The Project Gutenberg eBook of Elementary cryptanalysis

This ebook is for the use of anyone anywhere in the United States and
most other parts of the world at no cost and with almost no restrictions
whatsoever. You may copy it, give it away or re-use it under the terms
of the Project Gutenberg License included with this ebook or online
at www.gutenberg.org. If you are not located in the United States,
you will have to check the laws of the country where you are located
before using this eBook.

Title: Elementary cryptanalysis

Author: Helen Fouché Gaines

Contributor: George C. Lamb

Release date: January 9, 2025 [eBook #75074]

Language: English

Original publication: Boston: American Photographic Publishing Co, 1939

*** START OF THE PROJECT GUTENBERG EBOOK ELEMENTARY CRYPTANALYSIS ***

ELEMENTARY CRYPTANALYSIS

Helen Fouché Gaines

Originally published in 1939 by American Photographic Publishing Co.

PREFACE

The word _cryptography_, properly speaking, embraces the entire field

of secret writing, while that branch of the subject dealing with the
solution and reading of cryptic messages is generally referred to as
_cryptanalysis_.

Works on the subject of secret writing are comparatively numerous,

if not always easily available, but works devoted purely to the
analysis of such writing and the solving of its cryptograms have,
until recently, been so rare as to be almost non-existent for the
general reader.

Today we have two particularly excellent works, but both in foreign

languages: _Cours de cryptographie_, by General Marcel Givierge, and
_Manuale di crittografia_, by General Luigi Sacco. In English, we
find a more elementary work, _The Solution of Codes and Ciphers_,
by Louis C. S. Mansfield (Maclehose, London), which, the writer has
been told, is to be a first volume. As to America’s contribution, we
seem to find only small books such as Colonel Parker Hitt’s
_A B C of Secret Writing_, covering three ciphers, or Colonel H. O.
Yardley’s _Yardleygrams_.

There are, however, many works which deal most interestingly with the
analysis and decryptment of some one particular cipher. Most of these
are short works, published in magazines or incorporated into books of
a general nature, and nearly always the one cipher dealt with is that
type of simple substitution which appears with separated words in the
puzzle section of our current magazines and newspapers.

One well-known gem of cryptanalysis, equal to any modern specimen,

can be found in the story, _The Gold-Bug_, by Edgar Allan Poe. This,
too, deals with the simple substitution cipher just referred to, but
covers a case in which word-divisions are absent. Poe has also left
us an essay called _Cryptography_.

Rosario Candela’s recent book, _The Military Cipher of Commandant

Bazeries_, shows the unraveling of one particular cryptogram which,
for many years, had baffled the best efforts of all amateurs, and,
it is rather suspected, of some few who were not amateurs. The book
contains a chapter on general cryptanalysis, and also some
cryptograms for solution.

_Secret and Urgent_, by Fletcher Pratt, is primarily a history of

secret writing (a most interesting one, by the way), but contains
also a number of examples of cryptanalysis; it also shows a table
which the writer has never before seen in published form: a list of
English trigrams (three-letter sequences) and the frequency with
which they are used in the language. Other examples of decryptment
may be found in the Macbeth translation of Langie’s genial little
book, _De la cryptographie_; the appendix to this translation
contains the coveted Playfair demonstration, prepared by Lieutenant
Commander W. W. Smith of the United States Navy.

Just why so absorbing a subject has been so neglected in a world

full of puzzle lovers is hard to understand, especially since the
analytic writer, in addition to entertainment, has something to
offer of a more serious nature. It is true that trained cryptanalysts
are not greatly in demand in peacetime, and that our present corps
of cryptographers has a personnel more than ample for providing
necessary codes and ciphers, scientifically selected to fit their
individual purposes, and safeguarded with suitable protective devices.
Yet of what value is the most excellent of ciphers if, at the time
of direst need, this cipher, with all of its safeguards, must be
placed in the hands of even one man who cannot appreciate its
intrinsic value or imagine a need for extra precautions? At any rate,
we make our feeble attempt to reach this “one man.” May he learn, at
least, that there are reasons for his instructions!

In the planning of the present treatise, all purely historical

aspects of secret writing were neglected, and many well-known ciphers
whose interest is chiefly historical or literary have either been
omitted or given but cursory treatment. Certain other ciphers,
representative of types, have been treated at whatever length seemed
advisable for bringing out principles; and, with each type discussed,
a generous number of cryptograms has been provided, on which the
student will be able to test his skill as he learns. The student who
masters these fundamentals will be acquainted with the principal
forms of cipher, and will be able to solve cryptograms prepared by
means of these ciphers provided the cryptograms are of adequate
length and based on a language which he understands, or of which he
is able to secure understandable specimens. Within limits, he should
also be able to analyze and solve such cryptograms without being told
in advance what the cipher is. This, we believe, is the kind of
text-book desired by the many who desire information about “ciphers.”
Its material, compiled by members of the American Cryptogram
Association, has had to be gathered from a great many sources, both
within the organization and elsewhere, making it impossible, at times,
to give credit where credit is due. Our chief indebtedness, however,
is to M. E. Ohaver for a series of articles published during the years
1924 to 1928 in the former Flynn’s Magazine and most unfortunately no
longer obtainable from the publishers. Further acknowledgment should
be made to Colonel Parker Hitt, whose _Manual for the Solution of
Military Ciphers_, though not available for general distribution,
can usually be consulted in large public libraries. We have also
borrowed liberally from foreign sources, and members of the
association have most generously contributed the results of their
original research. For this collaboration and co-operation, the
writer is particularly grateful.

CONTENTS

Preface
I. General Information
II. Concealment Devices
III. Transposition Types
IV. Geometrical Types — The Nihilist Transposition
V. Geometrical Types — The Turning Grille
VI. Irregular Types — Columnar Transposition
VII. General Methods — Multiple Anagramming, Etc.
VIII. Substitution Types
IX. Simple Substitution — Fundamentals
X. The Consonant-Line Short Cut
A Method for Attacking Difficult Cases
(by George C. Lamb)
XI. Simple Substitution with Complexities
XII. Multiple-Alphabet Ciphers — The Vigenère
XIII. The Gronsfeld, Porta, and Beaufort Ciphers
XIV. The Kasiski Method for Periodic Ciphers
XV. Miscellaneous Phases of Vigenère Decryptment
XVI. Auto-Encipherment
XVII. Some Periodic Number-Ciphers
XVIII. Periodic Ciphers with Mixed Alphabets
XIX. Polyalphabetical Encipherment Applied by Groups
XX. Vigenère with Key-Progression
XXI. Polygram Substitution — The Playfair Cipher
XXII. Highlights of Fractional Substitution
XXIII. Investigating the Unknown Cipher
Appendix
English Frequency and Sequence Data
Comparative Table of Single-Letter Frequencies
Chart Showing Normal Contact Percentages (by F. R. Carter)
Chart Showing Frequencies of English Digrams (by O. Phelps Meaker)
Some Foreign Language Data
Bibliography (by W. D. Witt)
The Commonest English Words (by Frank R. Fraprie)
English Trigrams (by Frank R. Fraprie)
English Digrams (by Frank R. Fraprie)
Index
CHAPTER I
General Information

The subject which we are about to study is the analysis and solution
of _cipher_, though not including _code_, which is a very special
form of cipher demanding something more than elementary knowledge;
nor shall we enter at all into the subject of _invisible inks_,
certainly a most important aspect of secret writing, but belonging
to the province of chemistry rather than to that of cryptanalysis.
_Cipher machines_, also, are not within our present scope.

The term _cipher_ implies a _method_, or _system_, of secret

writing which, generally speaking, is unlimited in scope; it should
be possible, using any one given cipher, to transform any _plaintext_
whatever, regardless of its length and the language in which it is
written, into a _cryptogram_, or single enciphered message. The
process of accomplishing this transformation is called _encipherment_;
the opposite process, that of transforming the cryptogram into a
plaintext, is called _decipherment_.

The word _decrypt_, with its various derivatives, is being used here
to signify the process of _solving_ and reading cryptograms without
any previous knowledge as to their _keys_, or secret formulas; thus
the word _decipher_ has been left to convey only its one meaning, as
mentioned above: the mechanical process of applying a known key. Our
word _decrypt_, however, is an innovation borrowed from the modern
French and Italian writers, and is somewhat frowned upon by leading
cryptologists.

The word _digram_ is being used to indicate a two-letter sequence;

similarly, we have _trigrams_, _tetragrams_, _pentagrams_, etc., to
indicate sequences of three, four, five, etc. letters.

* * *

Ciphers, in general, fall into three major classifications:

1. Concealment Cipher
2. Transposition Cipher
3. Substitution Cipher

Minor types, such as “abbreviation,” are sometimes included, though,

to the writer, these have never seemed to be truly of a cryptographic
nature.

In _concealment cipher_, the true letters of the secret message are

hidden, or disguised, by any device whatever; and this type of
cipher, as a general rule, is intended to pass without being
suspected as the conveyor of a secret communication.

In _transposition cipher_, the true letters of the secret message

are taken out of their text-order, and are rearranged according to
any pattern, or _key_, agreed upon by the correspondents.

In _substitution cipher_, these original text-letters are replaced

with substitutes, or cipher-symbols, and these symbols are arranged
in the same order as their originals. There may, of course, be
combinations of types, or combinations of several forms belonging to
a single type.

* * *

The aristocrat of the cipher family is _code_. This is a form of

the substitution cipher which requires the preparation, in advance,
of a _code book_. A series of terms likely to be used in future
correspondence (that is, words, phrases, and even sentences) is first
gathered into a vocabulary, or “dictionary”; and beside each of these
terms is placed a substitute known as a _code group_, or _code word_.
These substitutes may be groups of letters, or groups of digits, or
actual words selected from ordinary language. Very common words or
expressions are usually provided with more than one substitute; and
nearly always there are substitutes provided for syllables and single
letters, so as to take care of all words not originally included in
the vocabulary.

No code presents any real security unless the code symbols have been
assigned in a thoroughly haphazard manner. This means that any really
good code would have to be printed in two separate sections. In one
of these, the vocabulary terms would be arranged in alphabetical
order, so that they could be readily found when enciphering (_encoding_)
messages; but the code groups would be in mixed order and hard to
find. In the other section, the code groups would be rearranged in
straight alphabetical (or numerical) order, so as to be readily found
when deciphering (_decoding_), and the vocabulary terms would be
in mixed order. Just what is meant can be seen in Fig. 1, showing
fragments from an imaginary code book.

Figure 1

ENCIPHERMENT SECTION DECIPHERMENT SECTION

Vocabulary Term Code Symbol Code Symbol Vocabulary Term

A 9001, 2114, 3000* 1120 Assenting to your

Aachen 8463 1121 Horse
About 1119, 0034* 1122 Meet me
About time for 5434 1123* Come; Paris
Armored car 1125 1124 Th-
Assenting to your 1120 1125 Armored car

*) When a plaintext term has more than one symbol, these are called
homophones. Polyphones are symbols which may have more than one meaning.
The terms _encoding_, _decoding_ are usually preferred to _enciphering_,
_deciphering_.

A code of this kind, with symbols assigned _absolutely at random_,

provided it is carefully used (never without re-encipherment) and a
close guard kept over the code books, represents perhaps the maximum
of security to be attained in cryptographic correspondence; and
security, of course, is of prime importance in the selection of a
cipher for any practical purpose.

But in considering the relative merits of the various ciphers, it

is always necessary to take into account many factors other than
security, each cipher being evaluated in connection with the purpose
for which it is wanted: Under what conditions must the encipherment
and decipherment take place? How must the cryptograms be transmitted?
How much of the enciphered correspondence is likely to be intercepted?
What _degree_ of security, after all, is absolutely imperative?

A commercial, or other, firm, having a permanent base of operations,

and in little danger of being blown to bits by an enemy shell, would
not consider the first of these questions from the same angle as the
War Department, and the War Department, though considering all of
them from several different angles of its own, would still not
consider them from the same viewpoint as the State Department.

If messages are to be sent by mail, or by hand, or by telephone,

or pasted on a billboard, it is conceivable that a cipher which
doubles or trebles their length could still be a practical cipher.
For transmission by telephone, the presumption is that the cryptogram
must be pronounceable, or, certainly, audible. For written
communication, individual purposes have been served by means of
pictures.

But when the cryptograms are to be sent by wire or radio, it must

be possible to convert them into Morse symbols, either letters or
figures, but not intermingled letters and figures. Here, length
must be considered, involving questions of time, expense, and the
current telegraphic regulations. Moreover, it is conceded that a
meaningless text will not be transmitted with absolute accuracy,
and a cryptogram which is to be sent by this means must not be of
such a nature that ordinary errors of transmission will render it
unintelligible at the receiving office.

A factor of particularly grave importance in the selection of a

cipher to fit a given purpose is the probable amount of enciphered
material which is going to fall into the possession of unauthorized
persons. A criminal, who has had to send but one brief cryptogram
in a lifetime, might reasonably expect that it will remain forever
unread, no matter how weak the cipher. A commercial firm, transmitting
thousands of words over the air, is more vulnerable; and the diplomatic
office, or the newspaper office, which makes the mistake of publishing
almost verbatim the translations of cryptograms which have been
transmitted by radio, and thus has surely furnished the cipher
expert with a _cryptogram and its translation_, might just as well
have presented him with a copy of its code book.

As to just what constitutes the “perfect” cipher, perhaps it might

be said that this description fits any cipher whatever which provides
the degree of security wanted for an individual purpose, and which
is suited in other respects to that individual purpose. Even a
basically weak cipher, in the hands of an expert, can be made to
serve its purpose; and the strongest can be made useless when
improperly used.

In the present text, we are likely to be found looking at ciphers

largely from a military angle, which, apparently, has a more general
interest than any other. In time of war, the cryptographic service,
that is, the encipherment and transmitting service, is suddenly
expanded to include a large number of new men, many of whom know
nothing whatever of _cryptanalysis_, or the science of decryptment.
Many of these are criminally careless through ignorance, so that,
entirely aside from numerous other factors (including espionage),
it is conceded by the various War Departments that no matter what
system or apparatus is selected for cipher purposes, the enemy, soon
after the beginning of operations, will be in full possession of
details concerning this system, and will have secured a duplicate
of any apparatus or machine. For that reason, the secrecy of messages
must depend upon a changeable key added to a sound basic cipher.

Speed in encipherment and decipherment is desirable, and often urgent;

and the conditions under which these operations must often take place
are conducive to a maximum of error. The ideal cipher, under these
conditions, would be one which is simple in operation, preferably
requiring no written memoranda or apparatus which cannot be quickly
destroyed and reconstructed from memory, and having a key which is
readily changed, easily communicated, and easily remembered. Yet the
present tendency, in all armies, seems to be toward the use of small
changeable _codes_, which are written (printed) documents; and, for
certain purposes, small mechanical devices.

An enormous number of military cryptograms will be transmitted by

radio and taken down by enemy listeners, and even the ordinary wire
will be tapped. It is expected that the enemy will intercept dozens,
and even hundreds, of cryptograms in a single day, some of which will
inevitably be enciphered with the same key. With so much material,
knowing the general subject matter, and often exactly what words to
expect, or the personal expressions invariably used by individuals,
it is conceded that he will read the messages. All that is desired
of a cryptogram is that it will resist his efforts for a sufficient
length of time to render its contents valueless when he finally
discovers them. By that time, of course, the key will have been
changed, probably several times, and even the cipher.

With these general facts understood, we may first dispose hastily

of the concealment cipher, after which we will examine at greater
length the two legitimate types, the transpositions and the
substitutions.

CHAPTER II
Concealment Devices

Concealment writing may take a host of forms. Perhaps its oldest known
application is found in the ancient device of writing a secret message
on the shaved head of a slave and dispatching the slave with his
communication after his growing hair had covered the writing. Or, if
this appears a little incredible, the ancients have left us records
of another device considerably more practical: that of writing the
secret message on a wooden tablet, covering this with a wax coating,
and writing a second message on top of the first.

In the middle ages we meet a development called _puncture cipher_;

any piece of printed matter, such as a public proclamation, serves
as the vehicle, and the cipher consists simply in punching holes with
a pin under certain letters, so that these letters, read in regular
order, will convey the desired information. It is said that this kind
of concealment writing was resorted to in England at a comparatively
recent period, to avoid the payment of postage. Postage on letters
was very high, while newspapers were permitted to travel free, and
the correspondents sent their messages very handily by punching holes
under the letters printed in newspapers. Where the sender of a message
may also control the preparation of the printed vehicle, any desired
letters can be pointed out by the use of special type forms, misspelled
words, accidental gaps, and so on.

But concealment cipher is not necessarily confined to written and

printed matter. Ohaver, in his “Solving Cipher Secrets,” demonstrated
the conveyance of messages in the shapes and sizes of stones in a
garden wall, or in the arrangement of colored candies in a box; and
we read, in fiction, of many similar devices, such as a series of
knots tied in a string, or beads strung in imitation of the rosary.
Again, we hear of cases in which the arrangement of stamps on
envelopes is made to represent the terms of a miniature code. All
such devices are, of course, combination-cipher rather than pure
concealment, since the stones, candies, and so on, must first be
made the substitutes for letters or code terms.

A method of pure concealment, said to have been used by Cardinal

Richelieu, involved the use of a _grille_. Grilles are made of
cardboard, sheet-metal, or other flat material, and are perforated
with any desired number, size, and arrangement of openings. The
Richelieu grille, of approximately the same size and shape as the
paper used for correspondence, could be laid over a sheet of paper
so as to reveal only certain portions, and the secret message was
written on these. The grille was then removed and the rest of the
sheet was filled in with extraneous matter in such a way as to present
a seemingly continuous text. The legitimate recipient of this message,
having a duplicate grille, simply laid this grille over the sheet
of paper, and read his message through the apertures.

Concealment cipher goes by various names, as _null cipher_,

_open-letter cipher_, _conventional writing_, _dissimulated writing_,
and so on, not always with a difference in meaning, though
“conventional writing” does convey somewhat the idea of a tiny
code. (In this, casual words have special meanings.)

The name “null cipher” derives from the fact that in any given
cryptogram the greater portion of the letters are null, a certain
few being significant, and perhaps a few others being significant
only in that they act as indicators for finding truly significant
letters. To illustrate what is usually meant: Say that your very
good friend, Smith, first complains about a radio which he has
bought from your neighbor, Johnson, then asks you to take Johnson
the following note: “Having trouble about loudspeaker. Believe
antenna connected improperly, but do whatever you can.” By reading
the final letter of each word, you will find out what Smith actually
had to say to Johnson: GET READY TO RUN.

That is the null cipher reduced to its elements, though naturally it

can be more skillfully applied. Significant letters may be concealed
in an infinite variety of ways. The key, as here, may be their
positions in words, or in the text as a whole. It may be their
distance from one another, expressed in letters or in inches, or
their distance to the left or right of certain other letters
(indicators) or of punctuation marks (indicators); and this distance,
or position, need not be constant, or regular. Sometimes it is
governed by an irregular series of numbers.

Similar devices are applied to whole words. We agree, say, that in

whatever communications we send to our accomplice, only the third
word of each sentence is to be significant. Desiring to send him the
order, STRIKE NOW, we write him as follows: “The building _strike_ is
worrying our friends quite a lot. It has _now_ extended to this part
of the city.”

A purely concealment cipher may be enveloped in apparent ciphers of

other types. The true message is concealed, as usual, in a dummy
message, and the whole is enciphered in one of the legitimate systems.
It is then hoped that the decryptor, satisfied with having solved the
dummy, will look no further. Even more effective would be the device
of concealing the message in what appears to be a cryptogram, but is
not. It is easy to string letters together in such a way as to make
them resemble most convincingly a transposition cryptogram, and in
this case it would be hoped that the investigator’s full attention
would be given to the hopeless task of decrypting the dummy.

Concerning the decryptment of concealment cipher, we regret to say

that cryptanalysis has little help to offer. Fortunately, most of
these ciphers depend absolutely on the belief that they will not be
recognized as cipher, and once they are so recognized, they present
no resistance. In those few cases where the secret message is not
at once obvious, it is sometimes useful to arrange the words (or
sentences) in columns, or in rows, for a closer inspection.

Figure 2

I N S P E C T
D E T A I L S
F O R
T R I G L E T H
A C K N O W L E D G E
T H E
B O N D S
F R O M
F E W E L L

We have, for instance, an apparent memorandum in which the

awkwardness of the wording, or some other factor, has drawn our
attention to the possibility of cipher: “Inspect details for
Trigleth — acknowledge the bonds from Fewell.” We arrange these
words in column form, aligned by their initials, as in Fig. 2, and
the third column promptly gives up the secret message STRIKE NOW.

The words of sentences can, of course, be treated in the same way,

and where the alignment from the left gives no results, letters or
words can be aligned from the right, or from the center. If columns
give no results, diagonals can be inspected, or a zig-zagging line
between one column and another.

Experience counts for most, and extensive reading is a vast help.

Having seen methods in use, or read the descriptions of methods,
we know of some definite thing to look for. Then, too, some of the
concealment ciphers have transposition characteristics. This would
be the case with the Legrand cipher, which is of the type called
“open letter.”

This cipher used a numerical key, which, in turn, was based on a

keyword in what seems today a rather odd manner: A keyword CAT, made
up of the 3d, 1st, and 20th letters of the alphabet, gives the key
3 1 2 0. Before concealment takes place, a series of word-positions
is marked off, and these vacant places are numbered (0 to 9, or 9 to
0), continuing to repeat the ten digits until there are enough of the
digits 3, 1, 2, and 0 to accommodate the words of the secret message.
This message is then written, word by word, below its digits,
beginning with the first digit 3, then going on to find a digit 1,
then a digit 2, then a digit 0, then another digit 3, and so on.
After the secret message is written into its place, all of the blank
positions are filled with connective matter, as in the case of
Cardinal Richelieu’s grille-writing. Our later study of
transpositions will show approximately how we should go about
reading this, once we suspect its use.

So far, we have been considering pure concealment. Many of the

classic ciphers, fundamentally of the concealment type, are also
substitution ciphers, and their decryptment would follow substitution
methods. Of these, perhaps the best known is Bacon’s biliteral
cipher, summed up in Fig. 3.

Figure 3

BACON'S BI-LITERAL ALPHABET

A aaaaa IJ abaaa R baaaa

B aaaab K abaab S baaab
C aaaba L ababa T baaba
D aaabb M ababb UV baabb
E aabaa N abbaa W babaa
F aabab O abbab X babab
G aabba P abbba Y babba
H aabbb Q abbbb Z babbb

S T R I K E
baaab baaba baaaa abaaa abaab aabaa

N O W
abbaa abbab babaa

Hold OFf uNtIl you hEar frOm mE agAin. wE

May cOMpROmIse.

Lord Bacon’s cipher presupposes that the encipherer may so control

the preparation of his published work that he may prescribe the type
to be used for each printed letter, and it is claimed that he
actually used his cipher for the preservation of historical secrets,
including that of his own parentage. Two fonts of type are required,
the letters of one font differing (very slightly) from those of the
other font. These we may speak of as the _A_-font and the _B_-font,
and each letter of the alphabet is given a substitute composed of
_A_’s and _B_’s, as shown in full in the figure. Before a message,
as STRIKE NOW, can be concealed, it must be expressed in _A_’s and
_B_’s, five of these for each of its letters, as shown, so that a
message of 9 letters attains a length of 45. For its concealment, we
may use any text whatever whose length is 45 letters, for instance,
one whose obvious meaning is the contrary of the secret one: “Hold
off until you hear from me again. We may compromise.” The first five
letters, _HOLDO_, are to represent _S_, the next five, _FFUNT_, are
to represent _T_, and so on; and the sole purpose of the _A_’s and
_B_’s is to point out the kind of type which must be used in printing
the corresponding letters. In the encipherment of the figure, letters
taken from the _A_-font are indicated by lower-case and those of
the _B_-font by capitals, though it is understood that no such
emphatic difference is contemplated in the cipher.

While the average modern person would have no opportunity for

employing Lord Bacon’s cipher as described, he has access to an
unlimited number of vehicles other than type-difference. Anything,
in fact, may serve the purpose, so long as the material is available
in two distinguishable forms and in sufficient quantity. Our message
of 29 _A_’s and 16 _B_’s could be expressed with a deck of playing
cards if aces and face-cards are considered to represent _B_’s. It
could assume the form of a fence with 45 palings, in which the
_B_-palings are crooked, damaged, or missing. Ohaver once made use
of a cartridge belt in which the _A_-loops contained cartridges and
the _B_-loops were empty. There is an excellent opportunity here,
too, for the compiling of “fake” cryptograms, with _A_-letters and
_B_-letters distinguished as vowels and consonants, or by the part
of the normal alphabet from which they have been taken.

With a biliteral or binumeral alphabet which requires 26 groups, we

cannot have fewer than five characters to the group without making
groups of different lengths. But another well-known cipher alphabet,
devised by the Abbé Trithème for use in much the same way, is
triformed, and thus permits that the group-length be reduced to
three. The Trithème (Trithemius; Trittemius) alphabet, expressed in
digits 1-2-3, was approximately that shown in Fig. 4.

Figure 4

A TRI-NUMERAL ALPHABET

A 111 J 211 S 311

B 112 K 212 T 312
C 113 L 213 U 313
D 121 M 221 V 321
E 122 N 222 W 322
F 123 O 223 X 323
G 131 P 231 Y 331
H 132 Q 232 Z 332
I 133 R 233 & 333

This alphabet has had many applications, including the use of colored
candy previously mentioned. One contributor to Ohaver’s column
submitted a cryptogram of the open-letter type in which the digits
1, 2, 3, were indicated in the _number of syllables_ of the
successive words. A sentence, “Can you be sure of sufficient
assistance from Mayberry?” indicates the digits 1 1 1, 1 1 3, 3 1 3;
and, if the alphabet of Fig. 4 is the one in use, represents the
letters _A C U_. This is of particular interest in that it is easily
done without involving the awkward turns of language that so often
betray the concealment cipher. (This same contributor, a Mr. Levine,
evolved another cipher, accomplished by an arithmetical process, by
which it was possible to make a cryptogram convey two separate
messages!)

Many writers have shown alphabets of the biform and triform types
applied to open-letter communications by making the significant
factor the _number of vowels_ contained in successive words. Thus,
the sentence given above yields a series 1, 3, 1, 2, 1, 4, 4, 1, 4.
Using a biform alphabet, these are usually considered simply as odd
and even; with a triform alphabet, some disposition must be made
of numbers larger than 3.

The subject is fascinating, and the literature of cryptography is

rich with examples. However, we need not delve further into what,
after all, is only the stepchild of a legitimate science. The matter
of telegraphic transmission alone will bar these ciphers for most
general purposes, or the fact that a cipher once betrayed will never
serve again. Then, too, the censorship combats it by cutting out or
rearranging or changing words, causing the open letter (or telegram)
to convey only the information which it purports to convey.

Concealment cipher has, of course, the unique virtue of being able

to convey messages under circumstances which make it seem that no
communication has passed, and we have hardly touched upon the fact
that the short message, prior to its concealment, may have been a
well-enciphered one. But we rather suspect that, for the end desired,
invisible inks are more convenient and practical.

1. By PICCOLA.

On peut être Napoleon sans être son ami, mes enfants!

2. By B. NATURAL.

FOR SALE: Spring coats. All fine Scotch serge, for ensembles. Stoat
trimmed, fashioned right. Black shirred lining, striped. Effective for
brides. Act quickly. - Abraham Batz, 522 Broad, Telephone Exchange 7104-R.

3. By TITOGI.

How about releasing Tony, the gang chief? He don't lie, and is not the
true slayer either. Let us be friends. I am all right. Ed Lehr.

4. By TRYIT.

To those friends considering, it is always news, but all filled ciphers

disturb happiness with varied answers!

5. By PICCOLA.

Do not send for any supplies before Monday, at earliest. Order once only,
as men in charge are feeling sore about your threat to encourage the
mutiny at Ford's. - Wilson.

6. By PICCOLA. (Why not, indeed?)

A W I T H A N Y S E N D F O R I T Y O U M U S T B E F E A R
T H E C A N H I T T R Y A B O U R E O U T I S E C H I Y O U
A N D M Y T I O N C U P C R E A S K T O C A N D Q.

CHAPTER III
Transposition Types

Transposition has already been explained as a form of cipher in which

the letters of a message are disarranged from their natural order in
accordance with any pattern, or key, agreeable to the correspondents.
The fact that _any_ plan may be followed will suggest the possible
ramifications as to detail. Transpositions are, in fact, found in
every conceivable degree of complexity. They are not even unanimous
in their demand that there be two separate operations in the
preparation of a cryptogram: (1) the writing down of the plaintext
letters, and (2) the taking off of these letters.

Generally speaking, these ciphers follow two types, the regular

(geometrical, symmetrical), and the irregular. The strictly
geometrical type, sometimes called _complete-unit_ transposition,
is based on one comparatively small _unit_, or _cycle_, repeated
over and over, every unit having exactly the same number of letters
and exactly the same disarrangement as the rest. This type always
demands an exact number of units, and when a plaintext message is
not evenly divisible into units, it must either be cut down to fit,
or lengthened by the addition of extra letters called _nulls_. Some
of these keys are actual geometrical figures, such as triangles,
diamonds, hexagons, etc., or conventional designs like crosses. Any
figure of this kind provides a number of cells, or points, for the
_writing in_ of letters, and thus will serve as a mnemonic device,
or key.

Figure 5

A D E H I L M P
X X X X
B C F G J K N O

Plaintext message: A B C D E F G H I J K L M N O P.

Cryptogram (a) A D B C E H F G I L J K M P N O.

Cryptogram (b) A D E H I L M P B C F G J K N O.

The two operations of writing-in and taking off may be governed by

any agreed ruling, though the second of these must be made to result
in five-letter groups if the cryptogram is to be transmitted by wire
or radio. Fig. 5, in which an imaginary message has been represented
as _A B C D E_ . . . . . , shows only one of the many ways in which a
simple cross could be used as the key for the writing-in operation,
together with only two of the many cryptograms which could be taken
off from this one arrangement. This figure shows also, in its two
cryptograms (a) and (b), two fundamentally different plans for the
taking off of transpositions. The unit here is 4, the first unit
containing the letters _A B C D_, the next unit _E F G H_, and so
on. In cryptogram (a), the letters of every unit are still standing
together in a group, while in cryptogram (b), the letters of any one
unit have been mixed with letters of other units. In this latter
case, the two correspondents will have to agree upon a certain
number of crosses per line; otherwise, they run the risk of having
to decrypt each other’s cryptograms.

The most popular of the geometrical figures appears to be the square,

with or without a series of numbers 1 to 25, 1 to 36, and so on. Any
device or game, which will provide a square, is likely to be seized
upon as the source of a transposition key. We find two widely-known
examples of this in the “magic square” and the “knight’s tour.”

A _magic square_, as most of us understand this term, is made up of

a series of numbers, such as 1 to 25, 1 to 36, which are so arranged
in their cells (positions) that the added numbers of any row, column,
or diagonal, will always give the same total. A square of given size
will provide more than one magic square arrangement; and these
numbers, being a series, constitute an _order_, which, once it can
be remembered or reconstructed, will serve either for writing in or
for taking off a unit of 25, 36, etc., letters.

The _knight’s tour_ is based on the chessboard, a unit of 64 cells.

In the game of chess, where each piece has certain prescribed moves,
the piece called the knight must move diagonally across a 2 x 3
oblong. The “tour” consists in starting the knight at one corner and
carrying him completely over the 64 cells of the chessboard, causing
him to touch every square exactly once without having made any other
move than the one allotted to him. Fig. 6 will show one of the many
such tours which have been published. Such designs will serve either
for writing in or for taking out. In either case, the text is made to
contain exactly 64 letters or a multiple thereof. For writing in, the
first letter is placed in the cell corresponding to No. 1, the next
letter in the cell numbered 2, and so on. For puzzle purposes, the 64
letters are usually left standing in the form of a square. As cipher,
they would be taken off, by rows, or by columns, or otherwise. Or the
64 letters may first be written in simple order into the form of a
square, and then taken out one by one following the route of the
knight.

Figure 6

1 4 53 18 55 6 43 20

52 17 2 5 38 19 56 7

3 64 15 54 31 42 21 44

16 51 28 39 34 37 8 57

63 14 35 32 41 30 45 22

50 27 40 29 36 33 58 9

13 62 25 48 11 60 23 46
 26 49 12 61 24 47 10 59

Other ciphers of the regular type merely employ a unit of so many

letters, to be arranged in some specified order, generally in
accordance with a numerical key. If, say, the unit has a length of
six letters, which we will represent as _A B C D E F_, and the
specified order for these is 6 2 1 4 3 5, this unit may be transposed
to read _F B A D C E_. Each unit will be transposed to have exactly
this pattern, except that semi-occasionally we find a final unit
slightly different from the others, owing to the fact that nulls
were not added to complete its length (Accurately speaking, this
transfers the cipher to the “irregular” class). Units, once transposed
in this way, may continue to stand intact, one after another; or they
may remain intact, merely exchanging places with one another; or the
cipher may be so planned that they do not remain intact, as was the
case with our cryptogram (b) of Fig. 5.

Often, two ciphers will differ from each other only in the method
by which their cryptograms are produced; oftener, there will be an
actual difference, but one which is purely superficial. For instance,
we have just mentioned a plaintext unit _A B C D E F_ as having been
transposed with a key 6 2 1 4 3 5 to result in the order _F B A D C E_.
Identically the same numerical key, used in another way, will
transpose this unit in the order _C B E D F A_. The two resulting
cryptograms would be different, but the _kind_ of cryptogram would not.

An extremely common form of complete-unit transposition is that

indicated in Fig. 7, where a short message, LET US HEAR FROM YOU AT
ONCE CONCERNING JEWELS QQ (38 letters plus 2 _nulls_), has been
written into an oblong, or _block_, in one order and taken off in
another. Both the writing in and the taking off follow a _route_,
rather than a key and, for that reason, the cipher is often spoken
of as _route transposition_, rather than _rectangular transposition_.

Three of the many possible _routes_ are shown in the three (partial)
cryptograms of the figure. In this connection, the American popular
terminology seems to favor _horizontals_ and _verticals_, rather than
“rows” and “columns.” The writing in or the taking out of a text is
said to be done by _straight horizontals_, or by _reversed horizontals_
(backward), or by _alternate_ (or _alternating_) _horizontals_
(written alternately in both directions). Similarly, we find ascending,
or descending, or _alternate verticals_; and again the _diagonal_
routes will be described as _ascending_, _descending_, or _alternate_.
The route may also be a _spiral_ one, and in this case it is said to
be _clockwise_ or _counter-clockwise_.

Figure 7

L E T U S Cryptograms:
H E A R F
R O M Y O (a) By descending verticals, from the left: L H R U C
U A T O N
C E C O N C N E E E O A E E G L T A M T C R J S U, etc.
C E R N I
N G J E W (b) By alternating verticals from the right, top:
E L S Q Q
S F O N N I W Q Q E N O O Y R U T A M T, etc.
 (c) By diagonals: L H E R E T U O A U C A M R S C E T Y F N E C O O,
etc.

For all of these routes, the point of beginning is nearly always one
of the four corners, except in the case of the two _spiral_ routes,
which are just as likely to begin with a central letter, particularly
when the rectangle is a square. Colonel Parker Hitt, in his _Manual
for the Solution of Military Ciphers_, shows the same series of
letters written into forty different blocks, always beginning at one
of the four corners.

Rectangular transposition, when used as cipher and not simply as a

puzzle, requires that one dimension of the oblong be fixed, the other
dimension being entirely dependent on the length of the message to be
conveyed. In the figure, the pre-arranged width of the block, called
its _key-length_, was 5, and the filling of the block required 8
complete units. These were written one by one as simple bits of
plaintext, and were then broken up in the method of taking off.
Occasionally it will be the vertical dimension of the block which is
fixed, and the plaintext will be written in by columns, beginning at
the left or at the right. But there is so little difference in the
results of the two procedures that a decryptor may solve and read a
cryptogram without learning which of the two was actually followed.
Ordinarily, it is the simple operation which comes first, the writing
in of intact units one after another. Sometimes the opposite is true,
the operation of writing in being made very complex, so that the
whole block is the unit, the taking off being done by simple rows
or columns. Frequently both operations are complex. This kind of
transposition belongs rather to the category of puzzles than to
cipher; any reasonably intelligent person can decrypt it, knowing
what it is. However, it has not infrequently been applied to serious
purposes, and a decryptor, encountering an unknown transposition,
would not overlook the possibility of simple rectangular encipherment.

Decryptment, here, is merely a matter of trying out the known routes,

and it would never be actually necessary to write out the entire
forty-plus blocks, or even half of these, for any one rectangle.
The decryptor begins by counting the letters of his cryptogram and
factoring the number of these, to find out what oblongs are possible.
A 36-letter cryptogram, for instance, might mean dimensions 6 x 6,
or dimensions 4 x 9. It could, conceivably, represent dimensions
3 x 12, or 2 x 18. But key-lengths are hardly ever shorter than 5,
or as long as 18. He would seize upon the square as the object of
his first investigation, writing the cryptogram into that block by
various known routes, and also _reading_ by various known routes,
diagonally, horizontally, vertically, backward, or upside down,
until he begins to find words. As a rule, this does not take him
very long; often the very efforts of an encipherer to achieve
complexity will result in an easier task for the decryptor. However,
a spiral will sometimes give trouble.

Figure 8

A E I
B D F H J
C G K........etc.
 Taken off: A E I & B D F H J & C G K...

The examples appended to this chapter are all of the complete-unit

type, and require little knowledge of cryptanalysis for their
solution.

Passing on to irregular types, we find these in all degrees of

difficulty, from the very simple “rail fence” to the formidable
“U. S. Army” double transposition.

The “rail fence” family is outlined sketchily in Fig. 8. The writing

in of the plaintext follows a zig-zag route, downward by so many
letters, then upward to the line of beginning, as indicated by the
series _A B C_ . . . . . , and the taking off of the cryptogram is
done by straight lines. In explanation of the character _&_,
this has been used here as a signal to show the ends of the straight
lines. No such signal is needed if a proper understanding exists
between correspondents as to the construction of the “fence” and the
length of it which may occupy one line of writing; and in some cases
the straight lines are all equal in length.

In Fig. 9, we have a suggested _grille-transposition_, of a kind

described by Mario Zanotti as “indefinite.” This kind of grille, we
believe, is the invention of General Sacco. To picture it complete,
we may imagine a flat surface, such as a piece of cardboard, marked
off into squares, having dimensions 12 x 6, and turned sidewise.
Assuming this to be shown in full, we are looking at 12 _columns_,
and each column has 6 of the small squares, or cells. To convert this
piece of cardboard into an encipherment grille, we clip out three
squares from each one of its 12 columns, always in the most haphazard
manner possible. The resulting grille will thus have 36 openings,
and, if placed over a sheet of paper (preferably also marked into
cells), enables us to transpose the first 36 letters of a message by
writing them one at a time into the 36 apertures in some one order
and taking them off in another. The original plan was the reverse of
the usual: write the letters by columns and take them off by rows.

Figure 9

[ (N) ...
[(S) (O) ( ) ...
[(T)(I) ( )( ) ...
[ (K) ...
[(R)(E) ( ) ...
[ (W)( )( ) ...

Cryptogram: N S O T I K R E W.

In the figure, a 9-letter message, STRIKE NOW, has been written into
the first three columns of such a grille, and, taken off by rows,
comes out in the order _N_, _SO_, _TI_, _K_, _RE_, _W_. While the
figure shows this cryptogram regrouped in the usual fives, the
original method, as prescribed with the device, would have grouped
it in threes, that is, to correspond with the number of apertures per
column. This would facilitate the operation of decipherment, which is
as follows: Count the number of letters in the cryptogram _and divide
this number by 3_, in order to find how many columns were used. Cover
(or ignore) the unused portion of the grille, write the cryptogram by
straight horizontals into the uncovered portion, then read, or copy,
by descending verticals. The recipient of the present cryptogram,
for instance, finds nine letters, divides this number by 3, thus
ascertaining that three columns were used, covers up the other nine
columns, then, proceeding by straight horizontals, places one
cryptogram-letter wherever he sees a hole. Having thus restored all
letters to their proper columns, he has the plaintext message before
him. It will be noticed that an encipherer uses only the number of
columns that he needs. His last column does not have to be completed
with nulls, as in the case of complete-unit ciphers.

As this grille has just been described, its full capacity is 36

letters, and it has a repeating cycle of that length, presuming
that, after the transposition of the first 36 letters, another
36-letter unit is to be transposed by the same grille standing in
the same position. But this grille, reversed, provides a new pattern;
and the opposite side of the grille provides two additional patterns.
These positions may be numbered, thus providing for the encipherment
of 144 letters, even assuming that the positions are to be used in
1, 2, 3, 4 order and without varying the method of use. Add to this
that the cryptographic offices may have provided half-a-dozen
different grilles to be used interchangeably and not always in
exactly the same way, and it becomes plain that such an encipherment,
in the hands of an operator who knows his business, could be made
to furnish a very effective form of transposition.

Figure 10

2 1 L E T U S H E A R

5 4 3 2 1 F R O M Y O

0 9 8 7 6 5 4 3 2 1 U

7 6 5 4 3 2 1 A T O N

3 2 1 C E C O N C E R

4 3 2 1 N I N G J E W

7 6 5 4 3 2 1 E L S Q

Zanotti, and others, have also described mechanical devices of a

patentable type for accomplishing very involved transpositions. The
principle on which most of these operate can be seen in Fig. 10. A
certain number of pointers, or narrow sliding rulers, all carrying
the same progression of numbers, are so attached to a framework that
they can be set, by means of a numerical key, to project at irregular
lengths over a sheet of quadrille paper cut to fit into the frame.
Thus, each pointer indicates a certain number of empty cells, as
nine on the first line, six on the next, and so on. In the example
of the figure, presuming that each pointer carries only ten numbers,
and that the full number of these pointers is seven, the numerical
key would be the column of numbers at the extreme left:
2-5-0-7-3-4-7. The message here is written in the usual horizontals,
with a null (not strictly necessary) completing the last line. It
could be taken off by columns: _L_, _EC_, _TEN_, _UFCI_, etc. The
decipherer, having a duplicate apparatus, would set this according
to the pre-arranged key, copy the cryptogram by columns, and read
it by rows. The exact method, of course, can be varied.

Some attempt has been made, too, to evolve cipher machines which will
produce effective transpositions, but our understanding is that these
have never been accepted as worthwhile. The accomplishment of
transposition by mechanical means is far from new. In fact, the
oldest transposition cipher of which we have any record was
accomplished by means of the Lacedaemonian _scytale_. The Spartan
general, departing for foreign conquests, carried with him a rod,
or scytale, of exactly the same diameter as one retained by the
administration. When it was desired to communicate matter of a
confidential nature, the sender, using a narrow strip of parchment,
wound this carefully around his scytale with edges meeting uniformly
at all points, and wrote his message lengthwise of the rod. When the
strip was unrolled, the message appeared as a series of short
disconnected fragments, one letter, or two letters, or portions of
one or two letters. It was presumed that no person would be able to
read the message without being possessed of a duplicate scytale on
which to rewind the strip. We are left to suppose that this
presumption was justified by fact, though the decryptor of today
would make short work of such a system. The scytale, we believe,
is the oldest known cipher of any kind, and is still serving today
as the emblem of the _American Cryptogram Association_.

Before leaving types, it should be mentioned that any of the

transpositions ordinarily used for disarranging single letters can
also be used for the transposal of entire words. The popular name
for this is “Route Cipher” — possibly because it is rather cumbersome
to accomplish by any other than a “route” transposition.

We have said little concerning _decipherment_. This, in practically

all cases, is a mere matter of performing inversely the two
encipherment operations. For either process, the operator begins by
setting down his key or design, or adjusting his mechanical device
in the agreed manner. The encipherer “writes in” a plaintext, and
“takes off” a cryptogram; the decipherer “writes in” a cryptogram,
and “takes off” (or reads) a plaintext. If the encipherer, by
agreement, has written the text in rows and taken it off by columns,
then the decipherer must do the reverse: write his text by columns
and take it off by rows.

Before entering into the subject of _decryptment_, the student should

acquaint himself with the significance of the various tables appended
to this text, in order that he may consult these or similar tables
for information as to _frequencies_, and _sequence_. Every written
language has its individual characteristics in these two respects,
and, to learn just what these are for each language, various
cryptologists have, from time to time, counted the letters, the short
words, the combinations, and so forth, often on extremely long texts,
afterward arranging these data in the form of charts, or tables, or
lists. Two such counts are never duplicates, and there may be a
noticeable difference, say, between results obtained from literary
text and those obtained from military or telegraphic text; yet
results for any one language are surprisingly uniform. Finding, for
instance, an unexplained cryptogram in which a count of the letters
shows that about 40% of these are vowels (with or without _Y_), we
may classify it, not only as a transposition, but as one enciphered
in English or German, since one of the Latin languages can hardly be
written with so low a vowel percentage. Then, if we note the
occurrences of the letter _E_, and find that this makes up about 12%
of the total number of letters, we may discard the possibility of
German, in which the letter _E_ is far more likely to represent 18%
of the text. Or, if the vowel percentage is high enough to point to
one of the Latin languages, French would be distinguished from the
others by the outstanding frequency of its letter _E_, sometimes as
great as that of the German _E_, while the Spanish, Portuguese, or
Italian language will not always show it as the leading letter, its
place having been taken by _A_. In the Serb-Croat language, the
letter _A_ always predominates, and in Russian the letter _O_.

