1 . 12 1111 11 11111 111 1 . 22 11111 . . . 1 32 1 111 . 1 1111 42 . . 11 1 . 52 . 111 . 1 . 62 . . 1 1 11 72 1 . . 1 1 82 . . . . 11111 1 92 . . . 1111 11111 1111 02 . . . 11 . 13 . . . 1111 . 23 . . . 1 1111 33 . . . . 11111 1 43 . . . . 11111 53 . . . . 11 63 . . . 11 . 73 . . . . . 83 . . . . . 93 . . . . 1 03 . . . . . We may try, then, to restore his original arrangement (or an equivalent one), placing beside it the five frequency counts in their five columns, as shown in Fig. 134. The probable arrangements are very few, and the placing of tally-marks opposite their numbers is very rapid, since this, at each trial, is a mere matter of copying them from their charts. Once the correct rearrangement is reached, notice, in the figure, the appearance of the five frequency counts. Insofar as is ever likely to happen with columnar counts, _all five have followed the same graph_. This, of course, is the simplest case; the finding of the encipherer’s original order, so that every frequency count has followed the graph of the normal alphabet. Any substitute can be identified, as in Vigenère, by its serial position in its own alphabet; and where numbers are used, there is seldom any doubt as to what number comes first in its alphabet. The shortest road to solution would be as follows: Prepare a temporary slide _exactly like the one which was used_ (except that we have no way of knowing what the key-letters were), mark the points at which the five alphabets begin, and decipher with the slide. There are many other cases, hardly more difficult, in which our rearrangement of numbers results, not in the original order, but in an _equivalent order_. We could, for instance, arrive at a rearrangement in which we have taken each third number, or each fifth number, of the original cipher alphabet, so that our rearranged numbers are following plaintext letters in the order _A D G J_. . . . or _A F K P_. . . . ; thus, all of our frequency counts would be following one same graph, though not the graph of the normal alphabet. The problem here is to make sure that their graphs are all the same graph, and then subject them to the process called “lining up.” Figure 135 The LINING UP of the Frequency Counts of Figure 134 ┌1st┐ ┌2d ┐ ┌3d ┐ ┌4th┐ ┌5th┐ TOTALS │ │ │ │ │ │ │ │ │ │ │ 30│11111 │ 10│111 │ 20│111 │ 21│11111111 │ 51│1111 23 * │ 40│11 │ 20│11 │ 30│11 │ 31│1 │ 61│ 7 │ 50│1 │ 30│1 │ 40│11 │ 41│11 │ 71│1 7 │ 60│11 │ 40│ │ 50│ │ 51│1111 │ 81│1 7 │ 70│11111 │ 50│111111111│ 60│111111111│ 61│111111111│ 91│111111 38 * │ 80│111 │ 60│ │ 70│1 │ 71│ │ 01│ 4 │ 90│11 │ 70│ │ 80│11 │ 81│1 │ 12│ 5 │ 00│ │ 80│1 │ 90│11111 │ 91│11111111 │ 22│1 15 * │ 11│11111 │ 90│111 │ 00│11111 │ 01│1 │ 32│1111 18 * │ 21│ │ 00│ │ 11│ │ 12│1 │ 42│ ** 1 │ 31│ │ 11│ │ 21│1 │ 22│ │ 52│ ** 1 │ 41│ │ 21│11 │ 31│1 │ 32│1 │ 62│11 6 │ 51│11 │ 31│1111 │ 41│ │ 42│1 │ 72│1 8 │ 61│1111 │ 41│11111 │ 51│11 │ 52│1 │ 82│111111 18 * │ 71│11111 │ 51│111 │ 61│11 │ 62│1 │ 92│111111111 20 * │ 81│11 │ 61│ │ 71│ │ 72│1 │ 02│ 3 │ 91│ │ 71│ │ 81│ │ 82│ │ 13│ ** 0 │ 01│1111 │ 81│111 │ 91│1 │ 92│1111 │ 23│1111 16 * │ 12│1111 │ 91│11 │ 01│111111 │ 02│11 │ 33│111111 20 * │ 22│11111 │ 01│1111111 │ 12│11111111 │ 13│1111 │ 43│11111 29 * │ 32│1 │ 12│11 │ 22│ │ 23│1 │ 53│11 6 │ 42│ │ 22│ │ 32│ │ 33│ │ 63│ (V) 0 │ 52│ │ 32│111 │ 42│11 │ 43│ │ 73│ 5 │ 62│ │ 42│ │ 52│ │ 53│ │ 83│ ** 0 │ 72│1 │ 52│111 │ 62│1 │ 63│11 │ 93│1 8 │ 82│ │ 62│ │ 72│ │ 73│ │ 03│ ** 0 265 To show the handling of all such cases (which would include our final autokey example), let us assume that the five frequency counts of our figure, though still following a common graph, are not following that of the normal alphabet. In this case, granting that all fifty-letter frequency counts will vary considerably from the normal, it is not quite so obvious that their pattern is the same; we shall have to cut them apart (preferably having copied numbers beside their frequencies) and place them side by side for a comparison of their graphs. Where this has been done, in Fig. 135, their similarity is plain in spite of some discrepancies, and the moving up or down of any one or more of the counts (which could be done so as to include another position, since the range of the numbers is only 25 per alphabet) does not result in greater similarity. If the alignment of this figure is correct, then all numbers found on any one row are substituting for one same original; thus, the added frequencies on any one row will be the total frequency of some one letter in a 265-letter text, and all of these totals, collectively, should resemble a frequency count taken on a simple substitution cryptogram of that length. To just what extent this is true may be seen at the right side of the figure. The nine leading letters have totalled 74%, where we normally expect 70%; but any single example can provide its surprises, and the excess 4% is not on the wrong side of the ledger. The other end of the count, as would be expected of the group _J K Q X Z_, is comparatively blank. Figure 136 The NIHILIST Number-Substitution The "Checkerboard" Alphabet: 1 2 3 4 5 1 A B C D E 13 = C 2 F G H I K 34 = O 3 L M N O P 32 = M 4 Q R S T U 15 = E 5 V W X Y Z 44 = T Encipherment, with Keyword COMET: S E N D S U P P L I E S T O .... Text... 43 15 33 14 43 45 35 35 31 24 15 43 44 34 .... Key.... 13 34 32 15 44 13 34 32 15 44 13 34 32 15 .... 56 49 65 29 87 58 69 67 46 68 28 77 76 49 .... This cryptogram is usually seen without grouping: 56-49-65-29-87-58..... Our substitutes, remember, are assumed to be in mixed order. We do not know what letter is represented by the five numbers of the top row, or by the five numbers of any other row. To proceed with solution, we shall have to assign arbitrary values, calling the top row _A_ (or 01), the second row _B_ (or 02), the third row _C_ (or 03), and so on; and when all of these substitutions have been made on the cryptogram, _the case has been reduced to one of simple substitution_. The mechanics by which the substitutions are made can be exactly those of the other case: Prepare a temporary slide, on which the numbers run in the order decided upon, and slide this against the normal alphabet (or any other); the result is a simple substitution cryptogram which can be solved by simple substitution methods. This case, first in one form and then in another, is encountered again and again; and however it may seem that its cause, in some one example, is a different one, yet the fault in all such examples is the same: The basic cipher alphabet (the primary one from which others are derived), either by its actual construction or by the method of its application, was not truly a mixed alphabet. * * * In some of the periodic ciphers, the basic cipher alphabet is a “checkerboard” of the kind we saw in Chapter XI, the substitutes being two-digit numbers which will point out the columns and rows of their originals. This primary alphabet, however, seldom appears unchanged in the cryptograms, as “position 1” often does when a slide is used, or as the _A_-alphabet often does in the Vigenère cipher. Instead, we find a series of secondary cipher alphabets all of which have been derived from the primary one according to a mathematical process. In view of the fact that any cipher which will necessarily double the lengths of messages is of doubtful value, it seems inadvisable here to do more than mention the infinite multiplicity of processes which would be possible; but with checkerboards, it is difficult to imagine any usable process which would not result in parallel frequency counts; that is, counts which all follow the same graph and thus are capable of being “lined up.” With most of these, in fact, the difference between any two of the (secondary) cipher alphabets will be a difference in _size_ which is uniform from _A_ to _Z_. (Often, the same result is produced with slides.) Here, then, we may content ourselves with a glance at one such cipher which is interesting rather than important. In Fig. 136, we have another of the Nihilist ciphers. Its primary alphabet is that most famous of checkerboards, the _Polybius square_, said to have been the invention of the ancient Greek historian, and certainly well known in his era as the basis for a signalling system — a capacity, incidentally, in which it still serves. We are showing it here in what seems to be the favorite version: The alphabet of the square is the normal one, normally arranged, with _J_ the missing letter; and the order of reading for the two digits is row-column. It should be understood, however, that these details, in practice, are quite variable. For the Nihilist encipherment, the message is first subjected to a simple substitution, using the checkerboard key. A key-word, treated in the same way, is repeated often enough to pair one key-number with each message-number, and the final cryptogram is formed by adding these pairs of numbers. Decipherment, of course, will be the subtraction of key-numbers from the finished cryptogram and the resubstitution of letters. We have, then, another periodic cipher, not essentially different from those already seen. Any number in the checkerboard can become a key, to be applied periodically at some given interval, and thus may govern one of the 25 possible cipher alphabets. It would be possible to lay out any one of these cipher alphabets, simply by adding a given amount to each number of the primary one; if all of them were written one below another, and if the primary alphabet were written across the top and along one side, we should have a tableau which could be used in identically the manner described for the use of the Vigenère tableau. Decryptment, too, can parallel that of the Vigenère: The period of a cryptogram can be found through repeated sequences, or, in their absence, through repeated single numbers, and individual frequency counts can be taken on the several alphabets of the period. If the arrangement of letters in the checkerboard is that of the figure, or any other strictly alphabetical one to which the order of the numbers can be adjusted, these frequency counts will all follow the graph of the normal alphabet, with allowance made for the missing letter. Or, if the arrangement of letters in the checkerboard is not strictly alphabetical, then the several frequency counts, no matter how badly mixed, will still be parallel; they will all follow one graph, and thus can be “lined up.” Very often, however, given the opportunity to examine and analyze a cipher, it becomes possible to formulate for it a special method which is much more rapid than the general one; Ohaver, who first published a special method for the Nihilist, has compared this cipher to a leaky boat in the open ocean. Notice that its primary alphabet contains only the digits 1-2-3-4-5. The maximum difference among these is 4; and the addition of any same number to all of them does not change this fact; the maximum difference between any two of the sums would still be 4. But the number which is added during encipherment is also a number containing no digit other than 1-2-3-4-5; thus any number found in a cryptogram can be considered as carrying two separate additions, one for tens and one for units. Even when two 5’s are added together, the result is an all-revealing zero; the “carried” digit 1 can be mentally “borrowed” back, causing the zero to become 10, and decreasing by 1 the size of the digit which precedes the zero. Specifically: Finding in a cryptogram the number 40, we may regard this as having only 3 tens, with 10 units; or finding the number 110, we may regard it as having 10 tens and 10 units. Thus, there is never a time when it is impossible to see the tens and units as having been separately added; if we find, in a Nihilist cryptogram, the two numbers 29 and 87, with a difference greater than 4 in their respective tens-digits, we may say promptly that they were not enciphered with the same key; no digit whatever added to any two digits of the original square can produce a difference greater than 4. But if the two cryptogram numbers are 30 and 77, where the difference in the tens-digits appears, at first glance, to be only 4, the presence of the zero must be taken into account; thus, the number 30 has only 2 tens, and the difference between 2 and 7 is greater than 4; therefore, the numbers 30 and 77 could not have been enciphered with the same key. It is interesting, also, to note that the digit 2, found in a cryptogram, can have been produced in only one way: the addition of 1 and 1; and that the digit 0, found in a cryptogram, can only have been produced by the addition of 5 and 5. Either one of these digits gives away its key; but, further than this, the cipher provides four “give-away” numbers, 22, 30, 102, and 110, the presence of any one of which in a cryptogram will give away the key to a whole cipher alphabet. Figure 137 Cryptogram by EDWIN LINDQUIST: Final Investigation of Supposed Period 4 24-66-35-77-37-77-55-59-55-45-55-88-28-66-46- 24 66 35 77 88-37-67-33-59-58-65-45-66-67-58-44-55-34-79- 37 77 55 59 55 45 55 88 44-59-55-45-42-87-28-76-43-78-46-86-26-67-24- 28 66 46 88 37 67 33 59 85-26-67-28-76-26-78-46-65-65-88-36-49-54-67- 58 65 45 66 67 58 44 55 28-65-42-88-36-49-44-89-57-58-54-66-47-67-26. 34 79 44 59 55 45 42 87 28 76 43 78 46 86 26 67 24 85 26 67 28 76 26 78 46 65 65 88 36 49 54 67 28 65 42 88 36 49 44 89 57 58 54 66 47 67 26 (Acceptable throughout) Now, to look at Ohaver’s special method, let us consider the cryptogram of Fig. 137, prepared by another “inventor” of exactly the same method. It can be noted, first, that this cryptogram has not resulted from the addition of a single number throughout, since it contains pairs of numbers like 24-88, 42-87, and so on, which have a greater difference than 4 in either their tens or their units. Now, using a bit of scratch-paper, we may, if we like, scribble down a series of possible periods, 2, 3, 4, 5, 6, and so on, to be crossed off as fast as we eliminate them. Considering these, one by one: _Period 2_: With a thumbnail on the first number, 24, and another on the third number, 35, we may run quickly through the cryptogram comparing numbers found at interval 2; that is, the first and third numbers, the second and fourth, the third and fifth, and so on, until stopped by the two numbers 33 and 38, whose difference, in the units, is greater than 4, showing that their key was not the same. Period 2, then, is eliminated. _Period 3_: Here we are stopped short at the very first comparison. The numbers 24 and 77, found at the first interval 3, have a difference greater than 4 in their tens, and thus cannot have been enciphered with the same key. Period 3 is also eliminated. _Period 4_: Starting again, and comparing numbers taken at interval 4, we are able to go all the way to the end of the cryptogram without finding any two numbers whose difference, either in tens or in units, is greater than 4. The numbers compared, however, included only those which would have been adjacent in their columns. To make sure that period 4 is possible, we must see numbers collectively in each of the four columns, and this is best done by recopying the cryptogram into its apparently possible period 4. Further examination, made individually on each column, still shows no two numbers in any one column whose difference, either in tens or in units, is greater than 4. It is possible, then, that each of the four columns was enciphered with a single key; and while this is not absolute proof that the period 4 is correct, those cases are extremely rare in which a period found in this manner is not the correct one. With period 4 accepted, and given as much material as we have, perhaps we can also discover just what key-number was added to primary numbers in order to produce each of the four alphabets. Considering alphabets one at a time, and examining separately the tens and the units: _Alphabet 1_: The tens-half of the first column contains a digit 2; and since this can only have been produced by the addition of 1 and 1, the only possible key-digit here is 1. (We have already ascertained that all digits in this column could have had a same key.) The units-half has a range of 4-5-6-7-8, the maximum range possible. The smallest digit which can result in 8 is 3, and the largest which can result in 4 is 3; that is, the only digit which can result in all of the digits 4-5-6-7-8 is 3, so that the only possible key-digit here is 3. Conclusion: The key which produced the first cipher alphabet must have been 13, _since it cannot possibly be anything else_. _Alphabet 2_: The tens-half of the second column ranges over the full five digits 4-5-6-7-8 (key 3), and the units-half ranges over the digits 5-6-7-8-9 (key 4). The key which produced the second cipher alphabet is 34. _Alphabet 3_: The tens-half of the third column contains the “giveaway” digit 2, and the units-half contains this digit also. The key which produced the third cipher alphabet is 11. _Alphabet 4_: The tens-half of the fourth column ranges only over the digits 5-6-7-8, with nothing to indicate whether the missing one is 4 or 9. Thus, the key to the tens might have been either 3 or 4, though it could not have been anything else. The units have the full range of digits, 5-6-7-8-9, key 4. In the fourth cipher alphabet, then, we cannot tell immediately whether the key is 34 or 44. Granting, however, that the arrangement of letters in Lindquist’s key-square was the same as that of Fig. 136, the substitution of letters for numbers may suggest which of the two numbers, 34 or 44, is the correct key. With one of these we obtain letters _C O A O_, and, with the other, _C O A T_, a word (The student might find it of interest to decipher this cryptogram and learn what the minister had to say). * * * Any sufficiently long cryptogram, then, will reveal both its period and its key, and this regardless of how the letters were arranged in the encipherer’s checkerboard. It may then be deciphered with its own key, and the case, at worst, becomes one of simple substitution. With shorter cryptograms, we often find, as here, that some one or more of the cipher alphabets could have had two or more possible keys. This happening, presuming that the alphabetical arrangement of the square is a known one, or one easily reconstructed, presents no real problem; a little experimentation on the cryptogram will show which keys bring out a message. When the alphabet of the square is an unknown mixed one, the problem may vary according to length, and the number of key-combinations which are found to be possible. If, for instance, the case resembles that of our preceding cryptogram, where only one alphabet out of four was in doubt, then, remembering that the Nihilist cipher alphabets are of a kind whose frequency counts can be “lined up,” we might take frequency counts on the several alphabets, and supply the missing numbers of the doubtful one by making its pattern match that of the rest. With several alphabets in doubt, which could only happen when frequency counts are too scant to betray their graph, it might become necessary to decipher the periodic cryptogram with each possible combination of key-numbers, each time obtaining a new cryptogram, and accept, among these new cryptograms, the one whose general frequency count seems most likely to be that of a simple substitution. The correct cryptogram, in this case, should also contain some fresh repetitions; that is, repetitions which were not present in the periodic one. As to the three examples which follow, there should be little difficulty in deciding whether or not the Nihilist cipher is represented. 131. By B. NATURAL. 45 68 48 46 60 78 45 78 24 59 35 67 50 75 38 58 53 60 65 26 54 46 68 55 38 67 42 69 56 59 24 59 70 54 30 85 32 90 44 46 45 56 79 54 30 86 22 78 27 26 44 49 78 75 38 54 55 78 47 27 45 49 89 44 49 88 42 59 56 49 42 86 50 52 26 55 42 60 47 36 22 50 78 65 50 76 35 78 28 59 26 50 68 54 60 76 25 87 28 29 55 58 59 73 59 97 54 69 66 57 26 46 78 65 48 76 45 57 47 29 65 79 77 55 30 57 35 89 45 49 53 46 66 75 57 97 55 68 28 47 22 66 66. 132. By PICCOLA. (Keyword, CRYPT. Fifth alphabet contains Q. But: Can you rearrange the numbers on the strip before taking frequencies? 15 20 23 18 03 15 26 12 26 25 03 30 40 14 20 09 20 25 11 15 17 25 16 02 29 30 25 21 18 03 11 16 27 30 26 10 02 21 17 01 06 25 13 01 25 03 30 23 26 23 06 27 12 11 20 12 22 16 18 03 29 20 19 01 19 17 19 12 12 20 02 11 14 18 19 13 20 38 11 23 19 01 19 01 27 30 16 21 01 23 17 24 22 25 03 19 26 21 11 28 11 17 16 21 03 13 20 28 05 20 06 26 13 11 26 11 16 27 26 16 02 26 18 05 25 06 03 16 03 03 30 26 16 27 28 10 02 16 02 29 06 26 27 11 24 15 20 23 13 15 11 25 13 05 24 28 20 40 27 19 19 30 27 19 19 13 02 23 21 28 11 30 14 28 03 18 26. 133. By PICCOLA. (If you recognize this gem of literature, you are beyond the draft age. It got around the censor in 1918). 20 08 17 29 15 09 01 05 08 29 24 11 06 05 10 26 13 22 06 01 18 19 05 03 16 24 13 16 04 08 07 19 12 18 24 11 17 09 07 27 26 22 01 15 21 21 10 03 06 22 03 18 04 22 20 06 07 24 12 19 10 19 10 30 10 19 16 24 13 16 04 08 23 01 10 10 23 10 09 05 08 17 21 22 09 15 21 21 10 03 06 06 21 20 12 22 21 08 18 19 23 05 02 01 11 34 19 27 12 06 02 15 10 22 03 03 02 11 12 19 10 11 19 27 13 12 18 24 19 13 24 15 07 16 16 16 26 20 04 05 11 29 26 20 03 10 19 10 23 11 16 19 13 16 04 08 25 17 05 24 20 20 23 09 10 25 20 25 02 05 07 16 26 20 04 05 11. 134. By DAN SURR. (Should you be worried at finding this in Daughter's boudour?) A B C D E F G E H D G E F J E K H D L J D G J M M J D G J M E E F J E O J E L F A C B D G. - P G M G. CHAPTER XVIII Periodic Ciphers with Mixed Alphabets Periodic cryptograms in which the cipher alphabets are mixed are nearly always produced by means of slides. Before discussing these ciphers, it may be well to clarify a few terms which otherwise could leave room for uncertainty. We have, for instance, two, and sometimes three, key-words. There is a primary one (sometimes two) used in the preparation of the slide, and a secondary one, often called the “specific” key, which is used, as in Vigenère, for the encipherment of cryptograms. Since we shall have practically no occasion to mention the primary key-word (or words), any references which are made here to a key-word, unless clearly seen to refer to the preparation of a mixed alphabet, can be understood as meaning the secondary one, that is, the specific key which selects the cipher alphabets. Perhaps it is also advisable to call attention once more to the existence of a primary cipher alphabet (the basic one which is written twice in succession on the slide) and of the 26 secondary cipher alphabets which can be derived from it by placing it in its 26 possible positions. These are usually referred to simply as “the alphabets,” while the basic one is more commonly called “the sliding alphabet.” All, of course, are the same alphabet except for their points of beginning. To see clearly what is meant by an “equivalent slide,” the student may make an experiment: First, form a temporary slide, using any two 26-letter alphabets, and use the slide to encipher a short message. Now form another temporary slide on which the two alphabets of the preceding slide (both treated by exactly the same plan) have been rearranged so that their letters are taken at every interval 3 (or at every interval 5, or 7, or 9 — any interval whatever that is not divisible by 2 or 13), and with care taken always to maintain this constant interval even when the 26th letter is reached and the 1st reappears. Then, using this new slide in the same way as before, encipher the same message with the same key, and compare this new cryptogram with the first. Finally, an _alphabetical_ interval (or distance) between two letters will mean their distance apart in the normal alphabet, while a _lineal_ interval (or distance) will mean their distance apart in any alphabet whatever. That is, the _alphabetical_ distance from _A_ to _B_ is invariably 1 (position), while their _lineal_ distance apart on a slide, or in the rows or columns of a tableau, could be anything from 1 to 25. Where these intervals must be mentioned often, the distance from _A_ to _B_ will be referred to more briefly as “the distance _AB_.” * * * Now let us consider the four slides of Fig. 138, which are being designated (arbitrarily) as belonging to _Types I_, _II_, _III_, and _IV_, in what would seem to be the order of their potential resistance to decryptment. Their actual resistance, however, might depend largely upon the manner of their use, and we are assuming throughout the chapter that the encipherment process is identically that described for the Saint-Cyr cipher: The upper alphabet, in all cases, is to be the plaintext one; the index-letter is always the initial one of this plaintext alphabet; and, for the encipherment of cryptograms, the letters of the chosen key-word are to be found in the lower alphabet and brought one by one to stand below the index-letter in order to set up their cipher alphabets. Also, for our immediate purposes, we are neglecting certain precautions the advisability of which will be seen later: First, the mixed alphabets have all been left undisturbed with their primary key-words (CULPEPER, DAMASCUS) and their alphabetical sequences in plain view; in practice, such alphabets ought to be carried through a transposition block, or otherwise made to appear incoherent. Second, the index-letter should never be _A_ (or any other frequent letter) unless the details of encipherment are varied. (We might, for instance, consider that the index-letter is in the sliding alphabet and that keys are in the upper.) Figure 138 SLIDE - TYPE I. Plaintext: C U L P E R Z Y X W V T S Q O N M K J I H G F D B A CIPHER: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C..... ══════════════════════════════════════════════════ a b c d e f g h i j k l m n o p ....... Key A: Z Y A X E W V U T S R C Q P O D ....... Key B: A Z B Y F X W V U T S D R Q P E ....... Key C: B A C Z G Y X W V U T E S R Q F ....... ══════════════════════════════════════════════════ SLIDE - TYPE II. Plaintext: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z CIPHER: C U L P E R Z Y X W V T S Q O N M K J I H G F D B A C U L..... ══════════════════════════════════════════════════ a b c d e f g h i j k l m n o p ....... Key A: A C U L P E R Z Y X W V T S Q O ....... Key B: B A C U L P E R Z Y X W V T S Q ....... Key C: C U L P E R Z Y X W V T S Q O N ....... ══════════════════════════════════════════════════ SLIDE - TYPE III. Plaintext: C U L P E R Z Y X W V T S Q O N M K J I H G F D B A CIPHER: C U L P E R Z Y X W V T S Q O N M K J I H G F D B A C U L..... ══════════════════════════════════════════════════ a b c d e f g h i j k l m n o p ....... Key A: B D A F P G H I J K M U N O Q L ....... Key B: D F B G L H I J K M N C O Q S U ....... Key C: A B C D E F G H I J K L M N O P ....... ══════════════════════════════════════════════════ SLIDE - TYPE IV. Plaintext: D A M S C U B E F G H I J K L N O P Q R T V W X Y Z CIPHER: C U L P E R Z Y X W V T S Q O N M K J I H G F D B A C U L..... ══════════════════════════════════════════════════ a b c d e f g h i j k l m n o p ....... Key A: C R P A Z Y X W V T S Q U O N M ....... Key B: A E L B R Z Y X W V T S C Q O N ....... Key C: U Z E C Y X W V T S Q O L N M K ....... ══════════════════════════════════════════════════ In the _Type I_ slide, the cipher alphabet is in normal order, and “slides against” a mixed plaintext alphabet. In _Type II_, we find a mixed cipher alphabet “sliding against” the normal one; in _Type III_, we find this mixed cipher alphabet “sliding against” itself; and in _Type IV_, we find it “sliding against” another, and different, mixed alphabet. Every slide, used in any manner, has an equivalent _tableau_ and while tableaux are seldom used, it is very important that we carry in mind a clear picture of their appearance; otherwise we shall find it difficult to understand how slides can be restored with only partial information. The imaginary tableau which is to serve this purpose, using any one of the four slides in the manner specified, is formed as follows: The plaintext alphabet, _with letters in exactly the order of the slide_, appears at the top. The 26 cipher alphabets, standing below and parallel to the plaintext one, are all seen in exactly the order of the slide, _and are shifted, one letter at a time, exactly as the normal alphabet is shifted in the Vigenère tableau_. Thus, exactly as in Vigenère, _the columns of this imaginary tableau are duplicates of the rows_. Keys, if considered, would repeat the first column of such a tableau. This tableau, as mentioned, is imaginary. Should the encipherer or the decipherer actually desire to make use of a tableau in preference to the slide, he would probably prefer one in which both his plaintext alphabet and his key alphabet are running in normal order, so that letters are easier to find. To form this tableau, he would begin by laying out, in normal order, his plaintext alphabet and his key-alphabet, and then lay out his 26 cipher alphabets in the manner explained in connection with the Beaufort alphabets. Each of the four slides of the figure is accompanied by a partial tableau of this kind, and it will be noticed there that we have only one case in which the (secondary) cipher alphabets bear any resemblance to the primary one. This tableau, too, should be well understood, since the cipher alphabets recovered from cryptograms will be like those of the figure. Figure 139 5 10 15 20 25 30 Y V N G K Y E G D P Z E A Y K H S M D Q K K W S J I Q V I O P E I T E A v c I c c c v 35 40 45 50 55 60 K C F K Q J P M L B J X G K C Z D B G N G Q B D Q M E O N K I T c v I T H T H E P E c E c E 65 70 75 80 85 90 X T Y A D D D G J R X R X F W G D A Y T Q S G G C G P B Y O H H I E H A I P H E E v 95 100 105 110 115 120 C L W K C B I C F E Z D G J W K U F K C B U I Z Y B K E K C T H A T H I I c T H A c E A c T H 125 130 135 140 145 150 G K T A O Q C B Y Q U U F Z G G Z Y F N F M J V Z B L Q J U E c H v E c c E E v A 155 160 165 170 175 180 V M M J T A E F V S M E N K Q J E I Z Y A L Q Y R X R X F R v W E v E T c E E W 185 190 195 200 205 210 O U F V S V V V V P K T B K C G O M I K B Q V Z N B I N A O c v c v I E T H E v A c c E A H v 215 220 225 230 235 240 C E V V J F V U Z S B K M K C G P M D T K K Y A D D D Y Z C E c v E A c v T H E v I c H H E H 245 250 255 260 265 270 B T K V S G Q W I T Z D A K P G W B I O N D G R C H P B H U A M v E c T H A T E E v H I H E 275 280 285 290 295 300 G K T Q H G U V Z N Y X M L H F S M D Q K K W Z Q U D A M T E c E c c E v v c I c E c H A 305 310 315 320 325 330 Z D B J O P E U L R Y U G K U Z E U S J Z D B O D R E S I O T H E v E c I T T E T H E E v 335 340 345 R L A B L J R S Z Q Y Q V F L A L E c c c * * * Of our four slides, only the _Type I_ is radically different from the rest. Since its basic cipher alphabet is not a mixed one, it makes little difference what has been done to its plaintext alphabet. Notice, in the partial tableau which accompanies it, that the difference between one cipher alphabet and another is purely a matter of alphabetical shift (or of “size,” if we wish to replace all of these letters with numbers). Properly speaking, this cipher belongs to the case of the preceding chapter; it is presented here largely as a warning of what could happen through misuse of the _Type I_ slide. In the remaining three cases, the sliding alphabet is a mixed one; a series of frequency counts taken from cryptograms cannot be “lined up” unless letters can be placed in the right order before these frequency counts are taken. The “right” order may be the original one of the cipher alphabet, or an equivalent order in which the original letters are taken at a constant interval. In these cases, as with any other periodic cipher, the period is found in the usual way. Individual frequency counts are then taken on the several cipher alphabets, and these are examined in the hope of finding a known alphabetical graph; that is, the graph of some mixed alphabet recovered from previous decryptments — (but notice also the _C_-alphabet under the _Type III_ slide!). It can also be ascertained whether or not the frequency counts have followed one common graph, whether any two or more have followed one graph, and so on. But when it is found that the frequency counts are those of unknown mixed alphabets, then each alphabet is to be treated by simple substitution methods. Here, the principles will still be those of Chapter IX, and we will examine, as briefly as possible, the mechanical phases of their application. Our cryptogram, shown in Fig. 139, is already written into its correct period, 5, with a few substitutions already made, and a few letters noted as vowels or consonants (_v_-_c_). With the period determined as 5, and alphabets found to be in an unknown mixed order, our next step is the preparation of a contact sheet (contact chart, contact count) for each one of the five alphabets, the usual form being that shown in Fig. 140. The necessary number of sheets is prepared in advance by writing the normal alphabet through the center, and each is numbered to show what alphabet it represents. It may also carry the numbers of the two contacting alphabets (those in parentheses in the figure). Then, if the cryptogram is properly grouped, so that all first letters of groups belong to alphabet 1, all second letters to alphabet 2, and so on, the putting down of contact letters is very rapid. Illustrating with alphabet 2: Start with its first letter, _V_; find _V_ in the prepared alphabet numbered 2; place on its left side the _Y_ of alphabet 1; place on its right side the _N_ of alphabet 3. Pass on to the next letter, _E_: contacts are _Y_-_G_. Pass on to the third letter, another _E_: contacts are _Z_-_A_. And so on to the end of alphabet 2. Each contact chart, of course, will serve also as a frequency count and as a graph. The five graphs should now be compared with one another in the hope that some two or more may represent the same alphabet. Such a key-word as DENSE, for instance, makes use twice of the _E_-alphabet, thus doubling the amount of material in one of the alphabets. In our present case, it is found that the five alphabets are all different. Now, just as in simple substitution, we wish to determine, for each of the five alphabets, what letters are apparently representing vowels, and what letters are more likely to be consonants. For this purpose, some of our “pointers” are still available, and are just as valid as in Chapter IX. Figure 140 (5) 1 (2) (1) 2 (3) YT A EL A CSNKZYCC B IUKLQIKT B OO C LE QK C FB DD D DD ZZUNZDZGDZ D BGAGYAGABB E RZPCJMAMZY E GAOFNIVUUS HJN F MVS F HUPSCCGCCWN G QDPKZOPQWKU G CK H SP H J I Q BB I CN LQBQ J PXER J QTPWOQ K KCUTKK KGKBGBK K WETMYTW L RABC L WQQA SQ M EE VF M JM O N D N R O U G O M O P E HGGJ P MBMB OT Q SC YGBGI Q VBVWV OD R EL JXX R XXS S FQH S MGM T BKX T YBK QQ U UD YGOUBK U FIFFVG SU V MV FVY V NVU W G W B RRK X TRR YJ X GM QRNK* Y VEXUQ Y JUTTECP Z EDDDDED G Z Y (2) 3 (4) (3) 4 (5) (4) 5 (1) LDDDE A YYKMB YNTY A DOOD A DDPWTCPQD B GDYYKIHJO A B L L B J I C F C RZKKKKKGK C ZGBBGGGBH D MMBMG D PQQTQ OAA D DDR K E K E F E Z UEUUC F KKZVV VXYCX F WENRL F UDDSDXE G DKJGJRK GBN G KNC Z G G H B H U LQ H GF EU I ZZ SBWMV I OKTOO I M J V BMQGG J RWUTO SVS J IFZ T K V GAMBMEFWGF K QCCCCQCCPU INYG K YHXB L UMM L BHR FB L J* SXPKOMPS M DLJIKDLD A M T M IEV N GKA O N K ZZFG N GFBY E O N B O D IJIAAYI O KCQCNPR P P KVD P ZKG LL Q JY T Q H ZZDKYDKD Q KJMUJKUY R G R C LFYJ R XXOY RE S IZ UW S JJ VZVV S MVBG KK T AQ T MIDJY T QAKZZ EEV U ZLS U KHJ U VGZ QUEQVQ V IVZVZF KVVFFJ V ZSSPJS V KQLK W SKIZ W JF W GK RR X FF X X DKZT Y AFAZ QBBAA Y KTOQR ZZ Y BA Z SWVYUVIFI Z YGYNSCNQQ V Z B Figure 141 Consideration of Alphabet No. 1 Letter: Frequency: LOW-FREQUENCY CONTACTS VARIETY OF CONTACT Left Right Total* Left Right Total* B (v) 7 2 3 5 6 6 12 G (v)(= E?) 11 5 3 8 8 8 16 K (v) 6 2 1 3 5 4 9 Z (c) 7 4 - 4 6 2 8 (*) These observations are not absolute, as in simple substitution. In Fig. 141 we may see some data and probable conclusions concerning alphabet 1. By frequency alone, the four letters _B_, _G_, _K_, _Z_, of this alphabet might all be vowels. When variety of contact is considered in conjunction with frequency, it is noted that _Z_ shows no variety on its right. And when contacts with low-frequency letters are also considered (from information present on sheets 5 and 2; in the figure, frequencies of 1, 2, or 3 were considered to be low), it is found that in this respect, too, the letter _Z_ stands apart from the others. These observations, usually, are mental, and conclusions for any one alphabet must often be modified by what is seen in other alphabets. It may be found satisfactory to begin by selecting only the most _obvious vowel_, or vowels, in each alphabet, and to circle these, or otherwise indicate them, not only on their own sheets, but also on the two adjacent sheets where they are found again as contact letters. When this has been done, the less obvious vowels may be considered again with an additional “pointer,” whether or not they show too much contact with the more obvious vowels. Fig. 142 shows, for each alphabet, the probable conclusions which would be reached after examining the contact sheets of Fig. 140, and before any confirmation is attempted. The next step in order is that of indicating them on the cryptogram itself, and the examination of long segments in which no vowels have been marked. At this stage, too, the total number of spotted vowels may be computed to find out how much of the expected 40% is still missing. Up to this point we have nothing new, and nothing particularly difficult. Whether or not the subsequent work is to become difficult depends chiefly upon the amount of material per alphabet, though granting that the presence of probable words materially alters the case of the shorter cryptogram. Figure 142 Conclusions for the Five Alphabets Alphabet No. Vowels Consonants 1 B G K * Z 2 E D K Q U 3 B G M * V 4 V Z K 5 O C Q (*) When B and G appear as vowels in two different alphabets, the graphic appearance of these two alphabets (1 and 3) should be given another inspection. It happens they are not the same. If the most frequent of the spotted vowels in each alphabet can be safely assumed as _e_, the establishment of other vowel-identities can follow the rules of Chapter IX: The high-frequency vowel which practically never touches _e_ is _o_; and the one which follows it is _a_; vowels of lower frequency may precede or follow _e_, but no vowel should touch it very often. And if, in addition, the most frequent of the spotted consonants in a given alphabet can be safely assumed as _t_, then _h_ of the next alphabet will seldom be out of reach. A very material aid here is found in those _repeated digrams_ (and trigrams) whose letters are already labeled as vowels or consonants. We find, for instance, _ZD_, alphabets 1-2, occurring five times, and with both letters already spotted as consonants. This is very likely to represent _th_, especially when further examination shows it continued as a repeated _ZDB_, with _B_ already quite likely to represent the _e_ of alphabet 3. Then the contacts of _D_, alphabet 2, supposed to represent _h_, have also pointed out a probable new vowel, _A_, in alphabet 3. Again, we find _KC_, alphabets 4-5, occurring six times, and with both letters already spotted as consonants — another probable _th_ — followed three times by _G_, alphabet 1, already likely to represent _e_, and twice by _B_, which could thus represent _a_ (the famous English _the_, _tha_). And similarly we might continue with a long demonstration. * * * Returning, now, to our mechanical operations: Dealing, as we are, with five different alphabets, it becomes imperative that we keep track of substitutes; otherwise, with all of our numerous trials and erasures, it is almost impossible to know what substitutes have been identified and what substitutes are still available for identification. Also, totally apart from this matter of convenience, we shall probably want these five lists of substitutes for use on future cryptograms. This applies to any series of cipher alphabets, whether or not they are in any way related to one another. But it is very seldom indeed that a series of cipher alphabets used in the same cryptogram will be unrelated alphabets. Nearly always, they will have resulted from the use of a slide, and when this is true, the recovery of alphabets and parts of alphabets enables us to reconstruct the slide. The usual plan for recording substitutes is to lay out a plaintext alphabet in _A B C_ order and then, directly below it, to rule off several rows of cells, one row for each cipher alphabet. Thus, any substitute, identified in any alphabet, may be written directly below its presumed original and on the row which corresponds to its particular cipher alphabet. We sometimes speak of such a set-up as a “key-frame” or “key-skeleton,” though a better name, probably, would be “partial tableau.” (Every row, if completed, will show one cipher alphabet of the kind we saw in the partial tableaux of Fig. 138.) Such a “key-frame” for our present cryptogram can be seen in Fig. 143. At (a) of this figure we have the first tentative identifications. The most frequent vowel in each of the first four cipher alphabets has been assumed as _e_ (in practice, the _O_ of alphabet 5 would also be assumed as _e_). The _ZD_ of alphabets 1-2 and the _KC_ of alphabets 4-5 have both been assumed as _th_, and after each _th_, we are trying one letter as _a_. The five rows of this set-up we may now speak of as “alphabets.” At (b) we are beginning to speculate as to what kind of slide has been used. Suppose that the cryptogram has been enciphered with a _Type II_ slide. If so, our plaintext alphabet, in the key-frame, is already arranged like the one on the slide; and when this is true, as may be seen by glancing back at Fig. 138, the recovered cipher alphabets will also build up with their letters in exactly the same order as that of the slide, and, in the end, if fully completed, will show a picture of the original sliding alphabet taking five of its possible positions. Examining the first cipher alphabet of (a), we note that the _lineal_ distance from _B_ to _G_ is 4 positions. If our hypothesis is correct, then the lineal distance _BG_ will have to be 4 positions in all of the other alphabets. The third alphabet contains a _B_; measuring 4 positions to the right of this letter, we find that _G_ of the third alphabet would fall below _i_, and thus would be the substitute for _i_ in the third alphabet. To see whether or not this is likely, we return to the contact sheet, where we find that _G_ has already been spotted as a vowel (see the list in Fig. 142). So far, so good. Then, the first cipher alphabet of (a) shows the lineal distance _BZ_ as 19 positions. Returning to the third alphabet, and measuring 19 positions to the right of _B_, we find that _Z_, in this alphabet, would fall below _x_. Examination of the contact chart shows that _Z_ has not been used in the third alphabet, making it satisfactory as the substitute for _x_. Still good. Again, the third alphabet shows the distance _AB_ as 4 positions. Still pursuing our hypothesis, the first alphabet must also contain an _A_ standing 4 positions to the left of _B_. If so, it will fall below _w_, and the frequency of _A_, in the first alphabet is found to be 2, which is satisfactory as that of _w_. With _G_ and _Z_ added to alphabet 3, and with _A_ added to alphabet 1, we may now turn our attention to alphabet 4, which contains a _Z_, and, by making similar observations there, we may add to the 4th cipher alphabet the letters _A B G_, and, to the 1st and 3d alphabets, the letter _K_. Thus we arrive at (b) through what is ordinarily referred to as the “symmetry of position” existing among the several cipher alphabets. Figure 143 (a) a b c d e f g h i j k l m n o p q r s t u v w x y z 1 - B G Z 2 - E D 3 - A B 4 - Z K 5 - C (b) a b c d e f g h i j k l m n o p q r s t u v w x y z 1 - B G K Z A 2 - E D 3 - A B G K Z 4 - Z A B G K 5 - C But the second and fifth alphabets cannot yet be combined with the other three, since neither of these contains any letter in common with them, and thus we have no point from which to measure lineal distances. We know, however, that if our hypothesis is correct, the letters _A B G K Z_, in these alphabets also, will be found at exactly the same lineal distances as before. It would be possible to prepare a sort of slide on which these letters, written twice in succession, are spaced as in the other three alphabets, and use this in experimenting with alphabets 2 and 5. The cryptogram, as we first saw it, showed all substitutions which are possible from (b) of Fig. 143, together with a few _v_-_c_ notations which were listed in Fig. 142 but not further investigated. In case the student cares to complete solution, he might refer to certain precautions mentioned at the beginning of the chapter. Notice, in the last figure, the lineal distance from _G_ to _K_; what letters would you feel inclined to try in the three intervening positions? Or notice the distance _BG_. What letter is very likely to have been taken here for use in the key-word, and where is it likely to stand in that word? If the index-letter was _A_, does it seem possible that the _a_-substitutes could all be selected in advance directly from the contact sheets? Would this be possible if the encipherment process were varied so that an index, selected in the sliding alphabet, were brought to stand below keys in the stationary one? The cryptogram is known to contain the word SUPPOSE, and the period is 5. Is there any room here for _pattern_ methods? * * * Our _Type II_ slide, then, unlike the remaining three, builds up automatically in the key-frame, _owing to the simple fact that we are able to set down the plaintext alphabet in the encipherer’s original order_. The method of solution, so far as we know, was first published (1883) by Auguste Kerckhoffs, who seems to have originated the term “symmetry of position.” The invention of the cipher is credited to “a member of the (French) Commission on Military Telegraphy.” If these parallel cipher alphabets are to be avoided in the key-frame, but still using a _Type II_ slide, General Sacco has suggested that the encipherment process be altered as follows: Let the index-letter and the key-letter both be found in the upper alphabet. Slide the plaintext letter to stand below the index-letter, and use the substitute which will then be standing below the key-letter. This, of course, would have to be letter-by-letter encipherment, and represents one of those rare cases in which a slide is less convenient and rapid than its equivalent tableau. If this tableau be laid out in full, as explained for Beaufort alphabets, it shows, on its 26 rows, 26 cipher alphabets not one of which appears to be at all related to the others. One of these (the one in which index-letter and key-letter are the same) will be the normal alphabet. We may find the original sliding alphabet, however, by looking at _columns_. Such a tableau is exactly equivalent to the _Delastelle tableau_ if the _Z_-alphabet be made the normal one. Delastelle’s tableau was described as follows: Using the mixed alphabet, fill in the tableau by columns, beginning each column with whatever letter, in the mixed alphabet, follows the plaintext letter shown above the column. This causes the final alphabet to come out in _A B C_ order. The Delastelle tableau is not nearly so easy to reconstruct as that of the ordinary _Type II_ slide; the method, however, will be plain enough when we have understood the reconstruction of _Types III_ and _IV_. * * * The _Type I_ slide, as pointed out in the beginning, is somewhat out of place in the present chapter; every frequency count will follow the graph of the mixed plaintext alphabet, so that all can be “lined up” by their common pattern. Having letters, and not numbers, the “top” of a frequency count may be anywhere; it is usually best to prepare at least one of the frequency counts of double length in order to effect the alignment. Granting, however, that for some reason the common pattern of the frequency counts has not been recognized, then the method of decryptment would be exactly the same as for any other case of mixed alphabets. Fig. 144 shows the development of the key-frame in this case. At (a), some substitutes have been correctly identified in each of four cipher alphabets. But long before reaching this stage, the most careless of decryptors must have noticed that the difference between any two cipher alphabets is purely a matter of alphabetical shift. This is particularly visible as between alphabets 3 and 4, where the alphabetical interval is only 1; examination of alphabets 1 and 2 shows that wherever both substitutes are present, their alphabetical difference is 14; and further examination shows that the alphabetical distance from alphabet 2 to alphabet 3 is 17. The use, here, of a Saint-Cyr slide enables us to arrive very quickly at (b). The alphabets of (b) are, of course, secondary cipher alphabets, and the primary one obviously runs in normal order (or, at worst, in a strictly methodized order which is easily obtainable from the normal one). What we still lack, in order to reconstruct the slide, is the mixed plaintext alphabet, and this can be recovered as at (c). Write out the normal alphabet (known to be the original cipher alphabet), then, using any one of the secondary alphabets, place originals above their substitutes wherever these are known. In the given example, all missing letters can be filled in by alphabetical sequence; and even though the index-letter was one of low frequency, and thus was not used in the message, the student should have no trouble whatever in discovering the key-word which governs the four cipher alphabets. * * * In considering the reconstruction of the remaining two slides, we shall have to keep clearly in mind the _imaginary tableau_ on which the plaintext alphabet has exactly the order of the one on the slide, so that cipher alphabets, also, have exactly the order of the one on the slide, and are shifted one letter at a time, as in the Vigenère tableau. For one thing, we are going to call some of these alphabets by numbers, or refer to them as odd-numbered and even-numbered alphabets. Thus, with the alphabet we have been using, the _first_ alphabet in the imaginary tableau is position 1 of the slide: _C U L P E R Z Y X W V T_. . . . . . , the _second_ alphabet is position 2 of the slide: _U L P E R Z_. . . . . . . , the _third_ alphabet is position 3 of the slide: _L P E R Z Y_. . . . . , and so on to the _26th_ alphabet, which is the final position of the slide: _A C U L_. . . . . But over and above this, it must be remembered that _the columns of this imaginary tableau are duplicates of the rows_, just as they are in the Vigenère tableau. We do not, of course, recover any of these alphabets in the order mentioned, since our plaintext alphabet of the key-frame must necessarily be arranged in its _a_-_b_-_c_ order. For instance, the _fourth_ alphabet, which, in the imaginary tableau, begins with its key-letter, _P_, and runs in the order _P E R Z Y X W V T_. . . . . , comes out in one of our examples (_Type III_ slide) as _L U P C Y A B D_. . . . . , and in the other (_Type IV_ slide) as _E W Y P V T S_. . . . Figure 144 The Alphabets from a TYPE I Slide: (a) a b c d e f g h i j k l m n o p q r s t u v w x y z 1 - L . . J Q . H G F . . . . B A . . R Y X . . . . . . 2 - Z . . . E . . . T . . C Q . O . . . . . B . . . . . 3 - Q P . O V N . . . . I . . G F U . . D C . B A . Y . 4 - R . . P W . . M L . J . . . G . . . . D . . . . . . (b) a b c d e f g h i j k l m n o p q r s t u v w x y z 1 - L K . J Q I H G F . D O C B A P . R Y X N W V . T . 2 - Z Y . X E W V U T . R C Q P O D . F M L B K J . H . 3 - Q P . O V N M L K . I T H G F U . W D C S B A . Y . 