As to sequence, and considering English combinations only, certain

digrams, such as _TH_, _HE_, _AN_, etc., very consistently
predominate over all others. These almost never show identical
percentages in any two digram counts (as the single letters sometimes
will), and seldom, if ever, are ranked in exactly the same order,
aside from the fact that _TH_ invariably comes first. But in all
counts, the same fifty to sixty digrams (out of 676) are always found
at the top of the list. Thus the Meaker digram chart differs from
similar charts made by many others; yet _any_ digram chart is the
most valuable weapon we have for attacking a cipher. The Carter
contact chart contains the same general information expressed in
another way for special use in transpositions. (This was not figured
from the Meaker chart, but from an earlier one by Ohaver, made on the
same kind of text.)

One very useful phase of frequency data is seen in the group

percentages. Single letters, especially in short texts, may vary
greatly from their normal percentages, while certain classes, taken
as a whole, maintain a fairly constant percentage no matter how
short the text. Such classes, or groups, listed under the general
heading of _English Frequency and Sequence Data_, can be memorized
as having roughly approximate percentages: Vowels, 40%; selected
high-frequency consonants, 30%; extreme low-frequency group, 2%;
the five most frequent letters, mixed, 45%; the nine most frequent
letters, 70%. This final group of nine letters, _E T A O N I S R H_,
hardly ever varies appreciably; the shorter groups will sometimes
vary as much as 5% one way or the other.

Very useful in _code_ decryptment is a list of the commonest words.

Trigrams have also been investigated, the favorite positions of
individual letters in their own words, average word-length,
_patterns_, and endless other information, some of which is
indispensable, and some merely convenient. It will not be possible,
in the space at our disposal, to point out all of the uses to which
this kind of information can be put; the student is urged to take
his cue from the occasional short references made in connection with
examples.

* * *

All ciphers are decrypted by the _general methods_ suitable to their

type, and a transposition cryptogram may involve _factoring_,
_examination of the vowel distribution_, and _anagramming_, either
singly or in combination. These are best explained in connection with
examples, which may themselves have _special methods_, and we have
selected for general discussion four ciphers, two belonging to the
complete-unit type and two to the irregular. A careful study of the
methods used in individual cases should furnish the student with a
basis for analyzing other ciphers and evolving other special methods
to suit particular cases.

Concerning the paper work, which, admittedly, is onerous in most

forms of cipher investigation, much reference may be found, in the
matter which follows, to “paper strips.” These are old stand-bys.
Most decryptors prefer to do all of their work on cross-section
(quadrille) paper, since the writing of the letters into cells
enables them to obtain an accurate spacing both laterally and
vertically, and this paper is easily cut apart along the separating
lines. But for the kind of cryptograms we are likely to see here,
many persons prefer to work with a set of anagram blocks. These can
be prepared at home from cardboard squares, or may be bought in sets
with frequent letters represented in approximately the correct
proportions.

7. By TITOGI.

T S S N I H A Y S T I N T P I S E R O O I A A S N.
Also this: S H C V I E O L E A E W E R M.

8. By G. A. SLIGHT. (Something found in every school-book - IF found!)

T G H M R R I A Y E X N U E E S D E X S H M T I D E Q U O A Y R O A U
N P U E T G T I T E S Y S N O A Q N X A T U A D S I S H X.

9. By PICCOLA.

W I N T A H D A E S W H L E T Y L W A I L H O Q L A S S S A S Q.

10. By NEMO. (Magic Square).

L E A S U L T S G M S L O E I E O I M E A R N S A S R C D E K I U S U
H E M A Q L Y S P R M E O A.

11. By THE ADMIRAL.

B S P N T E A E F T V V O A N E Y A P U Z S E T P T H M N A T A E E R
S D S S K P S J E S T Y S E A L R H I A S K S N T T E Y W O F T H M W
Y K E F E N N H C I E H H U M I H I T E O H G E S U C G D I O O W E A
S A S N E R H M A A S S L E R G S M N E D T H K E M L U A E T V M F O
R A I W P A Y A M A E Y A D.

12. By THE ADMIRAL.

A A F R S R T N E A R B N E E O H S R L T I A P D U E O S I I T T A T
G L F O T S O U S H H E P N Y.

13. By DAN SURR. (Received from General Headquarters following a skirmish).

F A A T R M N O A T I L V I S Y G U C F F I O O E P S N K L T O I N V
R T T O A H N D N E E R E N N B M P U N P O R R K A U O M E A N A I E
T S S B N R G T G S T T I E E I C T H R.
14. By PICCOLA. (This is serious advice!)

F F L T A A R N I E U O R N T O T D L A N R W S O I A T T E Y B A N T
M E H S K O G R Z E P S R E I O A O A M S S S M A L P I L Y S.

15. BY FRA-GRANT. (This might have been a little easier. Still - ?)

Q Y T E Y O F U B U Q E H I H T E C H T H S A U A O N S I T I T T T I
E T T E L L S E A P L T N T.

CHAPTER IV
Geometrical Types — The Nihilist Transposition

In the preceding chapter, we glanced at the most elementary form of

_columnar transposition_: a text is written into a block by rows and
taken off by columns in such a way that even though all or part of
the columns may be reversed in direction, these columns are always
left standing one after another in regular order. Columnar
transposition becomes less crude when the order for taking off the
columns is an irregular one, governed by a changeable numerical key,
the length of this key governing also the width of the rectangle.
This process can be examined in Fig. 11. In this figure, the
numerical key, 4 1 6 5 3 2 7, was first derived from a _keyword_,
HALIFAX, according to the following very common plan: The two _A_’s,
taken from left to right, receive the first two numbers; the third
number, in the absence of _B_, _C_, _D_, and _E_, is assigned to
_F_; and so on, following the alphabetical rank of the letters
present, and taking repeated letters from left to right. The presence
of seven numbers implies seven columns, and it is said that the
_key-length_ is 7. When a text has been written into a block of
that width, with a key-number standing above each column, these
columns can be taken off in the order shown by the numbers, and not
in regular sequence.

Figure 11

Usual Plan for Transposing

Columns

H A L I F A X
4 1 6 5 3 2 7

L E T U S H E
A R F R O M Y
O U A T O N C
E C O N C E R
N I N G J E W
E L S X X X X

Cryptogram: E R U C I L H M N E

E X S O O C J X L A O E N E U, etc.
The key, used exactly as described, is a “taking off” key, and
this is the common way of using one. It can, however, be used for
“writing in” the successive units, placing the first letter of a
given unit beneath number 1, the second letter beneath number 2,
and so on until the seventh letter has been written below number 7,
afterward beginning with the first letter of another unit below
number 1 again. Under this plan the first unit of our figure,
_L E T U S H E_, would have been _written in_ in the order
_U L H S T E E_. Since all units would follow exactly the same
pattern, the resulting _columns_ would be identical with those of
the present block; the only essential difference would be that the
new columns are already transposed, and can be taken off in straight
order. The two resulting cryptograms, however, would not be the same.
The unit which was _written in_ in the order _U L H S T E E_, would
have been in the order _E H S L U T E_ had the method been that of
_taking out_ (or “off”).

The Nihilist transposition is ordinarily accomplished by “writing in,”

and its numerical key is applied to _both columns and rows_. Thus its
major unit is a square, and the seven-letter keyword HALIFAX, applied
to both dimensions of a rectangle, demands a unit of 49 letters,
while the shorter word SCOTIA, key-length 6, requires a unit of 36
letters.

Theoretically, this cipher is a _double transposition_, requiring two

successive operations as shown in Fig. 12. But in practice, these two
transpositions can take place simultaneously as pointed out in Fig.
13. The operator, having laid out his key-numbers at top and side of
his square, begins his writing in the cell at which the column headed
by number 1 crosses the row headed by number 1. He _writes in_ his
first unit, proceeds to the row numbered 2 for the writing in of his
second unit, then to the row numbered 3, and so on, taking rows in
the order shown by the numbers at the left, and placing the letters
of his unit by following the numbers across the top. Thus, with only
a little concentration, he has the entire major unit at one
continuous writing. The decipherer, too, having restored his
cryptogram unit to its block and written his two series of numbers,
may read, or copy, continuously. The decipherer, in fact, uses the
exact method which would produce a Nihilist cryptogram if a key were
used in the “taking out” manner. What we have described is the
encipherment of a single major unit; and all cryptograms must
contain an exact number of these major units.

Figure 12

Nihilist Plan

(a) Transposal of Columns (b) Transposal of Rows

S C O T I A S-5 E U J W T O
5 2 4 6 3 1 C-2 R A F O R E
O-4 A N E B C O
S E U H T L (Let us h) T-6 X L X X S E
R A F O R E I-3 A Y U T O M
A Y U T O M A-1 S E U H T L (Let us h)
A N E B C O
E U J W T O (c) Cryptogram: E U J W T O R A F O R E A N E
X L X X S E
 B C O X L X X S E A Y U T O M S E U H T L.

The second operation, that of taking off the cryptogram, is not

always done by straight horizontals as we have shown this under
(c) of Fig. 12. This, of course, is the expected way; but the
Nihilist square is quite frequently taken off by some other one of
the forty-odd routes possible to rectangular transpositions. The
decipherer, knowing this route, merely writes his units back into
their blocks; but the decryptor is often faced with a preliminary
problem of discovering how they were taken off. Sometimes he must
also discover how many units a cryptogram contains.

To understand how such problems are solved, it is necessary to pause

and consider the make-up of ordinary written plaintext. English
vowel-percentage, as mentioned, is about 40%, and practically never
varies out of its limits 35%-45%. Each 40 vowels are fairly _evenly_
distributed throughout their 100 letters. Take any English text
whatever, not composed of initials or otherwise distorted, and,
beginning where you please, mark it off into ten-letter segments
and count the vowels in each of the segments. You will find that
the majority of these have exactly the normal number of vowels,
which is 4. Others will have 3 or 5, which, though outside of the
limits 35%-45%, are the closest variations possible. It will be a
rare segment indeed which contains fewer than 3 vowels or a greater
number than 5.

But suppose, having marked off such a text into ten-letter units,
or segments, we take each of these segments individually and mix
up the order of its letters, though still allowing it to stand
where it is. And suppose, having done this, we erase the original
division-marks and, beginning at some point in the midst of a former
segment, we again mark off a series of ten-letter units, and count
the vowels of these new segments. This time, we are just as likely
as not to find seven or eight vowels in one segment and none at all
in the next, depending on just what we did to the old units, and
still we have not actually mixed the units; we simply have our
division marks in the wrong places. Imagine, then, how the vowel
distribution can vary when a transposition is one so planned as to
break up units and scramble their letters.

This fact of uniformity in vowel distribution is of enormous

assistance in dealing with the simpler transpositions. For
instance, it may be that what we want to know is the length of
the units, and that what we have is a cryptogram of 144 letters,
which could be a single square, or a series of 36-letter squares,
or even a series of 16-letter or 9-letter squares. We may start
at the beginning of this cryptogram and mark it off into equal
segments of any length we like, afterward counting the vowels per
segment. If every segment shows approximately a 40% vowel count,
the chances are that we have a series of intact units, each one
merely transposed within itself; but if one segment shows 50%,
another 30%, another 28%, and so on, we may be quite sure that our
division marks are in the wrong places.

Figure 13
 5 2 4 6 3 1 5 2 4 6 3 1 5 2 4 6 3 1

5 5 5
2 2 . A . . . E 2 R A F O R E
4 4 4
6 6 6
3 3 3 . Y . . . M
1 . E . . . L 1 S E U H T L 1 S E U H T L

Returning, now, to the Nihilist cipher, suppose we consider the

make-up of its major unit, that is, of any one block. This major
unit is a series of minor units, and each of these minor units, at
the time of encipherment, was written by itself on its own line. In
the beginning, it was a small fragment of plaintext, presumably
conforming closely to a 40% vowel count. It is true that we placed
it on the line in transposed order, but we did not remove any of
its letters or add any new letters. Even in the transposal of the
lines themselves, we merely removed a number of intact units from
one place to another. There has never been a time, throughout the
entire encipherment, when we took any letter out of its original
minor unit and put it with some other unit. Thus, as we first see
our completed Nihilist square, we still have, on each horizontal
line, a small fragment of an English sentence in which all of the
original vowels are still present. If such a block is now taken
off by straight horizontals, it is no more than a series of intact
units. To break up these units, we must at least take it out by
verticals; and they will, of course, be much more thoroughly mixed
when taken out by diagonals or spirals.

The decryptor, hoping for the best, writes his cryptogram into a
square (or series of squares) by straight horizontals and counts the
vowels per horizontal line. If his block is wide, he may estimate
the actual number of vowels represented by 40%; if it is narrow,
he may only roughly approximate the number; but in either case what
he hopes to see is _evenness of distribution_. More than half of
his units must be exactly normal, and any which are not exactly
normal must show the smallest variation possible. If he finds that
this is the case, he assumes that his block arrangement is the
encipherer’s original square, with only the minor possibility that
half of his lines may be written in the wrong direction. If his
distribution is not uniform, he counts the vowels per _column_ so
as to find out what kind of distribution he would get from a
vertical arrangement (ascending or descending). If this, too, fails
to show him a uniform vowel distribution, he writes out a new block
by the route of alternating verticals (or gets this count from his
first block; this is possible, though a little confusing). Afterward,
he may go on to the diagonals and spirals until finally he reaches
the arrangement in which more than half of his horizontal lines show
a 40% vowel count, and the rest a minimum variation.

Now let us consider a concrete example of decryptment. The (purely

imaginary) history of the cryptogram shown as Fig. 14 is meager. It
was taken from the body of an unnamed man, killed in attempting to
dynamite a bridge in an American town called Baysport.

Figure 14
 I Y W B B O R T A F T I X D G S S E G H N A T O O I T O X T L U T R E

L X F A Y S D R C H T O M E D E I O V I K F T V T L A E U.

To begin with, the cipher appears to be transposition. Its cryptogram

shows 37½% of vowels, very close to the number expected of English
or German. It is too short to provide any reliable distinction
between these two languages, but the source of the cryptogram points
to English. Again, the encipherer, although he has grouped his
message in the usual fives, has neglected to complete his final
group with a null, and from this we judge that 64 letters is the
actual length of the message. The fact that 64 is a _square_ is
promptly noticed. But it is also the sum of several smaller squares,
and the unit might be 16. To investigate this possibility, we may
mark the cryptogram off into four equal segments of 16 letters each,
and count the vowels per segment. The normal number of vowels in a
16-letter segment should be about 6, and segments of this length
are long enough to afford reliable information, so that we may
promptly discard the possible unit 16 when we find that the first
segment shows 5 vowels (31%), the second, 7 vowels (44%), and the
remaining two, respectively, 4 and 8. Such a distribution does not
prove that the unit 16 is a total impossibility, because many things
are not average in single examples, but it is an extremely bad one
and would never be accepted. On the other hand, a satisfactory
distribution does not prove absolutely that a given unit-length,
or block arrangement, is correct. Here, had there been no question
of the ever-present _square_, we might have been led astray by the
unit 32, which divides the vowels of the present cryptogram into
two equal halves. In this connection, we can only say that the
decryptment of any cipher, even the simplest, will at times include
a number of wanderings which we shall have to overlook in
demonstrating principles.

Assuming, then, that the large unit, 64, is correct, we must get it
back into its block — presumably square — in the encipherer’s
original arrangement. Fig. 15 shows the same cryptogram written
into two different blocks. For an 8-letter unit, the normal number
of vowels is about 3 (actually 3.2). In block (a), a count taken on
the horizontal lines shows half of the units normal, two of the
others with the smallest possible variation, and two greatly outside
the 35%-45% limits. When the unit is so short, and when the line
containing only one vowel may be the one which was completed with
nulls, and most particularly when we have no other units to act as
a check, we cannot confidently discard a block of this kind. In
practice, we might waste some time giving it a trial, or we might
look for something better. Notice that its distribution is “ragged.”
We expected to find _even_ distribution, with _more_ than half of
the units exactly normal. This block (a) is the simple horizontal
arrangement. To find out what the simple vertical arrangement would
give us, we have only to examine the columns of this. Here the count
is obviously bad.

In block (b), we have one of the diagonal rearrangements from which

two sets of vowel counts can also be taken. Here, the horizontal
lines have given us exactly what we hoped for: Evenness of
distribution, more than half of the units normal, and only one unit
outside of limits. This, almost surely, is the encipherer’s original
block, in which every line contains one intact unit.
From our meager history of the case, we do not, of course, know that
this is specifically the Nihilist cipher. It becomes a case of
considering the various ciphers with which we happen to be
acquainted, and a _columnar_ transposition of the general kind shown
in Fig. 11 is an exceedingly common case. Moreover, a series of
juggled columns is suggested here in the fact that intact units are
standing on their own lines and still have not resulted in plaintext.

Figure 15

(a) Horizontal Rearrangement, (b) Diagonal Rearrangement,

With TWO Vowel-Counts With TWO Vowel-Counts

I Y W B B O R T 3 I W O F G N O L 3
A F T I X D G S 2 Y B A D H T E R 3
S E G H N A T O 3 B T X G I R D E 2
O I T O X T L U 4 R I E O T S M V 3
T R E L X F A Y 3 T S O U Y O O T 5
S D R C H T O M 1 S T L A T I F L 2
E D E I O V I K 5 A T F H E K T E 3
F T V T L A E U 3 X X C D I V A U 3

4 3 2 3 1 3 4 4 3 1 4 3 4 2 4 3

In Fig. 16, we have the successive steps which would be taken in

order to investigate this probability. At (a), the diagonal
rearrangement of our cryptogram, selected as the most likely of
those which were examined, has been repeated with its eight columns
set wide apart, and consecutively numbered for identification. These
presumed columns are now cut apart, and thus we have eight paper
strips which can be moved about and rearranged in various manners
in the hope of causing words to form on some of the lines.

Since we lack that most powerful of decrypting tools, a _probable

word_, we are forced to begin with probable letter-sequence. If the
magic letter _Q_ were present, we should look for a companion _U_,
and after that for a vowel to follow _QU_. But this, too, is lacking.

Familiarity with English digrams (or, in the case of the beginner,

an inspection of the digram chart or the list of digrams) shows that
_TH_ is by far the most frequent combination used in the language,
and that _HE_ and _HA_, also including an _H_, are very prominent
among the leaders. Further than this, the list of trigrams informs
us that both _THE_ and _THA_ are of outstanding frequency. Of the
four letters included, three are so frequent, and appear in so many
different combinations, as to be confusing; but _H_, though belonging
to the high-frequency group, does not appear in many _different_
combinations, and is less frequent than the other three.

Looking, then, for _H_, we find it twice in our present cryptogram,

once on the second row and once on the seventh; and, since the
seventh row shows two _T_’s and the second only one _T_, suppose we
try the second row, placing together the two columns (strips) which
are headed by the numbers 6-5 in order to set up a digram _TH_ on
the second row, as shown at (b).
 Figure 16

(a) (b)
1 2 3 4 5 6 7 8 6 5

I W O F G N O L N G
Y B A D H T E R T H
B T X G I R D E R I
R I E O T S M V S T
T S O U Y O O T O Y
S T L A T I F L I T
A T F H E K T E K E
X X C D I V A U V I

(c)
6 5 7 ........ 6 5 7 4 ... 1 6 5 7 4

N G O N G O F I N G O F
T H E T H E D Y T H E D
R I D R I D G B R I D G
S T M S T M O R S T M O
O Y O O Y O U T O Y O U
I T F I T F A S I T F A
K E T K E T H A K E T H
V I A V I A D X V I A D

(d)
6 5 3 ........ 6 5 3 4 ...

N G O N G O F (Abandoned in
T H A T H A D
R I X R I X G favor of c.)
S T E S T E O
O Y O O Y O U
I T L I T L A
K E F K E F H
V I C V I C D

The formation of this digram _TH_ on the second row has automatically
set up a digram _NG_ on the top row, a digram _RI_ on the third row,
and so on; and we find, upon examining these newly-formed digrams,
that the whole series is made up of good English combinations. Thus,
it looks as if our combination 6-5 is correct, and we will proceed
with a possible _HE_ or _HA_, attempting to complete a trigram _THE_
or _THA_ on the second row.

Both _E_ and _A_ are present on the second row, and we may observe
at the steps marked (c) and (d) in the figure just what would be the
result of adding strip 7 or strip 3. At first glance, it appears that
combinations 6-5-7 and 6-5-3 are about equally probable. But it so
happens that both set-ups have formed a sequence _YO_ on the fifth
line, suggesting _YOU_; and when the only _U_ on that line is tried
in both places, it becomes evident that combination 6-5-7-4 is going
to give better results than combination 6-5-3-4, where we find poor
sequences like _KEFH_. At this point, or earlier, a decryptor will
probably proceed on the left side of his set-up, completing the
syllable _ING_ and the series of column-numbers 1-6-5-7-4, as shown.
When this setting together of columns automatically brings out on
the third row a sequence _BRIDG_, we have our first suggestion of
a _probable word_, since the man who had this cryptogram on his
person had just attempted to blow up a _BRIDGE_. After this, all is
plain sailing; the necessary _E_ happens to be on the same line, and
even if it were not, we have only three strips left, and these may
be placed by trial. Thus our eight paper strips arrive at the stage
indicated on the left-hand side of Fig. 17.

Figure 17

Strips in order Adjustment of rows

2 1 6 5 7 4 8 3

1 W I N G O F L O 2.... B Y T H E D R A
2 B Y T H E D R A 1.... W I N G O F L O
3 T B R I D G E X 6.... T S I T F A L L
4 I R S T M O V E 5.... S T O Y O U T O
5 S T O Y O U T O 7.... T A K E T H E F
6 T S I T F A L L 4.... I R S T M O V E
7 T A K E T H E F 8.... X X V I A D U C
8 X X V I A D U C 3.... T B R I D G E X

"Taking-out" Key: 2 1 6 5 7 4 8 3 1 2 3 4 5 6 7 8
1 2 3 4 5 6 7 8 "Writing-in" Key: 2 1 8 6 4 3 5 7

If we have previously met the Nihilist transposition, we can see now

what the cipher is, and, if it is a true Nihilist, we can finish the
reconstruction _by decipherment with the key_. To do this, we simply
number the rows from 1 to 8 and then disarrange these rows so that
their numbers will reproduce the series of column numbers. This is
shown on the right-hand side of Fig. 17, where the plaintext is
easily read: “By the drawing of lots, it falls to you to take the
first move. Viaduct bridge.” The gentleman required three nulls, and
thriftily made use of them as punctuation. If we have not previously
met the Nihilist encipherment, or if this cryptogram is of a kindred
type but governed by two separate keys, one for columns and another
for rows, the only difference is that we may have to experiment a
little with rows before finding their correct order.

In completing our solution, we have obtained a key, 2 1 6 5 7 4 8 3,

shown in the series of column-numbers, and should other cryptograms
be intercepted having the same key as the first, we need merely
decipher them with our key. It is, however, a “taking out” key, while
the Nihilist, as we have seen, is ordinarily _written in_. Having
either of the keys, we may find the other easily enough as suggested
in the figure. Simply “number the numbers” and put them back in
serial order. The new set of numbers, now disarranged, will show you
the other key. It would not be impossible for the student who is a
good guesser to find the keyword on which our present writing-in key
was based. This kind of work, with paper strips, is much more rapid
than it probably seems, and is often done at random. The keen eye
needs no digram list for the spotting of _HT_, merely reversed, with
_GN_ above it.

Speaking now of the ordinary columnars (Fig. 11), one minor point
should perhaps be brought to the attention of the very new student.
Quite often, a digram, such as the _QU_ of Fig. 18, is not written
on a single line, and it may be necessary to match this valuable
digram in the manner shown at (b) of that figure, coming out in the
end as at (c). In such event, we can later on transfer columns 5-6-7
to the other side of the block, raising them all by one position.
(Column numbers, in this case, are for reference only.) The same
would not apply to a Nihilist block in which the whereabouts of the
“next” row is unknown; the digram_ QU_ would have to be abandoned in
favor of something else.

Figure 18

(a) (b) (c)

1 2 3 4 5 6 7 1 1 2 3 4
7 5 6 7
T H I S I S Q T T H I S
U I T E T R U Q U I S Q U I T E
E B U T W E D U E T R U E B U T
D W E D

We mentioned briefly, too, the possibility of finding alternating

horizontals, so that only half of the rows can be “anagrammed”
together. Such minor problems, and they are numerous, can all be
ironed out easily enough once the student is familiar with his type,
and columnar transposition, encountered frequently and in all sorts
of disguises, is surely the most fascinating of all types. In
Chapter VI we are to meet it again, this time with an incomplete
rectangle.

16. By PICCOLA. (Ordinary columnar).

O E E H E A T F L S V A S Y C I O A E D Q O H D F M C M T C P O G E O
R E U G M I E F U O G C Y W G D Q U U I A L S I E R N O R N R R A T O
A Q.

17. By KRIS KROST. (Nihilist).

T C I G R H N L A G T L I S A A O M O R N R I M N N E T R N K S A O E
I S D L E I K H H H E R D F T A S O I E T I H N E B T K E.

18. By MERLIN. (Nihilist. Its keyword has been used as a word-spacer).

T O L F P T E E R B I V O P S N R E W O R L I T T E S E N E T O O H O
F H H E H N Y H I O P F O S T G I P H E I E E T K I N U I B N R A A Y
R R E E W L S T H T E E R D T S E A I R S R E A E R R E P E U E U R S
S U I R R O F E S T R P O P A O R R B E E O N T T E E R T A H E R A R
L A D I O E E Z E L Y A O A Y M S L U L W I Y N N O O S S T G T S H L
W E Y M D M E A R E E U R I Y T P P R N Y N T Y O.

19. By SLEEPY. (Nihilist "route-cipher").

Wants Little Wish Should Long Muster But The Man And Gold Wants If Me
Many Below Mint For Not A So And Nor Of More With Score In Song
Wants
Were I That Told Exactly Are Here A Long 'Tis Many 'Tis My But Each
Still Little Would So!

20. By TITOGI. (Ordinary columnar).

T W E I S I A H O D S P O D E R I T O N J E U T A I A S Y S H N T S T
K D N R S W U.

21. By PICCOLA. (Ordinary columnar).

T E E P H B M E F E B N T U X A V E H A R D W X I E L N C V E V R O I
T A F U L B O R O N T H M T M U E F S H O E T T L E D A K E E G D N L
E E N N I O O E B E E E R S T N R Y D C N X O N O E N E X.

(And now try this. Probable word: EXAMPLE).

H E L K L T I P N W H S E S I A X S R R E E A C M C P L T L T E O S D
R A O E E X T I H Y E U H N G E M Y T A S L M A A D S C.

CHAPTER V
Geometrical Types — The Turning Grille

The well-known _turning grille_, also known as the _rotating_, or

_revolving_ grille, is said to have been originated by an Italian,
Girolamo Cardano (or Cardan). Such grilles can be prepared from any
substantial material capable of being made into sheets and marked
into cells, and may take the form of any geometrical figure which
happens to be equilateral. The number of cells to be clipped out,
so as to form apertures for the writing of letters, is based on the
shape of the grille, as: one-third of the total number for a
triangle, one-fourth for a square, and so on; and the writing of the
letters is done on a section of paper of the same size and shape as
the grille, and preferably ruled off into cells which correspond to
those of the grille. After such a grille has been placed on its
corresponding section of paper, and a letter has been written through
each aperture, the grille is _turned_ a certain number of degrees to
a new position on the same section of paper, so as to cover from
sight the letters already written, and expose another series of blank
cells for the writing of new letters; and this continues until the
grille has taken its full number of positions and every cell has been
accounted for on the section of paper beneath it. The preferred
grille is a square, based on square cells, and takes four positions.
Usually it is based on an _even number_ of these cells; otherwise,
the full number of cells is not evenly divisible into quarters,
leaving an extra central cell which has to be omitted or specially
dealt with.

The grille called “Fleissner,” after an Austrian cryptologist,

Eduard Fleissner von Wostrowitz, is the perfected Cardan grille as
described by Jules Verne in his story, “Mathias Sandorf.” Colonel
Fleissner’s grille is a square, taking four positions, and is always
based on an even number of cells. In preparing this grille, it is
easy enough to select apertures at random in such a way that each one
governs its own four cells on the paper beneath, causing each of
these to be uncovered exactly once. But concerning the preparation
of the grille, there is a phase which affects the value of the cipher
itself: unless the grille can be constructed at will, in accordance
with a key which is “easily changed, communicated, and remembered,”
it requires the keeping on hand of a material apparatus which can be
stolen or copied, or which cannot be destroyed in case of emergency.

There are, of course, many ways in which a key could be applied. The
method used here is one published several years ago by Ohaver, and
can be studied in Fig. 19. First, as shown at (a), we have a quick
mechanical method for selecting apertures that cannot conflict. The
square is divided into four quarters, and each quarter, treated as
if it were the one occupying the upper left-hand corner, receives
its consecutive cell numbers, 1 to 9 (or 1 to 4, 1 to 16, 1 to 25,
1 to 36, etc.). If the route of writing-in is made exactly the same
for all four of the quarters, it becomes possible to clip _one each_
of the numerals 1, 2, 3, 4, 5 . . . . . . . etc., taken absolutely at
pleasure, and each resulting aperture will expose only its particular
four cells. This can be seen at (b).

The grille shown at (b), however, was based on the key-phrase

FRIENDLY GROUPS, and the method can be studied at (c), following
Ohaver’s plan, even to its minute details. The fact that the square
is based on 6 is told in the initial letter of the key-word, _F_,
6th letter of the alphabet. This key-word must yield nine letters,
one for each proposed aperture in the grille. A short word, such as
FRIEND, can be lengthened by a partial repetition, as FRIENDFRI,
while a longer word is cut off after its ninth letter, as it was in
Fig. 19. This literal key is next converted to a numerical key, as
explained in the preceding chapter, and the nine resulting numbers
are divided as evenly as possible into four sections. Finally,
considering the four quarters of the grille in some definitely agreed
rotation, each section of key-numbers will show what numerals are to
be clipped from a given quarter. In the figure, the numerals 3 and 8
were clipped from the first quarter, numerals 5 and 2 from the second
— proceeding in a clockwise direction, — numerals 7 and 1 from the
third quarter, and numerals 6, 9, and 4 from the remaining quarter.

Figure 19 - Preparation of a Grille

(a) (b)

Top
1 2 3 7 4 1 _ _ 3 _ _ _
4 5 6 8 5 2 _ _ _ _ 5 2
7 8 9 9 6 3 _ 8 _ _ _ _
3 6 9 9 8 7 _ 6 9 _ _ 7
2 5 8 6 5 4 _ _ _ _ _ _
1 4 7 3 2 1 _ 4 _ _ _ 1

(c)

F R I E N D L Y G
3 8.5 2.7 1.6 9 4 1st Q: 3,8; 2d: 5,2; 3d: 7,1; 4th: 6,9,4

Another method for selecting cells, proposed by Edward Nickerson,

dispenses with numerals, using in their places the letters of a
key-word which must be without repetitions, as FRIENDLY G happens to
be. If these nine letters, all different, be written into the nine
cells of each quarter, following exactly the same route in each case,
it becomes possible to clip one each of the letters _F_, _R_, _I_,
_E_, _N_, _D_, _L_, _Y_, _G_, taken wherever desired. The choice can
be made as follows: Taking the four quarters of the grille in the
agreed rotation, follow the normal alphabet, clipping _A_, (when
present,) from the first quarter, _B_, (when present,) from the
second quarter, _C_, (when present,) from the third quarter, and so
on. Or, to insure a more even distribution, rearrange the nine
letters in alphabetical sequence: _D E_, _F G_, _I L_, _N R Y_, and
divide as in the former plan, clipping _D_ and _E_ from the first
quarter, _F_ and _G_ from the second, and so on. While it is possible
to provide key-phrases of sixteen letters, without repeating, it is
probably more convenient to take whatever number of letters is needed
from a key-mixed alphabet of the following type:
F R I E N D L Y G O U P S A B C . . . . . . W X Z _f r i e_ . . . . . .

In Fig. 20, at (a), (b), (c), (d), we have a detailed picture of the
operation of this grille on the 36-letter plaintext unit: MISFIRE ON
VIADUCT JOB X RUSH INSTRUCTIONS. One definite edge of the grille must
be designated as the top, and there is a right and a wrong side.
Taking precautions in these respects, we place the grille over a
sheet of paper and mark its outline with a pencil (or otherwise make
sure of maintaining this one location). We write the first nine
letters as at (a), and give the grille a quarter-turn to the right.
We add the second nine letters as at (b) — where the newly-written
letters are the capitals; the others, in lower case, are presumed to
be hidden from sight by the solid portion of the grille. Another
quarter-turn makes ready for the next nine letters (c), and a
remaining quarter-turn completes the revolution (d). The writing-in,
at all times, is _straight ahead_: cells taken from left to right,
and lines taken from top to bottom.

Figure 20 - Four Stages of Encipherment

(a) (b)

_ _ M _ _ _ _ _ m _ _ _
_ _ _ _ I S V _ I A i s
_ F _ _ _ _ _ f D _ _ U
_ I R _ _ E _ i r _ _ e
_ _ _ _ _ _ _ _ _ _ C _
_ O _ _ _ N T o J _ O n

(c) (d)

B _ m _ X _ b T m R x U
v _ i a i s v C i a i s
R f d U S u r f d u s u
_ i r _ H e T i r I h e
I N _ _ c _ i n O N c S
t o j S o n t o j s o n

In the Jules Verne story, the three units of his cryptogram were left
standing in their blocks. Verne’s heroes were clever enough to
unearth a ready-made grille, and, by laying this, in its four
successive positions, above each of the three blocks, were able to
read the message through the apertures. Today, such blocks would be
taken off in five-letter groups, and possibly by a devious route. A
little concealment can be afforded, too, by completing the last
five-letter group with nulls, or, better, by adding these nulls at
the beginning of the cryptogram. It is also possible to make the
final 36-letter unit _incomplete_ by blanking out its bottom cells
before putting in the letters.

A grille can be used in other ways. Negligible changes can be

produced in its cryptograms by altering the customary order of its
four positions. A more substantial change is introduced by departures
from the straight horizontal direction of the writing-in. It is
possible to revolve the paper instead of the grille, setting the
letters right-side-up at the time of their taking off. And in all
of these cases, the grille is still serving as an instrument for
_writing-in_; there would be corresponding cases in which it is used
as an instrument for _taking out_ the letters of a prepared block.
Each variation, perhaps, would require its own separate analysis
before its individual inherent weaknesses could be spotted and used
as the basis for a special method. If the student, after observing
some special methods applied to ordinary grille encipherment, cares
to try his hand at analyzing some one of its variations, we suggest
that he take a series of numbers, 1 to 36, 1 to 64, etc., and carry
these through a complete encipherment to see what becomes of each
one.

* * *

Grille transposition, like the Nihilist, involves a major unit

composed of minor units. But here, the four minor units are never
left intact, and if the type of encipherment is not known in advance,
the decryptment of a single block will give somewhat more trouble
than the decryptment of a single Nihilist block, for the reason that
the decryptor usually exhausts the simpler possibilities before
trying the complex. With grille encipherment known, or suspected, we
have a cipher bristling with points of attack.

The strictly horizontal writing-in of each minor unit has had to be

done within a fairly short compass, and no two consecutive letters of
this unit can have been placed very far apart without causing other
letters to draw closer together. Their average distance apart is four
cells. For the decryptor, this actual distance apart of letters is
made shorter by his knowledge that for each letter considered, there
are three others which cannot have been written into the same unit
with it, _and that he knows definitely what these three letters are_.

Particularly interesting is the assistance he receives from the

symmetrical pattern into which the letters of his four units are
written; position 3 is position 1 reversed, and position 4 is
position 2 reversed. Thus, having tentatively selected the letters
of a probable word, or fairly long sequence, he can check the
correctness of his observations by examining another sequence which
would automatically build up, traveling in the opposite direction,
in the reverse position of the grille.

For a clear understanding of these matters, suppose we consider the

decryptment of the block just enciphered, on the assumption that we
suspect the presence there of the word VIADUCT. Fig. 21 shows a 6 x 6
block carrying consecutive cell-numbers, which are also the serial
numbers of the cryptogram letters, as these appear in a separate
block beside the first. It is understood that our first move would be
that of ascertaining whether or not the seven letters of this word
are all present. It must be remembered, too, that a long word is not
necessarily altogether in one unit; the grille might have been turned
before the word was completed.

In the present case, however, our first letter, _V_, is found near
the top of the square, and only once, so that if the word VIADUCT is
present, a substantial portion of it must have been written before
the grille was turned. We expect to find letters _I_, _A_, _D_, _U_,
and so on, following the letter _V_ in just that order, and without
any very great distance between any two of them; and if, approaching
the bottom of the square, we find it necessary to proceed backward
for _U_, _C_, or _T_, then the grille was surely turned before that
_U_, _C_, or _T_, was written.

Now, considering together the two blocks of Fig. 21, we find that our
first letter, _V_, occupies cell No. 7. In imagination, we revolve a
grille in which the only aperture has been cut in cell 7, and find
that this aperture exposes the cells numbered 5, 30, and 32. These
three cells, then, were surely covered from sight when the letter
_V_ was written into cell 7, and regardless of what the letters are
that occupy these three cells, it is definitely impossible that any
one of the three could have been used in the same minor unit with the
_V_ of cell 7.

Looking for a letter _I_, we find several within a very short range.
But the block contains only one _A_, and since we cannot proceed
backward after selecting the _I_, the position of _A_ (cell 10) tells
us that only the _I_ of cell 9 is possible. We accept, then, the _I_
of cell 9, and, again revolving an imaginary grille with its only
aperture cut in cell 9, we eliminate the letters found in cells 17,
28, and 20. Similarly, accepting _A_ of cell 10, we eliminate
whatever letters are occupying cells 23, 27, and 14. So far, none of
the letters eliminated have been wanted for the development of the
word VIADUCT; but notice that the fourth letter, _D_, found only
once in the block, occupies cell 15, thus eliminating the letters of
cells 16, 22, and 21, one of which is _U_, the next letter
needed. Thus, we are not forced to make a decision as between the _U_
of cell 16 and the _U_ of cell 18.

Figure 21

1 2 3 4 5 6 B T M R X5 U

7 8 9 10 11 12 V7 C I9 A10 I S

13 14 15 16 17 18 R F D15 U S U18

19 20 21 22 23 24 T19 I R I22 H E

25 26 27 28 29 30 I N O27 N28 C S30

31 32 33 34 35 36 T O32 J S O N

We have put together, then, the letters _V I A D U_ in the only

manner which is possible at all, and their cell-numbers, taken in
order, are 7-9-10-15-18. If the grille is reversed, these same
openings, named in the same order, will uncover cells 30-28-27-22-19;
these new cells, however, will not be seen in reverse order; they
will be in straight order like their letters. If, then, our sequence
_V I A D U_ is correct, the five letters found in cells
19-22-27-28-30, taken in normal order, should form an acceptable
English combination. A glance at the right-hand block of Fig. 21
will show that this check-sequence is _T I O N S_.

When we selected _V_, we automatically selected _S_ of cell 30 as

its check-letter. When we added _I_ on the right-hand side of _V_,
we obtained with it the _N_ of cell 28 on the _left_ side of _S_,
giving the check-digram as _NS_, entirely acceptable. With _A_, we
added the _O_ of cell 27, giving the check-trigram as _ONS_,
still acceptable; and so on to _IONS_, _TIONS_. Our complete word
VIADUCT produces the check-sequence _UCTIONS_. It must not be
objected that the fact of having only one each of letters _V_,
_A_, _D_, has too greatly facilitated the search. This is
an entirely legitimate expectation in a case where we deal with one
unit, and the decryptor, when possible, chooses his probable word
with this in mind. In the absence of a probable word, we are never
without probable sequences: the list of frequent trigrams, and the
various common affIxes, such as _-TION_, _-MENT_, _-ENCE_, _-ABLE_,
_CON-_, _PRE-_, etc. For the first three or four letters, where
decisions are sometimes uncertain, it is more satisfactory to work
directly on the square (prepared in ink), so that impossible cells
may be canceled in pencil, and the pencil marks erased when wrong;
but once well started, a paper or celluloid grille can be prepared
to fit the block, and the chosen cells actually cut out as they are
selected. Having found seven out of nine apertures, we may, if we
like, turn the paper grille and experiment with its other two
positions. The letters, in this case, will show gaps in sequence,
and may indicate by these gaps just where the new openings ought to
be cut. With one full unit determined, we have the grille for reading
the others. The only remaining problem would be that of deciding the
exact sequence of these four units, with their context as a guide.

For the case in which it is necessary to begin with letter-sequences,

particularly if driven back to the digram list, the device shown in
Fig. 22 may prove of considerable assistance: The cryptogram is
written in both directions, and thus pairs every letter with its
check-letter, so that check-sequences here would be written backward.
This idea is adapted from General Givierge’s _Cours de cryptographie_.

Figure 22

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
B T M R X U V C I A I S R F D U S U
N O S J O T S C N O N I E H I R I T
36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19

19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36
T I R I H E I N O N C S T O J S O N
U S U D F R S I A I C V U X R M T B
18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1
Working with digrams is tedious, but will, in the end, give results.
Considering, for instance, Fig. 22, its first letter is _B_. Of
letters standing immediately to the right of _B_, the first one which
would form a good digram with it is the _R_ of cell 4. But
consideration of a possible digram _BR_, cells 1-4, shows the
check-digram as _JN_, cells 33-36, and this latter digram is so rare
in the language that Meaker did not find it even once in his
10,000-letter text. The next letter known to have an affnity for _B_
is the _U_ of cell 6, but a possible digram _BU_, cells 1-6, cannot
be considered, for the reason that cells 1 and 6 are uncovered by the
same opening in the grille. The distance away of the next letters to
which _B_ is partial proves frightening, and _B_ is abandoned (it is
actually followed by the _X_ of cell 5).

Figure 23

R R T H A O U E E O S B A G D E A E
A V E B K U N E S F D I A N K S S S
T A D P E B R A N S U K O D X F D N
C R E A R R N J A T I Y G O A O A R
A O I L I D X T U S O B R A A N L E
T S G T E P L M A O T V H R A X E X

Beginning over, with _T_ of cell 2: The first frequent digram noticed
is _TR_, cells 2-4, and shows the check-digram as _JO_, cells 33-35.
We accept this at once, because the letter _J_ must presumably be
followed by a vowel, and the only vowel immediately available is
this particular _O_. To extend the accepted _TR_, we require a vowel.
The first one is U, cell 6, and extends the check-digram to _TJO_,
cells 31-33-35, acceptable if _T_ is the final letter of a word. To
extend the supposed trigram _TRU_, we experiment with _C_ of cell 8
and obtain a check-sequence _CTJO_, cells 29-31-33-35, which is still
encouraging. We must know, of course, that no two of the chosen cells
are in conflict with each other. The unit we have partially
reconstructed is the second one of Fig. 20, and the check-sequence
is the fourth unit.

A method somewhat resembling the foregoing consists in writing

another block beside the first, in which the letters of the
cryptogram are strictly in reversed order. The pattern of the
check-sequence will then follow exactly that of the sequence under
examination, merely with its letters in reverse order. Still a
further suggestion was made by Herbert Raines: In the preparation of
the two blocks, one in straight order and the other in reverse order,
the writing should be done vertically, with all columns containing
four letters. The symmetry can still be found, and any two
consecutive plaintext letters are more nearly at their original
distance apart — the average 4.

So far, we have been dealing with an isolated unit. In Fig. 23 we

have a longer cryptogram, suspected of being a reply to the first.
We have set it up in its three blocks, expecting to decipher it with
the same grille, but find that something is wrong. To see quickly
how the presence of several units modifies the case, suppose we
consider some sequence, right or wrong, which is easily examined,
such as the _AVE_ on the second row of the first block. Regardless
of what the transposition is, if all three of these units are
enciphered alike, each of the additional blocks contains a
corresponding trigram in exactly the same location as the one under
consideration; here we have _NES_ in the second block and _ANK_ in
the third. But if the transposition is specifically that of the
grille, each one of the three trigrams _AVE_, _NES_, _ANK_, has a
check-trigram in its own block. Thus we have the six trigrams listed
with their cell-numbers in Fig. 24. Since all of these are acceptable,
we should, in practice, be encouraged to accept them; thus, it may be
well to say here that, in dealing with all ciphers these false
beginnings will quite frequently pitch the decryptor headlong into a
solution, through no act of wisdom on his own part.