4 - R Q . P W O N M L . J U I H G V . X E D T C B . Z . (c) Alphabet No. 1: Plaintext: o n m k . i h g f d b a . u l p e r . y . w v t s . CIPHER (Rearranged): A B C D E F G H I J K L M N O P Q R S T U V W X Y Z * * * The _Type III_ slide is, in many respects, the most interesting member of its family. With every alphabet taking exactly the same order (that is, the plaintext alphabet, the key-alphabet, and all cipher alphabets in the imaginary tableau), it parallels the Vigenère in every particular except the order of the 26 letters. It has a corresponding Beaufort form, and a corresponding variant in which complementary keys are based on the order of the mixed alphabet. Its 14th alphabet, like the _N_-alphabet of the Vigenère, is reciprocal throughout. And its first alphabet, like the _A_-alphabet of the Vigenère, is a duplicate of the plaintext alphabet. This was pointed out in connection with the slide of Fig. 138, where key-letter and index-letter were both _C_. There are two ciphers, then (the _Type III_ slide and the Delastelle tableau), in which we are sometimes able to find, among a number of mixed frequency counts, a single one which follows perfectly the graph of the Vigenère _A_-alphabet. Concerning the 14th alphabet, however, we are dealing altogether, here, with a 26-letter alphabet; and some of what follows is being explained on the theory that the number 26 contains no factors other than 2 and 13. If the student will give his careful attention to _reasons_, as well as to methods, he will be able to adjust these methods to alphabets of other lengths, as, for instance, the very common 25-letter alphabet met with in foreign texts. The first alphabet, of course, duplicates the plaintext alphabet regardless of what alphabet-length is being considered, and thus, whenever a _Type III_ slide has been used, we are always in full possession of one of the cipher alphabets. Figure 145 The Alphabets from a TYPE III Slide: Behavior of an EVEN-NUMBERED Alphabet 1st Alphabet (Always normal): A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 4th Alphabet: L U P C Y A B D F G H R I J K Z M X N O E Q S T V W For an EQUIVALENT SLIDE, follow the chain AL-LR-RX-XT-TO...... A L R X T O K H D C P Z W S N J G B U E Y V Q M I F L R X T O K H D C P Z W S N J G B U E Y V Q M I F A (1)........... ═ ═ ═ (2)................. ═══ ═══ ═══ ═══ ═══ To find the ORIGINAL SLIDE from the EQUIVALENT one: (1) Either take letters constantly at interval 9, which is the interval V-W-X: R Z Y X W V T S Q O N M K J I H G F D B A C U L P E (R) X W V T S Q O N M K J I H G F D B A C U L P E R Z Y (X) (2) Or: Spread the letters apart so that the alphabetical sequences K(JI)H, Z(YX)W, etc. are standing at the right interval, always maintaining the alphabet-length, 26, and intertwine. Both alphabets are the same in this slide: (The interbals A . . L . . R . . X . . T . . O . . K . . H . . D . are always odd, . C . . P . . Z . . W . . S . . N . . J . . G . . B 3, 5, 7, etc.) . . U . . E . . Y . . V . . Q . . M . . I . . F . . Behavior of an ODD-NUMBERED Alphabet 1st Alphabet: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 3d Alphabet: U C L A Z B D F G H I E J K M R N Y O Q P S T V W X 1st HALF-CHAIN: 2d HALF-CHAIN: A U P R Y W T Q N K I G D (A) B C L E Z X V S O M J H F (B) Spread the letters of each half, trying interval 2, interval 4, interval 6, and so on, treating both halves alike, until the intertwining of the two will set up some alphabetical sequences: . A . U . P . R . Y . W . T . Q . N . K . I . G . D B . C . L . E . Z . X . V . S . O . M . J . H . F . Now, granting that we have completed the decryptment of a message, we have before us a key-frame in which several cipher alphabets are at least partially recovered. With one alphabet fully known in advance, the recovery of another full alphabet usually enables us very quickly to restore the original slide, or an equivalent slide. The ideal case is that in which we recover one of the even-numbered alphabets (except No. 14). The recovery of an odd-numbered alphabet will, at times, leave us with thirteen possibilities; while the recovery of the 14th alphabet could be useless, provided we have no other information. The method of reconstruction can be followed in Fig. 145. First, we have the perfect case, one in which an even-numbered alphabet (the 4th) has been recovered in full. We begin by writing this recovered cipher alphabet letter for letter below (or above) the one which is always known to us; thus the two substitutes for _a_ are in a same column, the two substitutes for _b_ are in a same column, the two substitutes for _c_ are in a same column, and so on. The columns themselves are not in their original order, but the two alphabets, throughout, are running parallel, just as they would in the imaginary tableau, and thus the _columnar distance is uniform_ which separates each pair of substitutes; that is, the _vertical_ distances _AL_, _BU_, _CP_, _DC_, _EY_, etc., are all equal in the imaginary tableau. If these be rearranged in such a way that the last letter of each pair is the beginning letter of the next, we have a chain _AL_-_LR_-_RX_-_XT_-_TO_-_OK_. . . . . made up entirely of equal vertical intervals, from which the repeated letters may be dropped: _A L R X T_. . . . . , leaving us a series of 26 letters known to be equally spaced in the columns of the tableau. Then, remembering that the columns of this tableau are duplicates of its rows, we have also a series of 26 letters known to be equally spaced on the rows. That this series of letters, _A L R X T_. . . . , _sliding against itself_, produces exactly the results of the original series, the student may ascertain for himself; also that a number of other _equivalent slides_ can be formed by taking letters of this series at any constant interval which is not divisible by 2 or 13. The total number possible is eleven, of which one was the original. An equivalent slide, of course, is all that we actually need for enciphering and deciphering cryptograms. But where alphabetical sequences existed in the original alphabet, two methods are shown for obtaining it without writing out the entire eleven possibilities: (1) Find, at some constant interval, the letters of an alphabetical, or nearly alphabetical, sequence, as the (reversed) _V W X_ of the figure, standing at interval 9; the taking of all letters at this interval brings back the original order. (2) Find pairs of consecutive letters, as the (reversed) _HK_, _WZ_, _GJ_, which, if all spread apart to the same extent (some odd interval, as 3 of the figure), would then be standing at their normal alphabetical intervals, or nearly so. Lay out the 26 positions, and spread the entire alphabet, maintaining the common interval even after the 26th position is reached. The figure shows this on several rows; in practice, there is only one. If the recovered alphabet is an odd-numbered one, the same plan is followed, but results in a chain of only 13 letters; it is necessary to begin with some other letter, not included among the first 13, and form another 13-letter chain. Having absolutely no additional information, we cannot combine these two halves with certainty unless the original alphabet contained some alphabetical, or nearly alphabetical sequences. Presuming that it did, the method ordinarily described for combining the two halves is that of the figure. Spread the letters of the two halves (plan 2 of the preceding case), treating both halves exactly alike, until a point is found at which the two halves can be intercombined to show alphabetical sequences. For this case, however, George C. Lamb, the author of Chapter X, suggests another plan which would seem to be more direct and less troublesome than the standard one. Lamb, incidentally, is to be congratulated here for his entirely new observation: If the two half-chains can be properly adjusted with reference to each other, _each pair of letters, regardless of the order, will be a digram belonging to the original mixed alphabet_. The reason for this division into halves, of the odd-numbered alphabets, is probably self-evident: One half contains only odd letters (1-3-5-7-9. . . . . . . . .) and the other contains only even letters (2-4-6-8-10. . . . . . .). If both halves were recovered in this order, and if one half were written directly below the other with letters 1-2 standing together, then the other pairs would also be standing together: 3-4, 5-6, 7-8, and so on. We seldom recover them in straight order; but whatever rearrangement has taken place in one of the halves has taken place, also, in the other half; should one be recovered with letters in the order 1-7-13-19-25-5-11. . . . (each third letter in a series 1-3-5-7. . . . .), then the other will be recovered with letters in the order 2-8-14-20. . . . . . (each third letter in a series 2-4-6. . . . . .), though neither half necessarily begins with the first letter of its series. If, then, we are able to place together letters 1-2, the other pairs will also be adjusted, perhaps in the order 1-2, 7-8, 13-14, 19-20, and so on. These pairs may then be taken at some regular interval and will bring back the original order 1-2, 3-4, 5-6, and so on. Figure 146 Another Method for Combining the two Half-Chains of an Odd-Numbered Alphabet (Originated by GEORGE C. LAMB) With a Type III slide, based on the key-word EXCORIATE, the 7th alphabet, as recovered from a cryptogram would come out as shown: H K B L A M N P........ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z H K B L A M N P G Q S U V W D Y Z F E J X C O T R I The second half-chain, started with D, must be re-adjusted so as to plece in correspondence the alphabetical sequences PQ, YZ, FG, MN, etc. 1st HALF-CHAIN: A H P Y R F M V C B K S E 2d HALF-CHAIN: (d l u x) T J Q Z I G N W O D L U X Each corresponding pair of letters was a digram in the original cipher alphabet. Taking some two letters, as FG, which form an alphabetical sequence, look for another pair, such as HJ, which may be its continuation. HJ having been found at the interval 9, try taking pairs at the interval 9: FG HJ KL MN PQ SU VW YZ EX CO RI AT BD (FG) Lamb’s method, applied to an actual cipher alphabet, can be seen in Fig. 146. The first half-chain, if started at _A_, will include the letters _B_ and _C_, so that the second half-chain would probably have been started at _D_. But _AD_ will not be a correctly adjusted digram. It is necessary to look for one which forms an alphabetical sequence, as _FG_; and when the two halves are adjusted so that _F_ and _G_ are together, other alphabetical, or nearly alphabetical, sequences are also found to be adjusted, as _MN_, _VW_, _BD_, _KL_, making it likely that we have found some digrams belonging to the original mixed alphabet. With this adjustment reached, it is found that pairs can be taken at the constant interval 9, _AT_-_BD_-_FG_-_HJ_. . . . . , thus bringing back the original cipher alphabet. Presuming that the original alphabet did not contain these alphabetical sequences, then there are thirteen possible adjustments for the two half-chains, and any one of these could be the original alphabet (or its equivalent). But it must not be forgotten that in an actual case our key-frame always contains portions of other cipher alphabets; and if the foregoing principle has been well understood, it may be readily seen how we could make use of these in order to determine which of the thirteen possible adjustments is correct. Even the recovery of the 14th cipher alphabet (which results in thirteen 2-letter chains), would not be useless with this other information present always in every key-frame. The _Type III_ slide, in fact, can often be reconstructed without possessing any fully recovered cipher alphabet. This cipher is very popular with members of the American Cryptogram Association, and is usually known, for no very good reason, as “the Quagmires cipher.” * * * In the case of the _Type IV_ slide, we do not begin reconstruction with one complete cipher alphabet already in our possession. It becomes necessary that we recover two, the perfect case being that in which one is an odd-numbered alphabet and the other an even-numbered one. We will follow this case in Fig. 147, where the two recovered alphabets are Nos. 4 and 7. This tableau, like the preceding one, has columns which are duplicates of its rows, and to see our preceding case again (with its one modification), let us begin by looking only at the three alphabets immediately below the heading. One of these, the plaintext alphabet, shown in lower-case letters, we will disregard for a moment, giving our attention only to the two cipher alphabets. Figure 147 The Alphabets from a TYPE IV Slide: Plaintext letters: a b c d e f g h i j k l m n o p q r s t u v w x y z (1) 4th Alphabet: E W Y P V T S Q O N M K R J I H G F Z D X B A C U L (2) 7th Alphabet: Y S V Z Q O N M K J I H X G F D B A W C T U L P E R A CHAIN Started with ab ab ys vd qx nt jp gl bi sf du xm tz pw lr io fk uh me zc wa ry ov kq hn ej cg (ab) EW UZ BP GC JD NH SK WO ZT PX CR DL HA EF OI TM XQ RV LY AE FU IB MG QJ VN YS REARRANGEMENT of this CHAIN: ab bi io ov vd du uh hn nt tz zc cg gl lr ry ys sf fk kq qx xm me ej jp pw wa EW WO OI IB BP PX XQ QJ JD DL LY YS SK KF FU UZ ZT TM MG GC CR RV VN NH HA AE A Reconstructed EQUIVALENT Slide: Plaintext: a b i o v d u h n t z c g l r y s f k q x m e j p w CIPHER: E W O I B P X Q J D L Y S K F U Z T M G C R V N H A ORIGINAL Slide, Found by Taking Letters at the Interval 5: b u c s m a d z y x w v t ....... W X Y Z R E P L U C A B D ....... These two alphabets, like the two from the Type _III_ slide, are running parallel in the imaginary tableau, so that we have, as before, a series of 26 _vertical_ distances, _EY_, _WS_, _YV_, and so on, all known to be equal in the columnar direction and therefore known to be equal distances on any row. A chain may be started, exactly as in the other case, _EY_, _YV_, _VQ_, _QM_, _MI_. . . . . , resulting in a series of equally-spaced letters _E Y V Q M I F A L R_. . . . . . which is either the original cipher alphabet, or the original one with letters taken at some odd interval other than 13. It is, however, only the _cipher alphabet_; the mixed _plaintext alphabet_ must still be found. This may be done, as in the case of the _Type I_ plaintext alphabet, by using either of the two cipher alphabets which were first recovered and setting originals above their substitutes. If this is done with our cipher alphabet in the order _E Y V Q M I F A L R_. . . . . . , then the plaintext alphabet comes out in the order _a c e h k o r w z m_. . . . . . , and we have an equivalent slide. If we first rearrange the sliding alphabet (each 9th letter of the series _E Y V Q_. . . .), we obtain the plaintext alphabet also rearranged. Continuing, now, with the rest of our figure: The method we have just seen was based on a tableau, and our equal intervals were all vertical. In the figure, we are dealing purely with horizontal distances, and our method is based, not on a tableau, but on a _slide_ (as it was with the _Type II_). Our 4th and 7th (secondary) cipher alphabets, after all, are merely two different positions of the same slide. If we select any two letters, as _a_ and _b_ of the plaintext alphabet, and find that their substitutes are, respectively, _E_ and _W_, in alphabet 4, then the lineal distance _ab_ in the stationary alphabet must be exactly equal to the lineal distance _EW_ in the sliding one; if this were not true, the letters could not have coincided as they do. Then, if we find the same substitutes, _E_ and _W_, in alphabet 7, and note that, in this position of the slide, they have coincided, respectively, with plaintext letters _y_ and _s_, then the distance _EW_ in the sliding alphabet must be exactly equal to the distance _ys_ in the stationary one. It follows from this that _ys_ and _ab_ are equal in the stationary alphabet. If we begin again with the lineal interval _ys_, we find that this is equal to _UZ_ of alphabet 4, and that _UZ_, found again in alphabet 7, is equal to _vd_. Here, then, is another interval, _vd_, which is equal to both ab and _ys_. And so we may continue, forming a chain made up of these known equal intervals, _ab_, _ys_, _vd_, _qx_, etc., for the plaintext alphabet, and _EW_, _UZ_, _BP_, _GC_, for the cipher alphabet. Sometimes we return to _ab_ (_EW_) without having included all 26 letters, and in that case (unless the number of letters included is a divisor of 26), it becomes necessary to abandon _ab_, and try starting with some other interval, as _ac_. Figure 148 Some EXERCISES in the RECONSTRUCTION OF ALPHABETS Plaintext ....... A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Exercise 1: Q * Z A X B O C N * E R F P V G * Y M U I * W * T L Exercise 2: U V D W S X K Y H Z C F R J Q L I N G P T O M E A B Exercise 3: H J G K F P E Q O R S T D M B U V W X A Y Z C L I N Exercise 4: (1) V N U X J Y Z D Q E M P O W C K R I A T L S B F G H (2) H S G J R K L N F P Q B U I V A W C X Y T Z D E M O Exercise 5: (1) G X Y Z M H A F T R L K E V Q U O J W I P N S B C D (2) E * G J I K * L B * * U T C V W * Q D X S * * * * * The keywords, all selected by Mr. A. F. SEMPER, do not contain any repeated letters. The TYPES of slide, respectively, are: I, III, III, IV, and III. In the 5th exercise, the completely recovered alphabet is a "number 14." (See also practice-cryptogram No. 46). Here, as in the case of the _Type III_ slide, we sometimes obtain two 13-letter chains; but in the fortunate case of having recovered in full both an odd-numbered and an even-numbered cipher alphabet, we end the chain with every letter represented twice, both in the stationary alphabet and in the sliding one. Pairs of letters (representing horizontal intervals) can then be rearranged as in the other case, the second letter of one becoming the first letter of the next (in both series), and the dropping out of duplicated letters gives us an equivalent slide. In the figure, starting with _ab_ (_EW_), we find a plaintext alphabet _a b i o v d u_. . . . . and a cipher alphabet _E W O I B P X_. . . . . . This, as mentioned, is one of eleven possible equivalent slides, of which one is the original. Here, the original can be found by taking letters at interval 21. In the figure, letters were taken at interval 5, a result of observing the sequence _W X Y Z_ standing at that interval in the lower alphabet, and the slide comes out in reverse order. This is still an equivalent slide, and the decryptor may or may not care to decide which alphabet runs backward. Since the reconstruction of these mixed-alphabet slides is probably the most fascinating subject in the whole field of cryptanalysis, several problems are being appended in Fig. 148. In all of these, Semper has selected key-words or phrases to contain no repeated letters. With reference to the practice cryptograms, only one of those submitted was thought to have enough alphabet-length for purely analytical attack. The others, even with their probable words or partial translations, will still require some work. The periods of these examples are said to be, respectively, 6, 7, 8, 3, and (?). 135. By NEMO. (Type II. Partial solution: WHEN JACK BOOMER,GREEN RIVER,WYO,B..) T E R P J Y D B N Q S A I M B X B L Y M D O B I T Z P T I H K O K A G M Y Q R X T D W U U X B O B Q Y D B W Z S V Z G C U P R Z S W V O D M T Q Z C A T S M Y Q F D B H Z Q U T I H F S V S Y N F U L Z G L B G D M T R M U C N A J M I Y N Q O F B D P Q L G X U Y W U I P C A Y N J N X S B K W I J G R L G I B. 136. By NEMO. (Type III. Partial solution: ALOIS STEPHEN,YOUNG VIENNESE CHARGED W..) H G K S T I L O Y D B O L E G A Z N G P D U W P B D R V Z Q Y Z X F L Q S B H S L T U Q P S Z G X V A Y T G B C B X K H U R I E D M D X B T O E P S A R I N K X K J B I T P Y I X R I U Z Y O M I M H P H B E J D N E B S E F L B F D B H F J B F N L G P L J M I B O G T A W D U E Q E Z T Y U S I. 137. By THE SQUIRE. (Type III. Probable words: AMERICAN CONSTITUTION. GLADSTONE). H T F M R S R T Y E O V P D S Z L A X B A C N T N A K X R C S Z K G O Q U O F A Z R E T D S V I W K W T E L K F R P R B I H I N A S W R R S B O H T F L A D D L U B U F M Q O J A G I L I D W T Z I M M R H L L V K W U J S. 138. By ALII KIONA. (Is this a diplomatic telegram?) L L D R K Y C R F A S E V S U K T D U L X V K E V C A B L Y U P Y M R K B E X U B T E L W P J F P T I I U Q Q K T F C T P S K Q L W N D A P B F A E S N M P R K A P T T S H F K B Z R M G P P Y V M S A I F N P Z A L T S U S A U D N L X A A Z Y P U C H K N P Y V M S I A X K K D B E T P S A T P K P S Y V T A Y E A P B T E L W P J F P T A X N. 139. By PICCOLA. (This is a straight-alphabet cipher. Won't tell which one!) A N D N Y L M Y X N K D L R P G C X G Q N A A R Z L D E P L G I A W Q N E I O G A G P Q G Z V D E I E Z R H A Y P L B P N A G E L N V A G T D H O K H V G T I N D O L S F C P L R T. CHAPTER XIX Polyalphabetical Encipherment Applied by Groups Any one of the multiple-alphabet ciphers may change keys at each new group instead of with each consecutive letter. As a rule, this kind of encipherment is never found except in connection with very simple ciphers, and the intact plaintext groups, each one standing on its own key-line, are readily discovered by the decryptor who takes the precaution of cutting out a segment from his cryptogram and “running down the alphabet,” first treating the original letters and then, if necessary, their complements. Porta encipherment, in any form, is rare, but its cryptograms can be subjected to the same process, provided the letters of the tested segment are first enciphered in the _AB_-alphabet, and the subsequent extensions properly carried out. Figure 149 The "PHILLIPS" Cipher 1 C U L P E* 2 R Z Y X W 2 R Z Y X W 2 R Z Y X W 2 R Z Y X W 1 C U L P E* 3 V T S Q O 3 V T S Q O 3 V T S Q O 3 V T S Q O 1 C U L P E* 4 N M K I H 4 N M K I H 4 N M K I H 4 N M K I H 1 C U L P E* 5 G F D B A 5 G F D B A 5 G F D B A 5 G F D B A (1) (2) (3) (4) Plaintext: T R Y M A....... C D O N A....... L D O N T....... H A T M U.. CIPHER: K T Q D C....... T X N F R....... I X C F L....... C R K L D.. 2 R Z Y X W 3 V T S Q O 3 V T S Q O 3 V T S Q O 3 V T S Q O 2 R Z Y X W** 4 N M K I H 4 N M K I H 4 N M K I H 4 N M K I H 2 R Z Y X W** 5 G F D B A 5 G F D B A 5 G F D B A 5 G F D B A 2 R Z Y X W** 1 C U L P E* 1 C U L P E* 1 C U L P E* 1 C U L P E* (5) (6) (7) (8) ..... R P H Y P....... R O P O S....... I T I O N....... C U R L Y. ..... T W G Q W....... M R O R X....... W K W N Z....... T S U Q P. With mixed alphabets of any kind, a number of cases may arise, according to whether groups are of uniform length, or of varying lengths, or, in fact, represent word-lengths; or, in the one case of uniform groups, according to the length of these groups, or the amount of material available, or as to how much is known in advance, and so on. From among so many possibilities, suppose we select the case of accumulated short messages, and, at the same time, take a brief look at a cipher which, according to its description, was actually intended for group-by-group application. This cipher, which may be examined in Fig. 149, was described in an early issue of _The Cryptogram_ as having been used for military purposes, and was called the “Phillips” system. The text of the figure “Try Macdonald on that Murphy proposition. Curly” includes eight five-letter groups, thus requiring eight cipher alphabets. The key, as originally prepared, is a mixed 25-letter alphabet written into a 5 x 5 square, of which the five rows can be cut apart to form five horizontal strips. It may also be set up with anagram blocks. This is alphabet 1 (or block 1), and serves to encipher the first five-letter group. The method of substitution will be explained in a moment. Alphabet 2 (block 2) is derived from the first by moving line 1 so that it stands between lines 2 and 3. Alphabets 3, 4, and 5 are derived by continuing to move the original line 1 so that it stands, successively, between lines 3 and 4, between lines 4 and 5, and at the bottom of the square. Alphabets 6, 7, and 8 are derived by moving the original line 2 according to the same plan. For puzzle purposes, these movements may continue as they apparently began. Line 2 may be given its one remaining shift, which places it at the bottom of the square, and lines 3, 4, and 5 may then be moved downward in the same way as the first two; some puzzlers, in fact, will afterward continue by treating columns. But according to the description (the only one the writer has ever seen of this cipher), the eighth cipher alphabet is the last. For the encipherment of the next eight groups, either the square is restored to its original set-up and the same eight alphabets used again, or the first key is abandoned altogether in favor of an entirely new one. Now, considering any one block, as No. 1, the method of substitution is as follows: Each letter is to be replaced by the one standing immediately to its right on the descending diagonal. If the given letter happens to stand at the extreme right side of the square, it is to be replaced by one standing at the extreme left and on the next line below. If it happens to stand on the bottom row of the square, it is to be replaced by one standing on the top row and in the next column to the right. One letter, in fact, requires both of these (mental) adjustments; the letter which occupies the lower right-hand corner is to be replaced by the one occupying the upper left-hand corner. If the foregoing is well understood, is is quite obvious that our key-square is, to all intents and purposes, a rhombus formed with five diagonals. One diagonal is complete, as _C Z S I A_ of block 1. The other four break off at the right and are continued from the left, as _L X O N F_ of block 1; or, if you prefer, break off at the bottom and are continued from the top, as _N F L X O_ of block 1. It should be obvious, also, that any one of these five diagonals can be considered as beginning with any one of its five letters without in the least changing the encipherment. Thus, each diagonal furnishes what is called _cyclical encipherment_. But, as a matter of fact, the entire square involves cyclical encipherment: The placing of line 1 at the bottom of the square, or of column 1 on the right side of the square, or the transfer of several lines or columns, or of both, will not have any influence whatever on substitutes; for this, it is necessary to alter the 1-2-3-4-5 order of these rows or columns. Alphabet 5, then, will be the same as alphabet 1; and if the plan of the puzzlers be followed, this same alphabet continues to reappear for the encipherment of each fourth group, blocks 1, 5, 9, 13, 17, and so on, of a long cryptogram, eventually giving a great deal of material in one cipher alphabet. Moreover, groups having a length of five letters will carry some very visible simple substitution patterns. Now suppose we look at Fig. 150. These eight cryptograms have all come from one source. The general frequency count has shown a missing letter, _J_, suggesting the use of a square, and we have suspected the cipher as “Phillips.” With cryptograms arranged one below another, as shown, the first five columns are presumably enciphered with block 1 of that cipher, the next five columns with block 2, and so on; thus, we presumably have 40 letters each belonging to alphabets 1, 2, and 3, and almost that number belonging to alphabet 4, that is, enough material for frequency counts which will show whether or not they have been taken on simple substitution alphabets. While 40 letters of text are very few, we could, eventually, solve any simple substitution cryptogram of that length, or any mixed-alphabet periodic whose alphabets have furnished 40 letters each. In the present case, our first alphabet has furnished eight known word-beginnings; we have one column known to contain only initials, and followed by two others which are very likely to be the hiding-place of vowels. This does not mean that we should have no preliminary struggles, but in the end there are plenty of clues to set us on the right road: The predominant letters of alphabet 1 are _A_, _B_, _O_, _K_, _U_ (practically sure to contain _e_, _t_, and one of the vowels _a_ or _o_). The column of initials repeats both _A_ and _T_ (to be compared against a list _t s a_. . . .). The second and third columns, combined, include _B_ and _O_, three times each, with _O_ found in the initial column also (both could be vowels, and _O_ probably represents _a_, though _i_ is also frequently found as an initial). If _A_, by frequency and initial position, be tried as _t,_ then the other repeated initial, _T_, can be tried as _s_. This assumption brings out, in the fourth message, a pattern _s_ - _t_ _t_ -, in which the second letter, _B_, would have to be a vowel, either _e_ or _o_, since it has been doubled, with _e_ appearing more likely in the given pattern and also in that of the sixth message, _s_ - - - _s_. The letter _O_, which under the encipherment scheme could not possibly be its own substitute, can be assumed, by frequency, as _a_, rather than _i_. Figure 150 1. A F S X O S G Y F O N P Y O A K O A D G F Z K S Z O Y Z Y L A W A C F. 2. H O U A L H L E D H D L Y G A V D W A K. 3. K O N B K A X U O N H I Q P L B A Z F F S Y F D R R L Y F. 4. T B A A M A F Q E Z U M A I X G F S K B. 5. D K O A C Y B Y E N I M O W D L E G A D O H C Y U U R G. 6. T B B X T O M M D A S I A A Y D Z. 7. O U S U B U L O I Y G A K X M A K W E L. 8. A K R U W A N A L O N N F M S K A X E U. General Frequency Count: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 25 8 3 10 6 11 7 5 5 . 11 10 7 7 15 2 2 4 8 3 10 1 5 6 12 6 Frequency Count on Alphabet 1, Only: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 6 5 1 1 . 1 . 1 . . 4 1 1 1 5 . . 1 2 3 4 . 1 2 . . These first correct substitutions are all shown on the left side of Fig. 151, on the lines marked (a). Surely the next identification would be the _m_ of _seems_, and probably, too, the _l_ of _settl_. . . With the vowel _a_ already identified, the repeated _OU_ would be tried as _an_, and the repeated _KO_ as _ha_, using the digram list. These are the substitutions marked (b), and from this it is but a step to the assumptions marked (c). On the right side of this figure, we are proceeding into alphabet 2. A frequency count here has shown that the leading letters of this alphabet are _A_, _O_, _Y_, two of which, _A_ and _O_, were also leaders in alphabet 1. It is one peculiarity of the “Phillips” cipher that a change in alphabets means a change in only fifteen of the substitutes, the remaining ten continuing to represent the same originals as in the preceding alphabet. Concerning _A_, we can see, from the third and fourth messages, that it has not continued to represent _t_; but _O_, in the sixth message, has rather suggested the word _all_ and even the expression _all right_, which would carry us on into the third alphabet. From this point onward, then, we are in the same fortunate position as the decryptor who intercepts his message partly in cipher and partly in plaintext. With the context as a guide, we need not worry as to what happens at the ninth group. Figure 151 First Alphabet Second Alphabet 1. A F S X O S G Y F O ... (a) t . . . a . . . n a (b) t . . m a . . o n a (c) t r y m a . . o n a (Try ma...) 2. H O U A L H L E D H ... (a) . a . t . . . . . . (b) . a n t . . s u r . (c) c a n t . e s u r e (Can't be sure...) 3. K O N B K A X U O N ... (a) . a . e . i . . a . (b) h a . e h i m . a t (c) h a v e h i m . a t (Have him ...) 4. T B A A M A F Q E Z ... (a) s e t t . i . g . a (b) s e t t l i n g u . (c) s e t t l i n g u p (Settling up ...) 5. D K O A C Y B Y E N ... (a) . . a t . . . . . . (b) . h a t . o y o u t (c) w h a t . o y o u t (What do you t...) 6. T B B X T O M M D A ... (a) s e e . s a l l . i (b) s e e m s a l l r i (c) s e e m s a l l r i (Seems all ri...) 7. O U S U B U L O I Y ... (a) a . . . e . . a . . (b) a n . n e . s a . o (c) a n y n e w s a . o (Any news abo...) 8. A K R U W A N A L O ... (a) t . . . . i . i . a (b) t h . n . i t i s a (c) t h i n k i t i s a (Think it is a...) Frequency Count on Alphabet 2, Only: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 5 1 . 2 3 2 1 2 1 . . 3 2 3 5 . 1 . 1 . 2 . . 1 4 1 Presumably, during all of this time, we have been recording substitutes in a key-frame. We have recovered fifteen of these in alphabet 1, and also a number in alphabet 2. Those recovered from alphabet 1 are shown at the top of Fig. 152. _O_ is the substitute for _a_, _A_ is the substitute for _t_, _T_ is the substitute for _s_, and _S_ is the substitute for _y_. Thus, if the cipher is “Phillips,” then, in the original key-square, the two letters _A O_ were consecutive on one of the diagonals, the two letters _T A_ were consecutive, the two letters _S T_, and the two letters _Y S_, so that the complete diagonal must have been _Y S T A O_, and even though the letter _o_ was not used at all in alphabet 1, we know that its substitute must have been _Y_, since these diagonals may be considered to begin with any one of the five letters. By beginning at _c_-_H_, and following out another such chain, we may find another complete diagonal, _C H K W D_; and, in addition, we may find parts of diagonals. All of these are shown at (b). Figure 152 An Alphabet No. 1 - Taken from a Key-Frame: Plaintext: a b c d e f g h i . k l m n o p q r s t u v w x y z SUBSTITUTES: O . H . B . . K R . W M X U . . . F T A . N D . S . (a) A T S Y Y O A T S S T A (b) O *Y C E I L *V S H B R M N T K F *X U A *W O D (c) (d) (e) N D .│S│ S . N D . S I N D E . N D . S I N D E S U C│.│T . T . U C B T R U C T . U C . T R U C B .│H│L A H L A . . H L A F . L A . . H L A F . H │.│K M O . K M O . . K M O . K M O . . K M O . . │ │V W X Y . V W X Y . V W X Y V W X Y . V W X Y . Whether or not we can go further than this, without consulting other cipher alphabets, depends upon whether or not the original key-square contained some of those alphabetical, or nearly alphabetical, sequences which so often betray the poorly-mixed alphabet; usually, these are most easily found toward the _X Y Z_ end of the normal alphabet. In the given case (b), we are able to find the letters _V_, _W_, _X_, and _Y_, each standing on a separate diagonal; thus, by readjusting the beginning-points of their diagonals so as to place these letters at the bottom, we are able to set together four of these diagonals in the order shown at (c), leaving only the part-diagonals _E B_ and _I R F_ still to be added. Their length will show that _I R F_ belongs to the missing diagonal, but _E B_, by its length, could belong to any one of three diagonals. Further developments can be carried out with the rhomboid adjustment of (c), or, if this is confusing, the conversion to a square can be made immediately. The student may decide for himself which he prefers of the two developments marked (d) and (e). Notice that this restoration of the key-square can take place not only from a single alphabet, but with only 15 substitutes known in that alphabet. But without the aid of alphabetical sequences, we must, in the first place, have 20 substitutes, four for each diagonal, in order to recover the full diagonals, after which, each one is entirely independent of the other four, so that they cannot be adjusted and combined without consulting one or more of the other alphabets. Here, the method varies a little, according to just what we can recover, though a hasty glance at the perfect case will serve to show the general path for all. To see this as rapidly as possible, we will assume that we have recovered from alphabet 1 the full five diagonals, and that, in alphabets 2, 3, and 4, we have discovered the substitutes for _e_, and also the originals for which _E_ has been the substitute. A careful consideration of the cipher itself will show that no letter can have more than four different substitutes: the four letters in the next column to its right which are not on the same line with itself. Also, that no letter may act for more than four different originals: the four letters in the next column to its left which are not on the same line with itself. Any letter, in order to take all four substitutes and act for all four originals in four successive alphabets, must have started on the top line, which is the moving one. Figure 153 Five Complete Diagonals Recovered From Any Alphabet No.1 Y C E I V S H B R N T K L F U A W M P G O D X Z Q \ ↓ Y \ V │ │ S\I N│ E │ D E S I N T\R│U C B │ U C B T R A│F G H L │ F G H L A │O\P Q K M│ O P Q K M │ \Z W│X X Y Z V W │ \ │D ↑ Now, considering Fig. 153: Our five recovered diagonals are imagined to be those of a well-mixed square, so that we have no discoverable sequences. It has been found that the letter _e_, in alphabets 1, 2, 3, and 4, has taken, successively, the substitutes _B_, _H_, _Q_, and _Z_, and that the cipher-letter _E_ has served, successively, as the substitute for _x_, _u_, _f_, and _o_. The four letters _B H Q Z_, then, must all have stood in a single column _in exactly the order named_; and the four letters _X U F O_ must have stood in another column, two positions to the left of the first, but with a minor difference in the order: some other letter (the one on the same line as _E_) must have intervened between _X_ and _U_. The order in this column, then, must have been _U F O X_. Our first step toward combining the five diagonals is that of adjusting four of them so as to set up the column _B H Q Z_. This automatically sets up four letters of the other column _U F * X_ (_D_) — in the figure, the _X D_ is present, but has not been adjusted to the _U F_ * — after which, the fifth diagonal can be added to the others by placing the _O_ of the column _U F O X_ (_D_). Now, since the letter _E_ has taken, successively, all four of its substitutes and all four of its originals, it must, in alphabet 1, have been standing on the top row. Two parallel lines (if desired) can be ruled across the set-up to show the top and bottom of the square, and two others (placed anywhere, so long as they mark a width of five columns) may be ruled to show the two sides. The outside letters, _Y_, _V_, and _D_, may all be transferred to the opposite ends of their diagonals, after which the rhomboid is easily adjusted to the form of a square. It will be seen from what precedes that group-by-group encipherment offers little, if anything, that is new, and no problems or theories which the student could not figure out with what he has learned of substitutions. Solving the actual cryptograms, of course, could present some difficulties, according to the individual case. Of the practice cryptograms to follow, No. 140 follows the plan of the puzzlers, and should not prove very difficult in spite of its brevity. No. 141 is also a “Phillips,” while No. 142 has been enciphered with a mixed-alphabet slide applied to five-letter groups. 140. By NEMO. ("Phillips." Probable word: ASSOCIATION) N D Q T F Q Z C N G B U Z H X N L U K Y F T E E W N R G U R M O X Q X E Q Z L B G X H W F F N R P X P X V D D F I T G S E W R T I I T Z X E R V W A R I S P E Y I G R Q C. 141. By PICCOLA. (This is the real McCoy - in 1938. But times change). (a) K G E U H C K T S X P C K N C A D F X Q C B X T (b) O U T U I U B F S B Q A P H N B Y Z X X L R U G (c) O F U O S K H Q T K P W Q F E T B W W X P K B O K G H (d) B L A M R P G X B W G C W K Q Z I A Q C U H Y R C (e) G U C O S B B L P S B Q D K P G P K D S R C T B L I (f) X R O S U I T T F G Y P C M C K F T F X O S R B H O A G M (g) B O I B V B U K E E B D K B C O B Y W B T B M U H O O A B (h) Y C U Y U T B I T F H S A N P H C W T. 142. By PICCOLA. (Direct examination - Snowball vs. Snowball). (q) H F X L F M B L R N I N J W P Z Z G I S B B O Z X S F S H R H T A T M R O F V ? (a) S X F U R R W X I Q S S. (q) U F V H C N T I T T F O E J X O G N S G X U S O E H I V L X E A T ? (a) U R Q Q T W E X U W I T O S. (q) H C W R U Q U I T T F Y O Q I U D R S G X Z W H G F E T P C J E M K Q F I N D O E E Z B L ? (a) U R Q Q T W. (q) U R S U F U G J R E D V T O V E C Z X Z U Z G X S D S H C Q K E X Z W I O V I R M H D W B D Z R R M ? (a) U R Q T D H T T H I J S S. (q) X C Q H R E M Z L T T O P A V H U L E B O Y O G N U F V X T Z L E K S W F A V N ? (a) X R L L Q E W L T C O S P W V C Z L E B D W Y I Z F I S R D T W C E Z T T A S G O L E. 143. By PICCOLA. (Can you guess what cipher? "Foregoing" refers to No. 141). R N N G T R I O O H E I T T A F N D E N O G E L G E Y F I R D A I S E. CHAPTER XX Vigenère with Key-Progression Before leaving the study of multiple-alphabet ciphers, we will consider briefly the process which, in its simplest form, would be that shown in Fig. 154. The initial key, in each of three examples, is _A_, and a long key has been formed by causing the initial one to progress in the normal alphabet according to an agreed index. In the first example, the progression index is 1, in the second, it is 2, and in the third, it is 25 (or minus 1). The resulting long key will govern a period, which is 26 or 13, according to whether the progression index is odd or even. This encipherment, logically, would be applied with a cipher disk. The initial key, as _A_ of the examples, would indicate the starting position of the revolving disk, the first letter being enciphered with the disk in this initial position, after which the disk is made to revolve, so many angles at a time, without further reference to key-letters. For this kind of cryptogram, the solution is purely mechanical. A series of alphabets may be extended, with each cryptogram letter as a beginning, and the message can be found following a diagonal path in the resulting set-up. Figure 154 Forms of Key-Progression Keys: A B C D E F G... A C E G I K M... A Z Y X W V U... S E N D... S E N D... S E N D... S F P G... S G R J... S D L A... This type of key-progression can be decrypted by "running down the alphabet," and watching the diagonals for plaintext. A much commoner scheme, when using a cipher disk, is that of following a series of irregular shifts in accordance with a numerical key. If, for instance, the initial position has been established and the first letter enciphered in that position, and if the numerical key is 3-5-2-1-6, the disk will now be revolved 3 positions for encipherment of the second letter, 5 positions for encipherment of the third letter, 2 positions for encipherment of the fourth letter, and so on, so that the disk must move 17 positions during encipherment of five letters. This can produce a very long period indeed, especially when the collective shifts result in an odd number. Figure 155 Progressing Key: C U L P E P E R D V M Q F Q F S E W N R ... Plaintext: T H E R E I S O T H E R C A U S E F O R ... Partial Encipherment: V B P G . . . . W C Q H . . . . . . . I ... Substantially the same encipherment as the foregoing can be had with a slide and a key-word, as indicated in Fig. 155. The progression index, in this figure, is 1. The preliminary key-word, CULPEPER, enciphers the first eight letters, then moves forward in the alphabet and becomes _D V M Q F Q F S_ for the encipherment of the next eight, _E W N R G R G T_ for the encipherment of the third eight, and so on. In its practical application, one column could be taken at a time. Notice, however, in Fig. 156, that when a key-letter progresses in the alphabet, the possible substitutes for any one letter will also progress, and to exactly the same extent. If the encipherment is Vigenère or Beaufort proper, this progression is in the same alphabetical direction as that of key-letters, while the variant encipherment causes the substitutes to progress in the contrary direction. Probably, then, the most convenient method of application, and the one least likely to result in errors, would be that of Fig. 157. The cryptogram is first enciphered as an ordinary periodic, and the progression is added later, using group-by-group encipherment. Thus, as we receive the cryptogram, our repeated _ther_ has been enciphered once as _V B P G_, again as _W C Q H_, and possibly, later on, as _A G U L_, and the only period we shall be able to find, using the regular methods, will be 26 x 8, or, if the progression index is an even number, 13 x 8. But notice, in the same figure, comparisons (a) and (b). Figure 156 Vigenère and Beaufort Progression Variant Progression Progressing Key: A B C D E..... Progressing Key: A B C D E..... Plaintext letter: H H H H H..... Plaintext Letter: H H H H H..... Cipher letter (V) H I J K L..... Cipher letter: H G F E D..... (B) T U V W X..... Vigenère, it will be remembered, has been compared to the mathematical process of addition. If the key-digram _CU_ be added to the plaintext digram _TH_, their sum is the cipher-digram _VB_. The alphabetical distance from _C_ to _U_ is 18, the alphabetical distance _TH_ is 14, and the alphabetical distance _VB_ is 6 or could be 26 plus 6, 52 plus 6, and so on. It is a fact that when we “add” the two digrams _CU_ and _TH_, we actually do add their separating intervals, 18 and 14, since we obtain a sum 32 in that of the cipher digram _VB_. It is also an easily verified fact that the same reasoning applies to the subtractions of the two Beauforts. The student who cares to investigate may make use of the tableau shown as Fig. 158; to find quickly the distance from one letter to another, find the first of these at the left, the second at the top, and the alphabetical interval between the two is shown in the cell of intersection. If it is desired to know the reverse interval, find the first letter at the top and the second at the side. Now notice, carefully, that when any digram progresses in the alphabet, as _CU_ would become _DV_, _EW_, _FX_, and so on, in a series of periods, _it does not change its alphabetical interval_; in all of these digrams, the distance apart of the two component letters is still 18. Thus, while our period vanishes, the alphabetical intervals which represent it are still present in the cryptogram; we have only to find these intervals, subject them to a Kasiski examination, and convert the cryptogram to an ordinary Vigenère. Figure 157 Initial Key-word: C U L P E P E R C U L P E P E R C U L P E P E R Plaintext: T H E R E I S O T H E R C A U S E F O R T H I N... PRIMARY Cryptogram: V B P G I X W F V B P G G P Y J G Z Z G X W M E... Progression Key: A B C FINAL Cryptogram: V B P G I X W F W C Q H H Q Z K I B B I Z Y N G... (a) C U (key) plus T H (plaintext) equals V B (cipher). (b) Interval 18 plus interval 14 equals (32 less 26) = 6 Figure 158 Tableau for Finding ALPHABETICAL INTERVALS A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 A B 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 B C 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 C D 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 D E 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 E F 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 F G 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 G H 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 H I 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 I J 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 J K 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 K L 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 L M 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 M N 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 N O 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 O P 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 P Q 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 Q R 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 R S 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 S T 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 T U 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 U V 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 V W 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 W X 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 X Y 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 Y Z 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 Z A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Fig. 159 shows the preparation of the cryptogram: The alphabetical interval from _K_ to _O_ is 4, that from _O_ to _S_ is 4, that from _S_ to _X_ is 5, and so on. If these numbers are placed directly below the first letter, as shown, the computation of their _lineal_ intervals apart is less confusing than when they are placed between the two. As to repetitions, each repeated single number may represent a repeated digram, each repeated sequence of two numbers may represent a repeated trigram, and so on. Only the longer of these possibilities have been underscored. Figure 159 (5) (10) (15) (20) K O S X M Y M M Q Y T K N G Z W L T Z L 4 4 5 15 12 14 0 4 8 21 17 3 19 19 23 15 8 6 12 22 (25) (30) (35) (40) H C G F A P J Y K W A T Z P Q X U J Z P 21 4 25 21 15 20 15 12 12 4 19 6 16 1 7 23 15 16 16 6 (45) (50) (55) (60) V C Z Q A R F P V Y U Y C R C X M X G I 7 23 17 10 17 14 10 6 3 22 4 4 15 11 21 15 11 9 2 21 (65) (70) (75) (80) D U X Q Y M T E V V S C X J L J D A E Y 17 3 19 8 14 7 11 17 0 23 10 21 12 2 24 20 23 4 20 4 (85) (90) (95) (100) C S F P J W F V J V Q V E G A N G K B B 16 13 10 20 13 9 16 14 12 21 5 9 2 20 13 19 4 17 0 17 (105) (110) (115) (120) S C P Z B H G I D Z J A N Z I Y E Z P T 10 13 10 2 6 25 2 21 22 10 17 13 12 9 16 6 21 16 4 - Figure 160 Repeated Intervals Lineal Interval Possible Factors 4-4 KOS-UYC 51 - 1 = 50 2 5 10 15-12 XMY-JYK 27 - 4 = 23 21-17-3-19 YTKNG-IDUXQ 60 - 10 = 50 2 5 10 23-15 ZWL-XUJ 36 - 15 = 21 3 7 21-15 FAP-CXM 55 - 24 = 31 7-23 QXU-VCZ 41 - 35 = 6 2 3 6 16-6 ZPV-IYE 115 - 39 = 76 2 4 19 17-10 ZQA-BSC 100 - 43 = 57 3 19 10-17 QAR-ZJA 110 - 44 = 66 2 3 6 11 15-11 CRC-XMX 56 - 53 = 3 3 9-2 XGI-VEG 92 - 58 = 34 2 17 2-21 GID-GID 107 - 59 = 48 2 3 4 6 8 12 17-0 EVV-KBB 98 - 68 = 30 2 3 5 6 10 13-10 SFP-CPZ 102 - 82 = 20 2 4 5 10 20-13 PJW-GAN 94 - 84 = 10 2 5 10 9-16 WFV-ZIY 114 - 86 = 28 2 4 7 Fig. 160 shows the application of a modified Kasiski examination. Notice the prominence of small factors 2 and 3, caused, often, by repeated alphabetical intervals in the key itself. In the given case, the period 10 would probably be the choice, though period 5 is correct; in practice, we should probably consider possible digrams as well as longer sequences. Accepting period 10, we have still to learn the progression index, and for this we must consider letters, all of which are shown in the second column of the same figure. Taking the longest repetition, most likely to be reliable, the two first letters are _Y_ and _I_; their alphabetical distance apart is 10, and their lineal distance apart in the cryptogram is 50. If the accepted period, 10, is correct, it has taken five periods to produce the alphabetical shift of 10, therefore the shift per period (the progression index) is 10 divided by 5; or 2. This, of course, has taken for granted that the encipherment is either Vigenère or Beaufort. Considered as a possible variant Beaufort, where the progression is backward, the alphabetical interval from _Y_ to _I_ is 16, which is not divisible by 5, the number of periods. But this progression might have covered the entire alphabet and then included 16, or it might have covered the alphabet twice, and so on, before including 16. We must make it divisible by 5, adding 26, then another 26, and so on, until we obtain a total progression of 120. This, divided by 5, gives the progression index as “minus 24” — the same as a normal progression of 2. In Fig. 161, the cryptogram has been re-written into the accepted period 10, and the figures in parentheses at the right of each group will indicate the amount of alphabetical shift when the progression index is 2. A constant progression of 2 per group would correspond to the application of a Vigenère key _A C E G_. . . . . , so that the Saint-Cyr slide will serve for quickly converting the cryptogram to its periodic form, and this is shown in Fig. 162. The period, as mentioned, is actually 5, though this makes no difference in the final results. Figure 161 Figure 162 K4 O4 S5 X15M12Y14M0 M4 Q8 Y21 (A) K O S X M Y M M Q Y T17K3 N19G19Z23W15L8 T6 Z12L22 (2) (C) R I L E X U J R X J H21C4 G25F21A15P20J15Y12K12W4 (4) (E) D Y C B W L F U G S A19T6 Z16P1 Q7 X23U15J16Z16P6 (6) (G) U N T J K R O D T J V7 C23Z17Q10A17R14F10P6 V3 Y22 (8) (I) N U R I S J X H N Q U4 Y4 C15R11C21X15M11X9 G2 I21 (10) (K) K O S H S N C N W Y D17U3 X19Q8 Y14M7 T11E17V0 V23 (12) (M) R I L E M A H S J J S10C21X12J2 L24J20D23A4 E20Y4 (14) (O) E O J V X V P M Q K C16S13F10P20J13W9 F16V14J12V21 (16) (Q) M C P Z T G P F T F Q5 V9 E2 G20A13N19G4 K17B0 B17 (18) (S) Y D M O I V O S J J S10C13P10Z2 B6 H25G2 I21D22Z10 (20) (U) Y I V F H N M O J F J17A13N12Z9 I16Y6 E21Z16P4 T- (22) (W) N E R D M C I D T X Figure 163 MATHEMATICAL FORMULA - C. H. PRICE X = AD x P LD P = Period AD = Alphabetical Distance X = Progression Index LD = Lineal Distance As Applied to the Supposed Repeated Trigram KOS-UYC, Positions 1, 51: X = 10 P = P 50 5 BUT: P and X must be integers • • If P = 5, then X = 1 (and P must be a divisor of 50) • If P = 10, then X = 2 (Periods of 25, 50, are unlikely) For those who like mathematics, Fig. 163 shows a method used by one of our collaborators for determining both the period and the progression index directly from the cryptogram. Price also preferred to find alphabetical intervals by writing the normal alphabet into a block, five letters to the line, with _Z_ standing alone on the last line; thus, except for watching _Z_ occasionally, the distance from one letter to another could be counted by fives. It is understood, of course, that we do not accept the evidence obtained from only one of the supposed repeated sequences; too many of these will be accidental, and many of those which are actually periodic have not represented repeated digrams, but merely repeated intervals. Naturally, too, the progression index need not be a small number; the disk encipherment, mentioned in the beginning, showed a progression of 17 for each period 5. This disk encipherment, incidentally, has been dealt with in a most interesting manner in Givierge’s _Cours de cryptographie_. * * * We have seen, then, all of the essentials of polyalphabetical encipherment. With the cipher alphabets known to the decryptor, practically all of the multiple-alphabet ciphers will be solved by suitable modifications of processes described for Vigenère. When alphabets are not known, his problem, always, is that of collecting as many as possible of the substitutes belonging to each alphabet, so that he may determine both the order of the letters and the relationship of alphabets to one another. 