Figure 24

Straight Reversed

7 8 9 28 29 30

A V E L I D
N E S S O B
A N K N L E

Now, in order to arm ourselves against the larger grilles, which are
somewhat more troublesome, and for investigation of cryptograms which
may or may not have been accomplished with a grille, suppose we take
a look at Ohaver’s mechanical method — that is, his use of paper
strips. Picturing any block of 36 cells, numbered consecutively as we
saw these in Fig. 21, let us imagine that there is a grille placed
over this block, and that this grille has only one opening. If the
cell that shows is No. 1, then, at the first turn of the grille, we
uncover cell No. 6; at the next turn, cell No. 36; and, at the final
turn, cell No. 31. We will call this series of cell-numbers an
_index_, and say that the index for this particular aperture is
1-6-36-31. In the first block of the new cryptogram, the letters
which follow this index are _R O P T_. In the second block, the same
index governs the letters _U B V L_, and, in the third block,
_A E X H_. But if the single opening in our hypothetical grille has
exposed cell No. 2, then its _index_, discovered in the same way, is
2-12-35-25, and the corresponding letters, in the three blocks of
this cryptogram are, respectively, _R U E A_, _E I T X_, and
_G S E R_. Similarly, each one of the other seven apertures possible
in this quarter of the grille has an index, expressible in
cell-numbers, and governs a certain series of letters in each
cryptogram block. If the grille is the Fleissner, the index for any
aperture, in a grille of any size, will always contain four numbers,
and will govern four letters per block.

If the grille is a 16-letter one, there will be only four of these

indices, beginning in cells 1, 2, 5, 6. If it is a 36-letter grille,
there will be nine, beginning in cells 1, 2, 3, 7, 8, 9, 13, 14, 15.
A 64-letter grille will have 16, beginning in cells 1, 2, 3, 4, 9,
10, 11, 12, 17, 18, 19, 20, 25, 26, 27, 28; and so on to grilles of
100, 144, etc., letters. After one grows accustomed to the
swastika-like route of the open cell, such indices are not at all
difficult to prepare at the moment of need; however, many solvers
prefer to make them up in sets, once for all, and have them ready as
they happen to be wanted. As to the finding of the four letters per
block which follow any one index, it is sufficient to remember that
the cell numbers, arranged in the manner shown, are also the serial
numbers of the letters belonging to any one unit. Thus it is not
necessary to write the units into their squares; we need merely
number the letters of a unit from 1 to 36, and select those having
the desired serial numbers.

Returning, now, to our cryptogram: Our unit appears to be 36, since a

division of this kind distributes the vowels uniformly; and a unit of
36 may have been produced with a grille. If so, this grille had 9
apertures, and we need 9 paper strips, one for each aperture. On each
strip we are to have: the four index numbers, the four corresponding
letters from the first block, the four corresponding letters from the
second block, and the four corresponding letters from the third block.
But since, in each case, the first three cell-numbers or the first
three letters _must be repeated_, our strip will actually contain
seven numbers and twenty-one letters. These nine strips are prepared
all in one set-up, the details of which can be examined in Fig. 25.
In Fig. 26, the strips of Fig. 25 have been cut apart and rearranged
in such a way as to bring out plaintext on the top row of every block;
this is, of course, the first _full_ row, as pointed out in each case
by the four asterisks. It will be noticed that the top row of
cell-numbers is arranged in strictly ascending order (our strictly
horizontal route of writing-in). If the third row be now examined (as
pointed out by two asterisks), it is found that this, too, carries
plaintext, merely written backward, and that here the cell-numbers
are arranged in strictly descending order.

Figure 25

Preparation of Slips

Index....... 1 2 3 7 8 9 13 14 15
6 12 18 5 11 17 4 10 16
36 35 34 30 29 28 24 23 22
31 25 19 32 26 20 33 27 21
1 2 3 7 8 9 13 14 15
6 12 18 5 11 17 4 10 16
36 35 34 30 29 28 24 23 22

Block 1...... R R T A V E T A D
O U B A K E H B P
P E T D I L R R A
T A C S O R G I E
R R T A V E T A D
O U B A K E H B P
P E T D I L R R A

Block 2...... U E E N E S R A N
B I K S D U O F S
V T O B O S Y I T
L X N M T J A U A
U E E N E S R A N
B I K S D U O F S
V T O B O S Y I T

Block 3...... A G D A N K O D X
E S N A S D E S F
 X E X E L N R A O
H R G R A O A A A
A G D A N K O D X
E S N A S D E S F
X E X E L N R A O

Now, to read the cryptogram: Each full row of numbers includes all
cell-numbers belonging to some one of the four units, and any one of
these four rows of numbers is a key to the grille, since it shows
exactly what cells were uncovered when the corresponding unit was
written in. To obtain the grille, we have only to select some one row
of numbers, as 12-36-10-16-34-9-26-32-13, and clip out these
particular cells in a square numbered as we saw it in Fig. 21. The
student who cares to know what “instructions” were being sent might
also satisfy his curiosity as to whether or not this new cryptogram
could have been deciphered rather than decrypted.

Figure 26

One Correct Adjustment of Slips

┌────┐ ┌────┐
│ 9 ├────┬────┤ 13 │
┌────┐ ┌────┤ 17 │ 8 │ 7 │ 4 │
┌────┤ 1 ├────┬────┤ 3 │ 28 │ 11 │ 5 │ 24 │
│ 2 │ 6 │ 14 │ 15 │ 18 │ 20 │ 29 │ 30 │ 33 │ ****
│ 12 │ 36 │ 10 │ 16 │ 34 │ 9 │ 29 │ 32 │ 13 │
│ 35 │ 31 │ 23 │ 22 │ 19 │ 17 │ 26 │ 7 │ 4 │**
│ 25 │ 1 │ 27 │ 21 │ 3 │ 28 │ 8 │ 5 │ 24 │
│ 2 │ 6 │ 14 │ 15 │ 18 │ │ 11 │ 30 │ │
│ 12 │ 36 │ 10 │ 16 │ 34 │ │ 29 │ │ │
│ 35 │ │ 23 │ 22 │ │ E │ │ │ T │
│ │ │ │ │ │ E │ V │ A │ H │
│ │ R │ │ │ T │ L │ K │ A │ R │
│ R │ O │ A │ D │ B │ R │ I │ D │ G │ ****
│ U │ P │ B │ P │ T │ E │ O │ S │ T │
│ E │ T │ R │ A │ C │ E │ V │ A │ H │**
│ A │ R │ I │ E │ T │ L │ K │ A │ R │
│ R │ O │ A │ D │ B │ │ I │ D │ │
│ U │ P │ B │ P │ T │ │ │ │ │
│ E │ │ R │ A │ │ S │ │ │ R │
│ │ │ │ │ │ U │ E │ N │ O │
│ │ U │ │ │ E │ S │ D │ S │ Y │
│ E │ B │ A │ N │ K │ J │ O │ B │ A │ ****
│ I │ V │ F │ S │ O │ S │ T │ M │ R │
│ T │ L │ I │ T │ N │ U │ E │ N │ O │**
│ X │ U │ U │ A │ E │ S │ D │ S │ Y │
│ E │ B │ A │ N │ K │ │ O │ B │ │
│ I │ V │ F │ S │ O │ │ │ │ │
│ T │ │ I │ T │ │ K │ │ │ O │
│ │ │ │ │ │ D │ N │ A │ E │
│ │ A │ │ │ D │ N │ S │ A │ R │
│ G │ E │ D │ X │ N │ O │ L │ E │ A │ ****
│ S │ X │ S │ F │ X │ K │ A │ R │ O │
│ E │ H │ A │ O │ G │ D │ N │ A │ E │**
│ R │ A │ A │ A │ D │ N │ S │ A │ R │
│ G │ E │ D │ X │ N ├────┤ L │ E ├────┘
 │ S │ X │ S │ F │ X │ └────┴────┘
│ E ├────┤ A │ O ├────┘
└────┘ └────┴────┘

* * *

Concerning the grille cryptograms which follow, it seems not

impossible that the student who has seen his principles applied only
to a unit of 36 might find some difficulty in adjusting them to
grilles of other sizes. A tip, then, on Example 22: Instead of the
regulation nulls, its single unit was completed with a common Spanish
phrase beginning with _Q_. And if it still resists: the author’s own
name was used as the key for constructing the grille.

In adjusting his paper strips (when this is the method he prefers) it

makes no particular difference what plan he follows, so long as it
works. Some decryptors prefer to concentrate altogether on the
strictly ascending series of cell-numbers, allowing letters to form
their own sequences. Others will always have before them the set-up
of squares, noting there some possible letter-sequence, finding (by
means of their cell-numbers) the strips which contain these letters,
and then observing results in other blocks. If the given strip cannot
be found, then the cell must be already in use.

The shortest road is that of the probable word. For instance, the
set-up shown as Fig. 26 was actually initiated by the solver at the
letter _J_ of the second block, this being a rare letter and almost
invariably followed by a vowel. Of the several vowels immediately in
sight (in the square) the correct one was promptly suggested by the
sequence so plainly in sight, _OB_, suggesting the word _JOB_, one
already used by these people in discussing their mysterious
activities. The corresponding cell-numbers, 20-29-30, were found to
be on three separate strips — a necessary condition — and when placed
together brought out the straight sequences _RID_ and _OLE_, with
reversed sequences _AVE_, _NEU_, and _AND_. Another very probable
word was suggested by the check-sequence _AVE_ (_HAVE_), and the
necessary _H_ was found with cell-number 33, bringing solution to the
point suggested roughly in Fig. 27, where attention was promptly
focussed on the tetragram _RIDG_, suggesting _BRIDGE_, another word
previously used. There were two strips carrying the desired _E_, but
both refused to fit; and here the cell-numbers came into play. The
last one found, 33, was large and suggested that its letter, _G_,
might be the last letter of a unit; afterward, the building was
continued on the left, with _B_.

Figure 27

Straight Reversed

20 29 30 33 17 8 7 4

R I D G E V A H (Have)
J O B A U E N O (one u)
O L E A D N A E (e and)

22. By PICCOLA. (Probable word: CRYPTOGRAMS).

T S T H E T T U S H O E D G F R D O E O G R I S A A M S N M Q E U G I
B R I E L N O S T H S I C L S E T S W A T H A B R Y P A E.

23. By DAMONOMAD and POPPY. (Probable word: RIGHT FLANK).

A E K D S P V T O O N N A A O N R O N P R O C T I E H T R E H N E T I
A F G S R H T N I L O V T E F F A L M K I E C L A A S N M.

24. By DAMONOMAD and POPPY. (Probable word: SPECIAL MESSENGER).

E Y U I S S N S F P A O P E R I S C O A M N R A I R G A A T A L I M N
E G E E I S O S N O S A D N B E I T N O N G U E P R H T E E W S R U A
S S K V Y P I T O N O U E Y S O C M W O T N S T E U O B D G.

25. By SAHIB.

R N I I I N G T F L A I L N N D E E T D R V E U S E S T H R E I G E Y
F I A N O U R R D L G Y T N H A E O N R N E K C D E E I S E Y B S E F
W Y P G R L O L O E U O F H P A T V E R E H E R A E D G M I T R H N E
E I S Y T Q T S I I S A U S G I E A I C A S L L K L L T T X H V H E A
R X A X.

26. By NEMO.

I K O T H N N E H N E E I R C R A G E L O R N O H K T W T C H O H E I
E S S W W T N E T R H A R E O L S P L A A G E A E R L D B R Y E U I T
R T R E N I D T H E I A D E I E N D P D A B R A E C R K E M T A O A U
T O T S Y N B P E S N U H E S R A H E S U P D.

27. By DAN SURR.

O L T L A L I G E R T I V H E L L E R K I E A E I J F E I Y Y O O U U
S T H E A V A S G Y A S A W C K E P L U E Z T I Z O S I T.

28. By PICCOLA. (This is not a grille. It's a serious matter!)

H S O E S N P T A E T O H I S T W L E D T T F A I B T Y U Y O T C E O
I I T R C Y S B T R A H B T E I D O U S C I U O K R O Q N.

CHAPTER VI
Irregular Types — Columnar Transposition

Square units, in actual use, are less convenient than those

rectangular encipherments in which only one dimension of the block
is restricted, thus permitting that a single key govern messages of
many different lengths. We have a more practical cipher in the
columnar transposition of Chapter IV, and this can be rendered
somewhat safer if care be taken to avoid completing the rectangle.
The preparation of such a block is illustrated in Fig. 28, where the
key-word PARADISE is being used to encipher the following text:
REGRET CHANGE IN SYSTEMS BUT THOUGHT ADVISABLE ACCOUNT INCREASED
VOLUME SENT BY AIR.

Figure 28
 P A R A D I S E
6 1 7 2 3 5 8 4

R E G R E T C H
A N G E I N S Y
S T E M S B U T
T H O U G H T A
D V I S A B L E
A C C O U N T I
N C R E A S E D
V O L U M E S E
N T B Y A I R X
X X X . . . . .

First, let us understand the purpose of the four nulls. It

is customary, when cryptograms are to be transmitted by wire
or radio, to make them evenly divisible into five-letter groups.
This usually means the addition of from one to four nulls, and
since the nature of the cipher makes it inadvisable that additional
letters be added to the enciphered cryptogram, any desired nulls
must be added in the block before the columns are
taken off. Another precaution usually recommended is the
avoidance altogether of key-lengths which are divisible by 5,
so that an encipherer is practically never compelled to add a
complete five-letter group in order to leave his rectangle incomplete.
It might be added that our use of letters _XXXX_ is for emphasis only; a
better series would be one of the nature _AAEO_.

The decipherer’s only problem is illustrated in Fig. 29. Knowing the

key, the decipherer knows that there must be eight columns. The
number of letters, 75, divided by 8, results in 9, with remainder 3;
thus, the short columns are to contain nine letters, and there will
be three which contain ten letters. He lays out an 8 x 10 block,
cancels the last five cells, writes his key-numbers across the tops
of the columns, and then begins to copy letters, filling the column
numbered 1, then the column numbered 2, and so on, finally reading
his message by straight horizontals.

Figure 29

P A R A D I S E
6 1 7 2 3 5 8 4

_ _ _ _ _ _ _ _
_ _ _ _ _ _ _ _

...............
...............
_ _ _ _ _ _ _ _
_ _ _ x x x x x

The cryptogram from this block is shown as Fig. 30, and illustrates
the manner in which the decryptor will number the letters of
practically all cryptograms in order that he may quickly locate any
desired letter, or learn, by subtraction, the distance apart of any
two letters. The decryptor, of course, does not know how many columns
the cryptogram contains, and even after he finds out the key-length,
he still does not know exactly the point at which any one column ends
and another begins.

This form of transposition is among the most fascinating of

decryptment problems, and we shall look at it from several angles.
The simplest case is that in which the decryptor correctly assumes
the presence in his cryptogram of some word or phrase whose length is
greater than that of the key; if this probable word is long enough,
he is able to learn, not only the key-length, but the order in which
to write his columns. Our present cryptogram, for instance, has
key-length 8, and contains two nine-letter words, ADVISABLE and
INCREASED. These two words, repeated in Fig. 31, will show what
happens when a word is long enough to overlap the block. With the
word ADVISABLE, the final _E_ falls below the initial _A_, and when
this column is taken off, the letters _A E_ will stand in sequence in
the cryptogram. Similarly, the word INCREASED will provide, in the
cryptogram, a digram _ID_. Should the decryptor suspect the presence
of either of these words, he would look at once for sequences of this
kind in his cryptogram, and the presence of _AE_ (or _ID_) would tell
him that the key-length is probably 8, which is the distance apart of
the two letters in his probable word.

Figure 30

The Cryptogram Prepared for Examination

5 10 15 20 25 30
E N T H V C C O T X R E M U S O E U Y E I S G A U A M A H Y

35 40 45 50 55 60
T A E I D E X T N B H B N S E I R A S T D A N V N X G G E O

65 70 75
I C R L B X C S U T L T E S R

Figure 31

6 1 7 2 3 5 8 4
. . . . . . . .
. . . . . . . A
D V I S A B L E
. . . . . . . I
N C R E A S E D
V O L U M E . .

The ideal case is that in which the probable word is long enough to
furnish more than one of these overlapping letters, as shown in Fig.
32 in connection with the “word” INCREASED VOLUME. Suppose that we
have suspected the presence of this expression in our cryptogram, and
have ascertained that the necessary letters are present for forming
it. We consider its letters one by one, in the order _I_, _N_, _C_,
_R_ . . . . and go through the cryptogram, underscoring (or otherwise
noting) all cases in which the given letter is followed immediately
by another of the letters found in the same probable “word.” But, in
considering any one letter, say the letter _N_, we ignore such
sequences as _NT_, _NB_, _NX_, whose second letters, _T_, _B_, _X_,
do not occur in the expression INCREASED VOLUME. Fig. 33 shows
exactly what digrams of this kind can be found in connection with
letters _I_, _N_, _C_, _R_, _E_, and also the distance (or distances)
apart of the two given letters as found in the probable word. Notice
that in connection with every letter there is one digram in which
this distance is 8, the correct key-length of our present cryptogram.
And when these digrams are selected from the tabulation, and set up
vertically with top letters in the order _I N C R E_, the lower five
letters prove up in the order _D V O L U_. In actual work, the
tabulation must sometimes be made, though ordinarily it will suffice
to start directly with the “proving up.”

Figure 32

I N C R E A S
E D V O L U M
E

I N C R E A S E
D V O L U M E

I N C R E A S E D V
O L U M E

Now let us go ahead and solve the cryptogram, as shown in Fig. 34. We
will assume, to begin with, that our cryptogram has been prepared at
the top of a sheet, and that our various trials are being made on the
blank space beneath it. We will assume also that, having discovered
key-length 8, we have divided this cryptogram roughly into eight
segments, three of which contain ten letters and the rest nine.

First, we are in possession of a series of embryo columns, shown at

(a), and these can be set up without looking at the cryptogram at all.
Having done this, we turn to the cryptogram, find each one of the
sequences again, and lengthen the columns of our beginning block by
adding to each pair of letters a few of the letters which immediately
precede and follow it. Thus, our block begins to build up as at (b);
and, for each time that a partial column is set up in (b), the segment
which contained it is promptly circled out of the cryptogram itself,
which now begins to assume the appearance indicated at (c). Thus some
words have automatically formed on the new lines which tell us
plainly that the final column must contain a sequence _L T E_,
followed by _S_ or _W_, and the appearance of the cryptogram tells us
plainly where to look for it; the final segment is the only one
having enough letters to furnish another nine- or ten-letter column.

Figure 33

Letter Examined & Distance Apart

Sequences Found In Word

I IS 6
ID 8
IR 3
 IC 2
N NS 5
NV 8
C CO 8
CR 1
CS 4
R RE 1 4 11
RA 2
RL 8
E EM 9 (6)*
EU 8 (5)*
EO 6 (3)*
ES 2
(*) Distances from the second E

Proving up: I N C R E . . .
(8) D V O L U

At stage (c), we are practically in possession of the numerical key,

and to show this, the cryptogram segments have been numbered. The
first one, containing _V C C O T X_, has been set up in the partial
block as column 3; thus the third column of (b) should have
key-number _1_. The second segment, containing _S O E U Y E_, has
been set up as column 5, showing that the fifth column of (b) should
have key-number _2_. And so on with the rest, until the eight
key-numbers are standing in the order 4-6-1-7-2-3-5-8. This is shown
at (d), and directly below this, at (e) is the encipherer’s original
key. It can be seen that we are now in very much the same position as
the legitimate decipherer; by making a few trials, each time shifting
one key-number from the left side to the right, we need do little more
than decipher. Usually, however, it is quicker simply to go on and
rough out the block we have already started, and then make the
necessary adjustments, approximately as shown in Fig. 35. Having
noted, in the cryptogram, that there are some unused letters,
_E N T H_, on the left side of segment 1, we assume temporarily that
all other unused letters belong to the segment which follows them,
and add them all, indiscriminately, at the top of the block. Where
this is shown, at the left side of Fig. 35, the true key-numbers, as
found in the cryptogram, have been added above the original reference
numbers, and similarly with the adjusted block on the right.

Figure 34

Investigating the Key-length 8

(a) (b)
1 2 3 4 5 6 7 8
1 2 3 4 5 6 7 8 4 6 1 7 2 3 5 8
A D V I S A B .
I N C R E A S E E A C C O U N .
D V O L U M E ? I N C R E A S E
D V O L U M E .
E N T B Y A I .
(c) X X X X E H R .
(1) (2) (3)
E N T H/V C C O T X/ ¦R E M U/S O E U Y E/¦ I S G/A U A M A H/Y ¦
(4) (5) (6)
 T/A E I D E X/T N¦B H/B N S E I R/A¦S T /D A N V N X/G¦G E O
(7) (8)
/I C R L B X║C S U T L T E S R
x

(d) Apparent key-numbers: 4 6 1 7 2 3 5 8

(e) True key-numbers: 6 1 7 2 3 5 8 4

With the block roughed out, and knowing that a cryptogram of 75

letters using key-length 8 cannot have columns of any other length
than 9 and 10, the first obvious maladjustment is seen in column 1
(key 4), which has only 8 letters. Since this is the 4th segment of
the cryptogram, its remaining letter (or its remaining two letters)
will have to be found at the end of the third segment or at the
beginning of the fifth (keys 3 and 5), that is, at the bottom, or at
the top, respectively, of the columns originally set up as columns 6
and 7. The selection of _H_ from the bottom of column 6 leaves this
column too short, while the top row of the block shows a gap in
sequence, and evidently needs the _E_ at the end of the second
segment. The lone _R_ which remains at the bottom of column 7 is then
erased and written at the top of column 2, and thus we arrive at the
adjustment shown on the right side of the figure, where the only
remaining operation will be that of transferring the misplaced
nine-letter column to its own side of the block. This final
adjustment shows us the segments of the cryptogram in their key
order: 6-1-7-2-3-5-8-4.

Figure 35

Forming and Adjusting a Tentative Block

_4 6 1 7 2 3 5 8 4 6 1 7 2 3 5 8_
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8
E G R T C R E G R E T C
A N G E I N S H A N G E I N S
Y S T E M S B U Y S T E M S B U
T T H O U G H T T T H O U G H T
A D V I S A B L A D V I S A B L
E A C C O U N T E A C C O U N T
I N C R E A S E I N C R E A S E
D V O L U M E S D V O L U M E S
E N T B Y A I R E N T B Y A I R
X X X X E H R X X X X

Column 1 must have another letter, top. (Found at bottom of Column 6).
(4) (3)
Column 6 must then have another letter, top. (Found a bottom of Column 5).
(3) (2)
Column 7, bottom, then shows an extra letter, which must be transferred to
(5)
Column 2, top. When these transfers have been made, as shown on
(6)
the right, all that remains is to transfer the short column (1)
(4)
to the right-hand side of its block, raising it by one position.
Having seen the ideal case, the student will understand how the less
perfect example would be handled, or the case in which the probable
word is not long enough to overlap at all. For the latter, he would
attempt to find some word like CRYPTOGRAM, in which there are letters
such as _C_, _Y_, _P_, _G_, _M_, not likely to appear more than once
or twice in a short text. We need not discuss this latter case, since
we are to see something very much like it before the present chapter
ends.

Now, as a preliminary to those cases in which we are unable to find a

probable word, suppose we turn to the back of the book, and make an
inspection of the tool chest. First in importance, and valuable in
ciphers of all kinds, is the digram chart which O. Phelps Meaker has
been kind enough to prepare especially for this text. To learn how
often he encountered any given digram in his 10,000-letter count,
note its first letter in the horizontal alphabet, at the top of a
column, then note its second letter in the vertical alphabet, at the
beginning of a row, and observe the figure which occupies the cell at
the intersection of this column and row. If the digram is _TH_, its
frequency was 315; if the digram is _JN_, the cell is blank. This
does not mean that the digram _TH_ will appear exactly 315 times in
any other 10,000-letter text, or that _JN_ will never be found
(occurring, say, as initials). It merely shows that the digram _TH_
is of remarkably high frequency, while a digram _JN_ is so rare that
it practically never appears. The most commonly occurring digrams of
this chart have been listed on another page in the order of decreasing
frequencies. A list of the principal reversals is also given, with
other data which will be found useful in the majority of ciphers.
Meaker’s digram chart shows also the frequencies found for single
letters in the same text. These are shown at the extreme right, and
were obtained by adding the figures found on the 26 rows of the chart
proper. When such counts are made, every letter in the text is
considered to be the first letter of a digram, and no attention is
paid to the separations between words. Thus the single-letter
frequencies can be found by totalling either the columns or the rows,
which, except for minor discrepancies, will check against each other.

So much for _frequencies_. Now let us take a closer look at

_sequence_. Certain letters, ordinarily those of lowest frequency,
are peculiar in their _contacts_ with other letters. The shining
example, in most languages, is the letter _Q_, followed, almost 100%
of the time, by _U_ plus another vowel; and if it seems, in the
present text, that the significance of _QU_ is being overlooked, this
is simply because the individuality of this digram, like that of the
German _CH_ (_CK_), is so well advertised that even the novice
encipherer finds a way to avoid using it. It is impossible, however,
to avoid all letters having individual preferences. We still have _J_
and _V_, practically sure to be followed by vowels, and _Z_, almost
as sure. We have _X_, nearly always preceded by a vowel, but more
often followed by a consonant. If these are missing from the
cryptogram, we may have letters like _K_, _B_, and _P_, which confine
an enormous percentage of their contacts to vowels; or to vowels and
liquids; or to letters from the high-frequency group _E T A O N I R S
H_. Even among the high-frequency letters themselves we find that _H_
is followed about 75% of the time by either _E_ or _A_, and that it
is preceded largely by _T_, with _S_, _C_, and _W_ as the next
favorites; or we find that _N_ is inordinately fond of vowels on its
left, though with some preference for consonants on its right. All
information of this kind is present in the digram chart, and usually
is known to the decryptor without recourse to a chart.

For the beginner, however, who might like to have it in a more

visible form, another chart, of a kind which we believe has never
before been published, appears on page 220. This is F. R. Carter’s
contact chart, on which every letter of the alphabet has been listed
in the center of the page, with its favorite contact-letters beside
it. The arrangement here is from the center outward; the letters
shown on the left of any given letter are those which most often
precede it, with percentages as found in Ohaver’s digram chart;
letters shown on the right are those which most often follow, with
percentages from the same digram chart. This information was not
completed to the end for every letter, since the only information
wanted is the actual preferences of each letter, or the fact that it
has none. However, the outermost columns will show the complete
percentages of vowel and consonant contacts for all letters as these
were found in one 10,000-letter text. With such a chart before us, it
becomes very easy, in the absence of _Q_, and other particularly
vulnerable letters, to make good use of whatever letters we happen
to have; and it is hoped that this new “contact chart” will prove
sufficiently valuable to justify Carter’s labor in having compiled
it for us. As to the other data in the appendix, the student will do
well to look it over. The list of trigrams is that of the Parker Hitt
Manual, where _THE_ was shown as having been found 89 times in 10,000
letters, the others graduating downward to _MEN_, found 20 times. Now
let us return to our columnar transposition.

Figure 36

Key-length Columns, 75 Letters

Key 5: (Impossible under system)

Key 6: 3 columns of 13
3 columns of 12

Key 7: 5 columns of 11
2 columns of 10

Key 8: 3 columns of 10
5 columns of 9

Key 9: 3 columns of 9
6 columns of 8

Key 10: (Improbable under system)

Key 11: 9 columns of 7

2 columns of 6
(Etc.)

When a digram _QU_ is actually present in a text, or when it is

fairly certain that some other digram may be present, such as the
_YP_ of CRYPTOGRAM (that is, one composed of two infrequent letters),
it is possible to discover (or limit) the key-length by observing the
distance apart of these two letters in the cryptogram. To approximate
such a case, using the foregoing cryptogram (Fig. 30), we will make
use of the digram _VI_, and, in order to be brief, we will assume
that the letter _V_, position 5, is the only one in the cryptogram,
and that the only _I_’s present are those at positions 46 and 61. In
one case the interval which separates _V_ from _I_ is 41, and, in the
other, 56. As a preliminary step, we may discard all key-lengths
which are factors of 75: 3, 5, 15, 25. In addition, we may discard,
for the time being, the key-lengths 10, 20, etc., which are multiples
of 5. Of those left, any very short length, as 2 or 4, is very
improbable. We may consider, then, possible key-lengths of 6, 7, 8,
9, 11, etc., as far as we care to take them.

To make ready for the investigation, we first prepare a sheet of the

kind shown as Fig. 36, where each possible key-length has been used
as a divisor in order to learn the column-lengths for each one in a
75-letter cryptogram.

Figure 37

Q U I T E A F *
E W F A N S W
I L L B E D E
L I G H T E D **
T O S E E

*) From F in a short column

to E in a long column is an
interval of 5; but from E
to F is an interval of 4.
**) From T to E is an
interval of 5; from E to T
is an interval of 4.

Now let us picture any text written into any block, as in Fig. 37,
where long columns have five letters and short columns have four.
Considering any digram in the text, as _QU_ at the beginning, its two
letters are separated by exactly one column of length, provided the
letters are counted straight down the columns and columns are taken
in one straight direction, or provided the counting is done strictly
upward with columns always taken in one direction. In the case of
_QU_, this column of separation is a long one (five letters), while,
in the case of _AF_, on the right-hand side of the block, it is a
short one (four letters), but in both cases it is a full column. This
is true, also, of the digram _FE_, which is on two different lines,
presuming that, having counted all the way to the end of the last
column, we start again with the first. If both letters are in short
columns, the interval which separates them is that of a short column,
and if both are in long columns, this interval is that of a long
column. But if one letter is in a long column and the other in a short
column, the separating interval may be long or short, according to
whether the columns are taken in straight order or in reverse order.

If the columns of Fig. 37 should be cut apart, and placed in some

other order, then other columns might be placed between the one
containing _Q_ and its neighbor containing _U_, but these would be
_full columns_, never fractional columns, so that the interval from
_Q_ to _U_ would always be an exact number of full columns.
This is what happens in columnar transposition. If the digram _VI_,
which we intend to consider, was actually present in the original
encipherment block, then, in the cryptogram, its letters _V_ and _I_
are separated by an exact number of columns, long or short or mixed.
Also, if the column containing _V_ was taken off first, the distance
from _V_ to _I_ may include the full number of long columns permitted
by the key-length, but must fall one short of including all of the
short columns; but if the _I_ comes first, the opposite is true. Now,
assuming that the only _V_’s and _I_’s in our cryptogram are those
appearing at positions 5, 46, and 61, we find that if the first of
the _I_’s is considered, the distance from _V_ to _I_ is 41, while,
if the other is the one considered, then this distance is 56. We will
investigate, first, the interval 41.

If _V_ and the first _I_ stood in sequence in the encipherment block,
either as _VI_ or as _IV_, then the interval 41 represents a certain
number of complete columns, and if the digram was _VI_ (since the
_V_-column was evidently taken off first), this interval 41 must not
include the full number of short columns, but may include the full
number of long ones.

Consulting Fig. 36, we find that key-length 6 calls for columns

having 12 and 13 letters, and it is impossible to divide an interval
41 into columns of such lengths. The key-length 7 calls for columns
having 10 or 11 letters, of which only two columns may have the
shorter length; an interval 41 can be divided into the right lengths,
but only if three of the columns are short. Thus, if the first _I_ is
the correct one, the key-lengths 6 and 7 are totally impossible, as
is also key-length 8. The key-length 9, however, calls for columns
having 8 and 9 letters, of which six have the shorter length. An
interval 41 can be divided to produce four short columns and one long
column. Again, the key-length 11 calls for columns having 6 and 7
letters, of which two columns may be short; and an interval 41 will
provide five long columns and one short column. These two key-lengths,
then, 9 and 11, are possible, presuming that the first _I_ is the one
which actually followed _V_. When the other _I_, interval 56, is
investigated in the same way, it is found that the only key-lengths
possible are 8 and 11.

So that if the digram _VI_ is present at all, the key-length must be

8, 9, 11, or something longer. Since the key-length 11 is possible in
both cases, this is the one which tempts; when it fails, the remaining
two can be tried. The student may decide for himself whether a trigram
_IVI_ is possible, considering the distance apart of the two _I_’s. It
will be readily understood how this method, in combination with the
one first explained, could be used, say, in a cryptogram where the
suspected word is CIPHER, with the low-frequency letter _P_ occurring
only once.

* * *

Totally aside from analysis, there are many ways in which the
key-length can become known, or suspected. If the correspondence is a
military one, it may have been learned by espionage, perhaps through
careless talk on the part of an enlisted man; or, because of careless
habits on the part of the authority providing the keys, in having
confined himself always to certain lengths. Knowing the key-length is
two-thirds of the battle. It enables us, as in our former case, to
mark off the cryptogram into its approximate column-lengths, making
it easier to know the approximate whereabouts of any several letters
supposed to form a sequence. It even enables us to prepare a block,
which, cut apart to form paper strips, will effect a mechanical
solution almost as easily as in the case of the completed unit.

Such a block, for our foregoing cryptogram (Fig. 30), can be studied
in Fig. 38, and is explained as follows: An 8-unit key, used on a
75-letter text, calls definitely for three 10-letter columns and five
9-letter columns, and these columns have become eight segments in the
cryptogram. If all three of the long columns were taken off first,
then the arrangement shown at (a) has every letter in its proper
column. And if all three of these were taken off last, then the
arrangement shown at (b) has every letter in its proper column. With
blocks shown for the two extreme cases, it can be seen that the block
at (c) is a combination-block, in which one of the two extremes has
been superimposed upon the other, so that every column in block (c)
shows every letter which it could possibly have contained. By
concealing the letters of the “cap,” we have a duplicate of block
(a); and by changing the alignment, so as to bring all of the topmost
letters into the same row, we have block (b), with a “cap” attached
at the bottom.

Figure 38

Preparation of Strips for a Known Key-length

(a) Long Columns at Left (b) Long Columns at Right

E R I T B S G C E X Y A X I X X
N E S A H T E S N R E H T R G C
T M G E B D O U T E I Y N A G S
H U A I N A I T H M S T B S E U
V S U D S N C L V U G A H T O T
C O A E E V R T C S A E B D I L
C E M X I N L E C O U I N A C T
O U A T R X B S O E A D S N R E
T Y H N A G X R T U M E E V L S
X E Y N B R

(c) Combination Block (d) Matching Strips

1 2 3 4 5 6 7 8 . . | 8 | .
a x i 3 . . .
y h t r x . 5 . 4
x e y n a g x y x x a
E R I T B S G C e t C h ←
N E S A H T E S I n S y
T M G E B D O U S B U T
H U A I N A I T G H T A
V S U D S N C L ** A B L E **
C O A E E V R T U N T I
C E M |X I| N L E A S E D
O U |A T R X| B S M E S E
T |Y H N A G X| R A I R X
|X E Y H R T ←
Y A N
Comparing block (c) with the two above it: If the first column of (a)
was actually a short one, then its last letter, _X_, belongs at the
top of the second column. The making of this transfer would cause the
second column to have eleven letters, so that it would become
necessary also to transfer the last letter of the second column to
the top of the third; this third column would then have too many
letters, and its last letter would have to be transferred to the top
of the fourth, which at present has only nine and may have another.
But if the second column was also short, then there are two of its
letters which belong at the top of column 3. And if this column, too,
was a short one, it has three transferable letters at the bottom.

To prepare such a block, first write the cryptogram as at (a), and

mark off its transferable (uncertain) letters by the following rule:
One for the first column, two for the second, and so on, until the
number is _equal to the number of long columns_, which is the maximum
number possible. But if the final row is more than half filled, _the
maximum will not be reached_, and a check may be made by marking off
letters from right to left: zero for the last column, one for the
next-to-last, two for the third-to-last, and so backward to the number
which equals the number of long columns. Having marked off the
transferable letters, form the “bonnet” by copying these, in each
case, at the top of the following column, preferably making some
clear distinction to show the duplication. For this latter purpose,
many solvers use red ink. In this kind of work, as we saw in a
previous case, the spacing must be accurate both laterally and
vertically, since many of the letters belonging to the same sequence
are not found on the same row. A few of the strips cut from block (c)
have been matched at (d), where the beginning was made from the
common suffix -_ABLE_. The duplicated letters _A H Y_ have shown up
plainly, partly by the style in which the letters are written, and
partly, too, by the fact of consecutive column-numbers, 3 and 4. This
same thing is true of the letters _X T N_, column-numbers 4 and 5.
These numbers, it must not be forgotten, are also the serial numbers
of the cryptogram segments, and thus are the key-numbers. With the
eight strips correctly matched, and any misplaced columns transferred
to their own side of the block, the strip-numbers as they stand
across the top will reproduce the numerical key.

The matching of strips is generally a purely mechanical process, in

which impossibilities are not considered. However, having before us a
block (a) or (b), it is possible to apply the principle used with our
former digram _VI_, and find out in advance whether certain letters
found on two strips can possibly have stood in sequence. Nor is the
cutting apart of the strips really necessary; it is merely a
convenient method for dispensing with mental effort.

Now suppose we consider this same cryptogram on the theory that its
key-length cannot be determined, or restricted to certain
possibilities. Our first step is to select, somewhere in the
cryptogram, a segment which is to be set up vertically on a sheet of
paper to act as a _trial column_. If we select it from the body of
the cryptogram, we shall have to make it a rather long segment, since
we are uncertain as to whether it represents one column or parts of
two. We should do this, however, if the body of the cryptogram shows
_Q_, or any other letter or series of letters likely to be vulnerable.
Otherwise, we know definitely that one of the columns begins with the
first letter of the cryptogram, and that another column ends with the
final letter of the cryptogram, and one or the other of these two
segments is usually chosen, preferably the one containing the largest
number of vulnerable letters. If we have a probable word, and find
that its letter _P_, or _M_, or _G_, is the only one in the
cryptogram, we select the segment which contains this _P_, or _M_,
or _G_.

Figure 39

Tests, in Attempting to
Judge Column-Length

E G 20 ( 15)
N G 75 ( 83)
T E 94 ( 74)
H O 46 ( 42)
V I 19 ( 14)
C C 12 ( 6)
C R 7 ( 12)
O L 17 ( 36)
T B 14 ( 8)
X X - ( -)
R C 14 ( 7)
E S 145 (115)
M U 13 ( 7)
U T 45 ( 35)
S L 6 ( 9)

(First column of figures

is taken from Meaker's
chart; the second is from
Ohaver's).

Wherever the trial segment is taken, there is always the question

as to how many letters ought to be included. In Fig. 39, the decryptor
has decided to take the beginning segment of the cryptogram, and has
started with 15 letters. He has written beside it another 15-letter
segment, chosen because of _NG_, _HO_, _VI_, and is attempting to
tell, by the appearance of his digrams, and their frequencies as
taken from two different digram charts, just about how far his digrams
are uniformly good. If the nulls in use are actually _XX_, he knows
immediately that this is the end of his two columns; otherwise, his
digrams are acceptable throughout. If he sets down beside each digram
its frequency as taken from Meaker’s chart, he might decide that his
digrams are good as far as _UT_, depending somewhat on the letters
represented in our _XX_. Using Ohaver’s frequencies, he would feel
sure that his digrams are good as far as _OL_. In many cases the
frequencies shown for the lower digrams will grow so erratic as to be
plainly unlikely; and in other cases, more difficult than the present
one, a check on the probable column-length can be had by preparing a
similar set-up for the end-segment of the cryptogram, in which the
lower digrams are excellent, while those extending upward may grow
erratic. This decryptor is safe, however, in accepting as much or as
little of the length as he likes; there will be a more definite line
of demarcation when he attempts to write beside these a third column
of 15 letters. The only cases which ever give trouble are those in
which a short text has been enciphered with a long key. Key-lengths,
generally speaking, hardly ever run outside of limits 5 to 15, that
is, lengths which come from single words. Thus a tentative key-length
10, 11, 12, lying half-way between these extremes, is always safe to
try. The key-length 10, applied to 75 letters, gives columns of 7 or
8, and, in the discussion which follows, the tentative column-length
was fixed at 8 letters.

Figure 40

(The numbers assigned to these set-ups merely indicate the order in which the
second segments were taken).

1 8 9 10 11 2 3

E U 7 E Y 17 E B 11 E X 17 E G 20 E S E O*
N S 51 N T 110 N N 9 N G 75 N G 75 N O N E
T O 111 T A 56 T S 32 T G 1 T E 94 T E T U
*H E 251 *H E 251 *H E 251 *H E 251 *H O 46 H U H Y*
V U - V I 19 V I 19 V O 6 V I 19 V Y* V E
C Y - C D - C R 7 C I 15 C C 12 C E C I
C E 55 C E 55 C A 44 C C 12 C R 7 C I C S*
O I 13 O X - O S 37 O R 113 O L 17 O S O G
488 508 410 490 290
4 5
(1) (8) (9) (10) (11)
488 508 410 490 290 E E E I
H E 251 H E 251 H E 251 H E 251 H O 46 N U N S
237 257 159 239 244 T Y T G*
H E H A
Ranked in the order: 8, 11, 10, 1, 9 V I V U*
......... C S* C A
C G* C M*
O A O A
Same Test, Using Mr. Ohaver's Digram Frequencies:
6 7
1 8 9 10 11
E S E H*
E U 6 E Y 24 E B 24 E X 14 E G 15 N G N Y
N S 47 N T 97 N N 8 N G 83 N G 83 T A T T
T O 92 T A 64 T S 27 T G - T E 74 H U H A
*H E 305 *H E 305 *H E 305 *H E 305 *H O 42 V A V E
V U - V I 14 V I 14 V O 9 V I 14 C M* C I
C Y 1 C D - C R 12 C I 19 C C 6 C A C D*
C E 46 C E 46 C A 36 C C 6 C R 12 O H* O E*
O I 15 O X 1 O S 35 O R 99 O L 36
512 551 461 535 282
(Set-up No. 2
(1) (8) (9) (10) (11) would have
512 551 461 535 282 been tested.)
H E 305 H E 305 H E 305 H E 305 H O 42
207 246 156 230 240

Ranked in the order: 8, 11, 10, 1, 9 (as before).

Usually these trials are made by setting up the trial column (in
pencil) several times in succession, so that several of the possible
combinations can be seen side by side, in order to determine which is
best. Sometimes this can be decided by simple observation. Otherwise,
the combinations can be subjected to a digram test. This is made by
setting down beside each digram, as formed by each pair of columns,
its frequency as taken from a digram chart. These figures are then
added in each of the set-ups, and the supposition is that the
combination furnishing the highest frequency-total will be the
correct one, provided this high total has been produced by all of its
digrams collectively, and not by some one or two individual digrams.
With short columns, such tests are never conclusive, but with as many
as ten or twelve digrams they are nearly always dependable, and even
with only five or six digrams they will often select a correct
combination.

Figure 41

1 2 3 4

Y E 12 D E 39 R E 148 E E 39
E N 101 E N 120 A N 172 O N 145
I T 88 X T 1 S T 121 I T 88
S H 30 T H 315 T H 315 C H 46
G V - N V 4 D V 4 R V 5
A C 39 B C - A C 39 L C 8
U C 17 H C 2 N C 31 B C -
A O 2 B O 11 V O 6 X O 1
308 492 836 332

.....

Same Test, Using Mr. Ohaver's Digram-frequencies:

1 2 3 4

Y E 8 D E 64 R E 139 E E 57
E N 120 E N 101 A N 168 O N 162
I T 90 X T 4 S T 119 I T 90
S H 40 T H 377 T H 377 C H 53
G V 1 N V 1 D V 1 R V 6
A C 35 B C - A C 35 L C 1
U C 11 H C - N C 34 B C -
A O 2 B O 13 V O 9 X O 1
288 560 882 370

It was decided here to choose as the trial column the first eight
letters of the cryptogram: _E N T H V C C O_. This column is filled
with consonants, indicating that those which follow or precede it
might contain a number of vowels; and of the six consonants present,
practically every one could be called a “vulnerable” letter, or, as
we say in the Association, a “clue-letter.” If we wish, for instance,
to choose a column which will fit well on the right-hand side of this
trial column, we can search the rest of the cryptogram for two
consecutive vowels to follow, respectively, _H_ and _V_, and these
two vowels we should expect to find followed, either immediately or
at interval 2 by some letter (usually a high-frequency one) which
will follow at least one of the _C_’s. This kind of pattern,
unfortunately, was found eleven times. In practice, we should
probably abandon it rather than copy down and test eleven
combinations; here, however, the eleven set-ups can all be seen in
Fig. 40, accompanied by serial numbers to show the order in which
their second columns were taken from the cryptogram. Some of these
have not been tested. Of the five retained, particular attention is
called to the fact that the one having the very lowest total is
actually the correct one, as may be seen by turning back to the
encipherment block. But when a single row of corresponding digrams
(_HE_ in the first four set-ups and _HO_ in No. 11), has been
subtracted throughout, it is seen that No. 11 moves upward toward its
proper rank, having now the second highest total. In practice, it
might even be selected in preference to No. 8, which grows erratic
after its fifth digram (frequencies of 0, 55, 0). But the
column-length 5, in practice, is not unlikely, so that a test made
on the right-hand side of our trial column has not been at all
conclusive.

Figure 42

Trigram Observation

1 2 3(*) 4 5

REU REY ¦ REB REX REG

ANS ANT ¦ ANN ANG ANG
STO STA ¦ STS STG STE
THE THE THE THE THO
DVO DVI DVI DVO DVI
ACY ACD* ACR ¦ ACI ACC
NCE NCE NCA ¦ NCC* NCR
VOI VOX* VOS ¦ VOR VOL

(*) Acceptance of combination 3 would

entail shortening columns.