144. By THE SQUIRE. S O V F O G S G U F V I J R I F M O U I C F T T I K Z Y Z Z Z U I F Q Q L O W U V A F J F I W W L N C R G J F E M V V N N C D H W T A J N W A R D B. yallyyayyayalyyaaallayaaaylalllaylyayyallyyayaylalllyyall. 145. By NEMO. Y Y I Z C U O F Y V H Q Y H T B E B S X P T S Y C R M R X L X E A G U Y L P U Q B U U Q N Y U S O Q M O O S P U G I J I I F F F A L I R G G F G E H H N T E G Y Z S M C O F U D E M X O G I K K V B N K W K P Q X M G D L A I F N H M X T U M E Z X Y Z G N A P D W C D M N C T T H N J F D. 146. By PICCOLA. (We wouldn't throw monkey-wrenches for anything!) X E I T B B B B V M X R S J P Y L K E N Y K S Z K F R W L G S A Y E A V I X I X D U V D U R J G E I B A N Z F H D C C Y C O Y R V A B K W B R H F K K F X S E J Y T F N L R N I V K V K Q H I Q H I J L P G O U J V F C F T S H L I D V D D M P. 147. By DAN SURR. (Might try this without bothering about its progression!) E C G M H T Y T A J B T H N G A W K L I B E M N R H T D G N G P D A O Q A X R P Z P F H D D X I E A U B S Y C I X C W V R H P B O I X Y P Y D V W N R N X O O K K I H F O X D S V L V W W C L I H Z H V W R L H W M M I E E A H G Q Y R S R L K L W Z T J A Y W F N S S U C V Z L P X P S E E E Y R T H D H T Z N U P U R M G K Z N T Y E Q D E Z E N N H W M I N R L P S S W P Y M C R U B J Z Y C R N L M A S M E U C L R M D Y R N E S T O B V J E U D V L O T S Q B J H B N R L B V D X J P X N I G F I C Q J Y Q Z X Q G K B L F Q U B Q K N E L S S L Y G T L F L T D Z Z Y K E E R H K L W L I M R N J S O O J P Q C A U D M E I B B Q X A H C V A J C M G X B I C D K V C L G Q I B S C F V F W Q N A X I D R Z S X R B I W R C Q R. 148. By PICCOLA. (When is a tramp not a tramp?) E R N I C D M R A S T A A P H T P I L T Q V A A S N E A E E R O O L R. CHAPTER XXI Polygram Substitution — The Playfair Cipher Polygram substitution contemplates the encipherment of several letters collectively: Digrams are to be replaced with other digrams, or with three-digit numbers; trigrams are to be replaced with other trigrams, or with four-digit numbers; and so on, the substitute for an individual letter being entirely dependent upon the combination in which it happens to occur. Many devices have been contrived for accomplishing this. For pair-encipherment, tableaux of the general kind shown in Fig. 164 are fairly common. Figure 164 A M E R I C N B D F G H J K L O P Q S T U V W X Y Z E AA BA CA DA EA FA GA HA IA JA KA LA MA NA OA PA QA RA SA TA UA VA WA XA YA ZA Q AB BB CB DB EB FB GB HB IB JB KB LB MB NB OB PB QB RB SB TB UB VB WB XB YB ZB U AC BC CC DC EC FC GC HC IC JC KC LC MC NC OC PC QC RC SC TC UC VC WC XC YC ZC A AD BD CD DD ED FD GD HD ID JD KD LD MD ND OD PD QD RD SD TD UD VD WD XD YD ZD L AE BE CE DE EE FE GE HE IE JE KE LE ME NE OE PE QE RE SE TE UE VE WE XE YE ZE I AF BF CF DF EF FF GF HF IF JF KF LF MF NF OF PF QF RF SF TF UF VF WF XF YF ZF T AG BG CG DG EG FG GG HG IG JG KG LG MG NG OG PG QG RG SG TG UG VG WG XG YG ZG Y AH BH CH DH EH FH GH HH IH JH KH LH MH NH OH PH QH RH SH TH UH VH WH XH YH ZH B AI BI CI DI EI FI GI HI II JI KI LI MI NI OI PI QI RI SI TI UI VI WI XI YI ZI C AJ BJ CJ DJ EJ FJ GJ HJ IJ JJ KJ LJ MJ NJ OJ PJ QJ RJ SJ TJ UJ VJ WJ XJ YJ ZJ D AK BK CK DK EK FK GK HK IK JK KK LK MK NK OK PK QK RK SK TK UK VK WK XK YK ZK F AL BL CL DL EL FL GL HL IL JL KL LL ML NL OL PL QL RL SL TL UL VL WL XL YL ZL G AM BM CM DM EM FM GM HM IM JM KM LM MM NM OM PM QM RM SM TM UM VM WM XM YM ZM H AN BN CN DN EN FN GN HN IN JN KN LN MN NN ON PN QN RN SN TN UN VN WN XN YN ZN J AO BO CO DO EO FO GO HO IO JO KO LO MO NO OO PO QO RO SO TO UO VO WO XO YO ZO K AP BP CP DP EP FP GP HP IP JP KP LP MP NP OP PP QP RP SP TP UP VP WP XP YP ZP M AQ BQ CQ DQ EQ FQ GQ HQ IQ JQ KQ LQ MQ NQ OQ PQ QQ RQ SQ TQ UQ VQ WQ XQ YQ ZQ N AR BR CR DR ER FR GR HR IR JR KR LR MR NR OR PR QR RR SR TR UR VR WR XR YR ZR O AS BS CS DS ES FS GS HS IS JS KS LS MS NS OS PS QS RS SS TS US VS WS XS YS ZS P AT BT CT DT ET FT GT HT IT JT KT LT MT NT OT PT QT RT ST TT UT VT WT XT YT ZT R AU BU CU DU EU FU GU HU IU JU KU LU MU NU OU PU QU RU SU TU UU VU WU XU YU ZU S AV BV CV DV EV FV GV HV IV JV KV LV MV NV OV PV QV RV SV TV UV VV WV XV YV ZV V AW BW CW DW EW FW GW HW IW JW KW LW MW NW OW PW QW RW SW TW UW VW WW XW YW ZW W AX BX CX DX EX FX GX HX IX JX KX LX MX NX OX PX QX RX SX TX UX VX WX XX YX ZX X AY BY CY DY EY FY GY HY IY JY KY LY MY NY OY PY QY RY SY TY UY VY WY XY YY ZY Z AZ BZ CZ DZ EZ FZ GZ HZ IZ JZ KZ LZ MZ NZ OZ PZ QZ RZ SZ TZ UZ VZ WZ XZ YZ ZZ The tableau proper includes a full list of the 676 possible two-letter combinations, while two external alphabets will furnish another possible 676 two-letter combinations. With the plaintext marked off into pairs, the encipherment of a pair is usually accomplished by finding its two letters in the two external alphabets, where they act as co-ordinates, and replacing this pair with the one which is found at the cell of intersection. Thus, using the tableau of the figure, and the order row-column, the substitute for _th_ would be _LG_; or, using the order column-row, _TN_. With a tableau like that of the figure (notice the straight unshifted alphabets), it is also possible to encipher by what is ordinarily considered the decipherment process, finding the plaintext pair inside the tableau and replacing it with the two co-ordinates. But many of these tableaux are filled in a thoroughly haphazard manner, and when this is the case, only the ordinary encipherment plan is really feasible; in fact, the decipherer has trouble in finding his cryptogram pairs, and it is usually necessary that a second tableau be prepared especially for decipherment purposes. On the other hand, it is very easy to construct a mixed tableau in such a way that all of its encipherment is reciprocal, and in this case there is no need for a second tableau, since encipherment and decipherment are the same process. In most forms of tableau, one or both of the external alphabets may be made to slide and for the most part external alphabets are readily changeable. But the tableaux themselves will have to be of more or less fixed nature. Those which are safest are least readily reconstructed from memory, and even those most easily remembered are not set up very rapidly. Another common method for pair encipherment can be understood from the following description: Picture a chart of 100 cells which is divided sharply into four quarters; that is, having much the appearance of a 100-cell Fleissner grille. Each of the four quarters is a 5 x 5 square and contains a 25-letter alphabet. At least two of these alphabets are mixed, usually with different keys. To encipher a pair, find its two letters in two different squares, and substitute two others which occupy certain relative positions in the other two squares. Figure 165 The "SLIDEFAIR" Cipher -(H. F. GAINES) Key: H E R C U L E S Plaintext: SE ND DI AM ON DS TO AM CIPHER:..... XZ ZR RU KC TI HO KX US ST ER DA MM ON DA YW EE ..... MZ NI JU KO TI PO SC MW KW IT HO UT FA IL ..... PR PM XY RW GZ AT Cryptogram taken off: X Z Z R R U K C T I H O K X U , etc. The writer’s own contribution, accomplished with a slide, may be examined in Fig. 165; the slide used in the example was the Saint-Cyr, and details are self-explanatory, except for the method of enciphering pairs, which was as follows: To encipher those of the _H_-column, bring the _H_-alphabet into position on the slide; then, for each pair, find its first letter in the upper alphabet and its second letter in the lower one; imagine these to be standing at the two ends of a diagonal, and substitute the two letters from the two ends of the corresponding cross-diagonal, taking the upper one first. Where the two plaintext letters happen to coincide (as would be the case with a pair _EL_ using the _H_-alphabet of the Saint-Cyr slide) use the two letters which have also coincided immediately to their right (as _FM_ for _EL_ in the given case). Occasionally, such a tableau as that of Fig. 164 is made to serve (not very successfully) for trigram encipherment. A third external alphabet is added beside one of the others, so that the two which are parallel will make provision for the encipherment of a third letter simultaneously with the encipherment of each pair. But for trigram encipherment, another type of tableau is commoner: The tableau proper is not a list of pairs, but an alphabet square such as could be prepared for one of the mixed-alphabet slides of Chapter XVIII, and is accompanied by four external alphabets, two on the left and two across the top. The exact details of construction are not always the same, and the methods prescribed for using such a tableau are sometimes quite devious, but results are fairly uniform: We obtain cryptograms in which enciphered pairs have alternated with enciphered (sometimes _not_ enciphered!) single letters. In all of the foregoing, no system has been mentioned which the student will not be able to analyze for himself. At worst, he has a case very much like simple substitution, except that he would require a great deal more material, and would use a digram chart instead of a frequency list. Otherwise, he usually finds that he has merely a variation of pure periodic encipherment. There are, of course, more effective methods. Trigrams, tetragrams, and other polygrams, found in alphabet squares, can always be considered as geometrical figures, and replaced with other series of letters in related geometrical figures; and Lester S. Hill, in the American Mathematical Monthly, has described an “algebraic” method which appears practical, provided a machine is used. These methods, however, even granting that some are practical and not too unwieldy for use, are entirely beyond our present scope, and we will spend our few remaining pages on a cipher of a less cumbersome nature and presenting far more points of interest. Figure 166 The PLAYFAIR Cipher KEY Encipherment Some Equivalent Keysquares C U L P E (1) bl = IB L P E C U N O Q S T Y Z V W X R A B D F ez = FE B D F R A V W X Y Z P E C U L G H I K M (2) cl = UP I K M G H C U L P E D F R A B N O Q S T ce = UC Q S T N O R A B D F K M G H I V W X Y Z (3) th = OM X Y Z V W G H I K M S T N O Q ht = MO Example: SE ND DI AM ON DS TO AM ST ER DA MX MO ND AY WE EK WI TH OU TF AI LX. TP SR BK FH QO KY NQ FH TN CF FB IZ HT SR DW ZU PM XH OM WA ZM BH BL. * * * _The Playfair cipher_, which may be examined in Fig. 166, requires no apparatus other than pencil and paper. Its key is the usual 5 x 5 square, based on a key-word, and filled in by any agreed plan (preferably not by straight horizontals). For encipherment, the plaintext is marked off into pairs, and these pairs are enciphered according to three very simple rules: 1. If the two letters of the pair are found in the same column in the key-square, replace each letter with the one directly beneath it; and if one letter stands at the bottom of the column, use the one standing at the top of the same column. With the key of the figure, _ha_ becomes _OH_; _wa_ becomes _UH_. 2. If the two letters of the pair are found in the same row in the key-square, replace each letter with the one immediately to its right; and if one letter stands at the extreme right end of the row, use the one standing at the extreme left end of the same row (_os_ becomes _QT_; _st_ becomes _TN_). 3. If the two letters of the pair have a diagonal relationship in the key-square (and these are usually in the majority), consider them to be standing at the diagonally opposite corners of an imaginary small rectangle, and substitute for each letter that letter of the other diagonal which stands on the same row with itself (_bu_ becomes _AL_, not _LA_). The decipherment rules, as usual, are the same rules in reverse. * * * Notice that this encipherment is _cyclical_. So long as the order 1-2-3-4-5 is maintained in both columns and rows, it makes no difference whatever how many columns are transferred from one side to the other, or how many rows are transferred from top to bottom. This may be investigated in the three equivalent squares of the figure. Notice, too, that our three rules do not make any provision for the case in which the two letters of a pair are the same. If, in marking off the plaintext into pairs, we encounter a pair which is a double, it becomes necessary to dispose of this, usually by inserting a null which will throw the second letter into the next pair. Occasionally we find a sequence such as LESS SEVEN, in which it is necessary to do this twice in succession: _LE Sx Sx SE VE Nx_. An unpaired final letter also requires a null (unless left unenciphered), and when five-letter groups are to be used, it often becomes necessary to complete a final group by adding nulls. The foregoing description and rules are those of the original Playfair cipher. Many encipherers, however, will vary the rules, especially the one concerning doubles; perhaps one letter will be omitted or replaced with a null; sometimes one double is replaced with another; occasionally an encipherer will separate every doubled letter in the message whether or not this is necessary. We meet, too, with variant forms. A 24-letter alphabet will be used in a 4 x 6 rectangle, or a 27-letter alphabet (with character &) will be used in a 3 x 9 rectangle. One variation, attributed to W. W. Rouse-Ball, uses the standard key-square with the standard rule 3, but varies the two rules for lineal encipherment. Rule 1: If the two letters of the pair stand in a column, use the two letters immediately to their right. Rule 2: If they stand in a row, use the two letters immediately beneath them. In all of these cases, presuming the method to be known, the degree of difficulty would be the same as if the standard system had been used; otherwise, it is only necessary to keep in mind the fact that variations occasionally occur. We will give our attention, then, to the standard encipherment. But before entering into the subject of decryptment, let us look carefully at the system itself. Primarily, we have a _fixed_ substitution. No plaintext pair ever has more than one substitute pair; and no substitute pair ever changes its original. We might say that the Playfair is, in effect, a “simple substitution” based on an “alphabet” of 600 pairs; and, just as in simple substitution proper, the Playfair cryptograms will very often contain long repeated sequences which represent whole words. Again, the reversal of a plaintext pair means the reversal of its substitute pair, and vice versa, so that the discovery of any one equation (as _th_ = _OM_) always means the discovery of another (as _ht_ = _MO_); and if, in addition, the encipherment was a rectangular one (rule 3), we obtain also the two reciprocal equations (as _om_ = _TH_, and _mo_ = _HT_). The two lineal encipherments, however (rules 1 and 2), are not reciprocal. But notice particularly that, in spite of the polygram theory, each letter has its individual substitutes. No letter in the key-square may have more than five of these; the four which are standing on its own line, and the one which stands directly beneath it. It may be learned, too, by writing out the 24 (or 48) possible pairs for any one given letter, that the letter standing immediately to its right in the key-square is twice as likely as any one of the other four to act as its substitute; and, further than this, that any letter which is paired with it will be limited to eight possible substitutes, all of which must be found either in the column or on the row of the letter itself. To clarify this important point, let us assume that the letter in question is _E_, and that the key-square is that of Fig. 166. The letter _E_ may have only the substitutes _C_, _U_, _L_, _P_, and _F_, with _C_ twice as likely to be used as any one of the other four. Any letter which is paired with _E_ must take one of the following substitutes: _U L P E F M T Z_. Naturally, then, those letters which, in the key-square, are standing on the same row or in the same column with the normally frequent letters will have high frequencies in the cryptograms; in fact, the two or three which predominate in a given cryptogram will practically always be letters which, in the key-square, were standing in the same row or column with _E_ or _T_ (in English). Moreover, if any letter has been identified once as the substitute for _E_, there is a most excellent chance that it can be identified again as the substitute for _E_. Say, for instance, that _CF_ has been identified, or assumed, as the substitute for _er_. This means that _C_ is individually the substitute for _e_, and when another pair _CT_ is found to be of some frequency, it can be tried as the substitute for _en_, _es_, _et_, and so on. Single-letter frequencies, then, will play an important part in the decryptment of the Playfair. But the process will rest fundamentally upon the frequencies of digrams, and will follow, in general, three steps repeated over and over in the same rotation: 1. Certain pairs are identified, or assumed, as the substitutes for certain digrams. 2. These pairs and their supposed originals are set together in such a way as to start the reconstruction of the key-square. 3. Substitutions are made on the cryptogram and further pairs are identified. When probable words exist, the work of solution becomes more or less mechanical, as we shall see. At worst, we may begin at the beginning of the cryptogram and work straight through until we find the word. But very often, a really probable word is repeated, and even repeated more than once. In the latter case, we are sure to find the long repeated sequence in the cryptogram; while a word repeated only once may have been divided into two different sets of pairs, as: _ex_-_ec_-_ut_-_io_-_n_ and _e_-_xe_-_cu_-_ti_-_on_. But notice, here, what the two encipherments would be, using our key-square of the figure: _LZ CU EO HQ x_ and _x ZL UL QM QO_. These two sequences have five letters in common, _L Z U O Q_, and, in addition, when considered together, show the letters _E C U O_ of the word “execution.” This does not invariably happen, but is far from uncommon. Nor is the word “execution” the only one which produces reversal (_ex_ in one sequence, _xe_ in the other). Then, too, there are many words like “commission” which, regardless of the point at which the division begins, will always end in the same set of pairs: _mi_-_s?_-_si_-_on_. Granting an absence of probable words, the difficulties of solution are almost entirely dependent upon the amount of material available. A pair-count will be made in the usual chart-form (but only on the divided pairs, and not “straddling” from one pair to another), and pairs will be identified by frequency, by the frequency with which they are found reversed, by the possibility of their letter-combinations in a key-square, and so on. We will not attempt, here, to go into a detailed demonstration, since every case is individual in its details, and success, in all of them, is dependent largely upon the decryptor’s own persistence. But in order to see sketchily what some of the routine might be, we will make use of the very short example shown in Fig. 167. In the usual case, there has been a preliminary frequency count on single letters in order to find out what the cipher is. The appearance of this frequency count has more or less negatived the possibility of simple substitution, and the next step has been a Kasiski tabulation in the hope of finding a period. This tabulation, in any pair-system, will bring out a predominant factor 2, and, since many of the supposed digram systems actually do produce periods, the two supposed alphabets would have been examined for that possibility. But pair-systems, as a rule, will leave a wide-open trail: Repeated sequences, in the majority of cases, will include an _even_ number of letters (that is, an exact number of pairs), and will begin largely at the _odd_ serial positions (that is, at the beginnings of pairs). The Playfair shows this a little less distinctly than some of the others, because of the fact that substitutes for single letters are so limited in number. It is sometimes said of the Playfair that it can be distinguished from other ciphers by (1) the fact that cryptograms contain an even number of letters, (2) the fact that only 25 letters are represented in its general frequency count, (3) the fact that when the cryptogram is marked into pairs, no pair will be a doubled letter, and (4) the presence of long repeated sequences at irregular intervals. As conclusive evidence, these are debatable points, but all are good supporting evidence, provided a proper confession can be extracted from the pair-chart: (5) When the cryptogram has been marked off into pairs, and the pairs counted, the result should bear much resemblance to a count made on the same number of normal digrams. Even on an extremely long cryptogram, over half of the cells will be blank, since a normal text never uses more than about 300 of the possible 676 combinations; there will be a certain group of predominant pairs followed by a group of moderate frequencies; and, with any appreciable length, there will be a generous sprinkling of reversals. In preparing the cryptogram, a great deal of convenience may be had by placing frequency figures beside their digrams, by marking long repeated sequences, noticeable reversals, and so on; and many persons like to list the most prominent pairs and the most prominent reversals. Figure 167 HR5 KY3 LD ZX NQ2 EO ND EC TC TI2 AD CT AK RH LB2 GT SN AN UN2 ON DR HX PE BN ZC DT KV EQ2 HD AO HR5 DU RP TQ OB DE2 QD2 HR5 KY3 YA2 HZ HB BU KZ EQ2 XG TI2 BI KY3 RI CQ HR5 CE CO SX RM BC TH CG QD2 RK NQ2 IT DC WT FV2 UB2 YA2 GU HE CZ NU2 LB2 IQ2 YK FV2 UB2 IQ2 WD QB UN2 KM DE2 TD KA HR5 NU2 OU Frequency Count - Rearranged: D H B C N Q R T K U E A I O Y Z G X L V F M P S W J 14 12 11 11 11 11 11 11 10 10 9 7 7 6 6 5 4 4 3 3 2 2 2 2 2 - List of REVERSALS "Chart of Probable Position" HR 5 - RH 1 EC - CE E T/ D H B C N Q R K U KY 3 - YK 1 TC - CT D H UN 2 - NU 2 AK - KA B C N Q R UB 2 - BU 1 ZC - CZ K U TI 2 - IT 1 DT - TD The Playfair has also a rather characteristic frequency count. Notice, in the figure, where the general count has been rearranged in the order of decreasing frequencies, that the gradation from high to low is somewhat less even than in a periodic; frequency 8, for instance, is skipped altogether, and we have a sort of modified high-frequency group. Sometimes we find from one to three letters of great prominence before the downward gradation begins. Concerning the “chart of probable position,” most solvers prefer simply to keep this in mind, while others will actually set it down and make it the basis of their solution. With 176 letters of text, the average frequency of letters is about 7 (176 divided by 25). Any letter whose frequency is above that average is very likely to have been standing on the same row or in the same column of the key-square as _E_ or _T_, and the two or three which lead the list are practically sure to have been substitutes for one of these two letters. With cryptograms of the present length, or even with those of 400 to 600 letters, it is very uncertain as to whether or not the leading pair will represent _th_, or the leading reversal _er_-_re_. Here, in fact, we have no reversal of a definitely frequent character, and our one prominent pair, _HR_, might just as well represent _st_, _at_, _it_, _on_, _re_, _se_, or any other normally frequent digram capable of being used at the beginning of a sentence. Presuming, however, that it might represent _th_, we know that this digram is followed almost altogether by vowels, and is followed with remarkable frequency by _e_ and _a_; we know also that letters have individual substitutes. Thus, we might begin solution by listing (or noting) those pairs which, in the cryptogram, have followed the supposed _th_: _KY_, _DU_, _KY_, _CE_, _NU_, assuming that their first letters, _K_, _D_, _C_, _N_, have probably represented vowels, and that, of these, _D_, _C_, and _N_, which rank high in the list of single-letter frequencies, are very likely to have represented _e_. We may attempt to identify these five pairs by working down the list of normal digrams, taking only those of _v_-_c_ formation. If, in addition, it is assumed that the key-square has been filled by straight horizontals, certain assumptions can be made through possible alphabetical sequence; for instance, the _U_ of _DU_ and _NU_ may have stood on the same line with _R_ _S_ _T_ (_U_). There is a further field for suggestions to be found in _patterns_, such as _TI BI_, in which the two _I_’s could represent the same letter. And where the square is filled by straight horizontals, it is often possible to identify such a sequence as _HZ_ _HB_ as a “split double,” since the null used in these cases is often _X_, and _Z_ may well represent _X_ by alphabetical position, It is even possible to guess here a doubled _L_, since _H_ and _L_ are not far apart in the alphabet. (It may be, of course, that the two _H_’s represent two different letters.) The foregoing, then, has indicated the general path. If the student desires to follow out a detailed demonstration made on a cryptogram of only moderate length, a most excellent exposition can be found in the appendix to the Macbeth translation of Langie’s “Cryptography” (Dutton). It was written by Lt. Commander W. W. Smith of the U. S. Navy, and generally speaking, attacks the identifications of pairs as follows: Having placed frequency figures beside their digrams, find those points at which two pairs of high frequency are consecutive (not necessarily a repeated sequence), and attempt to identify these tetragrams as frequent tetragrams of the language: _ther_, _ered_, _ened_, _tion_, _atio_, _ment_, _beca_, and so on. We have one here, provided a frequency of 3 can be considered important: _HR_ _KY_. Since this happens also to be repeated, it probably represents a word, as _that_, _this_, _they_. Another good demonstration, provided the student has access to it in his public library, is found in Colonel Parker Hitt’s “Manual for the Solution of Military Ciphers.” This manual is an elementary work intended for the preliminary instruction of soldiers, and the attack is made on the assumption of a key-square filled by straight horizontals. With a square of the kind we are using, most of the vowels and high-frequency letters will be standing on the upper two rows, and letters on the first two or three rows will have a much higher frequency than those of the last two or three. In fact, it can often be detected that the letters _V W X Y Z_ were standing on the bottom row as an intact alphabetical sequence, for the simple reason that they have no frequency in the cryptogram. Colonel Hitt’s demonstration begins with the usual pair-count, made on a chart. He selects from this chart the (approximately) ten letters having the _widest variety of contact_, including, if necessary, the vowel or so which would have to be present in a key-word; and these letters are assumed to have stood on the upper rows of the key-square. The remaining (approximately) fifteen letters are then set up in their alphabetical sequence and are assumed to have stood on the lower rows in about that order. They are not, of course, known to be correctly placed; the set-up merely gives a concrete idea as to where letters ought to have stood. Then, following the military case of abundant material, it is assumed that the leading pair will represent _th_ (sure to be followed often by _e_), or, if _th_ is not the leader, then _he_ (sure to be preceded often by _t_). With a few obvious identifications made in the usual way, letters begin to arrange themselves on the upper rows, and a gradual adjustment takes place which corrects the few wrong assumptions of the lower rows, so that the key-square is restored far in advance of solution. When a short key-word has been used, it is not impossible, by following Colonel Hitt’s suggestions, to pick out all of the key-letters, guess the word, and decipher with the key-square. Other demonstrations, based, respectively, on French and Italian language characteristics, can be found in General Givierge’s _Cours de cryptographie_ and in General Sacco’s _Manuale di crittografia_. (In the French work, the cipher is referred to simply as “orthogonal and diagonal substitution.”) * * * It will be seen from the foregoing that the initial difficulty lies in the correct identification of the first few pairs, and this, in a short cryptogram, is no small difficulty. By whatever means it is found possible to make these first tentative identifications, the operation which is to admit or disprove their correctness is step No. 2, in which we set them up as equations and then attempt to replace them into their connected relationships in the key-square. If this cannot be done, they cannot be correct; and, on the other hand, it would be an extremely rare case indeed in which we could combine as many as five or six such equations into one framework and then find them incorrectly matched. To understand “equations,” suppose we look at Fig. 168. Figure 168 POSSIBLE RELATIONSHIPS (a) A 3-letter Equation (b) A 4-letter Equation Vertical Horizontal Vertical Horizontal Rectangular I T K I . K H T H R . I K . S Y . . R S Y . S Y (c) Impossible Equations: (d) Possible Equations: co nd em na ti on -c on de mn at io n- EO ND EC TC TI AD EO ND EC TC TI AD CT Assuming that the beginning pairs of our cryptogram, _HR KY_, represent the word _this_, we have two equations, _HR_ = _th_, and _KY_ = _is_. The first of these has only three different letters, since _H_ is common to both members, while the second has four different letters. With the first case (a), one of the lineal encipherments must have been used, and the common letter, _H_, must have stood between the other two, with its plaintext partner coming first and its cryptogram partner coming last. We do not know whether these three letters stood in a column or in a row, but we do know that they were consecutive. This relationship may be expressed simply as _T H R_, even though, in the actual square, the letters may have been partly at the end of the row (or column) and partly at the beginning: _H R * * T_ or _R * * T H_. Encipherment, remember, is cyclical, and we may come out with any one of numerous “equivalent squares.” With the second equation (b), the positions of letters are not so definite. In either of the lineal encipherments, _IK_ must be in direct sequence and _SY_ must be in direct sequence; either sequence may have come first, and we do not know the exact location of the fifth letter. Concerning their possible rectangular encipherment, all we know is that there must have been a parallel relationship; their distance apart, laterally or vertically, might have been anything permitted by the key-square. As to the rest of the figure, suppose that we have reason to suspect the presence in this cryptogram of the word “condemnation.” The equations of (c) are totally impossible, since, in Playfair, no letter may be its own substitute. Those of (d) are not only possible, but probable, since we find many letters from the word itself. Figure 169 Equations of (d),(Fig.168) Possible Combinations 1 2 3 4 5 6 7 8 O D O N O N D E D E C N O N D O D C D E N O N D E C E C D E C C 9 10 11 12 M T M . T O N D E C . M T . N C . . . . N C . N T M C 13 14 15 16 A O N D E C O N D E C T A T I . . . . I A A T I M T M I To learn whether or not the word “condemnation” does (or could) occur here, we proceed as in Fig. 169. The first of the five equations may have had either one of the relationships marked 1 and 2, and the second may have had either of the relationships marked 3 and 4. These two equations have a letter _D_ in common, and it must not be impossible to form a combination which will represent both. This, as it happens, can be done in four different ways, marked 5, 6, 7, and 8, and we do not know which of the four is most likely. The third equation, which has four different letters, may have had any one of relationships 9, 10, and 11. These, fortunately, show two letters, _N_ and _C_, which are also present in combinations 5, 6, 7, and 8, and with two common letters, there will not be so many possible adjustments as when we had only one. Nos. 9 and 10, for instance, cannot possibly combine with any one of combinations 5, 6, 7, and 8; both of these have demanded that the letters _NC_ be in direct sequence, where the first four combinations will not permit this. We may begin, then, by discarding Nos. 9 and 10. But No. 11, which we have retained, demands of _C_ and _N_ only that they be on the same row. This is not permitted by any one of combinations 5, 6, or 7, and these also may be discarded. But No. 8 shows them on the same row; thus Nos. 8 and 11 may be further combined, and we have the combination marked 12. The fourth equation, another lineal one, may have had either of the relationships marked 13 and 14, and both of these will combine easily with the combination marked 12, so that again we have more than one possibility, as indicated under numbers 15 and 16. As to which of these is correct, the fifth equation, _io_ = _AD_, is impossible to one, and has automatically been set up in the other. * * * We are safe, now, in making substitutions on the cryptogram. This means not only the five pairs originally identified, together with their reversals and possible reciprocals, but all others which can be derived from combination 16, such as _om_ = _CA_, or _dm_ = _CI_, or _en_ = _DC_, together with their reversals and possible reciprocals. Then, too, there will be many partial equations, such as those indicated in Fig. 170, where one letter of a pair can be identified. Usually time is saved by taking cryptogram pairs just as they come and filling in as many letters as possible; in this way, patterns are sometimes brought out, and thus we come back to step 1: the identification of more pairs. With the key-square beginning to shape up, the “chart of probable position” may be used to good advantage. For instance, what about the letters _H_ and _B_ which were very high in the frequency list? Figure 170 O * * E N * E DE EC . . . . A T I M Once a beginning is made, the cipher is broken, though just how rapidly we may proceed with the solution depends chiefly upon the manner in which the square has been filled. The presence of alphabetical sequences (either horizontal or vertical) will often enable us to complete the key-square independently of the cryptogram; but the badly mixed square must usually be built up to the very end, and we must sometimes be satisfied with one of the “equivalents” in place of the square originally used. If the student cares to make a fresh beginning of his own, this same cryptogram contains the word RECONSTRUCT. * * * Figure 171 S E N D D D S T O A R D A M M I A M O N M X S T E O N D A Y The Playfair has been, in its day, a very effective cipher, and is still good for many purposes. It can be rendered much safer if subjected to the process called _seriation_. This process may be examined in Fig. 171. Here, the text is “Send diamonds to Amsterdam Monday,” and the agreed _seriation index_ is 5. The text is written in pairs of five-letter lines, so that each ten-letter segment forms five _vertical pairs_, _SI_, _EA_, _NM_, etc., and these are the pairs which undergo the digram encipherment (notice the treatment of the doubled _S_ in the second group). If the key-square is that of Fig. 166, the first ten-letter segment is enciphered _QK_, _UF_, _TG_, _SA_, _RS_, and the cryptogram may be taken off in that order, or by taking the upper and lower lines separately: _Q U T S R_ _K F G A S_. Seriation, it will be noticed, adds a transposition to a substitution, so that what we have here is combination cipher. This case, in short examples, is extremely difficult; it is mentioned only by way of general information, and is not included in the practice cryptograms which follow. 149. By NEMO. (Playfair. Probable words: ENEMY AGENTS). OS CF WD OG DR AN PO AS OA DH SD EH XK FU CN DR PF UK SD. 150. By NEMO. (Playfair. Probable words: AUTHORIZED, EMERGENCY). PK HL PG RI YH YN HQ IF YF GY ZL EB YF UK NK NG FL FG OL BD GX GK FC PK HG NV AC ZL KH PK FG FK RZ FG RQ XO IB PB BD LE MV KG GY OL AD FK OR FC LK YN HL LK KZ IF EF AX NG ON BV IK BI PK IO HQ IF AG LX YA FK AD YG KO AK EG TO OH BI RB OL ON KM FO PK KY PR EF DZ IF AY QH CZ OK IQ WP FG LF DM CA VO GW PK NG KX KO LH AG NB RT NG KO KH HK OX ML GP ML PB QD RB OH EB LH NK NG FC PK KY QS LH NE IQ WP FG. 151. By PICCOLA. (Figure 164; new external alphabets. THE, THIS, CHARACTER). NF BJ HT MD NF WJ GD UC HN FW QI CE HP NF IA SE HS HS LG QA IY QD HV CC LB NF IA IA CL GA RJ BD NM MA SY KU RD FT HC US HN GH VJ UA SY UL HN XJ EG QQ CJ LB NF KJ CN CS UK GJ MD NF IA FK NQ GJ XX. 152. By PICCOLA. ("Slidefair." Probable word: DESCENT). AA FS AF XY GJ BD UI AA PW GN IV QZ RC NK CC WA FT QQ PR GP TT WF PS JS QC HM DI XC AH JP FB DC EW OX UG GP UI US CV GP MH QR OG JI ZR. 153. By DAN SURR. (Playfair. History: Detective Gettamann, investigating the murder of Francis V. Bacon, well-known traveler, explorer, and connoisseur, has found this message in an envelope addressed to Wm. K. Pierce, former traveling companion of the deceased. Death had occurred during sleep; caused by strangulation with red silk thread. Only clues found: a few grains of sand on the kitchen floor and what appears to be an oriental turban). YG NG CR FV FZ RI OU KZ CW OW BQ GQ IH HL YW EG NG QM WX RT KP VE CA IG QI VD QI GN GZ IZ QY QR HY NG XN AB AK OX NY WC WC TN OX DH NE IH IH YR IS QY WC HI UI UI IR QE WS RW LG WR AB GW VW CA RQ XM ER QM RE CW ZI RQ XW QW GH YC AY YO VO NE RL PG CG WI NX VW CA NX QM LH IG RQ WT GO UI GZ EG XN IW OU XT WO LH IG RQ XM WS QY TX IR IQ XM OG DU AB RM AK UM RG ZR XA PM RW LD KG HI XK LC RT KP VE FO NX XK WR WS QY UR ZX YL AT UI RH TR AV WS DH WQ PM AK IW OU WT DE IR WX RQ XZ SI GU QN IR XN IR YN IG GY TR ZX YU RU YL IQ YA RU KG QM PD QM IY HA WS FE RW GH RB HA QI QM GI QC QR UL WV AB NX GO HA FR IY QY BM QM YH NG IQ RU YL IQ BL PO QM RU GU IR TX SI GQ LQ DX XO EV BM CR FV GV AB GE RZ GQ YH HA RW YM NE YM BL VW PS. CHAPTER XXII Highlights of Fractional Substitution Fractional substitution requires a cipher alphabet of the “multifid” type; that is, one in which the symbols are composed of two or more units, as in the Bacon and Trithemius alphabets (Chapter II: Figs. 3 and 4), the various “checkerboards” (Chapter XI), and so on. Polygram “alphabets” are also of this type, and seriation is a forrn of fractional substitution. Among the older fractionals, we find a system called the “Pollux,” in which the basis was the Morse telegraphic alphabet. There were three units, the dot, the dash, and a separator (made necessary by the irregular lengths of the substitutes). There was a first substitution in which the letters of the text were replaced with their Morse symbols, including the space. The resulting cryptogram, composed entirely of the units dot, dash, space (. — x), was then subjected to a second substitution, using a small cipher alphabet (either digits or letters) in which each one of the three units might have any one of several different substitutes, chosen at will. For instance, a dot might be replaced with any one of digits 1, 8, 5, 6, a space with any one of digits 3, 9, 0, and a dash with any one of digits 2, 4, 7. Figure 172 Delastelle's "BIFID" Substitution -(Keyword Feature Added by M. E. OHAVER) Preparation of Alphabet: Checkerboard Key: Substitutes: G E N • R A L 1 2 3 4 5 S = 43 B C D F H I K E = 15 M O P Q S T U 1 G B M V E N = 24 V W X Y Z 2 C O W N D D = 25 3 P X F Q Y 4 R H S Z A 5 I T L K U Preliminary Substitution: S E N D S U P P L I E S T O M O R L E Y S R I G H T A W A Y. 4 1 2 2 4 5 3 3 5 5 1 4 5 2 1 2 4 5 1 3 4 4 5 1 4 5 4 2 4 3 3 5 4 5 3 5 1 1 3 1 5 3 2 2 3 2 1 3 5 5 3 1 1 1 2 2 5 3 5 5 Re-Substitution: 41 22 45 33 54 53 51 35 51 45 21 31 53 22 12 45 13 43 21 35 53 R O A F K L I Y I A C P L O B A M S C Y L 45 14 54 21 11 22 53 43 55 Transmitted: A V K C G O L S U. R O A F K L I Y I A C P L O B, etc. We find also a number of systems called “Collon” in which the basis is some one of the “checkerboards.” The text is subjected to a simple substitution in the agreed alphabet, and the resulting cryptogram is then subjected to a transposition, usually seriation, this being the final operation. A similar system called the “Mirabeau” uses an alphabet of the same type as that of the _Polybius square_, in which only the digits 1-2-3-4-5 are significant. The remaining digits are all null, and numbers like 67 or 88 may be inserted at will. Numbers are written vertically (tens below units); then, in the taking off of the cryptograms, the whole series of units is taken first, and the second half of the cryptogram includes all of the tens-digits. In all of these forms, the undesirable features are self-evident. The later devices have added another operation: the regrouping of the scattered units, and their reconversion into letters. Classic examples are those described by Delastelle as “bifid” and “trifid” (terms, incidentally, which some of our own writers find objectionable, as they do also the term “multifid”). Delastelle’s “bifid” cipher was of the kind shown in Fig. 172. A two-unit alphabet must be used, and all possible two-unit combinations must be convertible into letters. Any desired seriation-length may be agreed upon, though it should not be divisible by 2. In the figure, the key-word GENERAL, 7 letters, governs the seriation-length as well as the mixing of the key-square, a feature suggested by Ohaver. The substitution is identical with that of the Polybius square, except that the two units of the substitute are written vertically below the original. Digits are then grouped horizontally in pairs, treating one seven-letter group at a time (if the seriation index is 7), and these pairs are replaced with letters from the same key-square. It will be noticed that we have here a form of polygram substitution, in which one seven-letter group has been replaced with another. Also, that possible errors have been confined by the seriation feature to their own seven-letter group. Figure 173 A Fractional Substitution Based on Morse Symbols - M.E.OHAVER The Alphabet, Arranged by Group-Lengths: E . S ... H .... B -... T - U ..- V ...- X -..- R .-. F ..-. C -.-. W .-- ü ..-- Y -.-- I .. D -.. L .-.. Z --.. A .- K -.- ä .-.- Q --.- N -. G --. P .--. ö ---. M -- O --- J .--- ch ---- S E N D S U P ... . -. -.. ... ..- .--. Reverse digits, and re-group: 3 1 2 3 3 3 4 4 3 3 3 2 1 3 .... -.- ... ... .- . --. H K S S A E G Delastelle’s “trifid” cipher was of the same kind, except that a three-unit alphabet was required, resulting in three rows of units. It would have been the same as that of Fig. 4, Chapter II, but with the French accented _E_ replacing the character _&_. All combinations of three units must be re-convertible into letters. Fig. 173 shows a form of “mutilation” cipher once published by Ohaver. Beyond stating that its only key is the group-length (7 in the example), we leave the student to figure it out for himself. As an example of recent use (1918), we are told on excellent authority that the Germans, for quite a long time during the World War, used a field cipher of the following description: There was a preliminary substitution using a key-square of the Nihilist type, except that the external co-ordinates were letters, and not digits, and were chosen in such a way that the five or six letters used were letters having very distinctive Morse symbols; this was for the avoidance of telegraphic errors. In some cases a 5 x 5 square was used, containing only a 25-letter mixed alphabet, and in others a 6 x 6 square containing a 26-letter mixed alphabet and all of the digits. The preliminary cryptogram obtained from this first encipherment was then written into a transposition block and taken off by columns, using key-word columnar transposition. The cryptograms were not afterward shortened by resubstitution, but were always twice as long as their messages, and never contained any other letters than the five (or six) originally used as co-ordinates. This German Field Cipher proved very effective until finally broken by the great French analytical genius, Georges Painvin. We shall make no attempt, here, to go into the decryptment of these ciphers. The Delastelle “bifid” is, perhaps, a practical cipher, and the student may try his own hand at analyzing the example. The other examples should give no trouble. 154. By PICCOLA. (Delastelle's "Bifid." - Repeated words: AMERICA(N), ATTEMPT, REPORT, THAT, THE, OF, TO. Other short words: FROM, WITH, BEEN, HAVE. Likely words: REPORT, AGENT, CONFIRM, CABLE, etc). Q I N H P R M L M G R N B M A H G T O L O O E L O A O D R I N H W R O A A B M M I M M W I B M D A B T H D I L T H T H I N T L A Q M C A M F I V N K Y N O F H B I I T R F Q L A D K V Q I N H P R M R B H S L L U A B M E T S O A A B M M I M M I B P I V R Q F T K H I R D F G N I E M A B E N I L M M P A S I F I O P L Y C C R C I T W I V W M F G I O O S O E R O I K Q I E F O V N V M Q T D R S I O E R I B U Q C D O A L L A P L A A O O C A Q O M E I D C N T I U L O L Z D G. The mixed alphabet here was placed in the square by straight horizontals. History: Message intercepted following a report that on the tenth of August an attenpt had been made to enter the American embassy in a country where Royalists are opposed to a group of radicals. 155. By PICCOLA. (Fractional. - Not so hard). 3 3 3 2 3 1 1 1 2 3 2 2 1 3 1 1 1 1 3 1 3 3 1 1 3 2 2 1 2 2 1 1 2 3 1 2 3 3 2 1 2 3 3 1 1 3 2 1 1 2 1 2 2 2 3 1 2 2 2 3 1 1 2 2 1 2 3 2 3 2 2 1 2 3 1 3 3 2 3 1 1 2 2 1 3 2 1 2 2 3 2 1 3 1 2 2 2 2 3 2 3 2 2 2 2 3 1 1 1 3 1 2 3 2 1 1 2 2 2 3 2 3 1 3 2 2 2 2 1 2 3 1 2 2 1 2 1 2 2 1 1 2 2 3 2 3 2 2 3 2 2 2 3 2 2 3 3 1 2 2 3 1 2 1 3 1 1 1 1 2 1 3 3 3 3 1 2 3 3 3 2 1 3 3 1 1 1 1 2 2 3 1 1 3 1 1 1 1 1 1 1 1 3 2 2 1 2 3 2 2 2 1 2 1 2 1 2 2 2 3 3 2 2 1 3. 156. By PICCOLA. (Fractional. - Nor is this very hard). E D C Y B A Z C B Z A V W X C X B A E Y D C B V A E D W B X A E Y Z D A E Z V W D C A E D X C B Y D Y Z V C B W B A Z V E W X B X A E Y D C B V A E W D C X A E Y Z D C E Z V D W C B E D X C B Y A Z D C B V W A A E D C B A E E W D C B X Y D C Y Z B V A B A Z V E W X A E W D C X Y E D Y Z C B V E D C W B A X E D Z V C B A C B V W A X Y X B Y A E D Z E Y Z D V W C W E D X C B A D Y Z V C B A D C W B A X E E D C B A V E D C X Y B Z A E D C B A E W D Y Z C B V A B A Z V E W X E D V W C X Y X D C Y B A Z C Z B A V E W B A E W D X Y E D X Y C Z V V E D W C B A. CHAPTER XXIII Investigating the Unknown Cipher When the type of encipherment is unknown, the decryptor’s first problem may concern the probable language used in the plaintext, and this he is usually able to determine from the source and history of the cryptogram. His second problem is the major classification, and this, too, is usually simple, since transposition, as a rule, can be recognized by its appearance. It must, however, respond to a group-test, and for cases in which this is needed, the approximate percentages for English can be taken as follows: Vowels, with or without Y, about 40% (Variation limits: 35% to 45%) Consonants L N R S T about 30% (Variation limits: 25% to 35%) Consonants J K Q X Z about 2% (May be influenced by nulls). The 5% variation is suggested in the Parker Hitt Manual. In this connection, it should be pointed out that an apparent transposition with exactly 40% of vowels and 100% evenness in their distribution is suspicious. Many of the checkerboard systems result in this way, and also some of the codes based on pronounceable five-letter groups. Then, too, it is easily possible to construct a simple substitution cipher alphabet in such a way that the resulting cryptograms will resemble transposition, and even respond satisfactorily to a group-test. It should be carefully ascertained that a supposed transposition cryptogram does not contain the many repeated sequences which belong to simple substitution. As to those transpositions which do show an appreciable number of repeated digrams, they will probably have undergone one of the route transpositions, especially one in which columns were taken off in alternating directions. * * * Concerning the characteristics of simple substitution, these have been seen throughout the text; we have normal frequencies attached to the wrong letters, and we have those numerous repetitions of various lengths, occurring at all kinds of intervals, which are never found in a transposition. Here, too, we may apply a group-test, based only on the relative frequencies of letters. The five most frequent are supposed to represent the letters _E T A O N_ or their equivalents, and should total about 45% of the text. The nine most frequent should total about 70%; the eleven most frequent well over 75%; the five of lowest frequency (which would include all of those totally absent) should correspond to the normal behavior of the group _J K Q X Z_. * * * If the simple substitution frequency count is present without the repeated sequences, then we probably have a combination of simple substitution with transposition. It becomes necessary to rewrite the cryptogram into various new arrangements until one is found which will bring back the repeated sequences. Ordinarily, the simplest kinds of transposition will have been used; sometimes the transposition will have taken place in a complete-unit block, and there will be a clue in the total number of letters present in the cryptogram. * * * When all letters are present in the frequency count (or all but one or two in the possible cases of 25-letter and 24-letter alphabets), a period-investigation is usually indicated. The case of periodics has been seen at considerable length, though a final hint might be added for the detection of a possible Porta encipherment. One of our many collaborators, F. R. Carter, suggests that any Porta cryptogram, periodic or otherwise, ought to show from 52% to 53% of letters _N_ to _Z_ — the opposite of normal. The characteristics of digram-encipherment have been mentioned. Other polygram ciphers show corresponding characteristics, according to the polygram length, though the trail grows fainter as polygrams grow longer. A trigram-system, for instance, might be present when the cryptogram is evenly divisible into three-letter groups; it might suggest period 3, and might even show repeated sequences whose length is a multiple of 3 and which begin at serial positions such as 1, 4, 7, 10, which are the beginnings of trigrams. A great many of the trigram systems will show only repeated digrams beginning at these serial positions, or separated by intervals which are divisible by 3. A 5 x 5 square is often suggested in the fact of a missing letter; but the fact of 26 letters does not deny one, since the careful encipherer may make use of his missing _J_ instead of using _I_ exclusively. Great evenness in frequencies may suggest one of the key-lengthening devices, such as autokey and progressing key; and the practical absence of repeated sequences will usually mean that a transposition has been added to a substitution. It is never a bad idea, in a puzzling example, to make the various digram-counts (in chart form): An actual digram count, in which every letter is considered the beginning of a digram; a pair-count on separated pairs, as in Playfair; the two counts which could be made with the cryptogram marked off into three-letter groups; and the kind of pair-count which could be made in Playfair if the first cryptogram-letter were omitted. Many devices, as mentioned, may be uncovered simply by “running down the alphabet.” And if the cryptogram has come from an amateur “inventor,” it may be a case of digging into one’s memory for previous “inventions.” With this last case, however, the “inventor” very often fails to submit material in proportion to the amount of complication he has introduced. * * * Of the examples to follow, there is none in which the system may not be learned through analysis, unless perhaps the final unnumbered cryptogram, and the material, in every case, should be suffcient for solution. No. 163 follows Mr. Berkley’s encipherment plan, illustrated just above it. No. 164 is said to have been taken from a German spy serving in the American army in France. This applies, however, to the first fifty groups only; the remainder was added to increase the length and to emphasize the plan followed by the spy. No. 166 was accompanied by a plot: “Supposed to have been found on the body of a man floating in San Diego Bay. Autopsy shows death by drowning. Victim was a local banker who had disappeared a few days earlier. Wife says no financial worries. No money missing. Banker had prospered during depression. Was yachting enthusiast. Our hero solved the cipher with the unconscious assistance of a radio crooner. Tragedy occurred in _August, 1932_.” The date was doubly underscored, but those who have read the message have found no reason for this and no explanation for the “crooner.” 