Postponing the decision, then, let us take a fresh sheet of paper and
make some tests for columns which can be fitted on the left-hand side
of our trial column. Here, we find that the best “clue-letters” are
_N_ and _H_, standing at interval 2. To precede _N_, we should like
to find one of the vowels of which it is so fond, and to precede _H_,
we hope to find either _T_ or one of the letters _S_, _C_, _W_. That
is, we hope to find a pattern in the rest of the cryptogram in which
some vowel, other than _Y_, is followed at interval 2 by one of the
letters _T_, _S_, _C_, _W_. This time we find only four segments, and
when the test is made for these, as shown in Fig. 41, the resulting
totals point decisively to the correct combination, which is No. 3.
Notice, in both of these tests, that results are identical whether
the frequency-figures are those counted by Meaker or those counted by
Ohaver: In the test of Fig. 40, the five combinations (using either
chart) are ranked in the order 8, 11, 10, 1, 9, while the test of
Fig. 41 has ranked its four combinations in the order 3, 2, 4, 1.
Selecting, then, combination No. 3 of Fig. 41, let us return to the
doubtful tests of Fig. 40 and attempt to effect a combination between
our No. 3 and some one of the five previously considered worth
retaining. Thus we can make an observation of trigrams, as shown in
Fig. 42.
 Figure 43

/E N T H V C C O/T X R E M U X O E U Y E I S G A U A M A H Y

T A E I D E X T N B H B N S E I/R A S T D A N V/N X/G G E O

I C R L/B X C S U T L T E S R

Here, we must be guided by our judgment, since trigram tests, even

with figures available, would never be feasible on columns of this
length. The acceptance of No. 3, evidently, would mean the cutting of
our column-length to 5 letters, which, as we have said, is not at all
unlikely in an actual case. The two highest tests from Fig. 40,
however, are those included in Nos. 2 and 5. With reference to No. 2,
where the right-hand digrams have the higher total, it is not
impossible that the trigrams _ACD_ and _VOX_ were actually in use, or
that the set-up should be cut, above the trigram _ACD_; but No. 5 is
the one which _carries word-suggestions all the way to the end_.

Figure 44

(a) (b) (c) (d)

A R E G A R E G R A R E G R E X A R E G R E T
H A N G H A N G E H A N G E I C H A N G E I N
Y S T E Y S T E M Y S T E M S S Y S T E M S B
T T H O T T H O U T T H O U G U T T H O U G H
A D V I A D V I S A D V I S A T A D V I S A B
E A C C E A C C O E A C C O U L E A C C O U N
I N C R I N C R E I N C R E A T I N C R E A S
D V O L D V O L U D V O L U M E D V O L U M E
...S
...R
(e)

/E N T H V C C O/T X /R E M U S O E U/Y/E I S G A U A M/A H Y

T A E I D/ E X/T N B H B N S E/ I/R A S T D A N V/N X/G G E O

I C R L/B X C S U T L T E S R

(f) (g) (h)

X A R E G R E T X * R E G R E T * * R E G R E T C H
C H A N G E I N C H A N G E I N C H A N G E I N S Y
S Y S T E M S B S Y S T E M S B S Y S T E M S B U T
U T T H O U G H U T T H O U G H U T T H O U G H T A
T A D V I S A B T A D V I S A B T A D V I S A B L E
L E A C C O U N L E A C C O U N L E A C C O U N T I
T I N C R E A S T I N C R E A S T I N C R E A S E D
E D V O L U M E E D V O L U M E E D V O L U M E S E
S E N T B Y * I S E N T B Y A I S E N T B Y A I R X
R X X X R X X X * R X X X X
6 1 7 2 3 5 8 4
.....(Key).......

With the adding of other columns, which can be done on either side of
the set-up, further digram tests can be made (taken only on the two
extreme right-hand or left-hand columns), but in most cases no further
tests are needed. Considering, for instance, that No. 5 is the
combination tentatively accepted, we need a segment from the
cryptogram containing the _U_ which ought (apparently) to follow
_THO_, then the _S_ or _C_ which ought (apparently) to follow _DVI_;
that is, we want to find a sequence _US_ or _UC_ in the rest of the
cryptogram; and this (apparently) should be followed by two vowels in
succession, to fit after the sequences _ACC_ and _NCR_. In other
words, we know exactly what kinds of letters ought to make up the
column which can be added on the right side of combination 5, and even
the specific letters. Or, if it is the left side on which we have
chosen to fit the new column, we need a segment containing the _A_ of
the apparent _ADVI_, followed at interval 2 by the vowel, probably
_I_, which ought to precede a trigram _NCR_.

In Fig. 43, the three segments of set-up No. 5 have been circled out
of the cryptogram (to prevent further use of their letters), and the
segment chosen to fit on the left side of set-up No. 5 has been
underscored, ready to be circled out in case it is found to fit. It
is now possible to see the suggested nine-letter words, ADVISABLE and
INCREASED, the guessing of which would permit us to apply the easy
method first described.

With or without these guesses, the rest of the solution, as outlined

in Fig. 44, is now plain sailing. At (a), the underscored segment of
Fig. 43 is in place. At (b), the column containing the desired _US_
and following vowels has been set up on the right, where we seem to
need the _E_ or _A_ of ADVISE or ADVISABLE, followed immediately by
the _U_ or _R_ of ACCOUNT or ACCORD. At (c), we have found the
segment, and at (d) (usually earlier), we are introduced to the
actual lengths of our columns.

Figure 45

The OHAVER CV-VC Test:

RATEB OWSTT EETOP UUIMC YUAOG

AIOIA OBSTB BAKAR YYEDT UWYNT
NNFKG FJSOT WYQAR IROIH.

TT TO cv TM TE cv
WO cv WP WC WD
YP vc YU YY YT vc
(QU) (QU) (QU) (QU)
AU AI AA AW vc
RI cv RM RO cv RY cv
IM vc IC vc IG vc IN vc
4 2 2 5

The following is the original cryptogram

used by Mr. Ohaver for demonstration:

TVYIE TRROR EHNIA EUDSR IEONI

ORENA EEORP TEALO LTSUH LHQNO
UCADD CSAAE TDVFU GNNYC YI.

(Reprinted from Detective Fiction Weekly

 of October 8, 1927, with permission of
The Frank A. Munsey Company).

This latter can be seen by looking at the cryptogram (e), where all
segments, as soon as selected, have been circled out. In finding a
column which would complete the very evident word SYSTEM and, at the
same time, furnish a letter suitable to precede _HA_, we find that
this is the end-segment of the cryptogram, and would leave only two
letters — far fewer than the number needed for furnishing another
column.

At (f), we have extended the rest of the columns by two (and one)
letters, except that there is a gap in sequence on the next-to-last
line. At (g), we have transferred the letter which will fill this gap,
leaving a misplaced _X_ at the top; and, at (h), we have placed this
_X_ where it belongs and are now ready to transfer the two misplaced
columns and recover the key. This key, as before, is found by
numbering the segments of the cryptogram, and assigning these
key-numbers to the correct columns in the adjusted block. It is
usually possible to go further, and learn the long words on which
such keys might have been based.

Concerning digram-tests, Ohaver suggests another which is more

quickly made than the frequency test, and which the writer, so far,
has found fully as reliable. Using “C” for “consonant” and “V” for
“vowel,” he speaks of this as his VC-CV or “mixed” test. A digram
like _HA_ is a _cv_ digram, one like _AT_ is a _vc_ digram, and
others are _vv_ and _cc_ digrams. His theory is this: Since almost
two-thirds of the digrams used in the language will be of _mixed_
formation, that is, either _vc_ or _cv_ digrams, it stands to reason
that the set-up containing the largest number of “mixed” digrams
would probably be the correct choice. The student may look it over in
Fig. 45.

* * *

Figure 46

The Myszkowsky Cipher

(a) Keyword: CURTAINS

C U R T A I N S C U R T A I N S C U R T A
4 19 11 16 1 7 9 14 5 20 12 17 2 8 10 15 6 21 13 18 3
R E G R E T C H A N G E I N S Y S T E M S

Cryptogram: E I S R A S T N C S G G E H Y R E M E N T.

(b) Keyword: PARADISE

P A R A D I S E P A R A D I S E P A R A D
14 1 17 2 7 12 20 10 15 3 18 4 8 13 21 11 16 5 19 6 9
R E G R E T C H A N G E I N S Y S T E M S

Cryptogram: E R N E T M E I S H Y T N R A S G G E C S.
As to possible variations, a cipher with a new name is not necessarily
a different cipher. Fig. 46 shows a cipher originated many years ago
by the cryptologist E. Myszkowsky, and advertised by its inventor as
non-decryptable. The key-word here is repeated often enough to furnish
one key-letter for each text-letter, nulls being added, when
necessary, to prevent the complete unit which would result if key-word
and text were allowed to end at the same point. This long series of
key-letters is then treated as a single word, and is converted to a
numerical key in the usual way, all _A_’s receiving the first numbers,
all _B_’s the next numbers, and so on. The message of the figure is
very short: REGRET CHANGE IN SYSTEMS. Try enciphering this in the
ordinary columnar transposition, using first the key-word CURTAIN,
which contains no repeated letters, and afterward the key-word
PARADISE, which has a repeated letter _A_. In the second case, what
happens to the two columns belonging to the _A_-numbers? Suspecting
a Myszkowsky encipherment, how could you go about unscrambling the
two? Suppose there were three?

Fig. 47 plays another variation on the columnar theme. This cipher,

originated by a member of the _American Cryptogram Association_,
follows the rules of columnar transposition in all respects except
that pairs alternate throughout with single letters (The text is:
CHIEF WANTS YOU TO INTERVIEW SMITH). Can you pick out at a glance the
really vulnerable feature of this cipher, and formulate a special
method for its solution?

Figure 47

The "AMSCO" Cipher (A.M.Scott)

R A C K E T
5 1 2 4 3 6

CH I EF W AN T
S YO U TO I NT
ER V IE W SM I
T HX

Order for taking off:

I YO V HX / EF U IE /...

Cryptogram: I Y O V H X E F U I.....

29. By NEMO. (A military message).

A O T O I N E H T C T O T L I I A W G E L P R V L R I I R I U A D E O
W L R R R L C M E O N P E P T A V T S O H O E E N L S N P S S B Y T S
L R O P D R G E T S S T S Y A W N E.

30. By PICCOLA. (Hostilities?)

T A M L R I T E D W E E D H H N P W O S W R S H C N O I E D O H I L T
C S T N I W A A R C D H H D A I E T P T R L R O W A S E E T A K F P W
G M A T X E K A H D P I L E O F H W G I N H A K S F S S A A A H E H N
D H H E H.
31. By AMSCO. (The "AMSCO" Cipher).

N W L E L N T L C S L W D L Y L N S O O I D F I N R U C H A L N D C B
S I D E A I T E T I K S T B E E O U T J A T I L I A C O R E A Y E E G A
O.

32. By PICCOLA. (Can you recover this nice long keyword from the numbers?)

Y K I E T N T H H E X I A E N U B A K E E W S C S I H T N L N E N E A
K I E O B O L I E E A M C I F T I N A H S K A N I D L G S O E E I T T
S W H L L E U A D H F S H A B E O E N O A N O S C P H S N O D H T X R
N H R E A.

33. By PICCOLA. (An easy Myszkowski. Probable words: SOLVE, CIPHER, COLUMN).

V I N S R C F E A E O O H S E F H L E T F H U N S T N C L T S L C I A
E E S H R H S I R E T T M T S E T E P D T S O I N M R T T H T L O L R U B
E.

34. By PICCOLA. (Nothing like a bit of "philosophy" - oyeah?)

E L O S W E A H X P N N T R N H L W I E G E I G E A E Q A G L E A R R
Q L O N K E S Q L O R N X A R S P X S E E A E I P A G L R E P R Y M T
H N K S E I X X A Y.

35. By PICCOLA. (Not so easy; still, it's just another columnar).

H R O T E T E T E H I W E O T T D A O D K G DT C E R A I W O S Y N H
Y R H T W.

CHAPTER VII
General Methods — Multiple Anagramming, Etc.

In the past few chapters, we have been looking at all of the general
methods for decryptment of transpositions. We have seen the use of
_factoring_, which determines, for the geometric cipher, what
key-lengths are possible, and, for the irregular one, what
key-lengths are not. _Vowel-distribution_ has enabled us, in some
cases, to determine the length of major units, or has assisted in the
restoration of minor units to their original intact groups.
_Anagramming_ has been seen throughout: the matching of letters and
columns with or without the application of language statistics.

So far, we have been materially assisted by advance knowledge as to

what the cipher is. Where the type is unknown, and cannot be promptly
identified, and assuming, of course, that the decryptor has no
probable words, transpositions, taken as a whole, present confusing
problems in the very multiplicity of their possibilities. General
Givierge, in his _Cours de cryptographie_, remarks of this case that
novices, as a rule, display a tendency to recoil from the cryptogram
as if uncertain “which end to pick it up by.” He adds that the best
advice he can give is to pick it up _somewhere_ and do _something_,
rather than be satisfied to sit all day long and admire the
cryptogram!

As to how a type may sometimes be identified, the difference between

the regular and irregular types is ordinarily suggested by the number
of letters contained in the cryptograms. Irregular types, intended
for practical purposes, are nearly always seen in complete
five-letter groups, where the geometric cipher usually results in a
broken group at the end of its cryptogram. This, of course, is never
mandatory upon the encipherer; it merely happens because the only
persons making use of such ciphers are those who do not realize the
advisability of doing otherwise.

Among the irregular types, a columnar formation can usually be

spotted by the “bunching” of vowels at intervals throughout the
cryptogram. Then, too, we are still to see those cases in which the
exact type of the cipher may not become apparent until after solution
is well started.

It is usually well, when a new system is encountered, to analyze it

and find out what the transposition finally does to the letters. This
can be done by preparing actual cryptograms in which the plaintext
letters are serially numbered; or, if the question of
vowel-distribution is not involved, by using the serial numbers
without the letters, as suggested in a previous chapter. Many
ciphers, of course, will not require even this amount of analysis,
even though their type, accurately speaking, is irregular. For
example, the one shown as Fig. 48, whether or not its rectangle is to
be completed, is merely another _route_, so that once having seen it,
we might try to follow this route again. But the student who cares to
give this cipher his careful consideration must notice that its
longer cryptograms would be full of reversed plaintext segments; that
these would grow longer and longer with a constant rate of increase,
and would always alternate with incoherent segments which, in their
turn, would grow shorter and shorter; also that these incoherent
segments, if set up as columns, would show plaintext.

The complete-unit cipher, generally speaking, can hardly present any

real complexities. Consider, for instance, the following variation on
a Nihilist encipherment, which was proposed by Geo. C. Lamb, the
author of Chapter X: The key-length, to begin with, must be divisible
by 3, but this is not used for writing-in. The plaintext is written
into its block, not in straight order, but following a _route_ which
begins in the upper left corner and goes forward for the first three
letters, drops down to the second line and runs backward for the next
three letters, drops to the third line to run forward for another
three, and so on back and forth until the first three columns have
been filled with trigrams written alternately forward and backward.
It then moves over to the second three columns, beginning this time
at the bottom and “snaking” upward to the top. For the third three
columns it moves downward again, and so on until the square block has
been filled. After this very devious primary transposition, the unit
is taken off by means of the key, on the Nihilist principle of
transposing both columns and rows with the same key.

Figure 48

Cipher Requiring Little Analysis

1 2 3 4 5...

T│ H│ W│ S│ E│
 ──┘ │ │ │ │
S I│ O│ E│ .│
─────┘ │ │ │
D L U│ E│ .│
────────┘ │ │
B O T M│ .│
───────────┘ │
← . . .│
──────────────┘

Plaintext: THIS WOULD SEEM TO BE...

Cryptogram: T H W S E S I O E....

We believe that the resulting cryptogram could prove puzzling to any

cryptanalyst who has met the cipher for the first time. It is true
that he has, in the original square, a large number of intact minor
units, provided he can restore them. But these units are very tiny,
and the several of them which stand on any one row are not continuous
among themselves; thus his vowel-distribution, while approximately
normal, would probably not satisfy his expectations. If, however,
having failed to find a more satisfactory block arrangement, he
attempts to match columns (it being remembered that he is accustomed
to reading in all sorts of directions in order to discover plaintext
fragments), he will most certainly discover the trigrams and trace
their route. Afterward, however, having met and analyzed the cipher,
it would probably occur to him to look for exactly this complexity
whenever he discovers that he is dealing with a square whose
key-length is divisible by 3. We have mentioned before the assistance
which may be had from the mere knowledge that a certain method exists.

Complete-unit ciphers, of course, may be troublesome, but their

complexities are necessarily confined to one small area. An irregular
cipher, on the other hand, usually involves the entire text, and its
complexities may be real. In this class we occasionally find ciphers
in which a single cryptogram is impossible to break; and we find
others in which the eventual solution of one cryptogram will not
instantaneously provide the key to another enciphered exactly like
it. Such ciphers are well worth analyzing, for surely, somewhere,
they have their weaknesses; and most certainly any two cryptograms
enciphered exactly alike should be decipherable with the same key.

The cipher shown in Fig. 49 is of the double-columnar type known in

this country as the “United States Army” double transposition, and
has, in fact, been authorized for use, under suitable conditions, in
the military service of more than one country. As may be seen from
the figure, this cipher is, in all respects, the columnar
transposition of the preceding chapter accomplished twice in
succession on the same text (decipherment being, as usual, the
reversal of the encipherment process). The same rules apply here, as
in the single columnar transposition, to the use of nulls, and to the
advisability of avoiding the key-length which is a multiple of 5. It
goes without saying that the block should never, under any
circumstances, be allowed to work out as a square; this, in substance,
would be the block unit of the Nihilist cipher. While the figure
shows a primary cryptogram, taken off from the upper block, this, in
practice, is never actually done. The columns of the upper block are
always transferred direct to the rows of the lower one, and only the
columns of the lower block are taken off as an actual cryptogram. In
preparing this cryptogram, both blocks should be laid out at the same
time; otherwise, there is danger that the operator may apply the first
transposition and forget the second, thus sending out a simple
columnar transposition which carries the key to all of his other
cryptograms. This cipher, as may be seen, has its points. Yet it will
have been noticed that its use for military purposes was not
authorized without restrictions.

Figure 49

The "United States Army" Double Transposition

1st Encipherment

P A R A D I S E
6 1 7 2 3 5 8 4

R E G R E T C H Primary Cryptogram
A N G E I N S Y
S T E M S X X X (Not usually
X taken off)

2d Encipherment ENT, REM, EIS, HYX,

TNX, RASX, GGE, CSX.
P A R A D I S E
6 1 7 2 3 5 8 4

E N T R E M E I
S H Y X T N X R
A S X G G E C S Final Cryptogram:
X

N H S R X, G E T G I, R S M N E, E S A X T, Y X E X C.

The special hazards of military correspondence have already been

mentioned: the huge volume of interceptable cryptograms; the
ever-present knowledge as to probable subject-matter and
more-than-probable words, including numbers and dates; the personal
habits of individual operators; above all, the fact that much of the
enciphering is necessarily done by operators who are not, in the
first place, trained for their work, and who, very often, must
perform this work rapidly under conditions which are far from
conducive to clear thinking. These, however, are chiefly the hazards
of the firing line. Back of the lines, where hazards are reduced,
there may be a chance that a cryptogram will not be intercepted at
all. It becomes possible, for many purposes, to make use of a cipher
in which a single cryptogram, though probably read in the end, will
resist the decryptor for the necessary length of time, several hours
or several days. The double columnar transposition can be very
resistant, especially when the key is long and the columns short, and
can be made even more complicated by carrying it through still a
third block, perhaps using a different key with each new block.

Why, then, would it not be possible to use such a cipher for general
communication? To this, there are two answers. For transposition
cipher, taken as a whole, has two very serious drawbacks.
First, a transposition, in order to be a good one, must be a
transposition of the whole text, and not a series of short individual
transpositions. Thus, it becomes possible that an error, either in
the encipherment or in the transmission, will not be confined to one
small area, but will garble the whole message. In this way, we have
not only the delay during which the legitimate decipherer is
attempting to decrypt his own message, but, should he fail, the
danger which lies in having it repeated. The decryptor who has been
provided with both the correct and the incorrect version of a same
cryptogram, is often able to figure out both the system and the key.

The other drawback is the danger which lies in the fact of so very
many cryptograms. These, originating at many different sources, and
all enciphered with the same key, will invariably include many of
_identically the same length_. The nature of transposition cipher
makes it inevitable that when any two texts of exactly the same
length are enciphered with the same key, they will follow exactly the
same route. The first letter in both messages will be transferred to
exactly the same serial position in both cryptograms; the second
letter in both will be transferred to another same serial position,
and so on. If we are able to match correctly any two or three letters
in one of the cryptograms, the two or three corresponding letters of
the other cryptogram will also be correctly matched and will serve as
a check. This being the case, any two or more cryptograms which are
found to have the same length can be written one below another so as
to place corresponding letters in the form of columns, and the
problem is reduced to one of _geometric_ columnar transposition.

With ciphers of the complete-unit type, the same thing can be done
having several of the major units. We have, say, a single cryptogram
accomplished with a Fleissner grille, and taken off by spirals. It
may be that nulls were added in the final group, or at the beginning,
or the final unit may have been left incomplete (by blanking out the
unwanted portion of the final grille-block). In spite of these
possibilities, the unit-length, known to be a square based on an even
number, can be determined — _or assumed_ — and the placing of the
several units one below another provides columns made up of
corresponding letters. It is even possible, at times, to apply this
process, with suitable modifications, to several cryptograms whose
length is only approximately the same. It has been done, for instance,
with cryptograms from Sacco’s indefinite grille, mentioned in Chapter
III (General Sacco himself has explained the modifications). Such a
process is ordinarily referred to as multiple _anagramming_, and we
have already seen, in the case of the grille, how it may be modified
so as to take full advantage of any inherent weaknesses when the
cipher is known.

For discussion of the general case, suppose that we have intercepted

a number of cryptograms (seen, by their letter-frequencies, to be
transpositions), and that among these we have been able to find five
in which the length is 25 letters. Since all of these have been
coming from the same two stations, and within a comparatively short
period of time, it seems reasonable to suppose that at least a portion
of them have been enciphered with the same key, and, upon this
assumption, we have written the five cryptograms one below another so
as to set up the 25 columns shown in Fig. 50. We wish now to
rearrange the 25 columns in such a way as to bring out plaintext on
every row, or, failing that, on some of the rows. Once the set-up has
been prepared, we may arrive at our goal by any road that suits our
fancy. The majority of solvers will simply cut the columns apart and
start matching strips at random; and this, probably, is a good enough
method, especially when columns are so short. The writer, personally,
prefers to leave the set-up intact, at any rate until solution is
well started, trying out in pencil the various possible
column-combinations, and circling out accepted columns from the
set-up in the same way in which segments were circled out of
cryptograms in the preceding chapter.

Figure 50

A series of five cryptograms prepared as columns:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

C D D N C A A R T H L O I K A O E R T L S N A N O
D A I T E L O C W A I U X D N T Y M I N M O E Y O
B T O A T T U T O C F L I Y K X N E I O S B F Y Y
T A R O T O R E I L N A O H R I O N M D S R J Y S
W E K L N C H T S T S I E G E I H O O P D T N A O

For those who like this method, we repeat a suggestion which has
already been made: Many columns are usually present in such a set-up
which contain _more than one_ of the “clue-letters,” as here, for
instance, column 14 is practically made up of them. Such a column
makes a good point of beginning, since we may search the set-up, not
for some single letter, but for a pattern made up of several. For
column 14, specifically, we might examine the top row of letters,
pausing whenever we come to one of those letters frequently preceding
_K_, and examining the rest of its column to find out what letter
would have to precede _H_ on the fourth row. We may fail with the
first such column, but not with all.

Another particularly good method, and one which might work in the
present case in spite of the very brief columns, is that of finding
the particular column which contains the first letters of all the
messages. Well over half of the initials used in the language will be
found in the group _T A O S W C I H B D_, and with a frequency in
somewhat that order. Any column made up entirely of these particular
letters may be the one which begins the messages; and when this can
be found, it pays to remember that a vowel is practically always
present among the first three letters of each message.

As to finding the end-segment, it seems that this would be of little

value except in those cases where final groups are not completed.
However, the letter _E_ has a great fondness for final positions,
with terminals restricted largely to the group _E S T D N R Y O_; and
it is also true that many encipherers make a habit of completing their
final groups with such letters as _X_ and _Q_.

Aside from the general case, each individual case carries clues of its
own, and the finding of these must depend upon the detective ability
(or experience) of the decryptor. Here, for instance, we find that the
letter _K_ has appeared three times in only 125 letters of text. This
letter, normally, has one of the lowest frequencies in the language,
and often is not found at all in 125 letters of text. Finding it
three times, then, rather suggests the presence of some one word, a
word so important to the subject-matter that it has been used in
three different messages.

When considering the letter _K_, the first combination which comes to
mind is a digram _CK_ preceded by a vowel; and the letter _C_, also,
is not a letter which we expect to find in confusing numbers. When an
examination of the set-up shows that, for each of the _K_’s, there is
a _C_ present on the same row, we are inclined to accept the
hypothesis of a repeated word. In practice, we should pick out the
three columns containing _K_, place beside each one a column which
will set the digram _CK_ together, and _build on all three
combinations simultaneously_ to the point at which the supposed word
appears or is proved non-existent. Following out only one of these,
let us consider column 14, where _K_ is on the top row. On this row
we find that _C_ has appeared twice. Both of the _C_’s are tried with
_K_, as shown in Fig. 51; we find that both combinations will provide
acceptable digrams, but there is little doubt as to which we would
select. Combination 1-14 is merely acceptable, while combination 5-14
provides a very accurate description of the column which would fit
best on its left. There should be a vowel on the top row, to precede
_CK_, and another on the bottom row, to precede _NG_. After that,
perhaps another vowel should be found on the fourth row, to precede
_TH_, or perhaps, in this case, an _S_, since the list of frequent
trigrams includes a sequence _STH_; and, finally, something suitable
to precede _TY_, which appears to be a syllable, but may belong to
two different words. The five columns which will meet these
requirements have been added in Fig. 52. In this figure, two
combinations may be discarded, because of trigrams _KTY_ and _YTY_.
The others appear acceptable. At this point, however, the sequence
_XTY_ of combination 16-5-14 begins to draw attention because of its
very few possibilities (SIXTY, NEXT YEAR, etc.), making it likely
that one of these will quickly select or discard the entire
combination. For building SIXTY, row 3 of the set-up contains two
_I_’s and one _S_. The two _I_’s, columns 13 and 19, when inspected
visually, are found to bring out, on the top row, the two sequences
_I O C K_ and _T O C K_, while the _S_, column 21, brings out, on the
top row, another _S_, which would extend these, respectively, to read
_S I O C K_ and _S T O C K_, the latter surely the more acceptable.
The results of these additions, with subsequent development, can be
examined in Fig. 53. The completion of the word SIXTY has brought out
also: STOCK, _MITED_, SMITH, DOING. The presence of the word STOCK
suggests extending the sequence _MITED_ to read LIMITED, and the
addition of two more columns on the left brings out another CK,
suggesting another appearance of the word STOCK. The chances are that
we have already been building on this other word STOCK, but if not,
we may build it now to the point shown in the figure, where the top
row suggests RAILROAD STOCK, the third row, FIFTY TO SIXTY, and the
second may or may not suggest MEXICO. Thus we are well on our way to
solution, and have not once had recourse to a long prepared list of
probable words: _division_, _regiment_, _battalion_, _attack_,
_advance_, _report_, _forward_, _artillery_, _ammunition_,
_communication_, _enemy_, _signal_, _retreat_, _troops_, and so on.

Figure 51

1-14 5-14
 C K C K
D D E D
B Y T Y
T H T H
W G N G

Figure 52

12-5-14 13-5-14 15-5-14 16-5-14 25-5-14

O C K I C K A C K O C K O C K
U E D X E D N E D T E D O E D
L T Y I T Y K T Y X T Y Y T Y
A T H O T H R T H I T H S T H
I N G E N G E N G I N G O N G

Figure 53

11 8 25 6 3 21 19 16 5 14
L R O A D S T O C K
I C O L I M I T E D
F T Y T O S I X T Y
N E S O R S M I T H
S T O C K D O I N G

Naturally, there are times when the matching of the columns, for one
reason or another, proves troublesome. We are thrown off by errors,
by the presence of nulls, initials, abbreviations, etc., or by the
encipherer’s use of cover-up devices, such as the writing of _YH_
instead of _TH_. Or we find that the handling of many paper strips,
caused by message length, is awkward and confusing. But if, in the
eyes of the decryptor, there is any good reason for finding out the
contents of such messages, he can always succeed, even with only two
letters per column.

So far, nothing has been said about helping ourselves to the serial
numbers of the columns, which, during the rearrangement of letters,
are automatically forming in a certain sequence across the top of the
set-up. Regardless of the cipher, it can do no harm to examine these,
and find out what information, if any, they are able to give. In some
cases, they will provide us with both the system and its key,
enabling us to throw away the strips and start deciphering. Suppose,
for instance, we have correctly matched sixteen columns, and find
their numbers in the following order:
31-10-24-37-17-3-32-11-25-38-18-4-33-12-26-39. A careful examination
shows that the numbers are running in sets of six. After the first
six are passed, the next six have repeated them with an increase of
1, and another six appear to be forming up which will repeat them
with an increase of 2. We may verify this by finding the columns
which have numbers 19-5-34-13, etc., and, if the set-up continues to
show plaintext, we know that we are dealing with a simple columnar
transposition. Notice that if the above series were marked into
segments of six numbers each, and the segments placed one below
another, we should have _six columns_, each one made up of numbers
which are consecutive. Thus, we may sometimes learn from a series of
numbers: (1) the system, which is straight columnar transposition;
(2) the key-length, which is 6; and (3) the key itself, which, taking
the six numbers according to size, is 5-2-4-6-3-1, possibly with the
wrong numbers coming first, though it happens that in this case they
do not. This is our old friend SCOTIA, used on forty numbers, in case
the student cares to verify it.

The trail of the columns is not so plain where a second transposition

has done something to the first. But it is still present; the most
complex of ciphers has method of some kind, provided we can find it.
Consider, for instance, the series of numbers,
11-8-25-6-3-21-19-16-5-14, which has been forming in Fig. 53.
Examination here shows pairs of consecutive numbers, 11-8, 6-3, and
19-16, all having the same numerical difference of 3; that is, the
plan of our present encipherment, whatever it is, has, on three
separate occasions, caused some plaintext digram to appear in the
cryptogram reversed, and with its letters three positions apart.
Irrespective of the type of transposition, this constant numerical
difference of 3 might be found again; perhaps we can set some two
columns together correctly simply by _reproducing this numerical
difference_ in the two column-numbers. A glance ahead at the next
figure will show that we actually could, by setting together columns
12-9 or columns 20-17. Where we cannot discover a repeated numerical
difference, perhaps we can discover a progressing difference, or some
other signs of regularity.

Now, returning to the particular case, let us pass on to Fig. 54, in

which the matching of the 25 columns has finally been completed, and
make a careful comparison between the two numerical series 12-9-10-15
and 20-17-18-23. What can these represent but the _fragments of four
columns_, belonging to a _first encipherment block_, which have been
laid down along the _rows_ of a _second encipherment block_, and taken
out in slices? And since the lineal distance apart of any pair of
numbers, as 12 and 20, is seen from the figure to be six positions,
it would be possible, by writing the series of numbers in lines of
six numbers each, to place each pair of corresponding numbers in a
same column. The trail, usually, is not so wide, but there is little
doubt here that we have been dealing with a case of double columnar
transposition in which the key-length of the original block was 6. We
shall come back to this in a moment.

Suppose, now, we give our attention to the various series of numbers

which appear in Fig. 54, and make sure that we understand what they
are. The numbers running across the tops of the columns were,
originally, the _serial numbers of cryptogram letters_ (or columns).
When we restored these letters to their plaintext order, we
disarranged their serial numbers, causing these to come out in the
order 1-7-24-22-12-9, etc. This series, then, is made up of
_cryptogram serial numbers_. But it is also a _key_, since it shows
us exactly the order in which we might _take off a plaintext_ in
order to form a cryptogram. It is a key of the Myszkowsky type,
according to which every letter in the text has its individual
key-number, as we saw in Fig. 46 (imagine that encipherment
accomplished twice in succession). We do not desire, however, to take
off plaintext. And, to use this same key on a cryptogram, we should
have to use it in the _writing-in_ manner; that is, first lay out the
series of key-numbers, and then, taking the cryptogram letters in
their 1-2-3 order, place them, one by one, below their key-numbers.
But once the plaintext has been restored, the _plaintext letters_
(or columns) _may also have serial numbers_, and these new serial
numbers, in the figure, have been added at the bottoms of the
columns. Should we now restore these columns to the order in which we
found them, that is, to their cryptogram order, each column taking
with it its new serial number, we should find, running across the
bottom of the set-up, another mixed series of numbers in the order
1-10-20-9-24, etc., which is a different order from that of the
cryptogram numbers, and this new series is made up of _plaintext
serial numbers_. This is the other key, having the same relationship
to the first as that explained in connection with the short Nihilist
key. Applied to the plaintext, it would have to be used in the
_writing-in_ manner; used on the cryptogram, it serves for
_taking-off_. Thus we are able to recover from our reconstructed
plaintext two long keys, either one of which will serve to decipher
additional cryptograms, _but only on condition that these new
cryptograms contain exactly 25 letters_.

Figure 54

The Columns of Figure 50, After Solution by Multiple Anagramming:

1 7 24 22 12 9 10 15 4 2 20 17 18 23 13 11 8 25 6 3 21 19 16 5 14

C A N N O T H A N D L E R A I L R O A D S T O C K
D O Y O U W A N T A N Y M E X I C O L I M I T E D
B U Y B L O C K A T O N E F I F T Y T O S I X T Y
T R Y R A I L R O A D O N J O N E S O R S M I T H
W H A T I S T E L E P H O N E S T O C K D O I N G

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25
(Plaintext serial numbers, added at bottoms of columns)

(Appearance of the plaintext serial numbers, if the above columns should

be restored to their cryptogram order)
1 10 20 9 24 19 2 17 6 7 16 5 15 25 8 23 12 13 22 11 21 4 14 3 18

If, then, we hope to decipher cryptograms of other lengths, which

originally were enciphered with exactly the same key as our present
five, it is still necessary that we take one or the other of these
long Myszkowsky-type keys and reduce it to the short columnar form.
The theory on which this is done should not be at all difficult to
understand if it be kept in mind that both of our long keys are
actually the serial numbers of letters, and that each individual
serial number accompanied its letter throughout the encipherment
process. This will explain any references which are made to FIRST and
SECOND encipherment blocks, with their respective columns and rows.
Whichever of the long keys we decide to reduce, our first objective,
always, is that of determining the _length_ of the shorter key; after
that we restore its _order_.

The first process, summed up in Fig. 55, was originally published,

so far as the writer knows, by M. E. Ohaver, and makes use of the
cryptogram numbers which were the first series obtained. The
discovery of the shorter key-length is made by searching the set-up
for some numerical difference (between any two numbers whatever)
which is repeated by corresponding pairs of numbers at some regular
interval. For convenience in making the search, Ohaver suggests that
the mixed cryptogram numbers be written, with uniform spacing, on two
strips of paper, in one case repeated. One strip can then be moved
along beside the other so as to place pairs of numbers in actual
contact. It is immaterial what numerical difference is used; the
difference 1 pointed out in the figure seemed a little more visible
than others. This difference 1 has been noted between the numbers 9
and 10, and the next difference 1 has been found _six positions away_
between the numbers 17 and 18, but is not found again between the
numbers 25 and 6, which stand at the next interval of six positions.
This may be a clue, but it is not what we had hoped to find. The clue
is strengthened, however, by the observation that a difference of 5
occurs just at the right of the original difference 1, and is also
repeated at the lineal interval 6.

Figure 55

Finding the Original Short Key from the CRYPTOGRAM Serial Numbers - M.E.OHAVER

Finding the key-length:

1 7 24 22 12 9 10 15 4 2 20 17 18 23 13 11 8 25 6 3 21 19 16 5 14.
1 7 24 22 12 9 10 15 4 2 20 17 18 23 13 11 8 25 6 3 21 19 16 5 14 1 7
x . . . . . x (Repeat series)

A difference of 1 occurs again at the interval 6. The two

series 9-17 and 10-18 are fragments of columns from the first
encipherment block. The key-length necessary for placing
either pair in a same column is 6.

Replacing cryptogram numbers in first encipherment block:

(As PLAINTEXT)... 1 7 24 22 12 9
10 15 4 2 20 17
18 23 13 11 8 25
6 3 21 19 16 5
14

COLUMNS of the FIRST encipherment block are converted to ROWS of the SECOND:

(a) (b) (c)

1 10 18 6 14 1 10 18 6 14 22 1 - 3 - 5 - 2 - 4 - 6
22 2 11 19/ 7 15 23 3 2 11 19 7 15 23
12 20 8 16 3 12 20 8 16 24 1 10 6
24 4 13 21/ 9 17 25 5 4 13 21 9 17 25 2 . 7
5 3 8
4 9
5
At (a) the columns of the first block are (C O S M O S)
arranged so as to make the cryptogram numbers At (c) the order is
run consecutively in each of the new columns. shown in which the columns
At (b) this block has been adjusted, so as of (b) would be taken off.
to form six columns. This order is the KEY.

To find a good clear example, using the strips as they stand, let us
go back toward the left, and look for a difference 2. We find it
first between the numbers 24 and 22; exactly six positions away, we
find it again between the numbers 4 and 2; another six positions, and
we find it between the numbers 13 and 11; still another six positions,
and we find it for the fourth time between the numbers 21 and 19. Thus
we have two series of numbers, 24-4-13-21 and 22-2-11-19, which run
parallel to each other with their numbers always separated by
interval 6. Sequences of this kind came from the _columns of a first
encipherment block_, and can all be placed back in these columns by
re-writing the mixed cryptogram numbers in lines of _six numbers
each_. Sometimes we find such columns broken to bits, as would be the
case should we continue moving the strip until we have completely
exhausted the possibilities for difference 1; and we never find them
complete, since these columns of the first encipherment block were
taken out in irregular order and written continuously upon the rows
of a _second encipherment block_, and after that were sliced through
in the taking out of columns from the second block. We found traces
of them once before, where a difference of 8 was found throughout
four consecutive pairs of numbers 12-20, 9-17, 10-18, 15-23, always
at an interval of 6 positions.

The key-length, then, is 6, and the cryptogram numbers (in their

plaintext order) if written into a block of that width, will
reproduce the first encipherment block. From this, we wish to carry
the numbers, column by column, into their second encipherment block,
from which they may then be taken out, again by columns, in such a
way as to bring them back to their cryptogram order 1-2-3. If this
is to happen, the numbers must run consecutively in the new columns,
and the number 1 must be on the top line. We select, then, from the
restored plaintext block, the column which contains the number 1,
then the column containing the number 2, and so on, writing these
columns horizontally on the rows of the new block, in such an order
as to make the numbers consecutive in every column. This may or may
not require the adjustments indicated in the figure at (a) and (b).
When block (b) is completely adjusted, the order in which it would be
necessary to take its columns so as to produce the cryptogram numbers
in their original 1-2-3 sequence, is the order of the original short
key. Our key-word COSMOS, incidentally, could have been better chosen.

In Ohaver’s process, we have taken the _cryptogram numbers_ and

_enciphered_ them. By the process of General Givierge, summed up in
Fig. 56, we do the opposite: we take the _plaintext numbers_, in
their cryptogram order, and _decipher_ them, so as to bring them back
to their correct plaintext order 1-2-3. For learning the key-length,
General Givierge endeavors to find that number which, when added or
subtracted throughout the series of numbers, will most often cause
one of its segments to repeat another. The portions which repeat are
the columns, or partial columns, not from a first encipherment block,
but from a _second_, since the process here is to follow out a
decipherment. In the figure, the left-hand block (not strictly
necessary) represents the plaintext, written as a cryptogram, and the
one on the right represents it in what is known to have been its
first encipherment block. To develop the second block: either take
columns from the right-hand block and lay them on the rows of the
central one in such an order that its columns can be taken out to
form the cryptogram; or, write the cryptogram arrangement into the
columns of the central block in such an order that its _rows_ will
show the columns of the plaintext block on the right. The order in
which columns must be taken from the right-hand block to form the
central one (or that in which columns must be taken from the central
block to reproduce the cryptogram arrangement) is the order of the
original short key. The condensed presentation here is also drawn
from the writings of M. E. Ohaver. General Givierge, who seems first
to have published the method, was chiefly concerned with exposing the
possibilities of _analysis_, as applied to numbers generally, and
explains to us the reason of the increase 6 which betrays the
key-length in the plaintext series of numbers. The width of the
original block being 6, each number is larger by 6 than the one just
above it, making every one of the columns an arithmetical progression
in which the constant difference is 6. These columns, still retaining
their regular increase of 6, are laid down on the rows of a second
block, and, for at least a portion of their length, some two or more
of them always continue parallel, with progressions of 6 running side
by side. Thus the taking out of columns from the second block will,
at times, select _one each_ from two or more different progressions
of 6, and the new columns, throughout some portion of their length,
will differ from one another by exactly 6, the original key-length.

Figure 56

Finding the Original Short Key from the PLAINTEXT Serial tumbers - GIVIERGE

To find the key-length: Try adding (or subtracting) possible

key-lengths (4, 5, 6, 7, etc.) to the whole series until some one
of these added numbers causes portions of the series to repeat.

1 10 20 9 24 19 2 17 6 7 16 5 15 25 8 23 12 13 22 11 21 4 14 3 18
6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6

7 16 26 15 30 25 8 23 12 13 22 11 21 31 14 29 18 19 28 17 27 10 20 9 24

The portions which repeat when the correct key-length, 6, is added,

are columns, or part-columns, from the SECOND encipherment block.

Plaintext Serial Numbers S E C O N D F I R S T

In CRYPTOGRAM Order: Encipherment Block Enoipherment Block
/ 1 10 20 9 1 7 13 19 25 4 1 2 3 4 5 6
24/19 2 17 10 16 22 2 8 14 7 8 9 10 11 12
6/ 7 16 5 20 5 11 17 23 3 13 14 15 16 17 18
15/25 8 23 9 15 21 6 12 18 19 20 21 22 23 24
12/13 22 11 24 25
21/ 4 14 3 18

The ROWS of the CRYPTOGRAM BLOCK, (approximately of column-length), must be

written back into the COLUMNS of the SECOND ENCIPHERMENT BLOCK in such an
order that the ROWS of this SECOND encipherment block could have been taken
off as a primary cryptogram from the COLUMNS of the FIRST ENCIPHERMENT BLOCK,
extreme right, known to be the original order of the numbers.

The original short KEY can then be found by observing (in the central block)
the order in which columns have been taken from the right-hand block. That
is, find the small numbers which were on the top row; these are standing in
the order 1, 4, 2, 5, 3, 6 (a writing-in key), and the columns which are
headed by these receive key-numbers in the order 1-3-5-2-4-6.

* * *

We have seen, then, the general case in which the “enemy” decryptor,
having several cryptograms of the same length, enciphered with the
same key, is able to use a purely mechanical method in order to
restore the plaintext, and afterward, by observing traces of a known
cipher, to extract their key. For the solution of single cryptograms
enciphered in complicated systems, the writer knows of no other method
than straight anagramming, in which the single letters, accompanied
by their serial numbers, are written on individual cardboard squares
(or imagined to be so), and the attempt made to match them up.
Attention has already been called to some possibilities which may lie
in the serial numbers whenever the sequences or probable words are
thought to be correctly matched. But with absolutely nothing known or
suspected as to source or subject matter, and with nothing
discoverable from serial numbers or possible routes (and taking it
for granted that any accumulation of letters represented in about the
normal frequency-proportions can be made to yield dozens of different
solutions), it would hardly seem that the decryptor, even should he
find the correct solution, would have a means of distinguishing it
from any other.

Figure 57

A Single Cryptogram in Double Columnar Transposition:

L H D L A O D D H L H E E U I X D F P I U T A E R O I T Q A E T E R L
N I E N A U D K L I E E H Y N M S J L C N H P B O A D G R N.

The Solution, Enciphered by a Method Mentioned in Chapter III:

M T Q P I N A I E N E I T H R G E K D U U D L L I R I H F R T E C L O L N J
L A S H A A U Y D O E E L N E N D H P D H D E A B O.

For the student who may care to struggle with a case of single
anagramming, we have appended a problem in Fig. 57, together with a
means for finding out the solution and perhaps even the key-word. It
has come from the Philadelphia headquarters of a band of
revolutionists, and our stool-pigeon tells us that the leaders of
this movement are to be called together for consultation during the
coming summer.

* * *

The finding of a _key-word_, after recovery of the numerical key, is

not, of course, necessary to the decipherment of further cryptograms.
However, this recovery will afford us the same convenience which it
gave to the encipherer; that is, a simple mnemonic device for
reproducing the numbers at will. And to recover the actual original
key-word may, at times, provide some insight into the habits or
mental make-up of the person who selected it, and who may select
others like it, or might, conceivably, make use of this same key-word
in some other kind of encipherment. If the key is short, it is
practically always possible to recover more than one word; but with
long keys, we seldom, if ever, recover more than the one word on
which the numbers were actually based. In this connection, however,
it must be remembered that key-words are not necessarily taken from
any one language; thus, their recovery becomes largely a matter of
combined information, intuition, guesses, trials, and determination,
so that an exact method for accomplishing it is hard to give. But,
presuming that key-numbers have been derived in the usual way, those
which are small are, in general, likely to have derived from the
earlier portion of the alphabet, which contains _A_, _E_, _I_. So
long as they increase toward the right, they may continue to represent
a same letter, and when they do, this letter is usually a vowel, When
an increase occurs on the left, the new number has certainly derived
from a new letter, coming later in the alphabet. Whatever the
language, then, it is very easy to determine the two extreme
alphabetical limits outside of which no one of the letters can
possibly be found.

This can be seen at (a) of Fig. 58. The numbers 1, 2, 3, might all
have derived from _A_, but the number 4 cannot have derived from a
letter coming earlier in the alphabet than _B_. Similarly, the
numbers 4, 5, might, by possibility alone, have derived from _B_; the
numbers 6, 7, 8, might all have derived from _C_, the numbers 9, 10,
from _D_, and, finally, the number 11, from no letter earlier than
_E_. When these earliest possible limits have been established for
every key-number, and it is seen that the range is five letters, then
the last five letters of the alphabet, _V_, _W_, _X_, _Y_, _Z_, may
be used to establish the limits at the other end of the alphabet. It
is seen now, that the key-number 6, must have derived from some
letter between _C_ and _X_, inclusive, and similarly with the others.
But when we come to the particular case, it becomes necessary to make
assumptions; for instance, were these numbers derived from a common
English word or from a Russian proper name? The person who selected
it, so far as we know, is accustomed to speaking English, and in all
of his past cryptograms we have been able to recover common English
words rather than proper names. Assuming, then, as at (b) of the same
figure, that we are to recover his usual common English word, we set
down _A_ as a possible letter for the key-numbers 1 and 2. But when
we arrive at the number 3, we see that we cannot assign here a third
_A_, since common English words of this length do not contain a
doubled _A_. The earliest letter possible, then, is _B_, and, upon
noting the consecutive letters _AB_ at this particular point, we
think at once of the common English terminal sequence -_ABLE_.

Figure 58

(a) Limits: (b) Assumption of English word:

6 9 1 4 11 7 10 2 3 8 5 6 9 1 4 11 7 10 2 3 8 5
C D A B E C D A A C B A A B L E
X Y V W Z X Y V V X W (FL (MY A C (NZ (FL (MY A B L E
D
E (New limits)

To find whether this is possible, we make sure that the new letters,
_L E_, alphabetically considered, do not run contrary to their
supposed numbers, 8 5. Then, having accepted these four letters as
entirely possible and likely, we work back to the missing number, 4,
and find, now, that it has new limits; it must have derived from _E_,
_D_, or _C_, and from nothing else, and of these, we are inclined to
discard _E_, which would give a sequence _AE_. We then work back to
other missing numbers, 6 and 7, and find that these, too, have
acquired new limits; they must be found somewhere between _F_ and
_L_, inclusive. All numbers which follow 8 have attained a new limit
in the earlier portion of the alphabet, but not in the latter portion.
These are all shown in (b). At this point, any knowledge at all of
English prefixes will suggest what the first two letters are and will
narrow the limits still further. The student, perhaps, has already
guessed the word.

Of the keys which follow, (a) and (b) were derived from English words,
one of which has been used in the present chapter. The remaining four
are derived from proper names, respectively (c) German, (d) Italian,
(e) Spanish, and (f) French.

(a) 1-9-2-4-11-3-7-8-6-10-5. (b) 2-7-8-3-4-1-6-5-9-10.

(c) 2-5-11-3-9-13-6-12-8-1-4-7-10. (d) 9-1-10-6-5-2-8-7-4-3.
(e) 2-11-3-6-7-9-1-5-8-4-10. (f) 5-1-4-6-2-3-9-8-7.

36. By TITOGI.

(a) U O Y M E E T E N A W H T I M C I C T I J I U S O G N H Y F.
(b) Y T M I L L E M L E W U A A J T W O N F O R T A H L H T G I.
(c) R O P U L E A E E B A H F T K O D T S C I L T T M R Y T I H.
(d) U M H T S E U O K S I H W T R A N C I O W A O H T Y O S S Y.
(e) E C E R L T A D A R M R E A O G P O Y M E E A A T N I B S A.
(f) R E U O T K N A E H E H H L Y W D E L E E E E O M N W S L L.
(g) I H L P U H T T G I Y T T A S N E R T E O R Y T A H N J D S.
(h) E S E F K A C A P E E O L S A M E J N S T E O M S L E O T I.
(i) T E N E W O H S K I I N S G T M O O H T A A T H U E U T O B.
(j) H T P R A H L E R E E R E T A T L E E H S T T T E H B N B S.

37. By EFSEE.

(a) I U E G N M O W H X T A N O I P D I L S F P I A R -
(b) F N E E T X I E T O N O T S M G R T R Y V G P A C -
(c) S F U F N I C E Q E S C U N R I L T M Y I O I P T -
(d) B T E E S N B I H I E T L N X O E S N R E I E G T.

38. By SIR ORM. (This has a keyword!)

T A S H L E C P W E T C I H A O T N R A O O H L W D O Y I L E O H R L
E V A T E A O M N L E V N W I W I E I H S M H E T H N W O I O L S V I
I F S S O W A S O T F I L E H N M G O F I E R A L O C G N N.

39. By DAMONOMAD. (And he calls this a "Nihilist" !)

A H H S E S T I H D I S O M E A T H I O O H D I O U T T I K M I E S O
F G S N E R W U G T S G Y I S L A T I T T A A N H O G E N Y L A W E A
L E R T M I W T O E D.

40. By FRA-GRANT. (A military message sent by General Calamity to Major

Catastrophe).

T E H A N E M G S L L I W S N E T T A C K Y E I A A E B P S O U R P E
M O C E E T U N R I S T E R S A F O E T O R T D A E R T E F D I N C A
S E R E T T U O P W A R U R E F F O Y A E E D F O R D R C R.

No. 40 can be decrypted by the multiple-anagramming of its units. Afterward,

if you are unable to reconstruct the system, No. 41 will tell you all.

41. By PICCOLA. (Single block - completed unit - with columns transposed. The
key to this transposition may amuse you, provided you can
reconstruct it in letters!)
A O U U P D M C A N I O G T R S A A Y N K N C A B M N A O A T L E C H
Q S D O R E E W W D N C K E E S T S H N I E T E U H K N I F D I T Y F
U X G I V L T A I P H R C S N R R E H S B M E E A R M T A I U T E W O
P I R S M H O O E V R W F N X S D A H I E T S S U F C N N E E S N F S
E O O L T U A E A O F T V L T E E O E C.

42. By TITOGI and PICCOLA. (General information - nothing more).

(a) I H S
E W D O X H D H T S E O E H R N E C T O O A G A R S A
N O E A O S O H
U W R T C A U R E N T T O M S O C N Y N P G S H A P P
N F S N E R T E
H E P M A W S M E G I A E A P O R Y D T A A S S A F M
I H S R C H E C
W N E I T A T R X E I S O A C F A T I C E N I R T E U
Y H T E R T S R
S E L S T E G P A H R W. (b) S R H J I A X E C A
N E Y P K A N D
A T S D L I L A S L N T G E A D Y E B L Y T S C C I D
T C S G A M C E
E N W A T I E A E N H L A B D Y A G H C H E G I H O I
L P O N P A S E
D N T T W E S Y E F I M L A R E R H N E D I O T E L R
O S I T D S S R
I S N I R R F S S P E C T R E I F B G O M R X S E N A
H A R N L. (c) A E G Y B A T Y N S R I D T O O S D N E Y E E E O
G N I U U T W S N L H E I I S C G H H W D R R U W E A H E T K C T W V
O E H H I.

43. By TITOGI. (Keerful, Si! All is not gold that glitters).

C T I H N A I E S O R M F Y E E C T H U W I S L A E D K R L B E R N M
J I T S D A N D O O H T V A T H T E R Y G A U N O T S A P E M O E S U
R I L T E D I E O N E N R C A F I N P O L H O E A G R B X S.

44. By ALII KIONA. (Nou hooda thawt it uvvim?)

E N W N O T N S E N Y U H O I K H N O E W A O T I U S S A L B W S F R
M I E I D I H R W N T F N D S E E O T U E Y B N O T W E W Z E E D I B
A E R Y I P L R N P Z R S M U T A S O I S U S D T D T R N H N O A S A F E
Z.

CHAPTER VIII
Substitution Types

Substitution cipher presupposes the selection of a set of symbols

which can represent the letters or words of messages. As to what
these symbols may be, there is practically no limit; we meet
substitution in our every-day life: the dots and dashes of the Morse
alphabet, the pot-hooks of shorthand, the combinations of Braille,
and so on; and we hear of its use in the sign-language of Indians and
Gipsies, or in the drum-language of the African jungle. These, of
course, are not cipher, yet in each case the plain language has been
replaced with symbols. Considering the use of symbols for cipher
purposes, there are doubtless many among us who played, as children,
with the alphabet of the “Masonic” cipher, based upon a design like
the one used for ticktacktoe. Lord Bacon’s alphabet has already been
mentioned. The use of printers’ symbols, and similar characters, can
be seen in the works of Edgar Allan Poe. Charles I of England is said
to have used a cipher alphabet in which letters were represented by a
series of dots, placed in certain positions with reference to the
line of writing. An endless number of queer symbols is met with in
fiction, such as the use of the little dancing men by Sir Arthur
Conan Doyle. Cipher alphabets of the nature mentioned do not produce
ciphers in any way different from those produced by substitution with
letters and numbers; as a matter of fact, the decryptor who must deal
with a cryptogram made up of arbitrary signs usually begins the work
by making a substitution of his own, replacing each unfamiliar symbol
with some one letter (or number). We will confine our discussion,
then, to those characters which are transmissible by Morse.

* * *

Substitution ciphers may be classified under four major types, each

having its subdivisions and variations, and its intercombinations
with other types:

1. _Simple substitution_ (also called _monoalphabetic substitution_)

makes use of only one cipher alphabet.

2. _Multiple-alphabet substitution_ (also called _double-key

substitution_, _polyalphabetic substitution_, etc.) makes use of
several different cipher alphabets according to some agreed plan.

The term “multisubstitutional” is sometimes applied to the

multiple-alphabet cipher, but more correctly refers to a certain form
of the simple substitution cipher, in which the single alphabet is so
designed as to provide optional substitutes for all or part of the
letters.

3. _Polygram substitution_ provides a scheme by means of which groups

of letters are replaced integrally with other groups, which may be of
letters or of numbers.

4. _Fractional substitution_, which requires a certain type of cipher

alphabet, breaks up the substitutes for single letters, and subjects
these fractions to further encipherment. More often than not, the
result is a combination cipher, rather than a purely substitutional
one.

CHAPTER IX
Simple Substitution — Fundamentals

Simple substitution is ordinarily defined as a cipher in which each

letter of the alphabet has one fixed substitute, and each
cryptogram-symbol represents one fixed original. When this cipher is
used for puzzle purposes, as we find it in our newspapers and popular
magazines, the substitutes (which are invariably letters of the
alphabet) may be chosen at random, and the cryptograms must follow
certain arbitrary rulings which are designed to make them “fair”:
Word-divisions and punctuation must follow religiously those of the
original text; a certain minimum of length must be provided; no
letter may act as its own substitute; foreign words are not
permissible; and so on. Aside from the observance of such rules,
however, no holds are barred; the constructor of such a cryptogram,
totally unconcerned with the meaning of his plaintext (except that it
must have one), sometimes gives his chief attention to distorting the
normal language characteristics in an effort to baffle the analyst,
and often will carefully search his dictionary for words like
_yclept_, _crwth_, _syzygy_, _pterodactyl_, _ichthyomancy_, not
infrequently producing a plaintext which is almost as incomprehensible
as its corresponding cryptogram. Our study here will be confined to
the simple substitution cipher as applied to normal English text.

When a substitution key (a pair of alphabets) is being used for

cipher purposes, the letters which make up the cipher alphabet cannot
be chosen at random; the key must be of such a nature that any one of
the several correspondents, desiring to make use of it, will have it
at his disposal. Word-divisions are usually concealed, or,
occasionally, falsified. Punctuation, if used at all, must don the
apparel worn by the rest of the text; no limitations can be placed on
length, and no word whatever can be barred, where the intention is
that of conveying actual messages; and it is not at all uncommon to
find that one or more letters are serving as their own substitutes.

In discussing keys, we will make some arbitrary rulings of our own,

but only in the interests of clarity. We will assume, for all cases,
that the two necessary alphabets are always written horizontally, as
several are shown in Fig. 59; that wherever the two complete alphabets
appear, the upper of the pair is always the one in which plaintext
letters must be found, so that the lower one is always the cipher
alphabet. Thus, whenever the two alphabets are written out in full,
the substitute for any given plaintext letter will be the letter
standing immediately below it; and the original of any cipher letter
will be the letter standing just above it. Wherever it seems advisable
to show a distinction, the cipher letters will be expressed as
capitals and the plaintext letters will appear in lower case.

Among the oldest cipher alphabets ever used for practical purposes
are those of the type called “Caesar,” one such alphabet having been
used by Julius Caesar, and another by Octavius. As may be seen at (a)
of Fig. 59, this type of cipher alphabet is no more than a simple
_shifting_ of the normal alphabet to a new point of beginning. Using
this particular example, the word “Caesar” will be enciphered as
_F D H V D U_; or, if the word _R Y H U_ is found in a cryptogram, it
deciphers as “over.”

At (b) of the same figure, we have a pair of _inverse_ normal

alphabets. Here, it is not necessary to specify that one of the pair
is a plaintext alphabet and the other a cipher alphabet; whenever a
plaintext alphabet is merely reversed and allowed to serve as its own
cipher alphabet, the encipherment becomes _reciprocal_; that is,
whenever _Z_ is the substitute for _A_, then _A_ will also be the
substitute for _Z_, and so for other letters. Thus, we need not write
down more than half of the key shown at (b); and, in any other case
of reciprocal alphabets, only enough of it to make sure that we have
all 26 of the letters; after that, we may find them where we please,
both for encipherment and for decipherment. Simple reciprocal
alphabets are also ancient. The one just mentioned, and also the one
shown at (c), are both said to have been used in parts of the Bible.
The two inverse alphabets of (b) may, of course, be _shifted_ with
reference to each other; that is, one or the other may be caused to
begin at any desired letter, just as is done with the ordinary
alphabet in deriving one of the “Caesars.” It is also possible, as
indicated at (d), to divide the normal alphabet into its two halves,
and shift one of the halves; in this case the encipherment would be
reciprocal whether or not the shifted portion runs in reverse order.
At (e) and (f), we have mixed (or interverted) alphabets which,
though crude, are more in line with modern practice than those which
precede them, since both of these are based on the key-word CULPEPER.

Figure 59

Some Simple Substitution Keys

(a)
A shifted, or "Caeser," alphabet:

Plaintext: a b c d e f g h i j k l m n o p q r s t u v w x y z
CIPHER: D E F G H I J K L M N O P Q R S T U V W X Y Z A B C
(b)
A pair of inverse alphabets:

A B C D E F G H I J K L N N O P Q R S T U V W X Y Z
Z Y X W V U T S R Q P O N M L K J I H G F E D C B A

Other examples of the RECIPROCAL alphabet:

(c) A B C D E F G H I J K L M (e) C U L P E R A B D F G H I
N O P Q R S T U V W X Y Z Z Y X W V T S Q O N M K J

(d) A B C D E F G H I J K L M (f) C U L P E R A B D F G H I
T S R Q P O N Z Y X W V U J K M N O Q S T V W X Y Z

The usual plan for deriving cipher alphabets from key-words is as

follows: First, all repeated occurrences of any same letter, such as
the second _P_ and the second _E_ of the word CULPEPER, are discarded.
The unrepeated letters of the key-word, as _C U L P E R_, are placed
at the beginning of the cipher alphabet, and the rest of the 26
letters are made to follow these, usually in their normal alphabetical
order. If an adequate key-word be chosen, for instance the word
UNCOPYRIGHTABLE, a well-mixed alphabet results; but, in order to have
a cipher alphabet which is truly incoherent, and hard for the
decryptor to reconstruct, we may write this already-mixed alphabet
into block form and subject it to a transposition of some kind.
Several examples of this may be examined in Fig. 60. In example (a),
the repeated letters of the key-word have merely been discarded,
while example (b) retains these two positions in order to produce
more and shorter columns, with three different lengths. In both cases,
the columns of the block have been taken out by descending verticals
to form cipher alphabets (a) and (b), but the transposition may
follow any desired route or other process. Example (c) suggests
further uses for key-words. Still another process (not shown)
consists in writing the key-numbers above a block, exactly as in
example (c), and allowing them to govern the _lengths of rows_. In
the writing-in of the alphabet, normal or mixed, the first row of
letters is made to end under key-number 1, the second row under
key-number 2, and so on, so that the completed block contains rows of
different lengths; it may then be taken off by columns, or otherwise.
Numerous other devices exist, but it should be plain from the
foregoing that we have an unlimited field in which to derive
well-scrambled cipher alphabets, so that there is no need whatever
for forming one at random and later being unable to set it up again.

Figure 60
 Some Methods for Forming a Keyword-Mixed Alphabet

Keyword: CULPEPER

(a) (b)* (c)

C U L P E R C U L P E * * R C U L P E P E R
A B D F G H A B D F G H I J 1 8 4 5 2 6 3 7
I J K M N O K M N O Q S T V A B C D E F G H
Q S T V W X W X Y Z I J K L M N O P
Y Z Q R S T U V W X
*)(An OHAVER Method). Y Z

(a)
Plaintext: a b c d e f g h i j k l m n o p q r s t u v w x y z
CIPHER: C A I Q Y U B J S Z L D K T P F M V E G N W R H O X

(b) Plaintext: a b c d e f g h i j k l m n o p q r s t u v w x y z
CIPHER: C A K W U B M X L D N Y P F O Z E G Q H S I T R J V

(c) Plaintext: a b c d e f g h i j k l m n o p q r s t u v w x y z
CIPHER: A I Q Y E M U G O W C K S D L T F N V H P X B J R Z

For the _encipherment_ of substitution cryptograms, the plaintext is

first written out in full with enough space between its lines to allow
for the later insertion of cryptogram-letters. The correct substitute
for each letter is then written below it, after which, these
substitutes are nearly always marked off into five-letter groups, and
the groups are taken off on another sheet to form the finished
cryptogram. It is sometimes recommended that plaintext and cipher
letters be written in two different colors, so as to avoid any risk
of taking off portions of plaintext along with a cryptogram.

Figure 61

"Running Down the Alphabet"

Cryptogram: Y B P R O B Q L...
Z C Q S P C R M...
A D R T Q D S N...
Plaintext: B E S U R E T O...

For _decipherment_, the plan is the same, except that the cryptogram
is written first, and the two alphabets of the key exchange their
functions. Often, when the cipher alphabet in use is so incoherent
that its letters are not quickly found, the decipherer will prepare
for himself a special _decipherment key_, in which he places the
letters of his cipher alphabet in straight alphabetical order, and
allows the plaintext alphabet to grow mixed.

In taking up the _decryptment_ of simple substitution, we may dispose

summarily of the Caesar alphabets by pointing to Fig. 61. If we
suspect that one of these has been used, we may verify the suspicion
by taking some ten-or-fifteen-letter segment of the cryptogram, and,
with each of its letters as a beginning, extend the ten or fifteen
alphabets, a few letters at a time, until we come to the line which
is purely plaintext. This process is popularly known as “running down
the alphabet,” and whenever it results in a row of plaintext, we may
quickly determine the amount of “shift,” set up the cipher alphabet,
and start deciphering.

The same thing is true of a pair of _inverse normal alphabets_ which

have merely been _shifted with reference to each other_. But in this
case, the cryptogram (or that segment of it which is being
investigated), _must first be enciphered in the same kind of
alphabet_. To explain this, suppose that our cryptogram fragment is
_B Y K I L Y J O_. If we encipher this with the pair of inverse
alphabets which was shown at (b) of Fig. 59, we obtain a new
cryptogram fragment _Y B P R O B Q L_. This new fragment is now a
“Caesar,” and we may “run it down the alphabet” until we find its
plaintext. This particular fragment was done with a pair of inverse
normal alphabets in which the lower one began at _C_, instead of at
_Z_. Most decryptors, in dealing with any kind of substitution, will
make these two tests before trying anything else. When the guess
proves correct, a great deal of paper work can be saved.

Concerning decryptment in the case of the less simple alphabets, the

true vulnerability of simple substitution can be seen when the word
“battalion,” enciphered in alphabet (f) of our Fig. 59, becomes
_T S B B S M Z E P_. Since each letter of the alphabet may have only
one substitute, the pattern of -_atta_- shows up clearly in its
enciphered version -_SBBS_-. The decryptor knows instantly what kind
of pattern it represents, since the letters _S_ and _B_ can have only
one original each. The frequency with which these two letters have
been used in his cryptogram will tell him approximately what their
two originals ought to be, and, by making a few trials, he loses
little time in arriving at a solution. As a matter of fact, a simple
monoliteral substitution, given fewer than a hundred letters of text
and no information whatever as to source or subject-matter, can be
decrypted purely through the frequencies and other characteristics of
its letters; and if, in addition, the original word-divisions have
been preserved, we have the lengths and patterns of these words, plus
the knowledge that individual letters have their favorite positions
in words.

* * *

_The “Crypt” with word-divisions_. — Not infrequently, the cryptogram

which retains its word-divisions can be read at sight, without putting
pencil to paper, and this regardless of how short it may be. Again,
even though based on normal text, it will prove more troublesome; and
thus, in dealing with this type of simple substitution, we attack each
individual example according to what appears at first glance to be its
greatest weakness. The cryptogram shown in Fig. 62, for instance,
would be attacked through its many _short words_, probably the
simplest of the available methods. The words in question are those
numbered 3 (_RD_), 4 (_MD_), 9 (_QYR_), 11 (_RKV_), 13 (_DF_), and 15
(_DN_). Among the two-letter words, it is noticeable that every one of
these includes a letter _D_, used indiscriminately as the initial or
final letter. We do not need to know much of cryptanalysis to guess
that this letter represents the _o_ found in such words as _to_, _no_,
_do_, _go_, _of_, _on_, _or_. A comparison of the two three-letter
words shows that these, also, have a common letter, _R_, which ends
one of these words and begins the other. Of all words in English, the
commonest is _the_. If _RKV_ be assumed as _the_, then _RD_, already
thought to contain _o_, will check as _to_, another extremely common
word.

Thus we are able to begin work by _tentatively assuming_ that the

four cryptogram letters _R_, _K_, _V_, and _D_, are the substitutes,
respectively, for plaintext letters _t_, _h_, _e_, and _o_. These
assumptions are tested by actually making the necessary substitutions
directly on the cryptogram, as seen at (a) of Fig. 62. And we may be
sure that they are correct when we see the 12th word clearly outlined
as _other_. This word gives a new substitution: cipher letter _T_
evidently represents _r_, occurring in three different words; the
actual making of this substitution will cause the 8th word to show a
very common ending: -_tter_.

If we now consider the other three-letter word, the 9th of the

cryptogram, we see that _QYR_ cannot represent any one of the common
words _not_, _got_, _out_, _yet_, since the substitutes for _o_ and
_e_ have already been determined. It may, however, represent the
common word _but_, especially if we care to investigate the frequency
in the cryptogram of its first letter, _Q_. This letter has been used
only once; and its assumed original, _b_, is normally of very low
frequency, and, in addition, is known to have a fondness for initial
positions. The assumption of this word as _but_ gives us the
substitute for _u_, which appears to be _Y_.

Figure 62

Making Substitutions

(a) 1 2 3 4 5 6 7
F D R J N U H V X X U R D M D S K V S O P J R K Z D Y F Z J X
o t e t o o h e t h o

8 9 10 11 12 13
G S R R V T Q Y R W D A R W D F V R K V D R K V T D F
t t e t o t o e t h e o t h e o

14 15 16 17
S Z Z D Y F R D N N V O V T S X S A W V Z R.
o t o e e e t

(b) ...D F S Z Z D Y F R D N... ...Z D Y F Z J X...

o n a c c o u n t o f c o u n c . .
13 14 15 7

In addition to the points mentioned, it is not unusual to find that

short words, by their very positions with reference to some longer
word, will identify a whole sequence, as might happen with the
sequence shown at (b) of the same figure. Good examples of this are:
_as well as_, _as soon as_, _in order to_, and so on. In this
particular case of (b), we began with only the identified _o_, and
immediately were able to identify _t_; this alone should serve for
spotting the whole sequence _on account of_, taking into consideration
the doubled _c_. Notice what the identification of the word _account_
will do toward identifying the 7th word.

Among methods which do not seem indicated in the given example, there
is a very fertile field for research in the examination of _terminal
sequences_. When two or more of the affixes -_tion_, -_ing_, _in_-,
and _con_- are present in the same text, as they practically always
are, they will serve to identify one another, and may, in addition,
be cross-compared with many of the short words, as in, _on_, _no_,
_not_, _into_, _upon_, _can_. The prefix _sub_- may serve to identify
the word _but_. There is a whole group -_ment_, -_ence_, -_ance_,
-_ency_, -_ancy_; another group _pre_-, _re_-, -_er_, _de_-, -_ed_,
etc.; or a good comparison in _be_-, -_able_, -_ible_, etc.

Still a third road to solution, especially popular with those who

solve the “aristocrats,” is found in _pattern words_, that is, words
having one or more letters repeated. The puzzler, examining a
dictionary, prepares lists for his permanent use, one list for each
“pattern”; such a list, for instance, would contain PATTERN, FALLING
and all other words in which the third and fourth letters are the
same and all others different, another would contain all words having
the pattern STATE, DEFER, ROBOT, still another all words of the
pattern BANANA, ROCOCO, and so on. The solver, having thus armed
himself in advance, begins work by searching his cryptogram for words
having repeated cipher letters, and attempts to identify these from
the proper lists. He may provide himself, also, with non-pattern
lists, on which words have given lengths but contain no repeated
letters; and with “transposal lists” containing pairs of words (as
NIGHT and THING) which use the same letters but not in the same order.
It is true that such lists are troublesome to prepare, but they are
extremely effective; they will break the most resistant of the
“aristocrats” or the shortest example of legitimate cipher.

No matter how resistant the cryptogram, all that is really needed is

an _entry_, the identification of one word, or of three or four
letters. The experienced solver knows well that persistence will find
this entry, and trusts largely to instinct and perseverance; the
beginner, however, may feel at a loss for a “system,” and, if so,
may, perhaps, be able to find suggestions for one in the next few
paragraphs.

Figure 63

A Favorite Form of Frequency Count

Combined With CONTACT Data

A D S 2/4
R W
B

D F R M Z W W V T Z R 10/11
R M S Y A F R F Y N
E

F * Y D D Y 5/6
D Z V S R
G X 1/2
S
(Etc.)
 Concerning the numbers: A has a
frequency of 2, and a variety-count
of 4. D has a frequency of 10, and
a variety-count of only 11. (Yet
D, with so little variety of contact
is a vowel!)

First of all, in any substitution problem, there should be a counting

of the letters in the cryptogram in order to find out their
frequencies. This is called a _frequency count_, and is usually
accomplished as follows: The decryptor first lays out the normal
alphabet — either horizontally or vertically. He then begins with the
first letter of his cryptogram, taking letters one by one just as he
finds them, and for each time that he finds a letter in his
cryptogram, he places a tally mark beside that same letter as found
in his prepared alphabet. The result of such a count, taken on the
foregoing cryptogram, will be shown further on, when the same
cryptogram appears again without its word-divisions.

If the problem seems likely to prove really difficult, there should

also be a _contact count_; that is, a list showing every letter,
together with the two which have flanked it right and left each time
it was used. Such a count is partly shown in Fig. 63. This, like the
frequency count, may be prepared either vertically or horizontally;
and, just as in making ready for the frequency count, an alphabet may
be laid out in advance ready to receive the contact letters, taken
from the cryptogram as they happen to be found. Specifically: The
letter _F_ comes first in the cryptogram; it has no left-hand contact,
but is contacted on the right by _D_. We find the _F_ of the prepared
alphabet, and place beside it its contacts: *-_D_. The second letter
of the cryptogram is _D_, flanked by _F_ and _R_. We find the _D_ of
the prepared alphabet, and place beside it its contacts: _F_-_R_; and
so on to the end of the cryptogram. Some solvers do not prepare an
alphabet in advance, but simply put down the main letters as they
happen to come across them in the cryptogram. It should be added,
too, that the few contacts included in Fig. 63 were taken from the
_undivided_ cryptogram. When word-divisions exist, and are known to
be the correct ones, a great many solvers do not include any contacts
which involve two different words. Here, for instance, the second
appearance of _D_ is shown with contacts _R_-_M_. These solvers,
knowing that this _D_ stands at the end of a word, will leave the
_M_-contact blank: _R_-*

It will be noticed from the figure that the contact-count is, in

itself, a frequency count; it shows that _A_ has been used twice
(frequency 2), that _B_ and _C_ have not been used at all, that _D_
has a frequency of 10, and so on. We may also make it a
_variety-count_, by noting down beside each letter the number of
_different_ letters present among its contacts. Ordinarily, the
vowels have more variety in their contacts than do the consonants,
and take part in more reversals. The uses of contact data will be
examined more closely later on.

Now, giving our attention to English frequencies: No matter what

frequency table we examine, we always find that the letter _E_ tops
the list, with a frequency of over 12%. Except in telegraphic text,
the letter _T_ always has the second frequency, near 10%. After that,
the frequency tables will disagree as to whether _A_ or _O_ should
have the third frequency, or whether _I_ should come before _N_, or
_S_ before _R_; but always the same nine letters, _E T A O N I R S H_,
will constitute the _high-frequency group_ of letters. These
particular letters will make up about 70% of any English text, and it
is almost impossible to prepare one, no matter how short, without
using them in about that proportion, though in the shorter texts, _L_
and _D_ will sometimes creep up into the high-frequency class, taking
the place of _H_. Following the high-frequency group, we find a group
of letters which are always of _moderate frequency_; and a third group
made up of _low-frequency_ letters. Since the frequency tables
themselves are not duplicates throughout, we could not expect, even
having a 10,000-letter cryptogram, to make substitutions by simply
following the frequency table and be absolutely sure of coming out
with the correct solution, though we might very nearly do so, and
might, to some extent, succeed in doing this with a cryptogram of
2,000 letters. The “aristocrats,” however, are arbitrarily confined
to lengths which run between 75 and 100 letters. Even without
manipulation, a text of this length will not always show _E_ as a
frequent letter, and may, for some reason, show _Z_ or _X_ with a
fairly high frequency.

However, the “class distinctions” among the letters are always, to

some extent, dependable. High-frequency letters, moderate-frequency
letters, and low-frequency letters, all tend to be very exclusive.
They will exchange frequencies with letters of their own class, but
all three classes are disinclined to welcome outsiders. The vowels,
also, as we have seen, have their fraternity; if the frequency of _E_
is lowered, some other vowel, even _U_ and _Y_, will insist upon
making up the difference, rather than yield this privilege to a
consonant.

The high-frequency group, as mentioned, includes the nine letters

_E T A O N I R S H_. Even in this exclusive circle, there are cliques
— not ironclad, but clearly noticeable:

_Class I_. The letters _T O S_ appear frequently _both as initial

letters and as final letters_ in their own words, with terminal _O_
confined largely to short words. All three of these are very freely
doubled.

_Class II_. The letters _A I H_ appear frequently as _initial

letters_, but far less frequently as finals, especially _A I_. Not
one of these is readily doubled.

Class III_. The letters _E N R_ appear frequently as _final letters_,

but far less frequently as initials. The letter _E_ is very freely
doubled; the other two not so often.

The following further observation might be made: When one of these

letters changes its class, the least likely exchange is one occurring
between classes II and III.

* * *

Now let us return to the foregoing cryptogram and consider the

application of this information. A frequency count taken on this
cryptogram will show that when its letters are rearranged according
to their frequencies, they divide automatically into three rather
clearly-defined groups, much like those of the normal frequency table.
There are eight letters which outrank the rest, and these, named in
the order of decreasing frequencies, are: _R_, _D_, _V_, _S_, _F_,
_Z_, _K_, _X_. Presumably, then, most of these are substitutes for
letters of the class _E T A O N I R S H_.

If an examination now be made of the terminal letters in the

cryptogram, it will be found that, of the eight considered, the
letters _R D F_ have appeared at least once in both positions. These
we may label class (a), as being good material for the originals _t_,
_o_, _s_. It is found that the letters _S Z_ have appeared at least
once as initials, but not at all as finals. These we may label class
(b), that is, good material for the originals _a_, _i_, _h_, except
for a point which will be mentioned in a moment. The remaining three
letters, _V K X_ are found at least once as finals, but not at all as
initials; these we will call class (c), good material for the
originals _e_, _n_, _r_. Thus, we are enabled to begin our work by
noting down the following possibilities:

(a) _R D F_ might represent (I) — _T O S_. (Compare the facts: _t_, _o_, _n_).
(b) _S Z_ might represent (II) — _A I H_. (Compare the facts: _a_, _c_).
(c) _V K X_ might represent (III) — _E N R_. (Compare the facts: _e_, _h_, _l_).

While such a classification is probably never 100% accurate, the

writer has still to find a cryptogram (unless among the very badly
manipulated “aristocrats”) in which at least part of the assumptions
are not correct. We are dealing, however, with the _very short
cryptogram_, in which a single occurrence of a letter in a given
position can be regarded as of some importance.

Ordinarily, the most frequent letter of (c) will represent _e_, as it

does here. This letter is famous as a final letter, and any printed
page will show it at the end of 17 or 18 words in every hundred.
There is not so clear a distinction between _T_ and _S_ of class I.

The most vulnerable of the groups, however, is (b). Of the three

letters which may be represented here, two are vowels, concerning
which we are to hear more, and not one is readily doubled. When _Z_,
tentatively included in this group, is found to have been doubled
near the beginning of a word, it is seen to be wrongly classified.

This method, as mentioned, is intended merely as a suggested means

for effecting an entry. The correct identification of only four
letters, as we have seen, will make enormous inroads into the
contents of a cryptogram.

Other points which will at times prove helpful are as follows: In

words of three and five letters, the central one is nearly always a
vowel, taking it for granted that the words _the_ and _and_ will
never be present in any difficult cryptogram. In the longer words,
the favorite positions of the vowels are the two positions which
follow the initial letter and the two positions which precede the
final letter. The favorite position of _I_, in fact, is well known as
the third-to-last. About half the words used in any written text are
of the type called _negative_, or _empty_; that is, the pronouns and
auxiliary verbs, and particularly the various kinds of connectives
_without which_ _no sentence can be put together_. If your cryptogram
is an “aristocrat,” you will probably find that most of your
prepositions begin with _A_: _amongst_, _amidst_, _adown_, etc. Every
sentence contains a verb, and these are more or less limited in their
possible terminations. Any letter used only two or three times, and
always followed by the same letter, is good material for _Q_. With
what has been said, the student should have no trouble in dealing
with the first fifteen “aristocrats” which follow the next chapter.
As to the remaining thirty-five of Mr. Lamb’s collection, we need say
only this: It is impossible to avoid every characteristic of the
English language and still write English.

* * *

_The General Case_. — Now let us examine carefully Fig. 64, where the
foregoing cryptogram is repeated without its word-separations, and is
followed by its frequency and contact data. The various devices
indicated in this figure are all of a more or less optional nature.
Concerning the preparation of the cryptogram itself, the chief
requirement is that it be done in ink, or typewritten, on paper which
will suffer a great deal of erasure. The placing of its frequency
figure above each letter is highly recommended, but not vital. Many
solvers will underscore all possible repeated sequences, and will
indicate in some other manner all reversals of digrams; others will
underscore only the repeated trigrams and longer sequences; and still
others do not underscore at all, being content to have all of these
repetitions and reversals listed before them in the contact data.

Figure 64

5 10 11 3 3 2 1 9 4 4 2 11 10 1 10 6 4 9 6 2 1 3 10 4
F D R J N U H V X X U R D M D S K V S O P J R K

5 10 3 5 5 3 4 1 6 11 11 9 3 1 3 11 3 10 2 11 3 10 5 9
Z D Y F Z J X G S R R V T Q Y R W D A R W D F V

11 4 9 10 11 4 9 3 10 5 6 5 5 10 3 5 11 10 3 3 9 2 9 3
R K V D R K V T D F S Z Z D Y F R D N N V O V T

6 4 6 2 3 9 5 11
S X S A W V Z R

Ordinary Frequency Count:

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
2 10 5 1 1 3 4 1 3 2 1 1 11 6 3 2 9 3 4 3 5

Contact-Information:

(High-frequency symbols)

R D V S F Z K X

D.J F.R H.X D.K ..D K.D S.V V.X

U.D R.M K.S V.O Y.Z F.J R.Z X.U
J.K M.S R.T G.R D.V S.Z R.V* J.G
S.R Z.Y* F.R F.Z D.S Z.D R.V* S.S
R.V W.A K.D T.X Y.R V.R
Y.W W.F K.T X.A
A.W V.R N.O
V.K T.F O.T (Low-frequency symbols)
D.K Z.Y* W.Z
 F.D R.N G H M P Q
Z.. X.S U.V D.D O.J T.Y

(Moderate-frequency symbols)

J N T W Y A O U
R.N J.U V.Q R.D* D.F* D.R S.P N.H
P.R D.N V.D R.D* Q.R S.W V.V X.R
Z.X N.V V.S A.V D.F*

As to the preparation of the contact data, most of the expert

decryptors seem to prefer the vertical arrangement of Fig. 63 to the
one shown here. But, in simple substitution, a full listing, made for
all letters, is not necessary in dealing with the average cryptogram.
Usually, it will serve the purpose to make a frequency count first,
and then prepare a listing of contacts which includes only chosen
letters, those of very high frequency and those of very low frequency;
with many cryptograms, no listing at all need be prepared. The contact
data, however, are valuable. Each pair of contact-letters actually
indicates a trigram. Examining, for instance, the listing under _R_:
The first expression, _D.J_, represents a trigram _DRJ_ in which the
central letter was omitted in order to conserve time and space. When
we find, lower down in the same listing, another letter _D_, we see
in this a repeated digram _DR_. Considering the right-hand side of
the same listing: When we find _K_ used three times, we see this as a
digram _RK_ used three times. _By finding its duplication, under K_
(left side), we are able to see that two of these repetitions are
continued as parts of a repeated trigram _RKV_. In the list of
contacts for _D_, we find a repeated trigram _ZDY_, which may be
traced, under _Y_, as part of a longer repeated sequence, _ZDYF_. It
is usually best to underscore these longer repeated sequences on the
cryptogram; often, they can be identified from the list of frequent
trigrams. But repeated digrams, as a rule, are so numerous as to be
in the way when noted on the cryptogram itself. With digrams, only
those which are repeated oftenest need be underscored; they can
nearly always be identified directly from the list of frequent
digrams. The solver, then, prepares his cryptogram and sequence data
to suit himself, varying his method according to the difficulty of
the given example. With this done, his usual method of solution
follows the process popularly known as “vowel-spotting.”

* * *

_The Vowel-Solution Method_. — Using this process, the first step is

that of separating the vowels from the consonants; the second is that
of assigning identities to the selected vowels, and afterward to the
most recognizable of the consonants.

For assistance in applying this method, suppose we extract certain

information from the digram chart and have this concretely before us
in a series of numbered “pointers”:

1. The vowels _A E I O_ are normally found in the high-frequency

section of the frequency count; the vowel _U_ in the section of
moderate frequencies, and the vowel _Y_ in the low-frequency section.

2. Letters contacting low-frequency letters are usually vowels.

3. Letters showing a wide variety in their contact-letters are
usually vowels.

4. In repeated digrams, one letter is usually a vowel.

5. In reversed digrams, one letter is usually a vowel.

6. Doubled consonants are usually flanked by vowels, and vice versa.

7. It is unusual to find more than five consonants in succession.

8. Vowels do not often contact one another. If the letter of highest

frequency can be assumed as _E_, any other high-frequency letter
which never touches _E_ at all is practically sure to be another
vowel, and one which contacts it very often cannot be a vowel. (This
will apply equally to other vowels, wrongly assumed as _E_.)

With a text of reasonable length, say 150 letters, it is sometimes

possible to determine with certainty just which of the
cryptogram-letters represent the six vowels; with shorter cryptograms,
we can usually find four; sometimes only three. But once the
separation has been made, individual vowels can usually be established
as follows:

The most frequent one is ordinarily _E_. The one which never touches
it is most likely to be _O_. Both of these are very freely doubled,
and for that reason are often confused with each other, but seldom
with any other vowel. They rarely touch each other.

The vowel which follows _E_ and almost never precedes it, is _A_.

The vowel which reverses with it is _I_.

The same two observations will apply to the vowel _O_; but a
distinction occurs when the vowel _U_ can be found; this vowel
precedes _E_ and follows _O_.

The only vowel-vowel digrams of any real frequency are _OU_, _EA_,
_IO_.

Three vowels found in succession may represent _IOU_, _EOU_, _UOU_,

_EAU_.

As to identification of the consonants: Those letters still remaining

in the high-frequency section of the frequency count will usually
include _T N R S H_. Of these, the most easily identified is _H_,
which precedes all vowels and seldom follows one; it may be identified
often as part of repeated sequences _TH_, _HE_, _HA_.

Next to _H_, the most recognizable of the consonants, aside from

frequency, is probably _R_, which reverses freely and indiscriminately
with all vowels, and has a strong affinity for other high-frequency
letters.

The consonant _T_ can usually be identified by its frequency, by its

tendency to precede vowels rather than follow them, and by its almost
inevitable combination with _H_ on more than one occasion. It is also
notably difficult to distinguish from the vowels.
The letter _N_ has characteristics which are to some extent the
opposite of those mentioned for _H_; it prefers to follow vowels and
precede consonants, and, to a lesser extent, the same is true of _S_,
according to some charts. However, _N_, _S_, and _T_ are all readily
reversible with vowels, and are sometimes hard to tell apart.

The only frequent reversals of two consonants are _ST_-_TS_ and

_RT_-_TR_.

The doubles _TT_ and _SS_ are among the most frequent in the language.

Having this information, together with what we know of frequent

digrams and frequent trigrams and very common short words, we are
well armed against the longer cryptograms. Those which are shorter
will give more trouble; but it takes a very short cryptogram indeed
to be really resistant.

Our foregoing cryptogram contains only 80 letters.

Figure 65

(Cryptogram Frequencies:)
R D V S F Z K X
11 10 9 6 5 5 4 4
E T A O N I R S H
(Normal Grouping)

To apply “pointers” in this case, let us begin by considering the

individual frequencies of the letters _E T A O N I R S H_. Their
frequencies per 100, according to our own chart, are about as follows:
_E_, 12; _T_, 10; _A_, 8; _O_, 8; _N_, 7; _I_, 7; _R_, 6; _S_, 7; _H_,
5. Thus, when frequency alone is considered, _E_ and _T_ have a
tendency to draw away from the others and form a private
high-frequency group of their own. The distinction among the others
is not so clear, and not always the same in all tables; we can only
say of these that _A_ and _O_ will always outrank the rest, and will
be closely followed by one of the others, usually _N_, and that _H_
will always rank last.

Thus, the high-frequency group itself tends to sub-divide more or

less clearly into three minor groupings: _E T_ — _A O N_ — _I R S H_.
Of these, the first minor group shows one vowel, the second shows two,
and the third shows one; the vowels _U_ and _Y_ are not present.

Now if the eight leading letters of our cryptogram, already listed as

_R D V S F Z K X_, be examined in this respect, it is found that
these, also, have a tendency toward separation into groups of
differing frequency, which more or less correspond to the normal
groupings, as indicated roughly in Fig. 65.

Normally, we expect the highest of these subdivisions to contain one

vowel and one consonant, specifically _E_ and _T_. When we find that
the corresponding subdivision of the cryptogram contains three
letters, the supposition is that one of the vowels, _O_ or _A_, has
moved up into this section; in that case, it has taken part of the
frequency of _E_, making it not at all unlikely that the most
frequent letter of the cryptogram will not represent _E_, and will
not, in fact, represent a vowel. And if, as we believe, there are two
vowels in the highest section, then we are not likely to find more
than one in the central subdivision, especially when we note that it
contains only three letters. This would leave the fourth vowel to be
found in the third subdivision.

Thus, we have applied pointer No. 1. For the application of pointer

No. 2, we turn to the contact data. Comparing first the three letters
_R D V_, and making a careful inspection of all cryptogram letters
whose frequency is 3 or lower, we find that, of our three letters,
the letter _R_ has 7 contacts with low-frequency letters, the letter
_D_ has 9, and the letter _V_ has 8. Thus, the letter _R_, though
having a higher frequency than the other two, has fewer low-frequency
contacts than either, and so begins to draw away and assume the
aspect of a consonant.

The application of pointers Nos. 3, 4, and 5, provides no satisfactory

distinction. But in pointer No. 8, we find a very clear distinction:
_D_ and _V_ have touched each other only once, while _R_ has contacted
both with a total of six contacts — a great many for a cryptogram of
this length.

We decide, then, that _R_ is a consonant, and that _D_ and _V_ are
vowels.

Considering the central subdivision, where we expect to find one

vowel: Application of pointer No. 2 shows that _S_ has four of the
low-frequency contacts, while _F_ has two and _Z_ has only one.
Further examination of _S_ by pointer No. 3 shows that it has an
unusual variety in its contact-letters. Thus, _S_ would appear to be
the vowel here.