157. By PICCOLA. C S R Z V Y P Q Z J K H K V Q U U C V M R T W Z N G H Q S A K O X P M H D R W A J D F Q D F S R Z Z C G X P A J J T Z U L H T G S A H X J J L T R N N Z P B Z G R E B N F Y G E J N M T N J J Q H P J X M O B J A L X I A I C P F J O O F R N H. 158. By PICCOLA. O C E E A T T I T K S N D T D S T H O O Y E A O E E P E B O T Y T A O A D S E O E T F T T T H R V W C T H O Y L T O O H L R B T T U H R R V R A W O B R U A O Y E H H L A B N E R L R K V C R I O N S E I D R U E R I P. 159. By TITOGI. A H Y N U H C E S T I T N D O R F E H R W E A T F N R F P A O T M A T L H R E I O T N R L O D R H E E A T E S C T D I N W T S T O E A T S I T E C D U T M S O T R L D O N G N I I S O F A E T L I T A S. 160. By PICCOLA. (Veiled reference to crypt No. 166?) (a) H Z M Q L D N N D Z S P R F S K L L L L. (b) L I L V M S T Z U G D H Z U Q X L L L L. (c) T V I U M F R U O Y U Q Y P S F W X L L. (d) L I L V M F P O E Y Z K F D V U E L L L. (e) G K P V D Z T A Y T B F Y Y C F I U L L. (f) Q B F P W Y C L U D V P Z Z O S W Y N C. (g) Q B R T F F G V T U E N S Z H B Q E R L. 161. By PICCOLA. E G W G W G E G T U C L C U O X G K Z T E G O B G B Y L W M I Q N K Q Y E N F S C L H M N Y B X S E T N I W O C E G C B F C T C S Z T V G B E A E G T U R K F K B E G K X B C T G Z Y L X C H Y E G C U O X Y T Q F A D Q T T C U N B O G C O H X C E W E C U V E G C O C X Y X G B E A Y T K X F Q C O T B X N E G T U C O N T O P E L E K U V U N T O C N G N G B K W C E E C S Z K W N H E I K C C R E G C T E G T U R K F K T B R G M W X C F G Q N I C E B P E E W E N B K I Y F K F D O F E G N U C B G M T Z T F X C E W E C F V D T T U Z T E N E G W G L F M C T O V L. 162. By PICCOLA. S P P A S T A S E F U N M T E H S O O A E S L E I C T R C H V U G S E L Y R E M E N E E R O S N E H I R A E T O R N S H M O D R O P E A O R P O S R Y P D O I N O C K G T. The "NICODEMUS" Cipher (Harold Berkley) SPECIMEN ENCIPHERMENT Key: M E T H O D I C M E T H O D I C M E T... 6 3 8 4 7 2 5 1 6 3 8 4 7 2 5 1 6 3 8... Cryptogram: T H I S I S E N A N S P O S E D E T C... C I P H E R E D U S I N G T H E PFGVT VUHDG LMRIV I V V I G E N E S A M E K E Y F ZOPUH MMVNB FOUDQ WSURF R E A N D A F T O R B O T H O P BIOTP FGHRU VWHKR RWEVV E R W A R D T R E R A T I O N S WULVA MPGWV MGEAQ CUYHW LBFUT. 163. By PICCOLA. T Y D Q V W P A Z O M B W B I R K F I O O G W C O G E F L T Q M S R F X T C J C M A W P P Q M E X V O Q C O C Z F S F W V F E V E R S A B E C V J J W S I P P H M M K O X V Y I D B D B C I S Y N L J C Y F K C W E N Z E I T J V L Z M I L I I R W K R O O S Z A W E K J V J G F M Q K G F N C K H P B R D L V I A P E S L V M D J Z Z V F Z F F R D B A D P Q W E N L A L O E K M F M F W X O K D W D G C K K K C Q R V. 164. By VULPUS. P E N A R C P F T I Q E V A T E N B L A T K Q F O A R E N E U I P E P F U K X I L C N F Q E P C V B T A W A O B N C O E T I N D W B N A R D Q F O F N B V C P E P G V G P A V A P B P F O A O B S C L B V B T F W A N E W B T C S D N F M A N A O E V A R A R C T K Q E N B M B Q F V E V B X K O A P E T B U I P F O F Q E L E O B R D R B Q F U A W A S C U K L F P E W B O C O D N A M E L G V F V A N C N D M F N B V D T D L E P F V I T I Q E Q F O C O A U C L F L A O B M E P E N A S D L B T K L H N E P D. ..... U I L A L B O B M A V K M G U K R F P F U B U D M F W E T A T I Q E V B R C M B W A N F Z I L E N A Q F W B T C R D T B T K O E P E U A V A O F N B S C Z K V B W C U B O A L F O B M E X I T D Q C Q D W A P F Q E N A L A. 165. By PICCOLA. (Again that No. 166?) R O V L L A B T L D L B C Q M P X L B A F B T C T A T C O R L T O L C R H P D T X L Y O A E L B X P H L X B T X X Q L D R G L T K X R L G D B K L D P P L O H L Y O A E L K O M X B L H O E L V C R R C R J L T K D T L R C I N X P L L L T K X L R C I N X P L V D B L V O R L P O R J L D J O L F Y L I O P O R X P L M D E N X E L K C T T L V K O L O H H X E X G L T O L I O Q M E O Q C B X L H O E L T V O L I X R T B L B C R I X L K X L V D B L D F P X L T O L B X R G L T K X L B O P A T C O R L F Y L E X T A E R L Q D C P L L B T C P P L C T L V O A P G L F X L V O E T K L D R O T K X E L R C I N X P L T O L H C R G L O A T L T K X L N X Y L L T K C B L Q A B T L F X L T K X L X W M P D R D T C O R L O H L T K X L E X H X E X R I X L T O L D L I E O O R X E L D R G L T K X L X Q M K D B C B L O R L D L G D T X L L M L B L T K X L T V O L I X R T B L K D B L R O T L Y X T L F X X R L M D C G L. 166. By CACHE. (Contributor, C. H. Price, died without explaining his key). 03 65 12 45 58 28 06 41 72 14 22 03 02 17 36 88 25 20 55 77 74 51 23 45 41 42 30 24 36 61 96 09 07 78 05 44 08 06 55 92 16 93 02 15 36 37 40 87 41 01 33 77 06 36 27 54 48 29 16 78 92 66 03 10 38 17 45 23 72 96 73 01 49 25 72 38 92 72 24 55 48 08 40 92 28 01 72 96 02 04 74 61 06 99 30 45 72 69 74 93 77 23 55 36 24 93 47 84 76 35 32 89 87 76 77 64 51 96 58 43 76 02 81 38 87 69 89 55 99 23 79 55 51 06 99 71 74 69 89 84 27 25 22 39 42 53 19 93 41 66 09 75 87 37 91 87 90 91 43 19 40 30 38 16 96 22 69 38 78 02 74 92 47 25 77 91 15 40 24 45 07 07 96 48 44 15 12 06 99 44 93 19 25 23 55 30 45 87 96 18 01 78 44 29 45 86 47 69 48 30 66 44 03 41 66 37 38 22 06 42 41. 59. Here is one which nobody has ever been able to decrypt: V Q B U P P V S P G G F P N U E D O K D X H E W T I Y C L K X R Z A P V U F S A W E M U X G P N I V Q J M N J J N I Z Y K B P N F R R H T B W W N U Q J A J G J F H A D Q L Q M F L X R G G W U G W V Z G K F B C M P X K E K Q C Q Q L B O D O Q J V E L. APPENDIX ENGLISH FREQUENCY AND SEQUENCE DATA (Compiled from the MEAKER Digram Chart) Order and Frequency of Order and Frequency of Single Letters Leading DIGRAMS E 1231 L 403 B 162 TH 315 TO 111 SA 75 MA 56 T 959 D 365 G 161 HE 251 NT 110 HI 72 TA 56 A 805 C 320 V 93 AN 172 ED 107 LE 72 CE 55 O 794 U 310 K 52 IN 169 IS 106 SO 71 IC 55 N 719 P 229 Q 20 ER 154 AR 101 AS 67 LL 55 I 718 F 228 X 20 RE 148 OU 96 NO 65 NA 54 S 659 M 225 J 10 ES 145 TE 94 NE 64 RO 54 R 603 W 203 Z 9 ON 145 OF 94 EC 64 OT 53 H 514 Y 188 EA 131 IT 88 IO 63 TT 53 TI 128 HA 84 RT 63 VE 53 AT 124 SE 84 CO 59 NS 51 Group Percentages: ST 121 ET 80 BE 58 UR 49 EN 120 AL 77 DI 57 ME 48 A E I O U 38.58% ND 118 RI 77 LI 57 WH 48 OR 113 NG 75 RA 57 LY 47 L N R S T 33.43% List of Common REVERSALS: J K Q X Z 1.11% ER RE ON NO TE ET ST TS E T A 0 N 45.08% ES SE IN NI OR RO IS SI AN NA EN NE TO OT ED DE E T A O N I S R H 70.02% TI IT AT TA AR RA OF FO Order of the Leading TRIGRAMS In 10,000 Letters of Semi-Military Text - PARKER HITT THE ENT FOR NCE OFT AND ION NDE EDT STH THA TIO HAS TIS MEN INITIAL LETTERS OF WORDS: Order, as found by M. E. OHAVER ... T A O S H I W C B P F D M R, etc. Order, as found by H. O. YARDLEY .. T O A W B C D S F M R H I Y, etc. FINAL LETTERS OF WORDS: Order, as found by M. E. OHAVER ... E S T D N R O Y, etc. Order, as found by H. O. YARDLEY .. E T D N S R Y, etc. NOTE: Lists of terminals (letters, digrams, trigrams); of common affixes, short words, and common pattern-words, can be found in the booklet "CRYPTOGRAM SOLVING", obtainable from the author, M.E.Ohaver, at Columbus, Ohio. X J M M T V O Z B N Q M F B T F S F N J U G P S U I J T B E ? COMPARATIVE TABLE OF SINGLE-LETTER FREQUENCIES (Per 100) ENGLISH GERMAN FRENCH ITALIAN SPANISH PORTUGUESE A 7.81 A 5. A 9.42 A 11.74 A 12.69 A 13.5 B 1.28 B 2.5 B 1.02 B .92 B 1.41 B .5 C 2.93 C 1.5 C 2.64 C 4.50 C 3.93 C 3.5 D 4.11 D 5. D 3.38 D 3.73 D 5.58 D 5. E 13.05 E 18.5 E 15.87 E 11.79 E 13.15 E 13. F 2.88 F 1.5 F .95 F .95 F .46 F 1. G 1.39 G 4. G 1.04 G 1.64 G 1.12 G 1. H 5.85 H 4. H .77 H 1.54 H 1.24 H 1. I 6.77 I 8. I 8.41 I 11.28 I 6.25 I 6. J .23 J ... J .89 J ... J .56 J .5 K .42 K 1. K ... K ... K ... K ... L 3.60 L 3. L 5.34 L 6.51 L 5.94 L 3.5 M 2.62 M 2.5 M 3.24 M 2.51 M 2.65 M 4.5 N 7.28 N 11.5 N 7.15 N 6.88 N 6.95 N 5.5 O 8.21 O 3.5 O 5.14 O 9.83 O 9.49 O 11.5 P 2.15 P .5 P 2.86 P 3.05 P 2.43 P 3. Q .14 Q ... Q 1.06 Q .61 Q 1.16 Q 1.5 R 6.64 R 7. R 6.46 R 6.37 R 6.25 R 7.5 S 6.46 S 7. S 7.90 S 4.98 S 7.60 S 7.5 T 9.02 T 5. T 7.26 T 5.62 T 3.91 T 4.5 U 2.77 U 5. U 6.24 U 3.01 U 4.63 U 4. V 1.00 V 1. V 2.15 V 2.10 V 1.07 V 1.5 W 1.49 W 1.5 W ... W ... W ... W ... X .30 X ... X .30 X ... X .13 X .2 Y 1.51 Y ... Y .24 Y ... Y 1.06 Y ... Z .09 Z 1.5 Z .32 Z .49 Z .35 Z .3 Vowel Percentages: English German French Italian Spanish Portuguese 40% 40% 45% 48% 47% 48% Percentages for L N R S T: 33% 34% 34% 30% 31% 29% NOTES: ENGLISH frequencies, which may be compared with those of Mr. Meaker, (A, 8.05; B, 1.62; C, 3.20; etc.), were taken from M.E.OHAVER. FRENCH, ITALIAN, and SPANISH frequencies were taken from a count made by the author. All four counts are based on 10,000 letters of literary text, and the dropping of the decimal point gives the actual count. The frequencies given for GERMAN and PORTUGUESE are approximations, reduced from other texts, probably military. Chart Showing Normal CONTACT PERCENTAGES - Compiled by F. R. CARTER (Based on a Digram Chart by M.E.OHAVER) % % V. C. V. C. 19 81 P4 L4 C5 D5 M5 N6 S6 W7 T8 R8 E11 H14 A N21T17S12R10L8 D5 C4 M4 6 94 55 45 Y4 B4 N5 T5 U8 D9 O9 S10A16E16 B E34L17U11O9 A7 Y5 B4 R4 70 30 61 39 U4 O5 S8 N13A13I18E20 C H19O19E17A13I7 T6 R4 L4 K4 59 41 52 48 R4 I5 L6 A10N29E39 D E16I14T14A10O8 S6 U5 54 46 8 92 C4 B4 E5 M5 V5 D5 S5 L5 N6 T6 R11H24 E R15D10S9 N8 A7 T6 M5 E4 C4 O4 W4 21 79 69 31 S4 N5 F5 D5 A6 I7 E12O41 F T22O21E10I9 A7 R5 F5 U4 52 48 36 64 O4 D4 U5 R5 I9 E9 A10N48 G E14H14O12R10A8 T6 F5 W4 I4 S4 42 58 7 93 G4 E5 W5 S7 C9 T62 H E50A23I12O7 90 10 13 87 F4 M4 W5 E6 N6 L8 D8 S8 R9 H11T14 I N25T13S10O8 C7 R4 E4 M4 A4 L4 17 83 28 72 Y7 W7 T7 S7 N7 E7 C7 B7 A14M29 J U35O29A12E12M6 W6 88 12 53 47 Y5 U5 I5 N7 A11R13E13O15C18 K E34I21N10A9 T7 S6 68 32 52 48 N4 P4 T6 I7 B7 U7 O10E11L11A17 L E19I15Y12L12O9 A8 D7 U4 65 35 69 31 S4 D4 M5 R5 I12A13O16E24 M E26A17O12I11P5 M5 71 29 89 11 U7 E14O22A23I24 N D16T14G12E10A7 S7 O7 I6 C5 32 68 21 79 M4 O4 D4 L4 P4 H5 N6 E6 C7 F7 S8 I8 R9 T11 O N20F14R11U10T6 M5 L5 S4 W4 O4 18 82 47 53 R4 L4 T4 N4 I4 P6 M6 A7 O8 U10E16S17 P O17E16A15R15L8 U6 P6 T5 I5 S4 59 41 20 80 O10N10L10E10D10R20S30 Q U100 100 -- 70 30 P5 I5 U5 T7 A13O16E30 R E23O12A11T11I10S7 Y4 61 39 48 52 D4 T4 O6 U6 R7 N8 S9 I11A16E18 S T19E11O10I9 S9 A8 H6 P5 U4 41 59 43 57 U4 O5 D6 T6 F7 R7 E8 I10N10S13A14 T H39I10O10E8 A7 T6 R4 38 62 35 65 P5 F5 T5 L5 B6 D8 S9 O30 U N18S13T13R12L10P7 B4 C4 8 92 88 12 R6 U10O16A16I16E30 V E65I14O9 A8 99 1 48 52 G4 D4 Y5 N9 S10T11O16E23 W A27H16I16E15O11N4 80 20 95 5 U5 N5 I16E74 X P29T19I14A14U10C5 K5 O5 38 62 24 76 B4 N8 A8 T13E14R15L25 Y A15O12S12T9 W7 H5 I5 E5 D4 M4 B4 38 62 88 12 O12N12A25I50 Z E43I43W14 86 14 All figures indicate PERCENTAGES. - Taking any one letter, as A: On the left, it was contacted 14% of the time by H, 11% by E, etc., and 81% of its total contacts on that side were consonants. On the right, it was contacted 21% of the time by N, and 94% of the time by consonants. Chart Showing FREQUENCIES of English DIGRAMS - Prepared by O. PHELPS MEAKER (Actual Count Made on 10,000 Letters of Literary Text). A B C D│ E│ F G H I J K L M N O P Q R S T U V W X Y Z A 1 8 44 45│131│21 11 84 18 34 56 54 9 21 57 75 56 18 15 32 3 11 805 B 32 18│ 11│ 2 2 1 7 7 9 7 18 1 4 13 14 5 11 162 C 39 12 4│ 64│ 9 1 2 55 8 1 31 18 14 21 6 17 3 5 10 320 D 15 10│107│ 1 1 1 16 28 2 118 16 16 6 9 11 4 4 365 E 58 55 39│ 39│25 32 251 37 2 28 72 48 64 3 40 148 84 94 11 53 30 1 12 5 1231 F 10 1 12│ 23│14 3 2 27 5 8 94 6 13 5 1 1 3 228 G 18 2│ 20│ 1 1 10 1 75 3 6 6 1 12 5 161 H 46 3│ 15│ 6 16 5 1 9 3 7 3 30 315 2 48 5 514 I 16 6 15 57│ 40│21 10 72 8 57 26 37 13 8 77 42 128 5 19 37 4 18 2 718 J 2 1│ 1│ 1 1 3 1 10 K 10 8 │ 2│ 8 3 3 5 11 2 52 L 77 21 16 7│ 46│10 4 3 39 55 10 17 29 12 6 12 28 4 6 1 403 M 18 1 9│ 43│ 3 1 1 32 4 5 7 44 15 14 14 9 1 4 225 N 172 5│120│ 2 3 2 169 3 1 3 9 145 12 19 8 33 10 3 719 O 2 11 59 37│ 46│38 23 46 63 4 3 28 28 65 23 28 54 71 111 2 6 17 1 28 794 P 31 1 7│ 32│ 3 1 1 3 2 16 7 29 26 8 24 8 17 2 4 7 229 Q 1 1│ 14│ 2 2 20 R 101 6 7 10│154│ 4 21 8 21 2 5 113 42 18 6 30 49 1 5 603 S 67 5 1 32│145│ 8 7 3 106 2 12 6 51 37 3 39 41 32 42 3 17 659 T 124 38 39│ 80│42 13 22 88 1 19 6 110 53 14 63 121 53 45 6 1 21 959 U 12 25 16 8│ 7│11 8 2 4 8 13 12 96 7 20 6 30 22 1 1 1 310 V 24 4│ 16│ 1 14 2 4 13 5 2 4 1 3 93 W 7 1 9│ 41│ 4 2 7 1 3 5 2 15 36 1 10 27 16 2 14 203 X │ 17│ 1 1 1 20 Y 27 19 6│ 17│ 1 1 1 3 47 3 14 4 2 17 4 21 1 188 Z 1 │ │ 4 2 1 1 9 To learn the frequency of any digram, find its first letter at the top, find its second letter at the side, and observe the figure in the cell at which the column headed by the first letter crosses the row headed by the second. Frequency for EA, 131; for AE, zero. SOME FOREIGN LANGUAGE DATA NOTE: Frequencies of letters, and their order, are fixed quantities in any language. Group frequencies, however. are fairly constant in every language. (These may be computed from the Comparative Table for any desired group in the languages given.) Of the material which follows, portions came from Lange and Soudart, and from Valerio, but exact sources were not in every case furnished to the author. G E R M A N Order of single letters: E N I R S A D T U G H O L B M C F W Z K V P (J Q X Y) Order of digrams: EN ER CH DE GE EI IE IN NE ND BE EL TE UN ST DI NO UE SE AU RE HE Order of trigrams: EIN ICH DEN DER TEN CHT SCH CHE DIE UNG GEN UND NEN DES BEN RCH Order of tetragrams: ICHT KEIT HEIT CHON CHEN CHER URCH EICH DERN AUCH SCHA SCHE SCHI SCHO SCHU (Furnished by JOSEPH ARTHOLD). Peculiarities: C is practically always followed by H (or K), and SC by H. Word-length is normally greater than in English. F R E N C H Order of single letters: E A I S T N R U L O D M P C V Q G B F J H Z X Y (K W) Order of digrams: ES EN OU DE NT TE ON SE AI IT LE ET ME ER EM OI UN QU Order of trigrams: ENT QUE ION LES AIT TIO ANS ONT ANT OUR AIS OUS Peculiarities: Q followed by U and a second vowel. Four and five vowels may be found in sequence ("J'ai oui dire.."), but E seldom touches the other vowels. D and M contact E about 75% of the time, and L contacts it over 50% of the time. It is unusual to find more than four consonants in sequence; when five are found in succession, one is almost surely the final S of a plural word. Order of doubled letters: S L M R T N P E C F Order of initials: P A S M C E D T V F R B L G J I Q N O H U Y X Z Order of finals: E S T R N D A I X Z L C U P F Y Average word-length: 4.3 letters. Commonest short words, in order: DE IL LE ET QUE JE LA NE UN LES EN CE SE SON MON PAS LUI ME AU UNE DES SA QUI EST DU I T A L I A N Order of single letters: E A I O N L R T S C D P U M V G H F B Q Z (J X K W Y) Order of digrams: ER ES ON RE EL EN DE DI TI SI AL AN RA NT TA CO Order of trigrams: CHE ERE ZIO DEL ECO QUE ARI ATO EDI IDE ESI IDI ERO PAR NTE STA Peculiarities: Q followed by U and a second vowel. H largely preceded by C, in CHE,CHI, or sometimes by G in GHE GHI. Z most often part of ZIO or NZA. The frequencies of the vowels E A I O often exchange places. Doubling of consonants is very frequent. Order of doubled letters: L T S C R G P N B M Z F V I D Order of initials: S P A C D V T M F I G Q R E B L N O U Z H Order of finals: O E A I (Others, if used: R L D N) Average word-length: 4.5 letters. Commonest short words, in order: LA DI CHE IL NON SI LE UNA LO IN PER UN MI IO PIU DEL MA SE S P A N I S H Order of single letters: E A O S N I R L D U C T M P B H Q G V Y J F Z X (K W) Order of digrams: ES EN EL DE LA OS AR UE RA RE ER AS ON ST AD AL OR TA CO Order of trigrams: QUE EST ARA ADO AQU DEL CIO NTE OSA EDE PER IST NEI RES SDE Peculiarities: Q followed by U and a second vowel. The only doubles are LL, RR, CC, EE, NN, OO, in the order given, but the latter three are very rare. Group frequencies somewhat less stable than in the other languages. Order of initials: C P A S M E D T H V R U N I L B O F Q G J Z Order of finals: O A S E N R D L I Z Average word-length: 4.4 letters. Commonest short words, in order: DE LA EL QUE EN NO CON UN SE SU LAS LOS ES ME AL LO SI MI UNA DEL POR SUS MUY HAY MAS P O R T U G U E S E Order of single letters: A E O R S I N D M T U C L P Q V F G H B J Z X (K W Y) Order of digrams: ES OS DE AS RO EN CO DO RE ER NT SE AD OR AO SA TE AR EM QU UE OD ST Order of trigrams: QUE ENT NTE DES EST ODE ADO CON STA MEN ADE DOS ARA COM Much like Spanish. Spanish cion becomes cao; ll becomes lh. Articles drop the L: os, as, in place of Spanish los, las, etc. BIBLIOGRAPHY By W. D. Witt An extended bibliography of cryptography would fill many pages and is therefore beyond the scope of this work, but it is hoped that the following short selected list will be found useful. Some of these works are out of print or otherwise unobtainable, but may, in some instances, be found in public libraries or in old bookstores. The Riverbank Publications may be consulted at The Library of Congress, Washington, D. C. More or Less Elementary Works Boyer, John Q. “The Cryptogram” in Real Puzzles by John Q. Boyer, Rufus T. Strohm and George H. Pryor, pp. 147-154. Baltimore, 1925. (Simple substitution ciphers only.) Buranelli, Prosper, Margaret Petherbridge and F. Gregory Hartswick. The Cryptogram Book. New York, 1928. (Simple substitution ciphers only.) Hitt, Parker (Colonel). The A B C of Secret Writing. New York, 1935. Lysing, Henry, pseud. (John Leonard Nanovic). Secret Writing. New York, 1936. ―. The Cryptogram Book. New York, 1937. Mansfield, Louis C. S. The Solution of Codes and Ciphers. London, 1936. ―. One Hundred Problems in Cipher. London, 1936. Ohaver, M. E. Cryptogram Solving. Columbus, Ohio, 1933, (Simple substitution ciphers only.) Thomas, Paul B. Secret Messages. New York and London, 1928. 2nd printing, 1929. Windolph, J. Fred (“Phil Down”). “Cryptograms: Their Construction and Solution” in A Key to Puzzledom, pp. 53-64. New York, 1906. (Simple substitution ciphers only.) Yardley, Herbert Osborne (Major). Yardleygrams. Indianapolis, 1932. (The London edition (1932) bears the title Ciphergrams.) Advanced Works Friedman, William F. (Lt.-Colonel). Elements of Cryptanalysis. Washington, Gov. Printing Office, 1924. “For Offcial Use Only.” (Contains a bibliography. Out of print and unobtainable.) ―. See also Riverbank Publications. Givierge, Marcel (General). Cours de Cryptographie. Paris, 1st edition, 1925, 2nd edition, 1932. Hitt, Parker (Colonel). Manual for the Solution of Military Ciphers. Fort Leavenworth, Kans., 1st edition, 1916, 2nd edition, 1918. Riverbank Publications. Papers (except No. 19) by W. F. Friedman. Department of Ciphers, Riverbank Laboratories, Geneva, Illinois. No. 15, 1917. “A Method of Reconstructing the Primary Alphabet.” No. 16, 1918. “Methods for the Solution of Running-key Ciphers.” No. 17, 1918. “An Introduction to Methods for the Solution of Ciphers.” No. 18, 1918. “Synoptic Tables for the Solution of Ciphers, and a Bibliography of Cipher Literature.” No. 19, 1918. “Formulae for the Solution of Geometrical Transposition Ciphers,” by Captain Lenox R. Lohr, with an introduction by W. F. Friedman. No. 20, 1918. “Several Machine Ciphers and Methods for Their Solution.” No. 21, 1918. “Methods for the Reconstruction of Primary Alphabets.” No. 22, 1922. “The Index of Coincidence and Its Applications in Cryptographic Analysis.” Sacco, Luigi (General). Manuale di crittografia. Rome, 2nd edition, revised and enlarged, 1936. (The first edition was privately printed under the title Nozioni di crittografia. Rome, 1930.) Zanotti, Mario. Crittografia. Milan, 1928. Miscellaneous (Primarily descriptive of systems, historical, special essays, etc., usually with little on cryptanalysis.) Anon. “Cryptography” in Encyclopaedia Britannica, Vol. 6, 14th edition, New York and London, 1929. (Contains a bibliography.) Ball, W. W. Rouse. “Cryptographs and Ciphers” in his Mathematical Recreations and Essays. 7th edition, 1917 and later. (Latest edition is the 11th, 1939.) Blair, William. “Cipher in Diplomatic Affairs” in Rees’s Cyclopaedia. 1803-1819. Candela, Rosario. The Military Cipher of Commandant Bazeries, An Essay in Decrypting. New York, 1938. Friedman, William F. (Lt.-Colonel). “Codes and Ciphers” in Encyclopaedia Britannica, Vol. 5, 14th edition, New York and London, 1929. (Contains bibliography.) ―. “Edgar Allan Poe, Cryptographer” in American Literature, A Journal of Literary History, Criticism and Bibliography, Vol. 8, No. 3, Nov. 1936, pp. 266-280. Duke University, Durham, N. C. Hulme, Frederick Edward. Cryptography, or, The History, Principles and Practice of Cipher-Writing. London, 1898. Lange, André and E. A. Soudart. Traité de Cryptographie. Paris, 1st edition, 1925, new edition, 1935. (Contains an extensive bibliography.) Lange, André. Cryptography. Translated from the French by J. C. H. Macbeth, London and New York, 1922. Pratt, Fletcher. Secret and Urgent, The Story of Codes and Ciphers. Indianapolis, 1939. Yardley, Herbert Osborne (Major). The American Black Chamber. Indianapolis and London, 1931. Reprinted, New York, 1933, London, 1934. THE COMMONEST ENGLISH WORDS Below are listed the hundred most frequently used words in English. The figures give occurrences in 242,432 words of English text taken from fifteen English authors and many newspapers. Compiled by Frank R. Fraprie, after the rest of the book had been completed. THE 15568 OR 1101 WHEN 603 ONLY 309 OF 9767 HER 1093 WHAT 570 ANY 302 AND 7638 HAD 1062 YOUR 533 THEN 298 TO 5739 AT 1053 MORE 523 ABOUT 294 A 5074 FROM 1039 WOULD 516 THOSE 288 IN 4312 THIS 1021 THEM 498 CAN 285 THAT 3017 MY 963 SOME 478 MADE 284 IS 2509 THEY 959 THAN 445 WELL 283 I 2292 ALL 881 MAY 441 OLD 282 IT 2255 THEIR 824 UPON 430 MUST 280 FOR 1869 AN 789 ITS 425 US 279 AS 1853 SHE 775 OUT 387 SAID 276 WITH 1849 HAS 753 INTO 387 TIME 273 WAS 1761 WERE 752 OUR 386 EVEN 272 HIS 1732 ME 745 THESE 385 NEW 265 HE 1727 BEEN 720 MAN 383 COULD 264 BE 1535 HIM 708 UP 369 VERY 259 NOT 1496 ONE 700 DO 360 MUCH 252 BY 1392 SO 696 LIKE 354 OWN 251 BUT 1379 IF 684 SHALL 351 MOST 251 HAVE 1344 WILL 680 GREAT 340 MIGHT 250 YOU 1336 THERE 668 NOW 331 FIRST 249 WHICH 1291 WHO 664 SUCH 328 AFTER 247 ARE 1222 NO 658 SHOULD 327 YET 247 ON 1155 WE 638 OTHER 320 TWO 244 ENGLISH TRIGRAMS The ninety-eight most frequent English trigrams, combining a count of 20,000 trigrams by Fletcher Pratt, in “Secret and Urgent,” supposed not to include overlaps between words, and 5,000 by Frank R. Fraprie, including overlaps. This table and the following one are not referred to in the text, having been compiled since the completion of the book. THE 1182 HER 170 HIS 130 ITH 111 ING 356 ATE 165 RES 125 TED 110 AND 284 VER 159 ILL 118 AIN 108 ION 252 TER 157 ARE 117 EST 106 ENT 246 THA 155 CON 114 MAN 101 FOR 191 ATI 148 NCE 113 RED 101 TIO 188 HAT 138 ALL 111 THI 100 ERE 173 ERS 135 EVE 111 IVE 96 REA 95 INE 73 ORE 65 ART 58 WIT 93 WHI 71 BUT 64 NTE 58 ONS 92 OVE 71 OUT 63 RAT 58 ESS 90 TIN 71 URE 63 TUR 58 AVE 84 AST 70 STR 62 ICA 57 PER 84 DER 70 TIC 62 ICH 57 ECT 83 OUS 70 AME 61 NDE 57 ONE 83 ROM 70 COM 61 PRE 57 UND 83 VEN 70 OUR 61 ENC 56 INT 80 ARD 69 WER 61 HAS 56 ANT 79 EAR 69 OME 60 WHE 55 HOU 77 DIN 68 EEN 59 WIL 55 MEN 76 STI 68 LAR 59 ERA 54 WAS 76 NOT 67 LES 59 LIN 54 OUN 75 ORT 67 SAN 59 TRA 54 PRO 75 THO 66 STE 59 STA 75 DAY 65 ANY 58 ENGLISH DIGRAMS The one hundred and nine most frequent English digrams, compiled from a count of 20,000 trigrams by Fletcher Pratt, in “Secret and Urgent,” supposed not to include overlaps between words, and 5,000 by Frank R. Fraprie, including overlaps. TH 1582 RO 275 WI 188 SA 146 CT 111 IN 784 LI 273 HO 184 NI 142 TU 108 ER 667 RI 271 TR 183 RT 142 DA 107 RE 625 IO 270 BE 181 NA 141 AM 104 AN 542 LE 263 CE 177 OL 141 CI 104 HE 542 ND 263 WH 177 EV 131 SU 102 AR 511 MA 260 LL 176 IE 129 BL 101 EN 511 SE 259 FI 175 MI 128 OF 101 TI 510 AL 246 NO 175 NG 128 BU 100 TE 492 IC 244 TO 175 PL 128 AT 440 FO 239 PE 174 IV 127 ON 420 IL 232 AS 172 PO 125 HA 420 NE 232 WA 171 CH 122 OU 361 LA 229 UR 169 EI 122 IT 356 TA 225 LO 166 AD 120 ES 343 EL 216 PA 165 SS 120 ST 340 ME 216 US 165 IL 118 OR 339 EC 214 MO 164 OS 117 NT 337 IS 211 OM 163 UL 115 HI 330 DI 210 AI 162 EM 114 EA 321 SI 210 PR 161 NS 113 VE 321 CA 202 WE 158 OT 113 CO 296 UN 201 AC 152 GE 112 DE 275 UT 189 EE 148 IR 112 RA 275 NC 188 ET 146 AV 111 INDEX Amateurs, devices proposed by, 132, 140, 152 “Amsco” transposition cipher, 51 Anagramming, 22, 29, 45-50 Anagramming, multiple, 32, 56-68 “Aristocrats,” 69, 72, 88 Auto-encipherment, 146-158 Bacon’s biliteral cipher, 6 Basic cipher alphabet, 164 Bassières processes for autokey, 147-151 Beaufort ciphers, 121 “Bifid” substitution, 210 Book cipher, 106 “Caesar” alphabets, 69, 71, 100, 108, 118, 130 Characteristics of systems, 53, 100, 103, 105, 130, 153, 168, 201-203, 213-214 “Checkerboard” alphabets, 102, 104, 164, 209 Cipher, meaning of, 1 Cipher alphabets, 69, 130, 159, 172, 185 Cipher disks, 108, 111 Cipher disks, special application of, 192 Classification of ciphers, 1 Classification of substitutions, 68 Code, 1, 106 Collon systems, 209 Columnar transposition, 11, 17, 23, 37-52 Columnar transposition, double, 54 “Columns” in autokeyed ciphers, 146 Combination block, 44 Combination cipher, 1, 4, 6, 68, 207, 209, 213, 216 Complements, complementary alphabets, 123 Complete-unit transposition, 9 Concealment cipher, meaning of, 1 Concealment ciphers, 4-8 Consonant-line method for simple substitution, 88 Contact count, 74, 77, 83, 173 Conventional writing, 4 “Crypt,” 72, 91 Cryptanalysis, meaning of, 3 Cryptogram, meaning of, 1 Cryptographic security, 2 Cycle (see period or unit) Cyclical encipherment, 186, 200 Deciphering alphabet (or key), 71, 104 Decipherment, meaning of, 1 Decoding, meaning of, 2 Decrypt, meaning of, 1 Definitions, miscellaneous, 1, 68-70 Dictionary cipher, 106 Digram, meaning of, 1 Digram count, 83 Digram-solution method for simple substitution, 83 Digram tests, 45, 46, 47, 50 Dissimulated writing, 4 Double-key substitution, meaning of, 68 Double Myszkowsky transposition, 60 Double