As to the third section, there is so little difference in frequency

between these letters and some others not included in the
high-frequency class, that any distinction found would not be
convincing.

The individual cryptogram, however, has happened to contain the

sequences _VXXU_, _SRRV_, _SZZD_, _DNNV_. Application of pointer No.
6 confirms our previous selection of _D_, _V_, _S_, as vowels, and
suggests that the letter _U_ might also represent a vowel. Since the
frequency of this letter is only 2, we cannot feel so confident in
drawing conclusions about it; however, a glance at the contact data
shows that it has touched four different letters, which is 100%
variety, that one of these four letters is an accepted consonant, and
that none of the other three, so far, is an accepted vowel (pointers
3 and 8). The chances are that this letter _U_, with its low
frequency, represents _y_ in some such formation as _ally_, _ully_,
_etty_, etc.

With four vowels tentatively isolated, we are now in a position to

apply pointer No. 7, and this we may do by returning to the cryptogram
and marking for attention each appearance of each supposed vowel. This
is usually done by circling each one with a pencil mark. In Fig. 66,
a small letter “v” has served the same purpose, and a few serial
numbers have been added for convenience of reference. Now let us
examine Fig. 66.

At (a), watching the small “v’s,” we find a fairly uniform

distribution of vowels except for three long segments beginning,
respectively, at the 20th, 27th, and 37th letters. For convenience,
these have been copied out at (b). The two of these which are longer,
and therefore most likely to contain at least one of the missing
vowels, are both found to have included _Z_ and _J_. Of these two
letters, _Z_ is one which was previously discarded (from the central
section of the high-frequency group) during our preliminary
investigation. Examining it again, to make sure, we find it now as a
double between two supposed vowels, and having two additional contacts
with supposed vowels (pointers 6 and 8). But _J_, we find, has never
contacted any supposed vowel; it reverses with a supposed consonant,
and shows as much variety as could be expected of a letter appearing
only three times.

Figure 66
(a)
v ? v v v v v v v v ? 25
F D R J N U H V X X U R D M D S K V S O P J R K Z

v ? v v v v v 50
D Y F Z J X G S R R V T Q Y R W D A R W D F V R K

v v v v v v v v v v v 75
V D R K V T D F S Z Z D Y F R D N N V O V T S X S

v 80
A W V Z R

(b) 20-25 27-32 37-41

O P J R X Z Y F Z J X G T Q Y R W
? t ? t

(c)
F D R J N U H V X X U R D M D S K V S O P J R K Z
e t i y o y t e e a h o a i t h

D Y F Z J X G S R R V T Q Y R W D A R W D F V R K
e i a t t o t e t e o t h

V D R K V T D F S Z Z D Y F R D N N V O V T S X S
o e t h o e a e t e o o a a

A W V Z R
o t

(d)
Preliminary assumptions: y t e . e a h o a . t h o e t h o .
CORRECTIONS: y t O . O a h E a . t h E O t h E .
...to go ahead... ...the other...

(e)
F D R J N U H V X X U R D M D S K V S O P J R K Z
o t i y e y t o o a h e a i t h
N F G D W
 Notify *e**y to go ahead with.......

The acceptance of _J_ provides five of the vowels, with frequencies

of 10, 9, 6, 2, and 3 — a total of 30 out of an expected 32. In a
longer cryptogram, we should probably look for the sixth vowel among
those letters having approximately the correct frequency for making
up the expected 40%. As to the present case, we should have no trouble
selecting it from the five-letter segment at (b); but this would cause
us to spot also the short word in which it is used, and our immediate
concern is that of spotting vowels only through their known
characteristics as vowels. We will assume, then, that the last vowel
cannot be found.

The next step demands that we assign to the most frequent of the
supposed vowels the value _e_, which happens to be a wrong assumption.
Concerning this, it may be well to repeat here something which has
already been said: In dealing with the simplest of cryptograms, there
is often a short detour into trial and error. Also, the average
decryptor, accustomed to the work, and fully aware of what he may
expect from only 80 letters of text, will usually pause at this point
and make some further observations before filling in any of his
substitutions. However, there is value even in the making of wrong
substitutions; the actual placing of supposed plaintext values in
their supposed positions puts the plaintext possibilities before us
_in visual form_, causing us to note easily those very points for
which the experienced decryptor examines in advance.

Figure 67

1. F D R J N U H V X X U R D M D S K V S O P J R K Z D Y F Z J

X G S R R V T Q Y R W D A R W D F V R K V D R K V T D F S Z

Z D Y F R D N N V O V T S X S A W V Z R.
(80 letters).

2. H V X X U T V W D T R A Z D Y F Z J X T V S O U R D S Z R N

S E D T S Q X U L K S E V O T D W W V O D R K V T G S R R V

T Q Y R A Y M M V A R P V A K D Y X O H V V W K S G G V T J

F M S R R K J A R K T D Y M K T J Z K S T O A L R K J F H R

K V U G S U M T S F R R K V A Y Q A J O U R K S R U D Y A W

D H V D N.
(155 letters. - Total for both cryptograms: 235).

At (c), then, we have made our substitutions. We have assumed that

the most frequent vowel, _D_, is representing _e_. Having noted the
v-v digrams _DS_, _VD_, _VS_, we have selected _S_, rather than _V_,
as the substitute for _a_, preferring a digram _oa_ (_DS_) to a
digram _ao_ (_VD_). This leaves the vowel of second frequency, _V_,
to represent _o_. This will cause the third of the v-v digrams (_VS_)
to represent _oe_, not frequent, but better than the digram _ao_
previously mentioned. _J_, then, probably represents _i_, and _U_ may
represent _y_.

As to consonants, we have assigned the value _t_ to the most frequent

one, _R_, and there has been no difficulty in identifying _h_ in the
letter _K_, which three times has followed _R_. But our present
cryptogram is too short to provide any clear distinction among letters
which might represent _n_, _r_, _s_. With the seven substitutions
made, as shown at (c), notice how quickly it becomes possible to spot
the incongruity of sequences _tho_, more than once, in a short text
which contains not a single occurrence of _he_ or _ha_. Notice again,
at (d), how quickly the mere exchanging of the values _e_ and _o_
will bring out word-suggestions.

At (e), the first line of the cryptogram is repeated, as it would

appear after the making of this exchange. The beginning of the
message can almost be read: The first word appears to be _notify_,
furnishing two new substitutes. Three more can be furnished in the
suggested sequence _to go ahead with_. And here, the word _with_
would be tried in any case, because it is a common word, and because
the frequency of the letter _P_ is suggestive of _w_. Arrived at this
point, we begin to notice patterns: _postpone_, _council_, _account_,
_matter_, and so on; so that the rest of the solution is largely a
matter of filling in framework. In the given example, it would also
be noticed that _F_ and _N_ have resulted from reciprocal
encipherment; this may not be the case with other letters, but it
presents a possibility which is always well-worth investigating.

Figure 68

Digram Count for the Longer Cryptograms

(First-Letters)

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
A 1 1 1 1 2 1 3 1 A 11
B B
C C
D 1 1 1 1 1 3 3 1 2 4 3 D 21
E 2 E 2
F 2 2 1 3 F 8 *
S G 1 1 1 1 1 G 5
e H 1 1 1 1 H 4 *
c I I
o J 1 2 1 1 2 2 J 9
n K 1 1 1 10 1 1 1 K 16
d L 1 1 L 2
{. M 1 1 1 1 2 M 6
L N 2 1 1 1 N 5 *
e O 1 2 1 3 1 O 8
t P 1 1 P 2
t Q 1 2 1 Q 4
e R 3 3 2 1 1 1 4 4 1 3 1 2 2 R 28 *
r S 2 1 3 4 1 1 3 2 1 S 18
s T 2 2 1 1 1 1 6 1 T 15
U 1 2 1 1 1 3 U 9
V 1 1 1 4 6 1 1 1 1 2 2 1 2 V 24
 W 2 1 2 2 1 W 8
X 2 1 1 2 2 1 X 9
Y 2 6 2 Y 10
Z 1 2 1 1 2 1 1 Z 9
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
9 5 4 27

Most Frequent Digrams

RK, 10 KV, 6 WD, 4 SR, 4

VT, 6 DY, 6 RR, 4 KS, 4
HV, 4

* * *

_The Digram-Solution Method_. — This method, representing another of

our many debts to M. E. Ohaver, may be used either in conjunction with
the vowel method, or independently, as the fundamental method of
attack. For a satisfactory demonstration, however, we need more
material, and Fig. 67 shows our cryptogram again, together with a
suspected reply. Thus we have a length of 235 letters, so that the
preparation of contact-notations, which we found sufficient in the
preceding case, becomes here an irksome task.

For these longer cryptograms, it is usually best to put all of our

data into the form of a _digram-count_, as indicated in Fig. 68. This
is most easily done as follows: Using a sheet of cross-section paper,
mark off the limits of a 26 x 26 square; write the normal alphabet
across the top, so that each of its letters will govern a column; and
write it again along one side, so that each letter will govern a row.
For added convenience, these two alphabets may be repeated, as they
are shown in the figure. Now, remembering that each letter in the
text is the first letter of a digram (except the two which are
finals), our two texts, with their total of 235 letters, are to
provide a count on 233 digrams. Taking letters one by one, just as
they come in the cryptograms, find each letter in the upper alphabet;
find, in the side alphabet, the letter which immediately follows it
in the cryptogram, and count this digram by placing a tally-mark in
the cell at which the column and row governed by these two letters
are found to intersect. In the figure, the tally-marks have been
replaced with numbers showing their totals. It will be noted that the
process described is identically the method which would have been
used by Meaker in preparing the digram chart; and, just as in the
case of the digram chart, the counting of the digrams has
automatically counted the single letters. To obtain their frequencies,
we may total either the columns or the rows, taking the larger figure
in those few discrepancies caused by initial or final letters. With
the chart understood, the digram-method of solution can be shown in a
nutshell.

An inspection of this chart enables us to find quickly that the

leading digrams are those listed: _RK_, _VT_, _KV_, _DY_, etc. These,
almost certainly, are the substitutes for digrams ranking high on the
normal list, and many others, having a frequency of 3, are very likely
indeed to be substitutes for digrams from that same high-frequency
class. Our text, of course, is still short, even with 235 letters,
and we do not invariably find, in texts of this length, that the
ranking digram (in this case _RK_, frequency 10) is the substitute
for _th_, though the chances are, at all times, that it is. And
should it prove here that _RK_ does not represent _th_, then we may
be quite sure that _th_ is represented in one of the digrams _VT_,
_KV_, _DY_, having the next frequency, 6. With the single exception
of _RR_, each digram of the nine which are listed below the chart can
be checked against three other digrams: Its own reversal; the doubling
of its first letter; and the doubling of its second letter. In
addition, it may be checked through the individual frequencies of its
two component letters. These points of comparison, made for each of
the nine leading digrams, have been tabulated in Fig. 69, so that the
discussion may be easily followed.

Examining _RK_, assumed to represent _th_: Its reversal, _KR_, has

not appeared on the chart, which is satisfactory for a digram of no
greater frequency than its supposed original, _ht_. The doubling of
its first letter, _RR_, has appeared four times, which is satisfactory
for _tt_, one of the leading doubles of our language. The doubling of
its second letter, _KK_, has not appeared, which is eminently
satisfactory for a digram as rare as _hh_. Its first letter, _R_, has
a frequency of 28, the highest in the cryptogram, which is not at all
unusual in the case of _t_; and its second letter, _K_, has a
frequency of 16, a little high for _h_, but not unsatisfactory. Thus,
we find nothing, so far, to contradict the supposition that the
digram _RK_ is the substitute for _th_. But if _K_ represents _h_, it
should be possible to find digrams beginning with _K_ which will
check equally well as the substitutes for _ke_ and _ka_. We do, in
fact, find _KV_ and _KS_. But which is which? Examination of Fig. 69
shows that one of these, _KS_, has a reversal, _SK_, frequency 1; but
this is not informative, since it would be equally expected of _eh_
or _ah_. Further examination shows that _V_ has been doubled, which
is far more characteristic of _e_ than of _a_. Also, the individual
frequency of _V_, 24, is the second highest in the cryptogram, and
more likely to be that of _e_ than that of _a_. Thus we may assume
that _KV_ represents _he_ and that _KS_ represents _ha_. This
automatically identifies the digram _SR_ as _at_. As to _VT_, this,
apparently, involves the only reversal of any prominence in the
cryptogram. Its first letter has already been identified as _e_, and
the outstanding reversal of the language is _er_-_re_. This is not so
certain as in the preceding cases, but the frequency of _T_ is
satisfactory as that of _r_.

Thus we have identified the letters _t_, _h_, _e_, _a_, _r_, which is
as far as the tabulation has been carried. Having the substitute for
_h_, we may now bring in the vowel-solution method through examination
of digrams _KD_, _KJ_, _KT_, _KZ_; or continue with the
digram-solution method by looking over the field for some of the other
_h_-digrams: _sh_, _ch_, _wh_, _ph_, _gh_, and so on. The first of
these should be easily identified by the frequency of _s_, and, in
addition to the regular three check-digrams, we might check this
against a possible _st_, another of our leading English digrams. With
the process explained, we need not go further; the substitution of
letters _t_, _h_, _e_, _a_, _r_, _s_, will surely break any simple
substitution cryptogram. Possibly, enough has not been said as to the
use of the trigram list, the consideration of common affixes, common
short words, and so on; but these are all points which the student
can best develop for himself.

Figure 69
 Digram Doubled Letter Letter Frequency Supposed
Identity
Original Reversed 1st 2d 1st 2d

R K 10 K R... R R 4 K K... R 28 K 16 t h
V T 6 T V 2 V V 1 T T... V 24 T 15 e r
K V 6 V K... K K... V V 1 K 16 V 24 h e
D Y 6 Y D... D D... Y Y... D 2l Y 10 ?
W D 4 D W 1 W W 1 D D... W 8 D 2l ?
S R 4 R S... S S... R R 4 S 18 R 28 a t
K S 4 S K 1 K K... S S... K 16 S 18 h a
R R 4 .... .... .... R 28 t t
H V 4 V H... H H... V V 1 H 5 V 24 ? (-e)

Another point, however, must not be overlooked: _the long repeated

sequences_ _HVXXU_, _ZDYFZJX_, _DRKVT_, _GSRRVT_. Repeated sequences
of these lengths will usually come from _repeated whole words_, making
it possible, to some extent, to attack the cryptogram by word-division
methods. It is, in fact, the repetition of sequences, these and many
others, which, in the beginning, has led us to assume that both
cryptograms are using the same key. As to the recovery of this key, we
need not wait until solution is complete. Even in simple substitution,
it is well, during the identification of substitutes, to have before
us a sort of skeleton key, in which the plaintext alphabet has been
written out in normal order, so that the substitutes, as fast as
their identities are discovered, can be placed below their originals.

Thus, having identified as many as twelve letters in our present

cryptogram, this skeleton key, or framework, might begin to assume
the appearance which is indicated in the upper tabulation of Fig. 70.
Here, we are able to note a reciprocal encipherment between _A_ and
_S_, _F_ and _N_, _R_ and _T_, and _U_ and _Y_, suggesting that the
whole encipherment may have been reciprocal; if so, we have the
identities of four additional substitutes: _O_, _I_, _H_, _E_,
representing _d_, _j_, _k_, _v_, respectively. If they are present
in the cryptogram, these four substitutions may be tried; but with
or without their presence in the cryptogram, they can be added to the
skeleton key, as in the lower tabulation of the figure. Notice that
when this has been done, the cipher alphabet is beginning to show
alphabetical sequences (reversed). We find _H I J K_, and, just
before this, _D F_, which is an alphabetical sequence if the letter
_E_ has been taken out for use in a key-word. Between _DF_ and _HIJK_
of the cipher alphabet, we need only _G_ to fill out the sequence;
therefore either _l_ or _m_ must belong to the key-word; comparing
this with what is found at the other end of the sequence, we find
that either _L_ or _M_ would be the substitute for _g_. Between _NO_,
we find _V_, evidently misplaced; and, following _O_ and preceding
_S_, we find two positions which may be occupied by two of the
letters _PQR_, of which _R_ has already been placed (under _t_). That
is, where the encipherer has used a key-word-mixed alphabet without
troubling to carry it through a transposition process of any kind, we
are often able to build it up again, and make it help us in the
solution. This is especially true if he has used reciprocal
encipherment; with the substitutes which may actually be found in our
foregoing cryptograms, a little rearrangement is all that is needed
in order to discover exactly what the original key was. When the
cipher alphabet has been carried through a transposition block, it is
not so easy to recover during the actual process of solution;
afterward, however, it is not usually difficult to treat it by one of
the transposition processes, just as if it were a transposition
cryptogram of 26 letters. In the examples which follow, the
key-word-mixed alphabets were used as they stood, though we believe
that none of the encipherment was reciprocal. In one case, however,
the plaintext and cipher alphabets were both mixed, according to
different key-words, so that the recovery of this key may prove
troublesome.

Figure 70

Supposing 12 substitutes to have been identified:

Plaintext alphabet: a b c d e f g h i j k l m n o p q r s t u v w x y z
CIPHER ALPHABET: S V N K J F D T A R Y U

Assuming reciprocal substitution:

Plaintext alphabet: a b c d e f g h i j k l m n o p q r s t u v w x y z
CIPHER ALPHABET: S O V N K J I H F D T A R Y E U
Q?P? * L? G? C?B?* * T?
M?

45. By PICCOLA.

S C Y J T O P N R M J T U E A W S R O R O A E P Q R J C R O A R M P H
Q K J Q S R S J H A X P F K E A Q R M Y S R P Q P M P S E C A H G A W
S R O P E E E S H A Q O P V S H I R O A Q P F A E A H I R O P H N P Q
R J H T F U A M C J M R Y R O M A A W A E E B T Q R W M S R A S R J H
A I M J T K U A E J W P H J R O A M P H N Q A A W O P R Y J T Q A A L.

46. By PICCOLA. (Plaintext and Cipher Alphabets have each a key-word).

J C W E H S N D F S B N J I V T E A G V D H O C Q Q I Q F R P H F K Q
E A R F Q A R F A H F Q E J C B N J N H B E O C B N L N O V H B L F Q
J B N A B L F V H C A J I V B N W N S T B L E A G V A J N S R F W N S
Y R V S S C A E H V A Q F C J E A G J N A W N S O V B V C Q Y D C S P
H E H O C S P E A G B E O N A F R L C A G N E A K C S O N S H A C B E
F A C Q X.

47. By PALOMITA. (No key-word).

B O Y B A N K I L L A P K R I Y A P Y Y U P B L Y E R P B P L G Y G M
H L A B O Y K J A K L P Y L H H J A C R P O R C Q U Y N B H L A B O Y
G N A Z N Y L H B O Y K N A N P R B R W O J C B R C Q D N P K.

48. By PICCOLA. (Of these two, one has normal word divisions; the other has not).

W T E I C H E P P C A E P T J W P O Y D Q P R M E L U E I N D E P Q T C
Q D Q D P C P D H K G E P U O P Q D Q U Q D J I C. I S Y E Q T C P V E M Y R
E W M E K E C Q E S P E L U E I N E ? P D Q H U P Q C G P J T C V !
E O E E I Q M C I, P K J P E S X Q T E Q M C I P K J P D Q D J I D P U P U
C G G Y J R Q T E V E M Y P D H K G E P Q F D I S.

49. By PICCOLA.
P B K L A B E I C D J D B I L Y P K L D O I X L Y I P K V Y A L ?
A G F Y A M I L K L Y I K I D C A G G L D O I X V D J R K L Y I C P B R P B
N
X D Q A J I ? Q K J I S P B R K L Y A L A B R M X Q F P L F P E O L D
I B R V Y P E Y O B D V X D Q P C E G I A J F I J C I E L G X P K
S I A B P B N P L K. A J P K L D E J A L A B B D L P K L Y P K B D !

CHAPTER X
The Consonant-Line Short Cut
_A Method for Attacking Difficult Cases_
By George C. Lamb

Several routine methods have been evolved for special use on the very
difficult “aristocrat” — that fascinating form of simple substitution
with word-divisions in which the message is of no importance whatever
and the encipherer’s full attention has been given to manipulation of
letter characteristics. Of the several such methods which have proved
workable over a long period of years, the author’s favorite is the
“consonant-line” method, the exact value of which has been tested in
a special analysis of 130 very difficult cryptograms. However, it
should be stated clearly that no method is a mechanical crypt-solver;
these devices merely serve to bring out clues which to the haphazard
worker are totally invisible. For discussion, we will consider an
example by M. E. Bosley which appeared as No. 19 Aristocrat in _The
Cryptogram_ for June, 1936. This is shown at Fig. 71.

The work must be initiated by isolating a small group of consonants,

and the problem of selecting these with certainty is one which for
years has baffled the shrewdest solvers of both the National Puzzlers’
League and the American Cryptogram Association. Many successful
solvers have based their selection on frequency alone, rearranging
the letters of a frequency count in the order of decreasing frequency
and marking off a section of low-frequency letters which will
presumably include only consonants. But the clever manipulator is
able to distort frequencies out of all resemblance to the normal
table, and here we will base our selection on _variety of contact_
— something which the constructor cannot successfully manipulate.

Figure 71

U W Y M N X K A E H X R B Z U V X M U W B Z O Y Z T W H V C X Y A
C Y A U Z D B R A H V K B A; Z W S V A H K U Z B K C, M S C X
C Y X B S, X V Z Y T R Y C X P.

Fig. 72 sums up the entire process. At (a) we have a list of contacts

taken in the order of appearance of the letters, and at (b) a
rearrangement of the cryptogram letters _in the order of decreasing
variety of contact_. Immediately above each letter is its “variety
count” and directly above this is its frequency figure. In this
set-up, a certain number of letters taken at the extreme right may
confidently be marked off as a group of consonants. As to just where
the line of demarcation may be set, recent analysis has shown that it
is safe to include 20% of the total variety-count. In this case, the
sum of all variety-figures is 104, and 20% of this, roughly, is 21.
If we begin with _P_ at the extreme right and add numbers backward
for a count of 21, we find that the line of demarcation falls between
_R_ and _C_. However, we have at this point four letters, _M_, _R_,
_C_, _S_, whose variety-count is uniformly 5, and any two of which
might have occupied the places of _C_ and _S_. To accept a vowel at
this stage would mar the effectiveness of our system, and either we
must discard all four of these letters, or we must find a means of
differentiation other than their variety of contact. At this point,
letter-frequencies come into play.

Examining the set-up just as we have it prepared at (b), note that

the two figures just above _M_ are 3-5. This is a “step-up” of 2
points. Note that just above _R_ we have the same two figures 3-5,
another step-up. Above _C_, we find the two figures 6-5, this time a
“step-down” of 1 point; and above _S_ we again find 3-5, a step-up.
According to years of observation, confirmed by investigation of
special cases, a vowel nearly always shows a tendency to step up,
while consonants are prone to step down. Thus among our four doubtful
letters, there are three, _M_, _R_, and _S_, of which one will
probably be a vowel. But the remaining letter, _C_, has the step-down
peculiar to consonants; and while a step-down of only 1 point would
not be definitely informative when found at the left end of the
set-up, it almost certainly indicates in the present position that
_C_ is a consonant. Thus, we are able to include seven letters,
_C T N E O D P_, in our group of “sure-fire” consonants, but have to
dispense with several points of our 21-count.

Figure 72

(a) List of Contacts

U6 W7 Y9 M5 N2 X10 K7 A7 E1 H6 R5 B8 Z6 V8 O1 T4
C5 D1 S5 P1

-W U-Y W-M Y-H M-X N-K X-A K- -H E-X X-B R-Z B- U-X -Y Z-W
V-X -B W-V X-
-V U-B O-Z X-U H-R V-B Y- W-V B-A W-Z B- H-C Y-R
-Y M-C
M-W T-H X-A -S V-M H-D Y-U A-V T-Y D-R Y-T H-K
K- B-
A-Z Z-S C-A C-Y B-C R-H A-K K-A U- S-A
S-X
K-Z C-X C- B- Z-K -W X-Z
-Y
Z-T Y-B V-H X-S U-B
Y-X
R-C -V V-Y
C-P

(The figures give the "variety-count," or number of different letters contacted.

Roversals may be
indicated by circling letters. Note that in dealing with normal word-divisions,
we may omit contacts
falling between one word and another).

(b) Basis for Primary Isolation of Consonant-Group:

 Letter-frequencies: 8 7 6 5 4 4 6 5 4 7 3 3 6 3 2 1 1 1 1 1
VARIETY OF CONTACT: 10 9 8 8 7 7 7 6 6 6 5 5 5 5 4 2 1 1 1 1
(104)
X Y B V W K A U H Z M R C S T N E O D P

(c) (d) (e) (f)

3d word:
FIRST CONSONANT LINE SECOND CONSONANT LINE THIRD CONSONANT LINE

x . x x x
C T N E O D P C T N E O D P A U C T N E O D P A U W Z
U V X M U W B Z
│ │ │
H
v│ vv│v vvv│v
x│xxxx x│xxxx x│xxxx (Vowel) (g)
7th word:
yy│yyy yyyy│yyy yyyyy│yyyyy (Vowel)
k│ kkk│ kkk│ x x
x x x x . x
s│ s│ s│s Z W
S V A H K U Z B K C
z│ z│zz zz│zz (Consonant)
│w │www │wwww (Consonant H) (h)
4th word:
│r r│r r│r
m│ mm│ mm│ x .
x x x x x . . x
│h │hhh │hhhh O Y
Z T W H V C X Y A
│b b│b bbb│bbb (Vowel)
H
│ │u uuuu│u (Consonant)
a│ s│ (Consonant)
│ t│t (Consonant)
│

At (c) we have the beginning stage of the actual investigation, while

(d) and (e) are amplifications of the first stage. In these the
original consonants are used to determine other consonants,
progressing from stage (c) to stage (e). First, the original group of
consonants is set down on a sheet of paper, and the space below it is
bisected by the consonant-line. Consulting (a), we then find the
letters of this group one by one, and all contacting letters which
precede any one of them we set down on the left side of the
consonant-line, and all those which follow any one of them we set
down on the right side, always once for each time that the contacting
letter appears. Thus we have stage (c). While we do not often
encounter doubled letters in this form of cryptogram, it may be well
to say here that while a doubled letter would be counted among the
frequencies of letter appearance, its contacts with itself would not
be entered on the consonant-line. That is, a doubled _L_ would add a
frequency of 2 to the general count, but contacts _L_-_L_ would be
ignored.

At (d) we have the first step in amplification, for which we are

indebted to Chester A. Griffin. If there is any letter in the
cryptogram which _does not appear_ _at all in (c)_, such a letter is
practically sure to be another consonant. In this case we find _A_
and _U_, and in (d) these two letters have been added to the consonant
group and their contacts placed on the consonant-line. From this point
onward, the work becomes more tentative, and, as a detail of
operation, Mr. Griffin suggests that further additions to the
consonant-line be made in another color of lead; if it then becomes a
matter of necessity to erase, only the new letters will be included
in the erasing.

Figure 73

1 2 3 4
x x . x x . x x x . . x . x x x . x x x . x x . x x x . x x . . x
U W Y M N X K A E H X R B Z U V X M U W B Z O Y Z T W H V C X Y A
h h h

5 6 7 8
x . x x x x . x x . x x . x x x . x x . x x x . x x x . x .
C Y A U Z D B R A H V K B A; Z W S V A H K U Z B K C, M S C X
h

9 10
x . . . . . x x . x x . x . x
C Y X B S, X V Z Y T R Y C X P.

Further work includes the application of the “force method.” That is,
we turn our attention to the cryptogram itself, marking with a small
cross, or otherwise, all letters determined as consonants, and
placing a dot, or other indication, over all letters determined as
vowels. Some vowels become evident as early as stage (c), as here we
find both _X_ and _Y_ freely contacting our preliminary group of
consonants, and if confirmation is needed, a glance back at set-up
(b) will show that both of these are step-up letters. They may be
labeled vowels without hesitation.

As to consonants, there are two clear text letters, _h_ and _n_,
which, owing to their many contacts with other consonants, and
particularly with the low-frequency consonants (as in the digrams
_CH_, _GH_, _PH_, _WH_, _NG_, _NC_, _NK_, _NQ_, etc.), will often
show up clearly on the consonant-line. Of these two, _n_ will appear
largely upon the left side of the line, and _h_, the more reliable
of the two, upon the right side. Examining (d) we find _W_ and _H_
appearing exclusively on the right side of the line, and since,
under the rules of the game, no letter may be its own substitute,
we may assume here that _W_ represents _h_.

Further concerning _h_: An examination of the cryptogram shows that

_W_ has occurred twice as the second letter of a word, and the
second-position is particularly characteristic of _h_. Then, assuming
that _W_ actually does represent _h_, we have in the seventh word of
the cryptogram an intimation that the letter _Z_ is also a consonant
(since formations like AHEAD, AHA, are very rare, and seldom, if
ever, occur in long words). Thus, we have two new consonants, _W_
and _Z_, to be added to the consonant-line, with their contacts
below, extending operations to stage (e). If desired, the spotted
consonants may now be crossed off on the line itself, or merely
indicated as in (e). It seems evident from (e), confirmed by (b),
that _B_ is our third vowel, and the supposition can be strengthened
by inspecting the third cryptogram word, which, at this time, will
have appeared as in (f). It also appears from (e) and (b), confirmed
by the aspect of the tenth cryptogram word, that _R_ is a consonant.
Similarly, _M_, which, on three appearances, has twice contacted a
vowel, may be placed as a consonant. These two new consonants, _R_
and _M_, are added to the group of known consonants, and all of
their contacts are placed on the consonant-line. Our next victim is
_S_, evidently a vowel in spite of (e) because of its position in
the seventh cryptogram word (g), which, otherwise, must begin with
five consonants in succession. Presuming that a fifth vowel is to be
found, the same word suggests either _K_ or _H_ as the candidate.
The choice falls on _H_, according to the fourth cryptogram word (h);
and thus continuing the force method with one eye on the
consonant-line and the other on the cryptogram, the v-c formation of
the cryptogram is finally established as in Fig. 73. Actual
identification and solution follow the usual path of patterns,
cross-comparison of words, and inspiration, where all systems are
subordinate to the solver’s own perspicacity . . . or “cipher
brains.” Chapter IX has given some methods for identifying letters
from their characteristics, and also mentioned the preparation and
use of pattern-word lists.

Figure 74

A text prepared by RUFUS T. STROHM: H Y N W B D

│
OMRI, UNKEMPT HELP, BRISKLY SCYTHED BUCKWHEAT ee│eeee
t│t
CROP. PANICKY SKYLARK UPSHOT; BUMPKIN SHOWED w│
ss│
SMIRK. o│oo
l│l
Frequency: 8 6 5 4 5 3 4 5 4 6 5 3 4 4 4 3 2 3 2 c│
Variety: 10 8 7 7 7 6 6 6 6 6 5 5 5 5 4 4 4 2 1 kkk│k
K P E M R A C I O S H L T U Y N W B D u│uu
x x x x x x a│
i│i
│h
Amplification at step (d) adds P and M. │r
│

At this point, it might be well to mention the “vowel-line” method,

whose appearance was antecedent to that of the consonant-line. This
earlier method was conceived by Erik Boden, and in principle works
in reverse to the consonant-line method. Its set-up is like that of
the consonant-line except that vowels, instead of consonants, are
placed at the top. The contacts made by the determined vowels are
listed fore and aft as is done with the consonants in the
consonant-line method.

The vowel-line shows several letters by certain characteristics

. . . a letter appearing exclusively on the left might represent
_h_, and one appearing solely on the right can be taken for _n_. The
liquids, _l_ and _r_, straddle the line about equally. On the
supposition that you have located three vowels, the list of contacts
on the vowel-line will not include, or only rarely, any other vowels
as yet unidentified. A good suggestion is to use the consonant-line
as specified, and then follow up with the vowel-line, using the
vowels you have _definitely_ identified as such. The result will
be thus: The letter appearing exclusively to the right of the
consonant-line will appear solely on the left of the vowel-line,
and vice versa. If such appearances are noted, then you have spotted
_h_ and _n_ . . . . . identified as suggested in another part of this
chapter.

* * *

The workability of the consonant-line system in unravelling the

mysteries of the “Dizzy” crypt is best judged by making a series of
preliminary sheets from clear text. In Fig. 74, for instance, we have
the solution to one of the most skillfully manipulated cryptograms in
the collection of 130. This was prepared by Rufus T. Strohm as No. 17
Aristocrat of the April, 1932, _Cryptogram_. The total variety-count
is 104, 20% of which is about 21. The line of demarcation thus falls
in the group _H L T U_, each with a variety-count of 5 and no
step-down. _H_, with figures 5-5, could be grouped with the remaining
letters, giving us _H Y N W B D_ as consonants, with _P_ and _M_ to
be added at step (d). We thus include _Y_ among our sure-fire
consonants, and, in fact, it often is a consonant, but this is a
problem no solver has yet been able to overcome. However, the letter
_Y_ can usually be spotted by _position_. Note that except for _Y_,
every vowel here is a step-up letter.

Figure 75

A text prepared by J. LLOYD HOOD: D C M P B F Q W J K

│
GARGANTUAN MESTIZO ESCORTS JUNOESQUE NEGRO aaaa│aaaa
oo│ooo
WOMAN ADOWN NIGHT CLUB AISLE. DARK HUED │eeee
n│n
AMAZON HAD BEAUTIFUL LAPIS-LAZULI PENDANT. ss│
│l
Frequency: 14 9 8 6 10 7 6 6 6 4 4 5 3 3 2 3 2 2 1 1 2 1 1 i│i
Variety: 12 11 11 9 8 8 6 6 6 5 5 4 4 4 3 3 3 2 2 2 2 1 1 u│uuu
A E U I N O L S T G R D H Z C M P B F Q W J K r│
x x x x x x x x x x

Amplification at step (d) adds T, G, H, and Z.

The above two examples have represented the “tough” case. In Fig. 75,
where the text is the solution to a crypt by J. Lloyd Hood published
as No. 9 in the February, 1932, _Cryptogram_, we have the average
comparatively simple case. The total variety-count is 118, making the
isolation count about 23 and throwing the line of demarcation into
the group _D H Z_, where _D_ is the only step-down letter. Every
letter in the isolated group is actually a consonant, and step (d)
adds the letters _T G H Z_. On the consonant-line, _A_, _O_, and to
a lesser extent _U_, stand out clearly as vowels. _E_ might be
mistaken for _H_ until we apply the force method, while _I_ shows a
step-up of three points, in addition to whatever shows up on the
cryptogram. So up and at ’em! Edgar Allan Poe spoke truly when he
suggested that whatever the human mind can devise, the human mind
can also untangle.

* * *

Note: For additional methods of analytical attack on this kind of

cryptogram, the student is referred to the booklet “Cryptogram
Solving,” by M. E. Ohaver. This can be purchased directly from the
author (Columbus, Ohio) for twenty-five cents, or may be purchased
from the Frank A. Munsey Company. The textbooks of the National
Puzzlers League also include chapters devoted to the solving of
cryptograms; further information concerning these may be had by
writing to R. T. Strohm, 1328 E. Gibson Street, Scranton, Pa.
H. F. G.

50. By ROBO.

POUYH IBQUAV PUKO M EGUHAC MK KOH POUKH

OBLJH, KOHBSBGH GBBJHNHYK GHSHUNHC MA UAWLGR KB
BAH HRH POUSO SMLJHC IYUACAHJJ.

51. By SUE DE NYMME.

IDFURSF UJBDOC UJY NEGNXDNOWN IDFU FUN CXJKGDOC

JOY RGGXNKKDBN AJO IN WJOORF JGGXNWDJFN FUN
JZZJHDMDFL RZ FUN URONKF JOY CNONXRSK." --RXDNOFJM
JYJCN.

52. By I TAPPA KE.

B HCN FBA IOA CAXW PBXLSBW RAMC MPJ SCCHK.

BLMJI MPBM PJ RK IOAARAN COM CL MPJ SCCHK.

53. By TRYCHS.

ZAXABAPRSANL CDRLT ZNLZDLSERSANL NQ WNWFBRSANL, ZBNTD

FSABAPRSANL NQ SKD BRLU, TWEDRU NQ ALUFTSEV -- RBB
UEAXD HABU BAQD RHRV.

54. By DECIBEL.

KTJ UZ WJIWNLUFZA, RNUJW FV NYYWZQFBNUJCP ZAJ IZTWUG

KJJYJW UGNA FU NYYJNWV UZ MJ RGJA CZZDFAH FAUZ FU.

55. By B. NATURAL.

GBAM BP NCLBGMC: -- IBAM FDCCDIH HKULC BP DSBD, RBGE

BP BPTBLPL, AGDKC BP RBVSBULP, FLEMH VLEM BP BGGBPDBH.
SKHFLPT LNM BN BP RBHHDKCB, UDN BPTBUMHNBDP BP
NMPPMHHMM, NDDE FBVLCF BP EMPNKVEW.

56. By POSIUS.

SHTOADDCTUD TO SLIHCTICDP LHA XCZA IHALICAD TO SALFA

-- IEAR TUXR KCUB ICXX VA LHA DIHTUM AUTNME IT
KHALZ IEAP. -- ABPNUB KNHZA.

57. By LIGHTNING.
QFY. NZZDO, YOFLAVU HAVVOF NVVBCVSOY: "FOSAZO RBF
YBCZ AY RFBQ DNKO QFY. HCQZDAVU; BCK BR FOYZOSK
RBF WOF, A YCUUOYK YBCZ GO ONKOV AV YADOVSO!"

58. By BOUNCING BOB.

ACGLCRW BDHMW AHSXGE. "XI EHN TCYD DH WBDCFSXBO

GMWVXD OWMW, EHN ZNBD FW CD SWCBD WXRODE EWCMB
HSV CYV CGGHZACYXWV FE EHNM ACMWYDB."

59. By MISISEEG.

"PC KFJJW LF LPAS YG KF CYNE FH WFYJ LRCS,"

KPRI MYITS, RDOSLSJPLS PHLSJ-IRDDSJ KGSPASJ, PK ES
KSDLSDNSI CPD LF DRDSLW-DRDS WSPJK.

60. By EEGH.

EZVPJHOW HJWZB JZKRCHSPO HRRCHAOF OZAPEFE CSTF

JHWFBRSCCHB JBHVCSPL ZNFB RFBOSHP BAL VISCOW VFHBSPL
BAQQFB OIZFO.

61. By MERLIN.

ABDZYX UYDU ZA VYWZCE FBGH DBVTYCF SJJX YU RBVJ,

JKJC URBGER FBG LZAR URJF LJHJ.

62. By P. A. BEE.

"ZHN TCJP VDTK QHWWQF CLTDRP NDTX; ZHN CLGFP VDTK

QHWWQF WTF LTDRP NDTX." MSHLJ VTQJP ZB VCJFP LCR
GTCA WGF PQTX. LDBEW ITJFP VDTK PSLG HOFCP NDTX!

63. By SHORTY.

ABCDEFB XYGF HXYNEP OF QNHA BDRXA SYB SDPRFAZ

XYNHFKDSF KXY EDTFH VXCURDUR SNBUDANBF CBYNUP FIFBZ
KFFT YB AKY. BYNRX PFAYNB KYNEP ANBU AXF ABDVT.

64. By AH TIN DU.

ABCD ABEFGHJ KGLA: -- MKNNDOH PBOLA, FBPDE AMBNNGHJ,

ARBON PBOLA KHL KSSGTDA. PRDH NRDAD SKGE, NOW
XRKON KHL CGLHGJRN BGE.

T I P O F F S

For the benefit of the beginner a list of "tip-offs" are given below.
By comparing these groups, affixes and single letters it is possible
to find combinations which fit. For instance: ABC compared with ABCD,
ABGA, GA, DHA might result in "the", "then", "that", "at", "not", etc.

50. M, MK, KB, KOH, BAH, MA, PUKO.

51. FUN, IDFU, IN, IDFURSF.
52. B, MPJ, MPBM, PJ, RA-, -RAN.
53. AL-, -SANL, ZNL-, SKD.
54. UZ, FAUZ, FU, -FAH, -UFZA, FV, ZAJ.
55. BP, BP-, -NBDP.
56. IT, TO; IEAR, IEAP, AUTNME.
57. A, AV, -AVU; BR, RBF, RFBQ.
58. DH, CD, CYV, HSV; identify W through its frequency.
59. Note Pattern group; DRDSLW-DRDS.
60. SPL; O; EFE, word 5, last word.
61. Use of J, LJHJ, JKJC, -ZCE, ZA.
62. WGF, QHWWQF, WTF.
63. AXF, KXY, AKY; FIFBZ, YB.
64. -GHJ, KHL.

65. By KING SLY.

KING NERO PRVBY KHNC AVCL, FHYYVY CAVRDLK CHFN.

DEAF TFENGY IC; DHULY ERBV YCHTL. RIBY XHFF,
ERTFIKERD FHYYEL.

66. By THE SHADOW.

FJ CIGBHQ KDDH, LDQ FJJPHLC DXXCIGBHQ CAP. LDQQDHP

BCCAP: EBQMJ DXX; JPHLC KDDHEBQMJ BC QDHP.

67. By "33".

OXVXAKZDKY KYKOMSQXDI DIAB ABOQSXIZW ZWIALBV BVXQDO.

DOSQDOXASZ SZSOPXYQ YQSOQZBY BYQLBO, BOOSQXA XADIDAZSYQ.

68. By BUBBLES.

SBCWFK VWUKPI FCRSX PFNUKVSB. VWZGRE XZKRP ZBTFV.

WPGU SFGDJ DPERBFGP; VPIFZ TPASX JKPVA IKOBCU OGPRIV.

69. By DEAN RELAX.

XYZABCD ZEFZGBAZHDBHI JBDY KGLMZOCNHBDZ OBCXNMZGC XKPXBQA

KABO SPKXT ANHNXPBHBX FPZNXYGNBX FGBCAC.

70. By WEHANONOWIT.

ZYXWVXUTSRQUXO PXWVTW ZWNZXMXRTL XOOTKQXRQKT YNWRQUSORSWT:

ZWNJSUTL RXIXUTRSV, ONHTOQX, YTJTNVX, JQMQRXOQL, TR
UTRTWX, XJ QIPQIQRSV.

71. By CURLY.

WINIWKB OWBWO KRSRKVRV CRSRC NWEWN WCTPXVQBR XWKWXR.

AWKWARD TJJRKV VQPQVDRK DZKRWD. KRSRKRPD BWOVRC AKWEV,
GWKKQRB HE JCTTB DZKM BQSQBR.

72. By GALUPOLY.

LKMEGDIMJ, LHFABCGNKEF, LSNJJDI, LBMNKCJ, LBMEFJP MJR

LBTNIG GMVN RDSSDAXTK RNADLBNEDJI SCE AEFLKCIEMLBNE.

73. By SABIO.

WILD PANGRAMS RDMB ALCW EFFRRD HLFEM INJW. HAKNLLO

QLNTNW. INJW TFFRRD NIIRD UGUGVWG, WJGORTX RDMB
PAYWV XDOMAT ROZAVD.

74. By GINHUTS.
OLDMADE OVID SLATILK, ZLOMLX VWXYB, WERK SLMB LERVI,
NLI CLRO EVRS GKTV OTAHB ADGV TVWEY, YBLTO LISWR
RLDEWLEB.

75. By CIPHERMIT.

ABZYC DXXZBF, GYZBHVDX SZBHC, SGYBZTH VRZBS JKZBVXQ

FBZUB YDWZBY, WXZBYF, BZTRV WZBF, RDHCEBYMRZBS, FZBIB,
YBZHF, HBMEVZB; MRZBS YBVYZBIBF QZBXC.

76. By A. D. CODER.

ABCDEFB GHICD CJKLIC MNHHSJ OPCIQG MNJRBD PLFGSPLBR,

EILQ KICDTSCIR KICJRAC HL PLDRSJ GOFBBSIDQCNR.

77. By ROVING VIC.

MOCKMOCK ZPLY KPYO RSRI-RSRI FIPTSU FLIPFLIP. NERTS-NERTS

WICHWICH, SHPYSHPY TCYL, SILLSILL, MREX UPMD XRT.
APTS-ACTS WEPMWERM OLIREZU WPTRE MHIL.

78. By AMSCO.

ABWKGLWB ELTFTELHEG, SENGLMTUG FTELSABWKGLTF, LGBTGXGU

KHLCTHK DHTF BTOG HFATFH DGKESLTU.

79. By M. G. M.

ABCDECBFA, GHDIJKLF, HFBMD, NLHMO IEDHOBF OPPMGHR,

SMPDBIDBO UR VPHD, OMHGUMEONB, SPMDILFFEA.

80. By SIMPLICIUS.

VKJPE PBSCKZ RLHRTGM HJALCGSBR TLCG; RKPHCLRHM

NLMHGJCGAAKMBM; LIUJCGM NJCMJBH KQ CKZGPHM.

81. By KRIPTOBENS.

DYFR SWCX VHZS WMLB TMLB CZYO PHUT WKHT, JKOS

MOSY PHOB, NHTK IKAR AMLW WHCU, DUKT! LMSR LYZV
ECMQ XKOS, DMOT VHNK, VMLB, PUCK! VHDK YZKO, GHLB
UYVS! WHAT BOYS, YOUR LUCK!

82. By PHONEY.

ABCDE FEGHI, GEJBI; KLBGI MDCEH NDEST IEKRD DREIN

UMELV. TLHNR RGHBD HLWJI SRMHN, VESTI JHEKB, XBDJI
LDENB YRDIB; PDRGV ZRDSI, BKLWNI OEDJF WYBEN. CEGOF
EOLBM.

83. By ARROWHEAD.

ABCDEF GHIJK, LMN OPQR, STU VWXY. ZWHTAJ, FBIDEB

PEWCUH VHAXMP, HJQD BHXEJ XHUTA, EQGIF GTJE IHWREJMP.

84. By THE GRIFFIN.

TWDOIUESMA DMPOIREXYK TRXAWEKMLI XRYMUOLSED AMIEXKUGNO

MUTRYOLSDH YMKAGRXEIO GZPRKAESOY WHTOXZGDMA TDEHBXMIWS.

85. By SOUR PUSS.

OYESK PACHYDERMS AOPFL UXFD MHZOY XFBR PLMBS OZPL.

ZUFPLBAGH LBYCF QZDYPX YDLM GZQFBD ADLYJ RZUD.

86. By LIVEDEVIL.

PREVIOUSLY BDACL YOEL YFOCG, FLHCY, EHJJPOVLB GHKRCL,

UCOFMJ APCR EONQ MOIQCHBAPJ.

87. By NEOTERIC.

RXUGUZLQTVFR, CNSQRLQTVFR OTDALN RB MVFTQQRX QSTQ.

TFXUTSLCGSFZJ FTVXLVQNZ FTOSQ GUFLVOU DRTQDRX TRF.

88. By ZERO.

KROLGDB FURZGV ZDWFK BRXWKV VSULQW DORQJ GLUW WUDFN.

VZDUWKB FXEDQ MXQLRU MXELODQWOB ZLQV.

89. By JOKEL.

JPLX VUNKOM MLKDUB FUGHVP VKHCX VUPD FWHMVP; LQUMDPBV,

VWJKPLMNB; ULKFUGIKB, QKDHGP; VUXPLCMJ, AMJPVUD.

90. By LEE ANDER.

CLOUDY BERG-SLHVEC BECTR, UI BECT, FVRAKMY MGRAK-HVEC

BUDNR-VRGL BUZCLI EY BDAAEDA. NEKYDNLC; GEESE PUNFUY;
BETT ESTDNLC.

91. By TRYIT.

LSYKCTLSTRYITAB, MCDSLMLE, ZSRBWLX IUOLSC UWLAC BMTUZYLAB

YRUYHU GTKVBC KPMDSCASWUWVD PLANKX UCLM WSKCHBXU WVUBCB
VUITSRPLBD STUMBLER JSLP BHLMDVXU.

92. By DIZZY.

ABCDEFG, DZEIBJK LMFDBCN, MNTLYEA PRZBGSF TSBIURP

IECLSBJ, UKFIZBS, PNFLARB; EVLKZRO PWELMBK VTXPLNZ
TPXOBZG.

93. By ZANYCODAB.

ODZNERITFNM VNDRR BNOFDSK PNIODRHE EVMCDTIS EVANZTOS

FNQRZO HCRI PVEOHE. RZROHIK, URFRES CNISLVZTF AZSBE
HGAZNLS. QNCTK OZRUNI ASFRGSE GTERLVITEO.

94. By I. D. CIPHER.

JBMDVKJVMBTD AWTHVQBLTQV VGLBQWFXH FXBJWTHVQNM VCWYBLGX.

BDGWCDWKZ, DKWYFWKMB RNMBJCDPCY, GZCBQWFDP.

95. By NEON.

CDFGH, JHKLM NPQLR, SDTVW XMZDW PATVF LRXBV CDTWE

QRIGH. TKHFO XRDIP NHILW EFDQL, JMUVW MRPES, VHFAW
NRAPW.

96. By TWISTO.

FJKXZA, ETXZQ, ZCHUQP QPZUF, ZLLKUPTW QBTJPZ EDGN,

PQZM BTJMN QPZDU, MTUIWXJ ZXGJUW ZPFEWU DUQBTW
IBTQUWHJX.

97. By NUMERO.

BCBDBEBFC GHIBEK UGVBQW BRWPF OPFQR STDGPBQ -- EFHIKA

YBQWYTZW BLGUGZR LKFQCGZUZGTHCYKZI.

98. By WHIZZ BANG.

PGZPAPBPGZP? AZFHIDEPXOA AFISTP YOEN BPYC PBFISX PJDOBK

PKLPOT. BWXDYOPA AFEYWI LOIN BFKTDEOP TWRI WFDI. BWLF
BLPZR ESPAD HZDJOBWK ZWHPKI.

99. By INVICTUS.

PDOKX ZEVR MOLTA. MPNDR-NEX NPKWTM FACHX PSGTLUR

PGPGEVU CPUFAD. CZBPAQEUTCV TAMR TAOLPG BPVUC. HAEUWD
KONRUYC RBENZCMR MVEYOR.

CHAPTER XI
Simple Substitution with Complexities

Concerning the numberless variations and complications which have

been applied to the simple substitution cipher, our discussion here
will have to be along general lines, with perhaps a brief mention of
some analytical principle. Decryptment, for the most part, involves
no principles other than those already discussed, and can only be
demonstrated on very long texts. All such ciphers, however, will
yield readily to the “probable word method,” and the student, in
considering each case, should not lose sight of the one method which
applies equally to all.

If the _probable word_ is a pattern word, so much the better; but

_every word carries a pattern in the normal frequencies of its
letters_. For instance, the word CIPHER, considered in relation to a
text of 100 letters, has, roughly, the frequency-pattern
3-7-2-5-12-6; or, considered in relation to a 200-letter text, a
pattern which is approximately double the first: 6-14-4-10-24-12.
A cryptogram supposed to contain this word may be prepared as
recommended in Chapter IX, with a frequency-figure written above
each letter. The frequency-pattern of the word CIPHER, based on
approximately the same amount of text, may then be written on a slip
of paper and passed along below the frequency-figures shown for
cryptogram-letters, in the hope of finding points at which the two
sets of figures are, to some extent, alike. Wherever such points can
be found, the suspected word can be assumed to be present there. So
long as the method remains that of simple substitution, any
substitutes which can be found in this way can have no other
originals than those first determined; thus, their substitution
throughout the cryptogram will serve to bring out other possibilities.

For the multiple-substitute cases, that is, those cases in which all
or part of the letters may have more than one substitute, the
frequencies of such letters as _I_, _H_, _E_, _R_, may be left blank
(or cut in half, dependent upon just what the cipher is), and only
the frequencies of _C_ and _P_, standing two positions apart, need
be considered. Particularly helpful, in this case, would be a
probable word such as CRYPTOGRAM, in which five infrequent letters
are standing at known distances apart. The frequency-pattern of this
word, based on 100, can be expressed roughly as _3 - 2 2 - - 2 - - 2_,
and the attempt made to find points in the cryptogram at which five
letters of somewhat these frequencies are standing at the given
intervals apart. The foregoing is based on the supposition that while
the encipherer, having several substitutes per letter, will be able
to conceal the true frequencies of his high-frequency letters, _there
is not much that he can do toward concealing his low frequencies_. He
can, of course, produce any frequencies that he likes by swamping his
text with nulls; and this, in the hands of a clever operator, can be
very effective, especially if the circumstances are such that he can
keep his method a secret. But for the average practical purpose, the
time consumed in the encipherment, and the increased length of the
cryptograms, are highly undesirable features, especially if it be
kept in mind that there are many other ciphers than simple
substitution. As to attack by analytical methods, the one device
which is more likely than any other to prove applicable in all cases
is the preparation of a digram count of exactly the kind we saw in
Fig. 68. Such a chart will afford the means for studying carefully
the _contacts_ of any given letter; just what its _variety_ seems to
be; whether or not this seems disproportionate to its apparent
frequency; whether or not it shows a tendency to touch letters of
lower frequency, or to be present in reversals; and so on.

Many of these ciphers, however, make use of two letters to represent

one. With these, it is the single-letter frequency count which is
best made on a chart. That is, the cryptogram is first marked off
into its pairs, and these pairs are counted in the same way as that
described for digrams. But digrams, in this case, will be represented
by four letters, and usually the number of different pairs is so
large that the examination of digrams will have to be done by
listing. For any cipher whatever in which the substitutes are
two-digit numbers, a frequency count taken in chart form is usually
far more convenient than one made by listing the numbers in advance.
With only the ten digits, the 100 cells can be made larger than the
676 cells needed for letters, and the chart still be small and
compact. The pairs of digits would be counted in exactly the same
way as so many digrams. With numbers, it is sometimes possible to
take the subsequent digram count, also, on a chart. Solution, in
many cases, involves pure guess-work. The decryptor, perhaps, has
begun his examination by testing his cryptogram for some variation
of the “Caesar” encipherment. He has counted the first hundred or
so of his letters, and has discovered that his frequency count is
not going to be that of an ordinary simple substitution; that is,
it is evidently not going to be one which he would be able to mark
off into sections of high, medium, and low frequencies (usually with
several letters missing), which would certainly be the case had each
plaintext letter been replaced always with a given substitute
throughout the cryptogram. Perhaps he has then marked his cryptogram
into pairs of numbers or letters, and finds that these, also, are
not likely to furnish the kind of frequency count which betrays
simple substitution or some other cipher with which he is familiar.
At this point, he is likely to pause and consider the source of the
cryptogram. Is this the work of an expert, or the work of an amateur?
Is it worthwhile to make up the statistics? Or shall I try for some
one of the novelties which I have met many times before?

One device which is particularly popular with amateurs is that of

assigning to each letter the numerical value which represents its
serial position in the normal (or reversed) alphabet, _A_ having the
value 1, _B_ the value 2, and so on, and afterward representing each
plaintext letter with two (or more) others which will express some
arithmetical process. For instance, the letter _C_ (value 3) might,
in some one of these systems, have the substitute _AB_ (1 plus 2),
or the substitute _DA_ (4 minus 1), or the substitute _YD_ (25 plus
4 equals 29; and 29 minus 26 equals 3); and so on to infinity.

Other simple devices, hardly worth calling ciphers, which have been
used in the columns of _The Cryptogram_ under the title “Simple
Substitution with Frills,” have included: (1) The use of false word
divisions. (2) The simple reversal of an otherwise unmanipulated
cryptogram. (3) The use of two given digrams, placed alternately at
the ends of words. (4) The use of a new cipher alphabet for each new
sentence. The first of these, of course, should have been suspected
after examination of the apparent terminal letters. The second,
theoretically, ought to be spotted if the method of solution includes
a close investigation of digrams. As to the third device, any two
digrams, used in the manner described, will attain impossible
percentages; our leading digram, _TH_, in normal text, remains fairly
close to three or four percent. It was the fourth device, however,
which caused the greatest consternation among the younger solvers;
in this case, the making of the frequency count will show what the
trouble is: It begins very well, with the expected resemblance to a
normal count, and suddenly begins to grow erratic.

Not every variation encountered in dealing with simple substitution

is employed with the deliberate intention of creating difficulties.
Those correspondents, for instance, who select some one letter, as
_X_, and place it after each word as a word-separator, do so because
they find it difficult to read their texts unless the word-divisions
are present. As to whether or not this device does actually create
difficulties: The person who is content to make use of simple
substitution as his means of secret communication, is not usually
inspired to employ more than one such letter. The length of an
English word being somewhat shorter than five letters, any single
letter placed religiously after each word will attain a frequency
(based on the new length) of not less than 18%, where the letter
_E_, at its very maximum, can rarely attain 15%. The decryptor,
taking his preliminary frequency count, quickly discovers this one
letter of enormous frequency. He might suspect German, or even
French, and look for other characteristics of those languages. But
having reason to believe that the language is English, he recognizes
this letter instantly for what it is; he first makes sure that it is
distributed throughout the cryptogram at an average interval of five
or six letters, then calmly circles it out and deals with a case of
word-divisions.

Figure 76
 "Alphabet" for Encipherment of Numbers

"Plaintext" .. 1 2 3 4 5 6 7 8 9 0
"CIPHER" ... A B C D E F G H I J

Text ready for encipherment:

WE HAVE WCBEW BALES.

Considering something of a more practical nature, there is another

very common device, used with every conceivable kind of cipher, which
is not in the least intended for the purpose of creating difficulties,
yet invariably does in short cryptograms. The ordinary practice, when
dealing with numbers, necessary punctuation marks, and so on, is to
write these out in words: _three hundred twenty five_; _quote_;
_dollars_. But where a given correspondence is likely to involve a
great many of these, so that the ordinary practice is very wasteful,
the encipherer is nearly always provided with a little “cipher
alphabet” of the general kind indicated in Fig. 76, in which the ten
digits, any desired punctuation marks, and any other needed symbols
($, %, @) have each a single substitute. In the “alphabet” of the
figure, the number 325 will be enciphered _CBE_. But if this
enciphered group _CBE_ is always to be cleanly distinguishable from
the rest of the text, a means must be found for making this
distinction, and this is usually done by reserving some one letter
to act solely as an _indicator_ and never using this letter for any
other purpose. This indicator-letter, as _W_, may then be placed at
the beginning and end of the enciphered group _CBE_, and the
resulting group, _WCBEW_, may be placed in the plaintext message,
ready to receive whatever kind of encipherment is given to the rest
of the letters. These groups, used in short cryptograms, can give
about the same amount of trouble as would so many nulls. But where
cryptograms are longer, with a great many such groups, the decryptor
invariably spots them by means of the recurrent indicator. Sometimes
one letter is used, and sometimes two (_W_. . ._W_, or _K_. . ._W_);
but in either case, the indicator always appears as a pair of
correlatives, and wherever the first of the pair is found, its
companion is never far away. Some provision must, of course, be made
for replacing the indicator letter in the plaintext alphabet. In
English, we ordinarily select _J_ for any such omission; this is a
letter which is rarely used, and, on those scattered occasions when
it does occur, it can be replaced with _I_. Among the Latins, it is
commoner to make use of _K_ and _W_; these two letters are not used
at all in their native languages, and can be replaced, respectively,
with _Q_ and _VV_. It is also possible to omit _X_, replacing it with
_KS_, or _V_, replacing it with _U_. The fact that it is possible to
shorten the message alphabet without appreciably impairing the
clearness of its messages has given rise to what is probably the most
practical of the simple substitution variations: two or three
letters, as _J_, _K_, _V_, are omitted from the plaintext alphabet,
while the cipher alphabet retains its full 26, and in this way some
extra substitutes are provided which can be given to the more
frequent letters. It is possible to dispense with as many as five
letters, replacing _J_, _K_, _X_, _V_, _W_ with _I_, _Q_, _QS_, _U_,
_UU_, and assign the extra substitutes to _E_, _T_, _A_, _O_, _N_.
Fig. 77 illustrates an alphabet of this kind. Here, the letters _I J_
are to have the same substitute, and the letters _K Q_ are to have
the same substitute. This releases two extra substitutes which may
be given to _E_ and _T_.

Figure 77

j q
Plaintext: a b c d e f g h i k l m n o p r s t u v w x y z E T
CIPHER: C U L P E R Z Y X W V T S Q O N M K J I H G F D B A

Encipherment:
w e m u s t h a v e b e t t e r c o v e r a g e ...
H E T J M K Y C I B U E A K B N L Q I E N C Z B ...

The foregoing is one of those cases in which the decryptor can learn
a great deal by taking his frequency count in the form of a digram
chart. And he knows, of course, that his cryptogram contains some
two letters whose combined frequencies will reproduce the frequency
of _E_, or of _T_.

In Fig. 78, we have a “checkerboard” which, primarily, is intended as

a _transformation device_; that is, a means for replacing single
letters with syllables, and, consequently, for replacing five-letter
incoherent groups with ten-letter pronounceable groups; under the
European agreement, the price of transmission is the same for both,
and the pronounceable groups are less likely to result in
transmission errors. The alphabet is first reduced to 25 letters (in
this case by the omission of _X_), and is written into a 5 x 5 square.
The five vowels, written at one side, will then serve to designate
the five rows, while five other letters, written across the top, will
designate columns. Any letter found inside the square may thus be
pointed out by naming the two letters which will indicate its column
and row. In the given example, _A_ can be replaced with _EN_ or _NE_;
_T_ with _UL_ or _LU_, and so on.

Figure 78

L N R S T
b a t t a l i o n
A C U L P E ER NE UL LU NE AR RI OR NO
E R A B D F
I G H I J K
O M N O Q S Regrouped:
U T V W Y Z
ERNEULLUNE ARRIORNO.

The fact that two interchangeable substitutes have been provided for
each letter of the alphabet has led many persons to use this device,
absolutely without modifications, as a simple substitution key. Yet
it must be plain that any decryptor, taking his preliminary frequency
count, will discover, before going very far, that this count is being
made on only ten different letters, and thus can represent only one
possible kind of encipherment. A frequency count taken on the pairs,
with no distinction made between a given digram and its reversal,
will afford the necessary proof; after that, the average decryptor
will usually replace the pairs with single letters (or numbers), just
as he would in dealing with printers’ symbols, or other inconvenient
characters. The checkerboards which are actually intended for
encipherment purposes ordinarily use digits for pointing out columns
and rows. Where the digits at the side are the same as those across
the top, it becomes necessary to observe an order, as column-row, or
row-column, and this, using only five digits, is ordinary simple
substitution, in which every letter has one substitute. But if the
five digits at the side are different from the five written across
the top, then the order is immaterial, and any number may be
interchangeable with its reversal; that is, 17 or 71 can represent
the same letter.

This encipherment might not be spotted so promptly as the case in

which only ten letters are present out of a possible 26. But if the
count is made on a chart, as recommended at the beginning of the
chapter, it is very readily detectible that there are two separate
groups of digits, _neither one of which has ever formed any
combination within itself_, every number in the cryptogram being
composed of one digit from each group. Thus we see plainly the trail
which is left by co-ordinates.

Figure 79

The KEY-PHRASE Cipher

(a)
Plaintext: a b c d e f g h i j k l m n o p q r s t u v w x y z
CIPHER: O N E W H O H A S P A S S E D O N I S A M O N G U S

(b)
CIPHER....... O M S S
May represent: A U I I Full
F L L Fuss
P M M Fuzz
V S S Pull
Z Z Puss

Checkerboards, of course, can be used to better advantage. But,

before leaving the simple for the complex, we must not overlook the
celebrated _key-phrase cipher_, which discards the idea of multiple
substitutes in favor of multiple originals! This cipher, shown in
Fig. 79, is said to have been used for serious purposes. Its only
difference from the ordinary simple substitution lies in the nature
of the cipher alphabet, which must be a plaintext sentence, or phrase,
containing the necessary 26 letters. The mysterious pronouncement,
“One who has passed on is among us,” is the earliest example of which
the writer has any recollection; those of later years have been
largely proverbs, or other familiar sayings: “Journeys end in lovers’
meeting”; “Prosperity is just around the C.” As any cryptogram-letter
may have five or six different originals, it is readily understood
why the cryptograms of the key-phrase cipher are seldom seen without
their word-divisions; yet, curiously enough, their translations are
almost never ambiguous.

As to their decryptment, the student who cares to try the appended

example will find that it is hardly more difficult than one of the
simpler “aristocrats.” The method is about the same for both, keeping
in mind that the frequency shown by any cryptogram-letter is either
the frequency belonging to one letter or the exact sum of the
frequencies belonging to several. Here, however, the reconstruction
of the key simultaneously with the identification of substitutes is a
very important adjunct to solving; the cipher-alphabet, being pure
plaintext, can often be built up long in advance of solution. It
might be added that this cipher, with or without word-divisions, is
readily distinguished from all others by the make-up of its frequency
count, which, as a rule, consists chiefly of the high-frequency
letters in unusual numbers.

Passing now to the more difficult cases, we will glance at a few of

those ciphers which are truly multisubstitutional; that is, which
provide multiple substitutes for all or most of the plaintext letters.
This is usually accomplished by the use of two-digit numbers, of which
one hundred are possible: 01-02-03. . . . . .98-99-00. These one
hundred numbers may be assigned as substitutes to the twenty-six
letters, in proportions roughly approximate to their normal
frequencies, as suggested in Fig. 80; or most of them may be so
assigned, and the rest reserved as substitutes for digits,
punctuation, and so on. For security, however, they must never be
assigned in regular order, as in the figure, or even by any
methodical process, but absolutely in incoherent order. Thus, while
the form indicated in Fig. 80 will be convenient enough for
encipherment purposes, it is much less so for decipherment, and
ordinarily there will be two separate tables, the second of these
making it more convenient to find numbers. This _deciphering key_
can be prepared as a list, running in numerical order; but a much
more usual and convenient method is that of preparing it in the form
of a chart; that is, the ten digits are written across the top and
along one side of a 10 x 10 square, exactly as if making ready to
take a number-count, and the letters, or other characters, are then
distributed in the 100 cells so that the correct digits will serve as
co-ordinates for pointing them out. Such a key is changeable, but not
readily communicated and remembered without written documents; and to
overcome this very serious defect, many mnemonic devices have been
conceived, of which the following is perhaps the most practical:
Simply treat the one hundred numbers as if they were a plaintext
message, and encipher the series by any one of the irregular
transposition processes.

Figure 80

A 11, 12, 13, 14

B 15
C 16, 17
D 18, 19
E 20, 21, 22, 23, 24
(Etc.)

The two commonest of the checkerboard keys are shown in Fig. 81. When
digits are used, as in (a), an order must be observed in reading the
two co-ordinates. The letter _L_, for instance, may have any one of
the substitutes 13, 18, 63, or 68, but may not also have their
reversals, since these, using the same order, row-column, would all
be substitutes for _G_. Using letters, however, it is possible to
have two entirely different series at top and side, as in (b); in
this case, no order need be observed, and the letter _L_ may have any
one of eight substitutes: _KE_, _KF_, _LE_, _LF_, _EK_, _FK_, _EL_,
or _FL_. By including the still unused letters _U V W X Y Z_, it can
be arranged to provide yet more substitutes for some of the letters.
For either of these cases, the external numbers or letters (preferably
in mixed order), could constitute a semi-fixed key — that is, one not
changed every day — while the mixed alphabet of the square could be
changed as often as desired. Innumerable other keys of this type are
found. For the most part, they are based on rectangles of 35, 36, or
40 cells, the extra cells being used for digits, or other desired
symbols, and especially for extra appearances of the more frequent
letters.

Figure 81

(a) (b)
1 2 3 4 5 A C E G I
6 7 8 9 0 B D F H J

1-6 C U L P E K-L C U L P E
2-7 R A B D F M-N R A B D F
3-8 G H I J K O-P G H I J K
4-9 M N O Q S Q-R M N O Q S
5-0 T V W Y Z S-T T V W Y Z

One such key, the Grandpré cipher shown in Fig. 82, uses 100 cells.
The filling of the square with ten ten-letter words provides letters
in somewhat the normal frequency proportions, and an eleventh
ten-letter word, composed of the ten initials, serves as a sort of
mnemonic device for stringing the first ten together. The words, of
course, must be chosen in such a way as to include all 26 of the
letters.

General Sacco, dealing with fractional substitutions (Chapter XXII),

shows the same idea in a checkerboard which he describes as
“frequential.” This square is simply filled with letters, used in
proportions roughly approximating their normal frequencies; for ready
finding, all repetitions of a letter are placed close together, but
filled in on diagonals, which, to some extent, will prevent their
being represented by consecutive numbers.

Figure 82

The GRANDPRÉ Cipher

1 2 3 4 5 6 7 8 9 0
1 E Q U A N I M I T Y
2 X Y L O P H O N E S
3 H A L F O P E N E D
4 U N B L O C K I N G
5 M O V A B I L I T Y
6 A D J U R A T I O N
7 T H E O R I Z I N G
8 I G N O R A N T L Y
9 O W N E R S H I P S
0 N O V I T I A T E S
In Fig. 83, we have the checkerboard again, with a modification. If
the key used is exactly the one of the figure, those letters which
are standing on the first three rows may have twelve substitutes each,
and those which are standing on the fourth row may have eight. In all
of these cases, the substitute for any letter is a pair. But the final
row, including here the letters _V W X Y Z_, is not enciphered with a
pair of co-ordinates; each letter may represent itself, or each may
represent the one on its left or right, but in any case, the
substitute is a _single letter_. Thus we have cryptograms in which
most of the letters are represented by pairs, but a few are not. Such
words as _ever_, _you_, _with_, _when_, _by_, _have_, and so on, will
occasionally occur; or, if not, then the encipherer may insert a few
nulls at strategic points. Thus, the decryptor, taking his count
purely on pairs, is expected to take some of them correctly and
“straddle” the rest. Such a device is described by Givierge, also the
following similar device. The cipher alphabet consists only of
two-digit numbers, but includes no number coming from the 40’s. With
all of the 40’s omitted, a sequence 44 becomes impossible; and the
encipherer, having first prepared his cryptogram, looks it over, and,
here and there, inserts a digit 4 beside another digit 4, producing
the impossible sequence 44. The decipherer, wherever he sees this,
need merely erase one of the 4’s, and since the digits, in Morse,
have their own distinctive symbols, there is no great danger of
errors in transmission which the decipherer will be unable to
straighten out; but the decryptor, as before, is expected to
“straddle.” Concerning decryptment, in all of these cases, there is
little that we can say here except that, given sufficient material,
these ciphers can all be decrypted with comparatively little trouble.*
The “straddling” devices, perhaps, would represent the most difficult
case, presuming that the decryptor has no probable words and none of
the information which comes through espionage or from that even more
fertile source, the carelessness of the encipherer. In dealing with
one of these, the decryptor, who normally expects a certain amount
of uniformity in the frequency counts made from different portions
of a same cryptogram, is likely to find that his count is showing
altogether new substitutes, or the same substitutes with altogether
new frequencies. He suspects, then, that he may be “straddling”
between two pairs, and tries making his count _in sections_ until he
finally discovers what letters (or digit) are causing the trouble.

*For a clear and detailed exposition of the decryptment method

ordinarily used in multiple-substitute cases, see _Secret and Urgent_
(Bobbs-Merrill), page 64 et seq. For dictionary cipher and simple codes,
see _The Solution of Codes and Ciphers_, by Louis C. S. Mansfield
(Maclehose), page 56 et seq., or _Cryptography_ (Langie-Macbeth;
Dutton), page 88 et seq.

Figure 83

K L M N O
F G H I J

A-E-S A B C D E b a X t t a l i o n
B-P-T F G H I K AG EF Y NR DI SK KU TI CN HQ
C-Q-U L M N O P =
D-R Q R S T U
V W X Y Z
The use of co-ordinates, in those cases where row and column are
interchangeable as to order, shows up very plainly when the
pair-count has been made on a chart; as previously mentioned for a
case of digits, the letters will divide automatically into two groups,
neither of which ever forms any combination within itself. With the
other case, where an order must be observed, there are not so many
substitutes per letter. But in either case, it is possible to _pair
the letters_ which belong together. Here, for instance, are the
letters _E_ and _F_. The frequent combinations of both _E_ and _F_
are always formed with the same letters; and both have avoided the
same letters; _these two must have been paired_. Their combinations
with _G_ and _H_ are much more frequent than their combinations with
_I_ and _J_; thus _G_ and _H_ must have been paired, and _I_ and _J_
must have been paired. This combination _EG_ (and its equivalents),
has been frequently followed by this other combination (and its
equivalents) and so on. When a great many pairs can be considered
equivalent to one another, it is possible to begin setting up the
checkerboard. Some such devices, of course, are safer than others.
But the mere fact that they double the lengths of the cryptograms
renders them unfit for any purpose where speed is a requirement; nor
can the added time and expense of transmission be tolerated for any
purpose whatever unless there is some very definite gain in secrecy.

Figure 84

An Example of BOOK CIPHER

4-1 1-5 3-16 4-11 1-3 1-6 2-2 6-21 1-4 3-2 4-25 4-2

3-3 l-l 2-12 5-22 4-10 6-7 6-2 5-6 5-7 2-7 1-2 1-8

6-1 3-7 5-4 3-6.

(Key "volume": 23d Psalm).

One great objection to any device offering optional substitutes is

that the encipherer himself seems unable to take full advantage of
his system. Even having at his disposal five different substitutes
for _E_, he falls into the habit of using one of these in preference
to the other four; or, determined to avoid this, he uses them
meticulously according to rotation, so that when a frequency chart is
prepared from his cryptograms, this chart, which is, after all, a
_graph_, will show the five uniform frequencies sticking out like a
sore thumb. Even _book cipher_, notably secure, however unwieldy in
use, has been decrypted because of the encipherer’s very human
tendency to use a substitute more than once rather than search for a
new one among the hundreds at his disposal.

In book cipher, any agreed book, or other written or printed document,

will serve as a _key-volume_, so long as it is one that is sure to be
at hand when wanted. Words, or letters, can then be represented by a
series of numbers usually indicating: page, (column), line, serial
position. One letter or one word may thus have a substitute such as
20-1-4-32. An example is provided in Fig. 84, which the interested
student may puzzle out for himself. The particular key-volume was
issued in 1848, but we think this should cause no trouble. When the
key-volume selected happens to be the ordinary dictionary, identically
the same cipher becomes known as _dictionary cipher_, which is, to all
intents and purposes, a very insecure form of _code_. Perhaps the two
names together, book cipher and dictionary cipher, might be said to
represent the maximum and minimum degree of safety found in the code
family.

We leave undiscussed the subject of those alphabets which are based

on phonetics, with digraphs _TH_, _SH_, _CH_, having their individual
symbols, and each vowel capable of having several. The student who
desires to prepare one may find the necessary suggestions in any
shorthand manual; his substitutes can be two-digit numbers, and his
encipherment may be any one of those intended for the normal alphabet.
Having made mention of several processes which, to the younger student,
may present frightening possibilities, we hasten to add that the four
appended examples are all of a type which he should be able to solve
without a great deal of difficulty.

100. By PICCOLA. (Key-Phrase Cipher - intercepted by a "Royalist" spy).

N H H K O H W A E H M A U I H U U H S T U S A S T U N H U
M H N I W A H T. N H H H S A D T H H I A I I E I A M H K M
U W A H O L W N W H T M A M D S T H A J T E S U T O T K
N W I E W A O O. O U H K M W A H M N U I H U U H S T N W T O I K
H K M W A H A H O A N W T O I K A W O.

101. By PICCOLA. (Probable words: CIPHER, SUBSTITUTION, ALPHABET, etc).

D K I U O C Z P V C L U Z I Q U W Y V B V I N C D U U L C U K U Z I I
U O C Z P V C L U Z P Y N U S Q S C Z I U L Q T U K H I C Z I K L U Z
P Y N N Y J Q Y L U P L U Z I Q J S C U L U S U E Y G U Z I Q I U T Q
N U F S U Z F L U I C V F Q S W Q I I S U Y S U G S Q N B L U G U O V
V Y F S Q Y I H I Y I K O H K U V P T Y K Q I J U Y V P P C E S Y U O
F Q S U L C Z N Y Z F K E S Y Z I U Z I R Q V V C.

102. By PICCOLA. (Probable words: COLLECTION, GALLERIES, FIGURINE, etc).

Y C G U T H M P Y B X S K R M G X U F P C M I B C J G R M K X L X S Z
N Q V V U N I X Q S Q E E X Z H M X S R L E Q M L C V U D Y C G R N Q
S E X J U S K X C V X S E Q M T C I X Q S K Y C I I Y R K C S C Z M C
L I Q V U S E M Q T K Y R T Q M Z C S Z C V V U M X R L F C L L U R S
M U N R S I V B X S C N U M K C X S W H C M I R M D Y C L L X S N U J
X L C P P R C M U J D T C B O R X S K Y X L E U V V Q F L N Q V V R N
I X Q S S Q F X X X.

103. By EFSEE. (Probable words: PEOPLE, PERSON, CIRCUMSTANCES, etc).

B E C O M I C I Q U E X P A Y O T I A N S I Z I P I A N D O A B U M Y
O R E A N U S Q U I M O N I P M A M A M I F O X E G A O K A Z U K I S
G O V I X A W A Z A I T H I N A I L M O S U I S H E A T R U A L E M O
F A T I C A G I D O Y E M B E Y O L E N A C O S E K E E L S O G I Z A
C O O L S I D I O R Q U A Z O W A G E S D I B U S I V I P U A Z A M E
S I D A R T A C O O Y A P E S L I A R S E W O A L O N I K O L O M B A
R I L A Z A L O W I A V U M A K A T L O F I C I N A I M I L N A Q U I
M O N I P S A W O G A P A V I H I S U E C A N O S M O L E T A M E K O
W A I V S I A R T E Z E I R S I L A Z E G A S A M I V E E P.
CHAPTER XII
Multiple-Alphabet Ciphers — The Vigenère

The theory of polyalphabetical substitution is as follows: The

encipherer has at his disposal several simple substitution alphabets,
usually 26. He uses one such alphabet to encipher only one letter;
for the next letter, he may use another cipher alphabet; for the
third letter, a third alphabet; and so on, until some preconcerted
plan has been followed out. The earliest known ciphers of this kind,
the Porta (1563) and the Vigenère (1586), made use of a chart, or
_tableau_, on which all of the available cipher alphabets were
written out in full one below another. The Gronsfeld cipher (1655)
used a purely mental encipherment plan; but the Beaufort ciphers,
arriving two hundred years later (1857), again made use of a tableau,
and something of the same idea survives in the use of _strips_; that
is, a set of long narrow cards, each card carrying a simple
substitution key. Slides, however, must have been in use near the
time of Beaufort, since the best-known of the slide-ciphers, the
Saint-Cyr, was being taught in 1880 at the French military school
from which it takes its name. As to cipher disks, these appear to
have been known even in Porta’s time, and have passed through many
complications, though it has not been a great many years since a very
simple disk was in use in our own army. (A drawing of the United
States Army Cipher Disk may be seen in Webster’s New International
Dictionary.)

To know thoroughly any one of these ciphers is to understand the

fundamental principles of all, and we are going to base our studies
chiefly upon the Vigenère, most perfect of the simpler types, and the
basis upon which others have been founded. Fig. 85 shows, in full,
the Vigenère tableau, or “alphabet square.” The alphabet standing
horizontally across the top of this figure is the plaintext alphabet,
and serves for the whole tableau. Below this, and parallel to it, are
the 26 “Caesar” alphabets, the first one being a duplicate of the
plaintext alphabet, while the remaining 25 have been _shifted_, one
letter at a time, until the last one begins with _Z_. These are the
26 available cipher alphabets, and each one is named according to its
first letter, which is also spoken of as its _key_. Thus, the
key-letter _A_ points out the _A_-alphabet; the key-letter _B_ points
out the _B_-alphabet, and so on. The alphabet standing vertically on
the left side of the tableau is merely a list of these key-letters,
and so is called the key-alphabet. Except where cipher machines are
employed, the ordinary plan of encipherment does not make use of the
full 26 available cipher alphabets; only a few of these are used, and
these few are taken always in a given rotation, so that the cipher
becomes _periodic_. If the rotation includes, say, twelve of the
cipher alphabets (whether or not these are all different), the
cryptograms are said to have a _period of 12_. (The word “cycle” is
also used in this connection.) Since each letter of the normal
alphabet is the key to one of the Vigenère cipher alphabets, the
encipherer, wishing to make use of several different cipher alphabets,
is able to remember their sequence by means of a key-word, in which
each letter will point out one particular cipher alphabet. If today’s
key-word is BED, only three cipher alphabets will be used, the
_B_-alphabet, the _E_-alphabet, and the _D_-alphabet, and the
cryptograms will all have a _period of 3_. But if, tomorrow, the
key-word is changed to CONSTANTINOPLE, the complete rotation will
include fourteen alphabets, and the cryptograms will have a
_period of 14_.

Figure 85

THE VIGENÈRE TABLEAU

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

A A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
B B C D E F G H I J K L M N O P Q R S T U V W X Y Z A
C C D E F G H I J K L M N O P Q R S T U V W X Y Z A B
D D E F G H I J K L M N O P Q R S T U V W X Y Z A B C
E E F G H I J K L M N O P Q R S T U V W X Y Z A B C D
F F G H I J K L M N O P Q R S T U V W X Y Z A B C D E
G G H I J K L M N O P Q R S T U V W X Y Z A B C D E F
H H I J K L M N O P Q R S T U V W X Y Z A B C D E F G
I I J K L M N O P Q R S T U V W X Y Z A B C D E F G H
J J K L M N O P Q R S T U V W X Y Z A B C D E F G H I
K K L M N O P Q R S T U V W X Y Z A B C D E F G H I J
L L M N O P Q R S T U V W X Y Z A B C D E F G H I J K
M M N O P Q R S T U V W X Y Z A B C D E F G H I J K L
N N O P Q R S T U V W X Y Z A B C D E F G H I J K L M
O O P Q R S T U V W X Y Z A B C D E F G H I J K L M N
P P Q R S T U V W X Y Z A B C D E F G H I J K L M N O
Q Q R S T U V W X Y Z A B C D E F G H I J K L M N O P
R R S T U V W X Y Z A B C D E F G H I J K L M N O P Q
S S T U V W X Y Z A B C D E F G H I J K L M N O P Q R
T T U V W X Y Z A B C D E F G H I J K L M N O P Q R S
U U V W X Y Z A B C D E F G H I J K L M N O P Q R S T
V V W X Y Z A B C D E F G H I J K L M N O P Q R S T U
W W X Y Z A B C D E F G H I J K L M N O P Q R S T U V
X X Y Z A B C D E F G H I J K L M N O P Q R S T U V W
Y Y Z A B C D E F G H I J K L M N O P Q R S T U V W X
Z Z A B C D E F G H I J K L M N O P Q R S T U V W X Y

To make use of a cipher alphabet, say the _B_-alphabet, we may lay a

ruler across the tableau in such a way that this one alphabet is
pointed out. Then, to encipher any letter, as _S_, we may find this
letter, _S_, in the plaintext alphabet at the top, and trace down its
column as far as the _B_-alphabet which is being pointed out by the
ruler; we find that the substitute, in this alphabet, is _T_. Or,
wishing to decipher _T_, we find this letter in the _B_-alphabet and
trace upward to the plaintext alphabet in order to find that its
original is _S_. While the foregoing explains the principle, it has
not been expressed in the usual language. Where we have mentioned the
use of the _B_-alphabet, it is much commoner to hear that a certain
letter has been enciphered or deciphered “with key-letter _B_,” and
the usual description of the encipherment will be somewhat as follows:
To encipher _S_ by _B_, find _S_ in the plaintext alphabet, find _B_
in the key-alphabet, and use the substitute which is found at the
intersection of the _S_-column with the _B_-row. Or: To decipher _T_
by _B_, first find the key-letter _B_, trace horizontally to the
right as far as the cipher-letter _T_, then trace upward to its
original, _S_. This, we believe, is the original description, as
explained by Blaise de Vigenère himself, and the original encipherment
plan was that indicated in Fig. 86. The message of this figure is
SEND SUPPLIES TO MORLEY’S STATION. The key-word, BED, has been
repeated often enough to pair one key-letter with each text-letter,
and these pairs are handled _one at a time_: _S_ is enciphered by
_B_, _E_ is enciphered by _E_, _N_ is enciphered by _D_, and so on,
following the original description.

Figure 86

Original Method of VIGENÈRE Encipherment

Key: B E D B E D B E D B E D B E D B E D B E D B E D B E D B
Message: S E N D S U P P L I E S T O M O R L E Y S S T A T I O N
Cipher: T I Q E W X Q T O J I V U S P P V O F C V T X D U M R O

Figure 87

Modern Enciphernent

B E D B E D B E D

S E N D S U P P L
T I Q E W X Q T O

I E S T O M O R L
J I V U S P P V O

E Y S S T A T I O
F C V T X D U M R

N
O

5 10 15 20 25 30
T I Q E W X Q T O J I V U S P P V O F C V T X D U M R O X X

The modern method would be that of Fig. 87. Knowing that a great many
letters are going to be enciphered by _B_, a great many others by _E_,
and a great many others by _D_, and having no wish to preserve
word-divisions, we begin by writing our plaintext into three columns
(or by grouping it conveniently), and then encipher at a single
writing all of those letters which are to be enciphered by any one
same key-letter. That is, we apply one cipher alphabet at a time, as
first explained. The modern practice will also require that the
cryptogram be taken off in five-letter groups, and that the final
group be made complete. This is another of those cases in which the
decryptor will number his letters, as shown in the figure. The student
who has not previously met the Vigenère cipher is urged to perform the
two operations of encipherment and decipherment and thus familiarize
himself with the use of a tableau; it is possible that in most of his
subsequent reading he will find explanations based on the “columns”
and “rows” of a “tableau,” when, as a matter of fact, no tableau has
been used. To understand how this might be, suppose we take a look
now at the Saint-Cyr cipher.
 Figure 88

THE SAINT-CYR SLIDE

┌─────────────────────────────────────────────────────┐
│ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z │
┌───────┴┬───────────────────────────────────────────────────┬┴────────────
│ A B C D│E F G H I J K L M N O P Q R S T U V W X Y Z A B C D│E F G H I J..\
└───────┬┴───────────────────────────────────────────────────┴┬─────────────┘
└─────────────────────────────────────────────────────┘ (To Y.)

In Fig. 88, we have the principle of the sliding device by means of

which this encipherment is accomplished. The Saint-Cyr slide is very
easily prepared of cardboard, or of any other flexible and fairly
strong material, but may also be prepared of wood, or may be set up
for any temporary purpose on two strips of paper. Its details, also,
may be varied to suit the operator’s own convenience. As shown,
however, the upper and single alphabet, which is the plaintext one,
is written on a card, and slots will be cut in this card at two
points: Just below and to the left of _A_; and just below and to the
right of _Z_. This plaintext alphabet is considered stationary.
The lower and double alphabet, which is to furnish all of the
substitutes, is written on a long narrow strip, the two ends of which
may be inserted into the slots of the other card. This strip, or
slide, may then be moved back and forth at will. However prepared,
the spacing must be uniform throughout both alphabets. The Saint-Cyr
cipher also makes use of a key-word in which each letter is the key
to a cipher alphabet, and which is applied exactly as in Fig. 86 or
Fig. 87. To apply the key-letter _B_, we adjust the slide in such a
way that the _B_ of the sliding alphabet will stand directly beneath
_A_ of the stationary one. This gives us exactly the same set-up
which we used in Chapter IX for cases of simple substitution; that
is, we have a plaintext alphabet with a cipher alphabet standing just
below it; each plaintext letter is standing directly above its
substitute, and each substitute directly beneath its original. The
cipher alphabet just referred to, in which key-letter _B_, found in
the sliding alphabet, is standing directly below the index-letter,
_A_, found in the stationary alphabet, is identical with the
_B_-alphabet of the Vigenère tableau, and is even called by the same
name. Should we move the sliding alphabet, so as to place key-letter
_C_ directly beneath index-letter _A_, we reproduce the _C_-alphabet
of the Vigenère cipher, again called by the same name. In the figure,
we have the _E_-alphabet in position, with key-letter _E_ standing
directly beneath index-letter _A_. And since the sliding alphabet may
be placed in 26 different positions, each time reproducing one of the
Vigenère cipher alphabets, having the same key and the same name, it
appears that our Saint-Cyr “cipher” is merely a duplication of the
Vigenère. The chances are, then, that even though we call our cipher
by its original name, and even make references to its tableau, our
actual work of encipherment and decipherment will have been
accomplished by means of the more convenient and rapid Saint-Cyr
slide. But where a slide is possible, a _cipher disk_ is also
possible, and many will prefer to use the disk.

To prepare one of these, we might proceed as follows: First, cut out

from cardboard (or other desired material) a pair of disks, one
smaller than the other. Divide the peripheries of both disks into 26
equal segments, and write the 26 letters of the alphabet in a circle
around both of the peripheries, causing both alphabets to run in the
same direction. Place the smaller disk on top of the larger; and,
finally, stick a drawing pin through the exact center of both disks,
to serve as a pivot. The smaller disk may now be rotated to 26
different positions, so that any desired key-letter can be caused to
stand beside index-letter _A_ of the outer disk, and will place in
position the cipher alphabet of which it is the key. The use of this
revolving alphabet in place of a sliding one does away with the
necessity for doubling its length.

Now let us examine carefully Fig. 89, with its two examples of
decipherment. At (a) of this figure, a short cryptogram fragment,
beginning _T I Q_. . . . , is being deciphered with the original
key-word, BED, and is bringing out the message, SEND
SUPPLIES. . . . . This, of course, is to be expected of any cipher.
But at (b), it is this _message fragment_, SEND SUPPLIES, which is
acting as a _trial key_; exactly the same process is being used as if
applying the true key, and this decipherment is bringing out the
original key, repeating over and over. The Vigenère cipher, then,
works equally well in reverse, and in this respect it differs from
some of its kindred ciphers. To understand this peculiarity, we have
merely to consider the tableau. Concerning this we have said that the
horizontal alphabet which stands across the top is the plaintext
alphabet, and that the vertical one at the left is merely a list of
keys. Suppose we decide to look at it the other way round, and say
that the vertical alphabet at the left is the plaintext one, and that
all 26 of the cipher alphabets are standing on end with their
key-letters at the top, so that the horizontal alphabet, written
across the top, is merely a list of these keys. Will there be any
difference in the encipherment? Might the slide, also, be prepared in
a vertical position? Does it make any difference in the results
whether we encipher plaintext _SEN_ by key BED, or encipher plaintext
BED by key _SEN_?