substitutions, 155, 164, 193 Double transpositions, 18, 54 Empty, or negative, words, 76 Encipherment, meaning of, 1 Encoding, meaning of, 2 “Entry,” 74 Equivalent slide (or alphabet), 169, 180 Factoring, in transpositions, 12, 42 Factoring of intervals to find a period, 128, 132 “Force Method,” 90 Fractional substitution, meaning of, 68 Fractional substitutions, 209-212 Frequency (see statistics) Frequency counts, 74, 83, 129, 161, 173 “Frequential checkerboard,” 105 German field cipher (the ADFGVX), 210 Grandpré’s word-square, 104-105 Graph, graphic appearance, 106, 131, 173 Grille, Fleissner’s, 26 Grille, Richelieu’s, 4 Grille, Sacco’s indefinite, 12 Grille, turning, 26 Gronsfeld cipher, 117 Group-application in polyalphabetic ciphers, 185 Group percentages (see statistics) Hermann cipher, 143 Index-letter (or cell), 111, 119, 124, 143, 169 Indicators, 101, 143 Intervals, alphabetical and lineal, 169, 180, 193, 194 Intervals in cryptograms, 43, 127 Inverse alphabets, 69 Irregular transposition, 37-67 Isolating a cipher alphabet, 122 Kasiski method, 127 Key, meaning of, 1 Key-alphabet, 108 “Key-frame” (or “skeleton”), 86, 175, 206 Key-interruption, 143 Key-length, 11, 17, 42, 127, 147 Key-lengthening devices in Vigenère, 143 Key-letter, 108 “Key-phrase” cipher, 103 Keys for simple substitution, 69 Keys, preparation of, 17, 26, 70, 104 Keys, recovery of, 23, 33, 39, 40, 45, 50, 58-63, 64, 85, 106, 124, 150, 157, 163, 164, 167, 175-183, 188-190, 205 Keywords, uses of, 17, 70, 146, 169 Knight’s tour, 10 Legrand’s open-letter cipher, 5 Levine’s concealment ciphers, 7 “Lining up” frequency counts, 162-163 Low-frequencies, assistance from, 99, 100, 129, 136, 138, 160 Low-frequency contacts, 78, 174 Magic squares, 10 Mathematical aspects of multiple-alphabet ciphers, 142, 151, 193, 196 Mechanical methods, 21, 32, 45, 56-58, 133, 138, 149 Military aspects of ciphers, 3, 55 Mirabeau’s cipher, 209 Mixed alphabets, 70, 169 Monoalphabetic substitution, meaning of, 68 Morse alphabet, 210 “Multifid” alphabets, 209 Multi-literal substitutes, 6, 7, 104 Multiple-alphabet ciphers, 108-197 Multiple-alphabet substitution, meaning of, 68 Multiple messages, 56, 85, 140, 146, 185 Multiple-substitutional encipherment, Multiple substitutes, 68, 99, 102, 103, 159 Myszkowsky’s transposition, 51 Negative, or empty, words, 76 “Nicodemus” cipher, 216 Nihilist number-cipher, 164-168 Nihilist transposition cipher, 17, 53 Novelty ciphers, 100, 214 Null cipher, 4 Nulls, legitimate uses of, 37, 55, 110, 201 Nulls, meaning of, 9 Numbers and symbols, encipherment of, 101 Numbers used as substitutes, 154-157, 159-168 Ohaver method for period finding, 160 Open-letter cipher, 4 Pair-count, 202 Pair-encipherment, 198, 199, 200 Parallel frequency counts, 162, 165, 177 “Pattern words,” 73 Pentagram, meaning of, 1 Periodic ciphers, 108-184 “Period” in autokey ciphers, 146 Period, periodicity, 108, 112-114, 127, 138, 166, 195 “Phillips” cipher, 185 Phonetic alphabets, 106 Playfair cipher, 200 “Pointers” for vowel-spotting, 78 Pollux systems, 209 Polyalphabetic ciphers, names of, 108 Polyalphabetic substitution, meaning of, 68 Polyalphabetic substitutions, 108-197 Polybius square, 164, 209 Polygram substitution, meaning of, 68 Polygram substitutions, 198-208 Porta cipher, 118 Primary cipher alphabet, 164, 169 Primary cryptogram (see double transpositions or double substitutions) Probable word methods, 23, 29, 34, 37, 99, 113, 119, 124, 147, 202, 206 Progression, Progression index, 192 Puncture cipher, 4 “Quagmires” cipher, 182 “Rail fence” transpositions, 12 Reciprocal substitution, 70, 118, 121, 123 Rectangular transposition, 11 “Route cipher,” 14 Route transposition, 11 “Running down the alphabet,” 72, 100, 118, 124, 139, 185, 192, 214 “Running key,” 143 Saint-Cyr cipher, 110 Scytale, 14 Secondary cipher alphabets, 164, 169 Sequence (see statistics) Seriation, Seriation index, 207, 210 Shift, Shifted alphabets, 69, 70, 72, 108, 119, 133, 172, 177 Short word method for divided cryptograms, 72 Simple substitution, meaning of, 68 Simple substitutions, 69-107 Slides, slide-rules for decrypting, 141 for encipherment, 110, 119, 123, 169, 170 used in transposition, 13, 61 Specific key, 169 Statistics, some uses of, 14, 18, 21, 40-42, 45-50, 57, 73, 75, 78-85, 88, 113, 130, 141, 150, 153, 174, 187, 201, 202, 213 “Step-up” and “step-down” letters, 89 “Straddling” devices, 105 Strips used in decryptment of transpositions, 15 used for encipherment of polyalphabeticals, 108 used for decryptment of periodics, 136 Substitutes, 68 Substitution cipher, meaning of, 1 Substitution ciphers, 68-212 Symbols, 68 “Symmetry of position,” 176 Tableaux: Vigenère, 109 Porta, 118 Beaufort, 121 used for decryptment of periodics, 134 formed in autokey decryptment, 150 high-frequency co-efficients, 152 imaginary, or formed in key-recovery, 170-172, 178 Delastelle, 177 for finding alphabetical intervals, 194 for pair-encipherment, 198 “Taking off” (Transcription), 9, 17, 23, 60 Terminals (see statistics) Tetragram, meaning of, 1 Transformation device, 102 Transposition, meaning of, 1 Transposition ciphers, 9-67 Trial key, 111, 150 “Trifid” substitution, 210 Trigram, meaning of, 1 Trigram encipherment, 199 Trigram method of solution: applied to Beaufort, 125 applied to Gronsfeld, 117 applied to Porta, 119 applied to Vigenère, 113 with the use of a slide, 141 Trithème’s alphabet, 7 Unit, 9, 18 United States Army Cipher Disk, 108, 123 United States Army Double Transposition, 54 Variant Beaufort cipher, 121 Variety of contact, 75, 78, 88, 174, 204 Variety count, 75, 88 Vigenère cipher, 108 Vowel-distribution (see statistics) Vowel-line method for simple substitution, 91 Vowel-solution method, 78, 174 Word-spacers, 100 “Writing-in” (Inscription), 9, 17, 23, 60 Transcriber's Note The original figures were made with a typewriter, and then lines, arrows, or circles were added. This file reproduces them as well as is possible as plain text. Please see the HTML version if you wish to see the figures with all of their details. Minor corrections, such as removing extra spaces or punctuation, or adding missing spaces or punctuation or diacritical marks, were made without note. Archaic and inconsistent spelling was retained. In two places, the number of a referenced figure was corrected. Grammar and spelling were only corrected as in the following list of notable changes. In two places, “diagram” was corrected to “digram”. In three places, “direct” was corrected to “directly”. In Chapter III, we italicized the first occurrence of “magic square” because it seemed like the author’s intention. In the same chapter, “said be clockwise” was corrected to “said to be clockwise”. In Figure 43, “ISGAY” was corrected to “ISGAU” to match previous figures and to correct spelling in the plaintext. In Chapter VII, “those who like method” was corrected to “those who like this method”. In Chapter XVIII, “misuse of the Type II slide” was corrected to “misuse of the Type I slide”. In Figure 139, “IQCIO” is corrected to “IQVIO”. In the Appendix, in the list of English trigrams, “WHI 51” was corrected to “WHI 71”. Some corrections were made to the exercises in order to rectify the spelling in their plaintexts or (in one case) to resolve an inconsistency in its key. In exercise 33, seven letters were missing. The uncorrected cryptogram is VINSC FEAEO OHSEF HLEHU NSTNC LTSLC IAESH RHSIR ERMTS ETEPD TOINM RTTHT TLRUB E. Exercise 110: “LRSFQ” corrected to “IRSFQ”. Exercise 115: “FBEHZHWU” corrected to “FBEHZHWG”. Exercise 116: “HVIYF” corrected to “HVXYF”. Exercise 128: “JQAOJ” corrected to “JQAOI” and “QNUSG” to “QNUSU”. Exercise 130: “FBWXJ” corrected to “FRWXJ”. Exercise 138: “XVKFV” corrected to “XVKEV”. Exercise 141: “KFTFB” corrected to “KFTFX”. Exercise 144: “TAJNI WRDB” corrected to “TAJNW ARDB”. Exercise 145: “TTHNY” corrected to “TTHNJ”. Exercise 146: “PGOUR” corrected to “PGOUJ” and “VDDMH” corrected to “VDDMP” (we are not sure about “VFCFT”). Exercise 147: “UVSYC” corrected to “UBSYC”, “IXYDY” to “IXYPY”, “VXOOK” to “NXOOK”, and “NNHMM” to “NNHWM”. Exercise 149: “MS” corrected to “PF”. Exercise 153: “QY BN QM” corrected to “QY BM QM” and “BL PK QM” to “BL PO QM”. Exercise 40 has error(s) in the first 25 letters. We do not know what was the intention of its creator. The above list should not be assumed to be correct or complete. We wish to thank the anonymous proof-readers who volunteered at the British National Cipher Challenge (www.cipherchallenge.org). *** END OF THE PROJECT GUTENBERG EBOOK ELEMENTARY CRYPTANALYSIS *** Updated editions will replace the previous one—the old editions will be renamed. Creating the works from print editions not protected by U.S. copyright law means that no one owns a United States copyright in these works, so the Foundation (and you!) can copy and distribute it in the United States without permission and without paying copyright royalties. Special rules, set forth in the General Terms of Use part of this license, apply to copying and distributing Project Gutenberg™ electronic works to protect the PROJECT GUTENBERG™ concept and trademark. Project Gutenberg is a registered trademark, and may not be used if you charge for an eBook, except by following the terms of the trademark license, including paying royalties for use of the Project Gutenberg trademark. If you do not charge anything for copies of this eBook, complying with the trademark license is very easy. You may use this eBook for nearly any purpose such as creation of derivative works, reports, performances and research. Project Gutenberg eBooks may be modified and printed and given away—you may do practically ANYTHING in the United States with eBooks not protected by U.S. copyright law. Redistribution is subject to the trademark license, especially commercial redistribution. START: FULL LICENSE THE FULL PROJECT GUTENBERG LICENSE PLEASE READ THIS BEFORE YOU DISTRIBUTE OR USE THIS WORK To protect the Project Gutenberg™ mission of promoting the free distribution of electronic works, by using or distributing this work (or any other work associated in any way with the phrase “Project Gutenberg”), you agree to comply with all the terms of the Full Project Gutenberg™ License available with this file or online at www.gutenberg.org/license. Section 1. General Terms of Use and Redistributing Project Gutenberg™ electronic works 1.A. By reading or using any part of this Project Gutenberg™ electronic work, you indicate that you have read, understand, agree to and accept all the terms of this license and intellectual property (trademark/copyright) agreement. If you do not agree to abide by all the terms of this agreement, you must cease using and return or destroy all copies of Project Gutenberg™ electronic works in your possession. If you paid a fee for obtaining a copy of or access to a Project Gutenberg™ electronic work and you do not agree to be bound by the terms of this agreement, you may obtain a refund from the person or entity to whom you paid the fee as set forth in paragraph 1.E.8. 1.B. “Project Gutenberg” is a registered trademark. It may only be used on or associated in any way with an electronic work by people who agree to be bound by the terms of this agreement. There are a few things that you can do with most Project Gutenberg™ electronic works even without complying with the full terms of this agreement. See paragraph 1.C below. There are a lot of things you can do with Project Gutenberg™ electronic works if you follow the terms of this agreement and help preserve free future access to Project Gutenberg™ electronic works. See paragraph 1.E below. 1.C. The Project Gutenberg Literary Archive Foundation (“the Foundation” or PGLAF), owns a compilation copyright in the collection of Project Gutenberg™ electronic works. Nearly all the individual works in the collection are in the public domain in the United States. If an individual work is unprotected by copyright law in the United States and you are located in the United States, we do not claim a right to prevent you from copying, distributing, performing, displaying or creating derivative works based on the work as long as all references to Project Gutenberg are removed. Of course, we hope that you will support the Project Gutenberg™ mission of promoting free access to electronic works by freely sharing Project Gutenberg™ works in compliance with the terms of this agreement for keeping the Project Gutenberg™ name associated with the work. You can easily comply with the terms of this agreement by keeping this work in the same format with its attached full Project Gutenberg™ License when you share it without charge with others. 1.D. The copyright laws of the place where you are located also govern what you can do with this work. Copyright laws in most countries are in a constant state of change. If you are outside the United States, check the laws of your country in addition to the terms of this agreement before downloading, copying, displaying, performing, distributing or creating derivative works based on this work or any other Project Gutenberg™ work. The Foundation makes no representations concerning the copyright status of any work in any country other than the United States. 1.E. Unless you have removed all references to Project Gutenberg: 1.E.1. The following sentence, with active links to, or other immediate access to, the full Project Gutenberg™ License must appear prominently whenever any copy of a Project Gutenberg™ work (any work on which the phrase “Project Gutenberg” appears, or with which the phrase “Project Gutenberg” is associated) is accessed, displayed, performed, viewed, copied or distributed: This eBook is for the use of anyone anywhere in the United States and most other parts of the world at no cost and with almost no restrictions whatsoever. You may copy it, give it away or re-use it under the terms of the Project Gutenberg License included with this eBook or online at www.gutenberg.org. If you are not located in the United States, you will have to check the laws of the country where you are located before using this eBook. 1.E.2. If an individual Project Gutenberg™ electronic work is derived from texts not protected by U.S. copyright law (does not contain a notice indicating that it is posted with permission of the copyright holder), the work can be copied and distributed to anyone in the United States without paying any fees or charges. If you are redistributing or providing access to a work with the phrase “Project Gutenberg” associated with or appearing on the work, you must comply either with the requirements of paragraphs 1.E.1 through 1.E.7 or obtain permission for the use of the work and the Project Gutenberg™ trademark as set forth in paragraphs 1.E.8 or 1.E.9. 1.E.3. If an individual Project Gutenberg™ electronic work is posted with the permission of the copyright holder, your use and distribution must comply with both paragraphs 1.E.1 through 1.E.7 and any additional terms imposed by the copyright holder. Additional terms will be linked to the Project Gutenberg™ License for all works posted with the permission of the copyright holder found at the beginning of this work. 1.E.4. Do not unlink or detach or remove the full Project Gutenberg™ License terms from this work, or any files containing a part of this work or any other work associated with Project Gutenberg™. 1.E.5. Do not copy, display, perform, distribute or redistribute this electronic work, or any part of this electronic work, without prominently displaying the sentence set forth in paragraph 1.E.1 with active links or immediate access to the full terms of the Project Gutenberg™ License. 1.E.6. You may convert to and distribute this work in any binary, compressed, marked up, nonproprietary or proprietary form, including any word processing or hypertext form. However, if you provide access to or distribute copies of a Project Gutenberg™ work in a format other than “Plain Vanilla ASCII” or other format used in the official version posted on the official Project Gutenberg™ website (www.gutenberg.org), you must, at no additional cost, fee or expense to the user, provide a copy, a means of exporting a copy, or a means of obtaining a copy upon request, of the work in its original “Plain Vanilla ASCII” or other form. Any alternate format must include the full Project Gutenberg™ License as specified in paragraph 1.E.1. 1.E.7. Do not charge a fee for access to, viewing, displaying, performing, copying or distributing any Project Gutenberg™ works unless you comply with paragraph 1.E.8 or 1.E.9. 1.E.8. You may charge a reasonable fee for copies of or providing access to or distributing Project Gutenberg™ electronic works provided that: • You pay a royalty fee of 20% of the gross profits you derive from the use of Project Gutenberg™ works calculated using the method you already use to calculate your applicable taxes. The fee is owed to the owner of the Project Gutenberg™ trademark, but he has agreed to donate royalties under this paragraph to the Project Gutenberg Literary Archive Foundation. Royalty payments must be paid within 60 days following each date on which you prepare (or are legally required to prepare) your periodic tax returns. Royalty payments should be clearly marked as such and sent to the Project Gutenberg Literary Archive Foundation at the address specified in Section 4, “Information about donations to the Project Gutenberg Literary Archive Foundation.” • You provide a full refund of any money paid by a user who notifies you in writing (or by e-mail) within 30 days of receipt that s/he does not agree to the terms of the full Project Gutenberg™ License. You must require such a user to return or destroy all copies of the works possessed in a physical medium and discontinue all use of and all access to other copies of Project Gutenberg™ works. • You provide, in accordance with paragraph 1.F.3, a full refund of any money paid for a work or a replacement copy, if a defect in the electronic work is discovered and reported to you within 90 days of receipt of the work. • You comply with all other terms of this agreement for free distribution of Project Gutenberg™ works. 1.E.9. If you wish to charge a fee or distribute a Project Gutenberg™ electronic work or group of works on different terms than are set forth in this agreement, you must obtain permission in writing from the Project Gutenberg Literary Archive Foundation, the manager of the Project Gutenberg™ trademark. Contact the Foundation as set forth in Section 3 below. 1.F. 1.F.1. Project Gutenberg volunteers and employees expend considerable effort to identify, do copyright research on, transcribe and proofread works not protected by U.S. copyright law in creating the Project Gutenberg™ collection. Despite these efforts, Project Gutenberg™ electronic works, and the medium on which they may be stored, may contain “Defects,” such as, but not limited to, incomplete, inaccurate or corrupt data, transcription errors, a copyright or other intellectual property infringement, a defective or damaged disk or other medium, a computer virus, or computer codes that damage or cannot be read by your equipment. 1.F.2. LIMITED WARRANTY, DISCLAIMER OF DAMAGES - Except for the “Right of Replacement or Refund” described in paragraph 1.F.3, the Project Gutenberg Literary Archive Foundation, the owner of the Project Gutenberg™ trademark, and any other party distributing a Project Gutenberg™ electronic work under this agreement, disclaim all liability to you for damages, costs and expenses, including legal fees. YOU AGREE THAT YOU HAVE NO REMEDIES FOR NEGLIGENCE, STRICT LIABILITY, BREACH OF WARRANTY OR BREACH OF CONTRACT EXCEPT THOSE PROVIDED IN PARAGRAPH 1.F.3. YOU AGREE THAT THE FOUNDATION, THE TRADEMARK OWNER, AND ANY DISTRIBUTOR UNDER THIS AGREEMENT WILL NOT BE LIABLE TO YOU FOR ACTUAL, DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE OR INCIDENTAL DAMAGES EVEN IF YOU GIVE NOTICE OF THE POSSIBILITY OF SUCH DAMAGE. 1.F.3. LIMITED RIGHT OF REPLACEMENT OR REFUND - If you discover a defect in this electronic work within 90 days of receiving it, you can receive a refund of the money (if any) you paid for it by sending a written explanation to the person you received the work from. If you received the work on a physical medium, you must return the medium with your written explanation. The person or entity that provided you with the defective work may elect to provide a replacement copy in lieu of a refund. If you received the work electronically, the person or entity providing it to you may choose to give you a second opportunity to receive the work electronically in lieu of a refund. If the second copy is also defective, you may demand a refund in writing without further opportunities to fix the problem. 1.F.4. Except for the limited right of replacement or refund set forth in paragraph 1.F.3, this work is provided to you ‘AS-IS’, WITH NO OTHER WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY OR FITNESS FOR ANY PURPOSE. 1.F.5. Some states do not allow disclaimers of certain implied warranties or the exclusion or limitation of certain types of damages. If any disclaimer or limitation set forth in this agreement violates the law of the state applicable to this agreement, the agreement shall be interpreted to make the maximum disclaimer or limitation permitted by the applicable state law. The invalidity or unenforceability of any provision of this agreement shall not void the remaining provisions. 1.F.6. INDEMNITY - You agree to indemnify and hold the Foundation, the trademark owner, any agent or employee of the Foundation, anyone providing copies of Project Gutenberg™ electronic works in accordance with this agreement, and any volunteers associated with the production, promotion and distribution of Project Gutenberg™ electronic works, harmless from all liability, costs and expenses, including legal fees, that arise directly or indirectly from any of the following which you do or cause to occur: (a) distribution of this or any Project Gutenberg™ work, (b) alteration, modification, or additions or deletions to any Project Gutenberg™ work, and (c) any Defect you cause. Section 2. Information about the Mission of Project Gutenberg™ Project Gutenberg™ is synonymous with the free distribution of electronic works in formats readable by the widest variety of computers including obsolete, old, middle-aged and new computers. It exists because of the efforts of hundreds of volunteers and donations from people in all walks of life. Volunteers and financial support to provide volunteers with the assistance they need are critical to reaching Project Gutenberg™’s goals and ensuring that the Project Gutenberg™ collection will remain freely available for generations to come. In 2001, the Project Gutenberg Literary Archive Foundation was created to provide a secure and permanent future for Project Gutenberg™ and future generations. To learn more about the Project Gutenberg Literary Archive Foundation and how your efforts and donations can help, see Sections 3 and 4 and the Foundation information page at www.gutenberg.org. Section 3. Information about the Project Gutenberg Literary Archive Foundation The Project Gutenberg Literary Archive Foundation is a non-profit 501(c)(3) educational corporation organized under the laws of the state of Mississippi and granted tax exempt status by the Internal Revenue Service. The Foundation’s EIN or federal tax identification number is 64-6221541. Contributions to the Project Gutenberg Literary Archive Foundation are tax deductible to the full extent permitted by U.S. federal laws and your state’s laws. The Foundation’s business office is located at 809 North 1500 West, Salt Lake City, UT 84116, (801) 596-1887. Email contact links and up to date contact information can be found at the Foundation’s website and official page at www.gutenberg.org/contact Section 4. Information about Donations to the Project Gutenberg Literary Archive Foundation Project Gutenberg™ depends upon and cannot survive without widespread public support and donations to carry out its mission of increasing the number of public domain and licensed works that can be freely distributed in machine-readable form accessible by the widest array of equipment including outdated equipment. Many small donations ($1 to $5,000) are particularly important to maintaining tax exempt status with the IRS. The Foundation is committed to complying with the laws regulating charities and charitable donations in all 50 states of the United States. Compliance requirements are not uniform and it takes a considerable effort, much paperwork and many fees to meet and keep up with these requirements. We do not solicit donations in locations where we have not received written confirmation of compliance. To SEND DONATIONS or determine the status of compliance for any particular state visit www.gutenberg.org/donate. While we cannot and do not solicit contributions from states where we have not met the solicitation requirements, we know of no prohibition against accepting unsolicited donations from donors in such states who approach us with offers to donate. International donations are gratefully accepted, but we cannot make any statements concerning tax treatment of donations received from outside the United States. U.S. laws alone swamp our small staff. Please check the Project Gutenberg web pages for current donation methods and addresses. Donations are accepted in a number of other ways including checks, online payments and credit card donations. To donate, please visit: www.gutenberg.org/donate. Section 5. General Information About Project Gutenberg™ electronic works Professor Michael S. Hart was the originator of the Project Gutenberg™ concept of a library of electronic works that could be freely shared with anyone. For forty years, he produced and distributed Project Gutenberg™ eBooks with only a loose network of volunteer support. Project Gutenberg™ eBooks are often created from several printed editions, all of which are confirmed as not protected by copyright in the U.S. unless a copyright notice is included. Thus, we do not necessarily keep eBooks in compliance with any particular paper edition. Most people start at our website which has the main PG search facility: www.gutenberg.org. This website includes information about Project Gutenberg™, including how to make donations to the Project Gutenberg Literary Archive Foundation, how to help produce our new eBooks, and how to subscribe to our email newsletter to hear about new eBooks.