One road to decryptment, then, is clearly indicated. If we have a

probable word, we may use this word exactly as if it were the key,
and, if it is actually present, it will bring out the true key. Or,
if we have no probable word, we may try probable sequences, or make
use of the trigram list. Here, however, we have two separate cases:
The simplest, in which the probable word is long enough to bring out
the key-word _repeating_; and the most difficult, in which the
sequence, or probable word, is very short, and will bring out only a
short fragment of the key-word.

Figure 89

(a) Deciphering with the KEY:

Key: B E D B E D B E D B E D.......
CRYPTOGRAM: T I Q E W X Q T O J I V.......
Plaintext: S E N D S U P P L I E S.......

(b) Deciphering with the MESSAGE:

Trial Key: S E N D S U P P L I E S.......

CRYPTOGRAM: T I Q E W X Q T O J I V.......
True Key: B E D B E D B E D B E D.......
The simpler case is readily explained. We have, say, a cryptogram
beginning _U S Z H L W D B P B G G F S_. . . , in which we suspect
the presence of the word SUPPLIES. We decipher the first eight
letters, _using this probable word as a trial_ _key_, and obtain a
jumbled series of letters _C Y K S A O Z J_, which is not satisfactory.
We leave off the first cryptogram-letter, _U_, and decipher the next
eight, obtaining another jumbled series of letters _A F S W L V X X_.
We start again at the third letter, then at the fourth letter, and
still there is no information. But at the fifth trial, beginning at
the fifth cryptogram-letter, we obtain a series _T C O M E T C O_,
and this is satisfactory, not necessarily because we have recognized
the word COMET, though this, of course, is a very desirable happening,
but because the last three letters, _T C O_, are repeating the first
three. _The series is beginning over_. The student should practice
doing this, using both the tableau and the slide (or disk), until he
is sure that he understands the process. The exact details of his
work are immaterial; if he is sure that his key will be a recognizable
word, it will be satisfactory to make decipherments directly on the
cryptogram, erasing as he goes. Sometimes, however, the key is
incoherent, or apparently so, and a jumbled series like
_C Y K S A O Z J_ might actually be the correct key; for this reason,
it is well to follow a routine of some kind which will preserve all
of the decipherments. One such plan is illustrated in Fig. 90.

Here, the cryptogram, or a substantial portion of it, would be

written across a sheet of quadrille paper, and the probable word
would be written at one side, where each of its letters will govern
one row of decipherments. The first letter, _S_ in the figure, has
been used to _decipher the whole row of cryptogram-letters_, giving
every possible key-letter which can produce _S_. The second letter,
_U_, has been used to decipher them all again (except the very first
letter; we do not expect a word UPPLIES). The third letter, _P_, has
been used to decipher them all a third time; and soon. The resulting
rows of decipherment include all key-letters which could have produced
_S_, then _U_, then _P_, and so on. To read them consecutively,
beginning at any cryptogram letter, start immediately below that
letter, and read diagonally downward to the right. The first diagonal
gives key _CYK_. . . , the second gives _AFS_. . . , and so on to the
fifth diagonal, showing the key as _T C O M E T C O_. (If it is
desired that these possible keys should come out standing in a
horizontal position, then the _decipherments_ may be made diagonally.)
F. R. Carter, the originator of this scheme, does not necessarily
make all of the decipherments which are included in the figure. He
begins with the assumption that his key will be a recognizable word;
having deciphered in full the first three rows, he abandons all of
those diagonals which cannot develop into words. If, in the end, he
is forced to conclude that his key was incoherent, _no decipherments
have been erased_; he may still go back and develop the rest of his
diagonals, in the hope that one will begin repeating.

Figure 90

Deciphering with the Probable Word SUPPLIES - Routine of F.R.CARTER

Cryptogram fragment: .... U S Z H L W D B P B G G F S .........

Probable word: S C A H P T/ E L J X J O O N A .........

 U Y F N R C/ J H V H M M L Y .........
P K S W H O/ M A M R R Q D .........
P S W H O M/ A M R R Q D .........
L A L S Q E/ Q V V U H .........
I O V T H T//Y Y X K .........
E Z X L X C//C B O .........
S O//
(Key: COMET)

The more difficult of our two cases, that in which we have no probable
words other than _the_, _and_, _which_, _that_, _have_, _but_, etc.,
can follow exactly the routine outlined in Fig. 90; but in this case
there must be two separate work-sheets. Here, it is usually better to
forget words and start at once with the list of normally frequent
trigrams, _THE_, _AND_, _THA_, _ENT_, _ION_, _TIO_, etc. The
key-fragments which are deciphered by these will be very short, and
very numerous; a great many of them will be very good usable
sequences, and perhaps the correct key-sequence will not look quite
so inviting as others which are incorrect. It becomes necessary, then,
to have a second work-sheet on which we may take these fragments one
by one and try them as keys. If any one of them is a fragment of the
original key, _it must bring out fragments of plaintext, and must
bring them out at some regular interval_. If the scheme of Fig. 90 is
the one preferred, the second work-sheet may be prepared exactly like
the first, and used in the same way. The only difference is as
follows: On the first work-sheet, where the figure shows the word
SUPPLIES, a supposed trigram (_THE_, _AND_, etc.) will have been used
to bring out supposed key-fragments; on the second work-sheet, one of
these supposed key-fragments will have been used. These new rows of
decipherment may then be examined to find out whether any of the new
diagonals contain apparent plaintext fragments, and, if so, whether
these occur at a regular interval.

For this kind of work, however, Ohaver has offered us another routine
which requires somewhat more preparation than Carter’s but which is
well worth the extra trouble, especially if it be remembered that a
trigram-search is never necessary except with the shortest of
cryptograms. For the longer cryptograms, we have easier methods.
Ohaver’s plan can be examined in Fig. 91.

The cryptogram, shown at the top of this figure, contains 26 letters;

therefore, remembering that each letter, except the final two, may
begin a cipher-trigram, it contains 24 trigrams. The preparation of
the two work-sheets requires that these 24 cipher-trigrams be written
out in full on both sheets. This work should be done in ink, or on the
typewriter. Then, too, for a reason which will be explained in a
moment, it is well that the first of these work-sheets be prepared
with a great deal of space, say seven or eight lines, between its
rows of trigrams. Now, considering the first work-sheet, shown at
(a) of the figure: The upper row shows the 24 cipher-trigrams as
originally written out. We have been working down the trigram list,
using every normally frequent trigram as a trial key, and have failed
to find _THE_, _AND_, _THA_, or _ENT_, which means that we have done
quite a lot of tedious work. We have now reached the normally frequent
trigram _ION_, and this we have applied as a trial key, assuming one
by one that each of the 24 trigrams represents _ION_. We have, then,
24 decipherments on the second row, and _any one_ of these 24
deciphered trigrams might be a fragment of the original key. However,
it is natural to assume that a trigram _FRI_ or _WAY_ is more likely
than one such as _XHR_ or _NQB_, and those fragments which look like
usable sequences have been underscored in the figure. These are to be
tested first. At (b), we have the other work-sheet, the upper row, as
before, showing the 24 possible cipher-trigrams. Here, we have already
failed in our tests for key-fragments _FRI_, _WAY_, _DZI_, _NYE_,
which means that we have done some more tedious work, and we have now
arrived at the possible key-fragment _EDA_. If this sequence, _EDA_,
is actually a portion of the original key, it must not only bring out
fragments of a plaintext message, but must bring them out at some
constant distance apart. The point at which we found this is the tenth
trigram, and here it may be advisable to remind that this begins at
the tenth cryptogram letter; that is, _every trigram presents only
one new letter_, so that to find a completely different trigram in
either direction, we must count backward or forward a distance of
three trigrams.

Figure 91

L N F V E O L N V M R N G Q F H H R N H I R V F E B,

(a) Trial Sheet No. 1

ION
LNF NFV FVE VEO EOL OLN LNV NVM VMR MRN RNG NGQ
AZS FRI XHR NQB WAY GXA DZI FHZ NYE EDA JZT FSD

GQF QFH FHH HHR HRN RNH NHI HIR IRV RVF VFE FEB
YCS IRU XTU ZTE ZDA JZU FTV ZUE ADI JHS NRR XQO

(b) Trial Sheet No. 2

EDA
LNF NFV FVE VEO EOL OLN LNV NVM VMR MRN RNG NGQ
HKF JCV BSE RBO ALL KIN HKV JSM RJR ION NKG JDQ

GQF QFH FHH HHR HRN RNH NHI HIR IRV RVF VFE FEB
CNF MCH BEH DER DON NKH JEI DFR EOV NSF RCE BBB

(c) Testing out the Period 5

D A E D A E D A E D A E D A E D
L N F V E O L N V M R N G Q F H H R N H I R V F E B
I N . . A L L . . I O N . . B E H . . D F R . . A Y

(TION?) (FRIDAY?)

Beginning, then, at the tenth trigram, and examining every third

trigram in both directions, we find that our key-fragment has given
us the following decipherments: _HKF_, _RBO_, _HKV_, _ION_, _CNF_,
_DER_, _JEI_, _NSF_. These are largely incoherent; but, in addition,
it must not be overlooked that on the continuously-written cryptogram,
these would be consecutive, giving us a message _H K F R B O_. . .
Applied at interval 3, then, our key-fragment _EDA_, will not
decipher us a message; therefore, the period of this cryptogram,
using this key, cannot be 3.

To examine for the possibility of a period 4, we start again with our

tenth trigram, and examine every fourth decipherment in both
directions; our series, this time, is _JCV_, _KIN_, _ION_, _MCH_,
_NKH_, _NSF_. Most of these are usable, and the first one might be
due to nulls, initials, and so on; but here again we have the reminder
that with each trigram representing only one new letter, these are
_almost consecutive_, starting at the second cryptogram letter, so
that our message, with each fourth letter missing, will be as follows:
_* J C V * K I N * I O N_. . . . Unless we can think of some letters
which would fill these gaps and provide plaintext, our period is
not 4.

Trying again, however, beginning at the tenth trigram and examining

each fifth decipherment, we find something more satisfactory: _ALL_,
_ION_, _BEH_, _DFR_. If these are correct, the period is 5. At (c),
we have gone back to the continuously-written cryptogram in order to
try these in their places; and since a period 5 would mean that each
of the letters _E D A_ is used regularly to encipher each fifth
letter, we are able to include two shorter decipherments at the two
ends of the cryptogram. The next step in logical order is to try
deciphering _T_ in front of _ION_, since the trigram _TIO_ would
have been the next one on our trigram list. This brings out
key-letter _C_, which, if correct, will decipher correctly at each
interval 5, and which extends our key-letters to _C E D A_. We can
see, too, that this is not the beginning of the word; the sequence
we have is _D A * C E_. In the given example, it is not difficult,
also, to guess a probable word, FRIDAY. Now, having twice called
attention to the fact that the trigram-search can grow quite tedious,
we hasten to point out that it need not be made more so by
deciphering each trigram individually. If your trial key is _THE_,
set your slide at the _T_-alphabet (or point this out on the
tableau), and decipher every first letter on the sheet. Then set the
_H_-alphabet in position, and decipher every second letter on the
sheet. Finally, set the _E_-alphabet in position and decipher all of
the remaining letters.

The foregoing few paragraphs have illustrated the worst case in

almost its worst form, but will show the principle. Now let us
consider this work in a much more usual case. As mentioned earlier,
the first of the two work-sheets will be prepared with a great deal
of space between the rows of trigrams. The full number of
decipherments will be made for the first trigram _THE_, but _not
erased_. Just below these, a second row of decipherments will be
made for _AND_, and these, too, will be left standing. (_THA_ can be
omitted.) A third row of decipherments is made for _ENT_, a fourth
row for _ION_, and so on down the list, until there are six or eight
rows of possible key-fragments. These are all examined and compared
with one another, in the hope of finding duplications. Perhaps _THE_
and _AND_ have _both_ brought out a key-fragment _EDA_, or one has
brought out _CED_ and the other _EDA_, having _ED_ in common. It is
far from unusual, in some of these cases, to find a whole series of
these overlapping key-fragments, for instance, _CON_, _ONS_, _NST_.
This will explain why many persons consider the trigram-search the
simplest and most direct way of attacking a Vigenère cryptogram.

For the benefit of the novice, we end the chapter at this point in
order that he may have some practice. Example 104 comprises a
thrilling serial with all the trimmings, gripping and original title,
smashing climax, and a brave hero, John Miller. The key to the title
is STRANGE. Part I repeats a word found in the title; part II repeats
a word of part I; and somewhere are the trigrams _NOT_, _CON_, _YET_,
_ING_, _TEN_, _THE_. We have heard, too, that an amateur encipherer
will occasionally encipher the nulls which he adds in his final group.
Example 105 is easily investigated through short common words. As to
the remaining examples, while it is true that they can be attacked by
the trigram method, the student will probably prefer to leave them
until he has seen the methods outlined in Chapters XIV and XV.

104. By PICCOLA. (For trigram practice. A new key for each fragment).

Title of Serial: S L K R N T K W W Z S N V T W T I A A I I X X X X.
Part I: R I G Z V Z K I U O M H J L B W F P K S R Z T R H E J T W I
O S W I O S G Q I I. Part II: H H T X T N E O L V R M T U L C L P P X
T Y R X K U K B U W U O J Z H X M Z K H. Part III: S Y Z Y R T N F U R
K C U S I I R Q U X W U F K C J N R L Q N F O K V X M P U O N H J A X
J H V O P. Part IV: X B V P Y S X C J J Y U R X O T S P I N Y I L U P
A V M X M M F C I B S T I T O O T B R O.

105. By PICCOLA. (For investigation of short words. - Still Vigenère!)

V Y I D J G I E J S N V R J H J F J D B G E K O W U Y A R F F Z W
V O K U X R P G R J U O E K M R B U Y S U H Q W J L J G C I W H G I
W.

106. By NEON. (Any repeated trigram is worth watching!)

P Q X E J F V E G Y M N Y N Y I U F R D S G V R I L P S G Z T M E S I
R K N Y I G P E R W G R R N D L O J N T Y I D X O T Y C I P C R E V C
E S G O I R L I S I R Z Q E U C G L T C I X H Y I X H E L E K Y J E K
P X I E Y R R S L H D L I F Y G P R J G S D I C E.

107. By THE ADMIRAL. (Numbers are always possible!)

L V P R V S F P T Y J S P H L F R C E U S B O S Z P H J F Z N S O A P
K T T V V Z C F R J X C C T P W W R H K E W Y U K W G L N U X C C T P
X W G E R F R Z N V Z O W F J W Q Z N U K W Y O E W M P A I.

108. By NEON. (This cryptogram, circulated in April, 1935, caused great

consternation among solvers. Do you see any reason why?)

T W G J C N I U J X C S L S K K B N V G W I P S U Q I U J A U L J U Z
H B E V J V M A O H G G L T P D G L E Y S S L A F I M J S W Q I U M O
N N F L V H I U I Z D Q K V Y R T W H I M R F E U K P N O V Y T K E F
N V Q N O T.

109. By PICCOLA.

A X S E H G O I W W F O I A L G E M Q W E E N B W R E I K L S H Z Z Q
X L G A H V P Z K L D L G G D W T C M H Q D J N W K E H M V V A B M A.

CHAPTER XIII
The Gronsfeld, Porta, and Beaufort Ciphers

Now let us have a brief look at other classic ciphers of the

multiple-alphabet type, and see to what extent these will differ from
the Vigenère. The Gronsfeld cipher, as may be seen from the specimen
encipherment of Fig. 92, uses a number-key. Its ten alphabets are
governed by the ten digits. To encipher _S_, using key-digit 2,
simply begin at _S_ and count forward 2 in the normal alphabet; the
substitute is _U_. To encipher _E_ with key 8, begin at _E_ and count
forward 8 in the normal alphabet; the substitute is _M_. For
decipherment, count backward in the alphabet. A very superficial
investigation will show that the Gronsfeld key of the figure, 28105,
and the Vigenère key _CIBAF_ will produce identically the same
cryptograms. The key-digit _zero_ governs the _A_-alphabet of the
Vigenère, the key-digit 1 governs the _B_-alphabet, and so on to the
_J_-alphabet. If it is found convenient to use a tableau (as it may
be for the decipherment), the first ten cipher alphabets of the
Vigenère tableau can be ruled off from the rest, and the key-digits,
in the order 0 to 9, can be added beside the key-letters _A_ to _J_.
Or, if the slide is the preferred method, these digits can be written
beneath the first ten letters of the sliding alphabet; it is then
possible to slide them into position below the index (the stationary
_A_), in the same way as the letter-keys. The Gronsfeld cipher, then,
is no more than a minor variation of the Vigenère, and requires no
separate discussion other than a simple reminder that its
possibilities are far more limited than those of the Vigenère proper.
That is, it covers a range of only ten cipher alphabets where the
Vigenère covers 26, and this limitation more than compensates for the
fact that its key is not a plaintext word (presuming, that is, that
we know what cipher has been used. Otherwise, the difficulties are
about the same for both). To understand how this limitation may
modify the case, let us examine the work-sheet shown in Fig. 93.

Figure 92

GRONSFELD Encipherment

Key: 2 8 1 0 5 2 8 1 0 5 2 8...
Plaintext: S E N D S U P P L I E S...
Cryptogram: U M O D X W X Q L N G A...

Here, we have exactly the routine of Fig. 90, except that our search
must be made for probable trigrams, and not for a probable word. We
have begun with the most likely trigram, _THE_. But here we do not
find it possible to do as we did in Fig. 90; that is, _decipher every
letter_, first as _T_, then as _H_, then as _E_. Of the twelve
cryptogram-letters present, only seven can be deciphered as _T_; the
rest are too far away from it in the normal alphabet, and would
require keys larger than 9. Of the six letters which immediately
follow the possible _T_’s (the seventh is not shown), only three can
be deciphered as _H_. And of the three letters which immediately
follow a possible _TH_, only two can be deciphered as _E_ or as _A_.
It is often possible, in these ciphers, to investigate simultaneously
the trigrams _THE_ and _THA_. So far as the cryptogram is shown, then,
there are only two points at which a trigram _THE_ can be present,
while a Vigenère cryptogram of the same length would have presented
ten possibilities. Thus, we have no real need for a second work-sheet;
the only possible key-fragments, 114 and 790, can be tested by any
hit-or-miss method which happens to be quickest.

Figure 93
 Decrypting a Known Gronsfeld

Cryptogram Fragment: X U I I A Q E U U Y J W.......

Trigram tried: T 4 1/ 7/ 1 1 5/ 3
H 1/ 9/ 2/
E 4/ 0/

The sequences U I I and A Q E are the only points at which the trigram
T H E could possibly be present, so that only the key-sequences 1 1 4
and 7 9 0 are to be tried. The digram T H alone may be present at Y J.

This cipher is often decrypted in much the same way as a “Caesar”

simple substitution (shown in Fig. 61). The cryptogram, or a
convenient portion of it, is copied on a single line of writing; then,
with each letter as a point of beginning, a series of alphabets is
extended (written in reverse order), but only for a distance which
includes ten letters. That is, the ten possible decipherments for
each cryptogram-letter are written in the form of a ten-letter column.
The decryptor may then inspect the ten rows of decipherment to see
what he can find. At any point where it is possible to find _T_, _H_,
and _E_ in three consecutive columns, the correctness of this possible
_THE_ can be checked by finding out whether or not it has a series of
companion-trigrams standing at some regular interval on exactly the
same three rows.

* * *

In Fig. 94, we have the tableau of Giovanni Battista della Porta,

adjusted to suit the modern 26-letter alphabet. Here we have only
thirteen cipher alphabets, each of which may be governed by either of
two key-letters; these pairs of keys may be seen at the left of their
respective alphabets. In all thirteen of these cipher alphabets, the
encipherment is _reciprocal_. In the _AB_-alphabet, for instance,
which is the first one on the chart, the substitute for _A_ is _N_,
and the substitute for _N_ is _A_. The Porta cipher, the oldest known
of its kind, employs a key-word, applied as in Vigenère. If the
key-letter in use is either _A_ or _B_, the topmost alphabet is the
one to be used; if the key-letter is either _C_ or _D_, the second
alphabet must be used; and so on. Where this encipherment is
illustrated in Fig. 95, it may be of some interest to observe that it
is not totally impossible for two different key-words to produce
identical cryptograms. As to decipherment, we have already mentioned
the fact of reciprocal substitution. Whenever the alphabets are
reciprocal (in any cipher), the decipherment is identically the same
process as encipherment.

Figure 94

The PORTA Tableau

AB A B C D E F G H I J K L M
N O P Q R S T U V W X Y Z

CD A B C D E F G H I J K L M
O P Q R S T U V W X Y Z N
 EF A B C D E F G H I J K L M
P Q R S T U V W X Y Z N O

GH A B C D E F G H I J K L M
Q R S T U V W X Y Z N O P

IJ A B C D E F G H I J K L M
R S T U V W X Y Z N O P Q

KL A B C D E F G H I J K L M
S T U V W X Y Z N O P Q R

MN A B C D E F G H I J K L M
T U V W X Y Z N O P Q R S

OP A B C D E F G H I J K L M
U V W X Y Z N O P Q R S T

QR A B C D E F G H I J K L M
V W X Y Z N O P Q R S T U

ST A B C D E F G H I J K L M
W X Y Z N O P Q R S T U V

UV A B C D E F G H I J K L M
X Y Z N O P Q R S T U V W

WX A B C D E F G H I J K L M
Y Z N O P Q R S T U V W X

YZ A B C D E F G H I J K L M
Z N O P Q R S T U V W X Y

The Porta tableau, being smaller than the Vigenère, is not at all
inconvenient to prepare and use as it stands. It can be made still
more compact: The upper half being alike for all thirteen cipher
alphabets, this half can be written _once only_, at the top of the
chart. The lower halves can be written below this on thirteen parallel
lines, with their pairs of keys at the left. A ruler may then be
used, as suggested for Vigenère, to point out any given lower half.
But when it is noticed that these lower halves are identically the
same series of letters, with its point of beginning shifted one
letter at a time, it is promptly seen that a slide is possible, on
which the _N_-to-_Z_ half of the normal alphabet, if written twice in
succession, could be placed in 13 different positions with reference
to the _A_-to-_M_ half; and a slide is more convenient still. The
slide shown in Fig. 96 is another of Ohaver’s devices. The only new
feature in connection with the Porta slide lies in the handling of
the key-letters, which, in this cipher, are no longer the first
letters of their cipher alphabets. Mr. Ohaver has added them on the
sliding portion of the device, each pair of keys being placed directly
below the letter which must stand beneath the index (_A_) whenever one
or the other of the pair is the key-letter in use.

Figure 95

Porta Encipherment
 Keyword: E A S T E A S T
Plaintext: S E N D S U P P...
Cipher: D R E Z D H G G...

(Compare:)

Keyword: F A T S F A T S
Plaintext: S E N D S U P P...
Cipher: D R E Z D H G G...

The Porta cipher, aside from its purely historical interest, provides
a most interesting decryptment study in the formation of its
alphabets. Notice that because of the encipherment scheme itself, it
becomes totally impossible that the substitute for any letter, in any
cipher alphabet, can ever be taken from its own half of the normal
alphabet. This limitation is far more visible than that of the
Gronsfeld. We have, say, a cryptogram sequence _H E P_. Can this
represent the trigram _THE_? No, because _E_ cannot represent _H_;
for the same reason, it cannot represent _THA_. Can it represent
_AND_? No, because _H_ cannot represent _A_. Can it represent _ENT_?
No, because _H_ cannot represent _E_. Can it represent _ION_? _TIO_?
_FOR_? _NDE_? _HAS_? It is not until we reach _STH_ that we find a
normally frequent trigram which could have the substitutes _HEP_.
But to gather the full significance of this Porta limitation, and
also a suggestion concerning the detail work when taking advantage of
it, let us picture the case of a probable word: INFANTRY.

Figure 96

A Slide for PORTA - Devised by OHAVER

┌─────────────────────────────────┐
│ A B C D E F G H I J K L M │
┌───────────┤ ┌───────────────────────────┐ ├───────────┐
│ N O P Q │ │ T U V W X Y Z N O P Q R S │ │ V W X Y │
│ │ │ │ │ │
│ │ │ (Keys) │ │ │
│ A C E G │ │ M O Q S U W Y │ │ │
│ B D F H │ │ N P R T V X Z │ │ │
└───────────┤ └───────────────────────────┘ ├───────────┘
│ │
└─────────────────────────────────┘

Using digits 1 and 2 to mean, respectively, the first and the second
half of the normal alphabet, this probable word INFANTRY has the
alphabetical pattern 1 2 1 1 2 2 2 2. And, since every substitute
must have been taken from the other half of the normal alphabet, it
will certainly be represented in any Porta cryptogram by eight letters
having the opposite alphabetical pattern: 2 1 2 2 1 1 1 1. Moreover,
a pattern as long as this is not going to be found very often in any
one cryptogram. The decryptor, then, may proceed as in Fig. 97. Each
cryptogram letter is marked I or 2, or imagined to be so marked, and
this series of digits is examined in the hope of finding a sequence
2 1 2 2 1 1 1 1. If it cannot be found, the word is not present; if
it is found, it can be assumed to represent the word INFANTRY. Here,
we meet with a slight difference between the procedure for Vigenère
and the procedure for Porta.

Figure 97

THE PROBABLE WORD METHOD IN PORTA

Pattern of word INFANTRY: 1 2 1 1 2 2 2 2

Pattern of substitute: 2 1 2 2 1 1 1 1

The cryptogram, with pattern:

F J I D T U V S S L F F I T X M S T M E D L
1 1 1 1 2 2 2 2 2 1 1 1 1 2 2 1 2 2 1 1 1 1

Determining the KEYWORD:

.....X M S T M E D L.....
I N F A N T R Y

E C A M C E C A
F D B N D F D B
D A N C E

In Vigenère, we found it possible to discover the key by simply

taking the probable word and deciphering with it. In Porta, we cannot
do this. We must first pair the two letters, that is, a supposed
substitute with its supposed original, and then find out what key
would cause this. In the figure, for instance, we have a sequence _X
M S T_, assumed to represent _I N F A_. The first corresponding pair
is _X_ = _I_. If we are using the tableau of Fig. 94, one of these
letters, _I_, is never found anywhere except in the 9th column. We
find the _I_-column, and trace down until we find _X_; the key, in
this case, must be _E_ or _F_, The next corresponding pair of letters
(_M_ representing _N_) demands that we find the _M_-column and trace
down to _N_; key _C_ or _D_. The third pair (_S_ representing _F_)
demands that we find the _F_-column, and trace down to _S_; key _A_
or _B_. The fourth pair (_T_ representing _A_) demands that we find
the _A_-column, and trace down to _T_; key _M_ or _N_.

Using the slide of Fig. 96: Place _X_ and _I_ together, and note that
the key-letters standing below the index (stationary _A_) are _EF_.
Place _M_ and _N_ together, and note key-letters _CD_. Place _S_ and
_F_ together, and note key-letters _AB_. Place _T_ and _A_ together,
and note key-letters _MN_. From the recovered pairs of key-letters,
we are to select one each in order to recover the key-word, using
somewhat the logic we might apply in dealing with a key-phrase
cryptogram. In the given case, where we need the two vowels to form
any word at all, it is not difficult to surmise that the key-word was
DANCE. It might not be so easy to decide as between EAST and FATS;
but key-words, as a rule, are seldom so short as those we have been
using, and the longer the word, the fewer the possibilities.
Concerning keys, however, there is one contingency which may have to
be considered: The various modernized versions of this tableau are
not always duplicates. The cipher alphabets will be the same as those
given here; but where we have caused these to shift in the normal
direction, another tableau may show them shifting in reverse. The
first alphabet will be the same as here, but the second, still showing
key-letters _CD_, will show its lower half beginning _Z N O P_. . . ;
the third, still showing key-letters _EF_, will show its lower half
beginning _Y Z N O P_. . . ; and so on. The recovery of the key-word,
of course, is not vital.

* * *

Coming now to the two ciphers which are called Beaufort, we return to
a tableau so closely resembling Vigenère’s tableau that the two can
be used interchangeably. Fig. 98 shows only enough of the Beaufort
tableau to bring out the difference in form. Here, we find no separate
plaintext alphabet and no separate key-alphabet. Those which form the
square have been lengthened by repeating their first letters; and a
27th alphabet, added at the bottom of the tableau, repeats the
alphabet shown at the top. In this way, we have a 27 x 27 alphabet
square in which _all four of the outside alphabets are exactly alike_.
These ciphers, also, make use of a key-word, applied as in Vigenère
and in Porta. As Sir Francis Beaufort himself is said to have used
the tableau, the encipherment of a given plaintext-letter, using a
given key-letter, was accomplished as follows: To encipher plaintext
_S_ with key _C_, find the letter _S_ in any one of the four outside
alphabets, trace into the square along the _S_-column (or row) as far
as the key-letter _C_; at that point, turn a right angle, in either
direction, and trace outward along that row (or column), emerging
from the square at the substitute, which, in the given case, is _K_.
Or: To _decipher_ _K_ with key _C_, begin with _K_, and _follow
identically the encipherment process_, emerging this time at the
plaintext letter, _S_. This process we have called the _true Beaufort_
cipher. Notice that we have _reciprocal encipherment_; encipherment
and decipherment are identically the same thing.

Figure 98

Upper Portion of the BEAUFORT Tableau

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A
B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B
C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C
D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D
E F G H I J K L M.... (Etc.) ....W X Y Z A B C D E

There are no external alphabets. The four outer alphabets of the

square are exactly alike, with A in each of the four corners.

TRUE BEAUFORT Encipherment VARIANT BEAUFORT Encipherment

Key: C O M E T C O M E T C O Key: C O M E T C O M E T C O
Plaintext: S E N D S U P P L I E S Plaintext: S E N D S U P P L I E S
Cipher: K K Z B B I Z X T L Y W Cipher: Q Q B Z Z S B D H P C E

As to the companion cipher, the student will promptly have guessed

this for himself: Instead of starting with the plaintext-letter, _S_,
and tracing inward to the key-letter, it is entirely feasible to begin
with key-letter _C_ and trace inward to the plaintext-letter _S_,
emerging at _Q_ instead of at _K_. This cipher, too, is called
Beaufort, since its method of accomplishment is Beaufort’s method.
But there is a difference in the two resulting ciphers; notice here
that the encipherment is no longer reciprocal; should we start at
key-letter _C_, trace inward to the new cipher-letter, _Q_, and then
trace outward, we do not emerge from the square at the plaintext
letter _S_, but at _O_, an entirely new letter. In order to
distinguish the two ciphers, we have referred to this second process
as the _variant Beaufort_, or sometimes, more briefly, as “the
variant.” There is some justification, also, for calling it the
“Vigenère-Beaufort.” To see why, the student may turn back to his
Vigenère tableau, and actually perform the encipherment, using only
the two sides of this tableau in which the alphabets run from _A_ to
_Z_.

In applying the variant encipherment, in which key-letters are found

first, he need find a given key-letter but once, then lay a ruler
along the row (or column) indicated by that key-letter, and encipher
at a single writing all plaintext letters which are going to have that
particular key. But if, as previously recommended, he has familiarized
himself with the use of the Vigenère tableau, he will see instantly
that the operation which, in the variant Beaufort he is calling
_encipherment_, is identical, in every particular, with the operation
which, in Vigenère, he would have called _decipherment_, and that, in
order to decipher the variant, he must perform the operation which,
in Vigenère, is called encipherment. Neither of these operations
provides a reciprocal substitution; instead, they are reciprocal to
each other. Once it is seen that this is true, it becomes equally
plain that the Saint-Cyr slide serves just as well for the variant
as for the Vigenère. To make use of it in applying the variant
encipherment, set key-letters below index-letter _A_, exactly as if
making ready to encipher in Vigenère, but reverse the functions of
the two alphabets; that is, find all plaintext letters in the lower
one, and take their substitutes from the upper one.

Figure 99

How to find the C-alphabet of each Beaufort

TRUE BEAUFORT VARIANT BEAUFORT

Key: C C C C C C C C Key: C C C C C C C C
Plaintext: A B C D E F G H... Plaintext: A B C D E F G H...
Cipher ALPHABET: C B A Z Y X W V... Cipher ALPHABET: Y Z A B C D E F...

Now, consider the true Beaufort cipher: Here, plaintext letters are
found first, and keys are found by tracing into the square, so that
encipherment is more or less a letter-by-letter process, and hardly
so convenient as in the other two ciphers. It is true that every
ascending diagonal in the tableau is made up of only one key-letter,
so that a ruler, laid diagonally across this tableau, will point out
a whole line of _C_’s, or _O_’s, or _M_’s. But practically every one
of these diagonals is broken into two portions, so that in attempting
to encipher by one key-letter at a time, we find it rather confusing
to make the necessary adjustments. Is there not, then, a more
convenient method for applying the Beaufort? Every cipher of this
family, remember, provides a certain number of individual simple
substitution cipher-alphabets. For every key (whether it is a letter
or a number) there is some kind of cipher alphabet showing a
substitute for _A_, a substitute for _B_, a substitute for _C_, and
so on. To isolate one of these cipher alphabets, and find out what it
is like, we have merely to take some one key-letter (or some one
key-number) and discover what these substitutes are, and what their
order is; that is, we need merely _encipher the normal alphabet_,
using this one key. This is true of every cipher of the
multiple-alphabet type. The process can be seen in Fig. 99, where the
_C_-alphabet (that is, the alphabet governed by key-letter _C_) is
being isolated for each of the Beaufort ciphers.

In the Beaufort proper, we find that the _C_-alphabet will begin with
_C_ and come out in the order _C B A Z Y X_. . . . , which is merely
the normal alphabet reversed. Should we investigate the _D_-alphabet,
we should find that this begins at _D_ and comes out in the order
_D C B A Z Y_. . . . , again the normal alphabet reversed; or,
investigating the _E_-alphabet, we should find _E D C B A Z_. . . . ,
always the normal alphabet written backward, and always beginning with
whatever letter is called the key. This being the case, it becomes
quite evident that a slide is possible, and the formation of this
slide is clearly indicated in the left-hand tabulation of the figure:
Its upper alphabet must run in one direction and its lower alphabet
in the other; if one of the two is made of double length, it becomes
possible to place any one of the 26 key-letters in juxtaposition with
index _A_, thus bringing into position any one of the 26
cipher-alphabets which are governed by these keys. Nor does it make a
particle of difference which of the two _A_’s, the upper or the lower,
is regarded as the index-letter; when _C_ is standing below _A_, then
_A_ is also standing below _C_. We saw, in the tableau itself, that
the true Beaufort encipherment gives reciprocal substitution. This,
however, was not our first meeting with one of the Beaufort alphabets;
in Chapter IX, we met the _Z_-alphabet. We saw there that whenever a
cipher alphabet is merely the plaintext alphabet written backward, it
makes no difference which of the two is called a cipher alphabet; we
may see here that this fact is not altered by shifting one of the
alphabets. Since a slide is possible, it follows that a disk is also
possible. This particular cipher disk, on which one alphabet runs
forward and the other backward, was used long ago in our own army,
and is widely known in this country as “The United States Army Cipher
Disk.” Most persons, apparently, prefer the slides, on which the
letters are always right-side up, and the preparation of which does
not involve the division of a circle into 26 equal arcs. Of those who
prefer the disks, practically all will make the smaller disk
_reversible_, with the normal alphabet on one side and the reversed
alphabet on the other.

Figure 100

A Pair of COMPLEMENTARY Alphabets:

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
A Z Y X W V U T S R Q P O N M L K J I H G F E D C B

By doubling the length of one or the other of these

two alphabets, we may use them to form a slide which
will encipher and decipher the true BEAUFORT.
Now, returning to our Fig. 99, and examining its right-hand
tabulation: We find that, in isolating the _C_-alphabet of the
variant Beaufort, we have merely reproduced the _Y_-alphabet of the
Vigenère. Should we now isolate its _Y_-alphabet, we should find that
we have obtained the _C_-alphabet of the Vigenère. Further
investigation will show that the _D_-alphabet of one is the
_X_-alphabet of the other, that the _E_-alphabet of one is the
_W_-alphabet of the other; and so on. Only their _A_-alphabets and
their _N_-alphabets are keyed alike. Thus we seem to have here a case
of “reciprocal” key-letters. These particular pairs of corresponding
letters, _B_ and _Z_, _C_ and _Y_, _D_ and _X_, and so on, are called
_complements_, one letter of each pair being _complementary_ to the
other. Since the letters _A_ and _N_ have no complements (or serve as
their own complements), the normal alphabet will furnish only twelve
such pairs, and these are shown complete in Fig. 100. In this same
set-up, it can be seen that the _A_-alphabet of the Beaufort cipher
is the complement of the normal alphabet. Thus, having provided
ourselves with a Beaufort slide (or disk), we have always at hand a
means for finding out the complements of letters. Once it is clearly
understood that the chief difference between a Vigenère cryptogram
and a variant cryptogram lies in the names of their respective cipher
alphabets, it becomes evident that we might decrypt a variant,
believing it to be a Vigenère, and have no trouble whatever in
reading its message, though finding that it has an _incoherent key_.
Vigenère keys, of course, can be incoherent; occasionally they are
based in some way on numbers, following the Gronsfeld scheme. But
usually, this is not true; the incoherency is only apparent, and a
little investigation will discover what the trouble is. In the case
just mentioned, the variant key-word COMET will come out in Vigenére
as _Y M O W H_, or vice versa; all that is necessary, in order to
discover the original key-word, is to set the Beaufort slide at the
_A_-alphabet, and perform a bit of simple substitution. Another cause
for the apparently incoherent key lies in the use of some other
index-letter than the stationary _A_. Say, for instance, that the
encipherer has used the key-word COMET, but has placed his key-letters
beneath index _D_. The key recovered by the decryptor is _Z L J B Q_;
to find the original key-word, he need merely “run it down the
alphabet.”

Figure 101

Applying a PROBABLE WORD to BEAUFORT

(a)
Cryptogram, TRUE BEAUFORT: K K Z B B I Z X T L Y W T Q

Probable word.......... S C C R T T A R P L D Q O L I
U E T V V C T R N F S Q N K
P O Q Q X O M I A N L I F
P Q . . . M I A N . I .
L E
I T
E C
S O

Use the word SUPPLIES as a trial key, exactly as in Vigenère, but make
use of the VARIANT method, and not tho TRUE BEAUFORT.

***
 ***
(b)
Cryptogram, VARIANT BEAUFORT: Q Q B Z Z S B D H P C E H K

Probable word............. S Y Y J H H A J L P X K M P S
U W H F F Y H J N V I K N Q
P M K K D M O S A N P S V
P . . . . O S . N . P .
L W
I H
E Y
S M

This was deciphered as a Vigenère, and showed the repeating of a scrambled

key: Y M O W H. Had it been deciphered with the BEAUFORT SLIDE, suggested
in Figure 100, it would have reproduced the plaintext keyword, C O M E T.

Of the ciphers we have seen, then, those three which are complete,
that is, which employ a full 26 alphabets, are curiously interrelated
to one another. In the matter of substitution (encipherment and
decipherment), the Beaufort stands alone, in that it is reciprocal,
while the other two ciphers are reciprocal to each other in this
respect. But in the matter of keys, it is the Vigenère which stands
alone, in that it can be deciphered indifferently by key-letter or
message-letter, where this is not true of either Beaufort. _In this
respect, these two ciphers are reciprocal_. To see this plainly, we
may examine our three encipherments, each one showing a different
cryptogram obtained from the plaintext fragment SEND SUPPLIES, using
key COMET. The Vigenère version was seen in Fig. 90. If this be
_deciphered with its message_, SEND SUPPLIES, the result is a
repeating key-word COMET COMET CO. The other two cryptograms were
those of Fig. 98. Here, the Beaufort cryptogram, beginning
_K K Z B B_, if deciphered with the key COMET, gives the
message-letters _S E N D S_. But when we attempt to decipher it using
_S E N D S_ as our key, we obtain: _I U O C R_. It becomes necessary,
in order to find out our key-letters, that we proceed as we did for
Porta: Assuming that the slide is being used, place message _S_
beside cipher _K_, and find out what key-letter is standing beside
the index _A_. Place _E_ and _K_ together, and find the next key,
and so on. That is, change the position of the slide for every
decipherment.

In this same figure, the variant cryptogram begins _Q Q B Z Z_. If it

be deciphered with the correct key-word COMET, we obtain the correct
message-letters, _S E N D S_. But if we attempt to decipher it with a
key _S E N D S_, we obtain the same series as in the other case:
_I U O C R_. To decipher it as a variant, we must again proceed
letter by letter. How, then, are we going to apply a probable word as
we did with the Vigenère in Fig. 90? How are we going to decipher a
whole row of letters, first as _S_, then as _U_, then as _P_, and so
on? Must we do this letter by letter, shifting the slide for every
letter on every row? And suppose it is a page of trigrams, where we
wish to decipher every trigram on the page as _THE_? Is there no way
in which we can decipher all first-letters as _T_, all second letters
as _H_, and all third letters as _E_, with only three settings of a
slide? The answer is simple. _Switch the slides_. We have said (and
shown) that in this respect the two Beauforts are reciprocal. Where
the cryptogram is true Beaufort, and you desire to use your probable
word as a trial key, do this with your Saint-Cyr slide (used in
reverse, that is, as if enciphering in Vigenère). If your cryptogram
is variant Beaufort, use the Beaufort slide (or treat it as a
Vigenère, and obtain the key later). Both cases can be looked at in
Fig. 101. The cryptogram at (a) is our same Beaufort cryptogram; that
at (b) is our same variant. In another chapter, we shall look a little
more closely into this odd triangle of Vigenère-variant-Beaufort.
Meanwhile, the interested student might like to investigate for
himself a few of the curious angles:

Would it be possible to prepare a tableau for the true Beaufort, and

use it in exactly the manner described for Vigenère? Recalling the
appearance of the Vigenère tableau (Fig. 85): Suppose we should add
to this another vertical alphabet, this time on the right-hand side,
causing this new alphabet to begin at _A_ and run backward,
_A Z Y X_. . . . Could this new alphabet be made to serve any useful
purpose? More than one? What about the reversible cipher-disk? Is
there any way at all in which it would be possible to encipher and
decipher Vigenère cryptograms with a Beaufort slide, or Beaufort
cryptograms with a Vigenère slide? Could you make a cipher disk for
the Porta?

110. By NEON. (Gronsfeld).

J Q Q Y P I R S F Q Y J N E U R U V E F V W P E B Q F G T E M K U K G
R W E T Z I D V I Q Q S Z I H K W M C E K B F J Q Q X T R F V R J K O
A T E E N J U M S N G L P I B S O A S R Y S A X R U O J G W M V R U S
V D Q Q R D P P K P L I C.

111. By B. NATURAL. (Gronsfeld).

L N P L G S Y R U A I R I Q X R E N D I U U N H D
Y M S U U O Q N S T I T U G L W R E R V B Z D U Q
S I C T U Q B T F X J F E H J W N I K U N H A Y H
I E P R G X K W M P U K U L F N G Q P R B X Z R E
T E U U W T R X J F N H J Y O J U V S P N W O Z G
S O Q C J N W K G E B X Z R I P U N X B N A W O -

112. By B. NATURAL. (Porta).

I O U K J G F Y S M Q S X H W W D P K M M J E S P Y W Y L B X B V U D
X T V L V O G Q K S L W W Q S E U D K W J I A M G W Z C W F O U I M M
V Z F U Q K S O X D S E L E E P T I O T U L U L W W P K Q K S Z E U.

113. By KRIS KROST. (Beaufort. Probable word: AMERICA).

N D L H T I E Y R K F M F H L C S Z Q A H B H T Y H A F P I V I D C S
X P Z E X N K W Q R M S A H E Q X G R E H A U H G D S O O A G X U G D
W G T I L S A P D V H A Q W E W Z M I M Y Y Q O B F E K C M M T F N E
V H W Z Y B G P W V E H R Z V U O O N B K X F O Z J A Z I Q N Z T T O
P R V I T.

114. By WHOSIT. (Variant Beaufort).

K O A S Y B B S G P A R Y A T F R F D U L W H J A R G H S G U W D B C
J R V M C U P S T Q W M B Y S I W Y I F H B A A F I A N Y H J L S B T
J O C Z E E N N R U A S R U I E J N O E P S G C G W V U M E A K W R L
Y H N S R G H B A H.
115. By PICCOLA. (Short Simple Substitution. - No keyword).

O F T D A F F B E H Z H W G W F O M; M F W R J D E D N V F P Z K
W F D Y F M Z Q K K Z T.

CHAPTER XIV
The Kasiski Method for Periodic Ciphers

Prior to the 1860’s, the ciphers of the past two chapters had been
regarded as entirely safe. A radical change of opinion took place in
1863, when Major F. W. Kasiski, a German cryptanalyst, was so
indiscreet as to publish certain of his observations. The student
will surely have noticed, among the examples of Chapters XII and XIII,
the happening which is suggested in Fig. 102. Some sequence, usually
a digram, is repeated in the plaintext, and happens to be enciphered
more than once by exactly the same few key-letters; the result is a
_repeated sequence in the cryptogram_. What he may have failed to
notice is the _periodicity_ of such repeated sequences. In order that
the same few key-letters be used again, _the key-word must have been
repeated an exact number of times_, so that, in these cases of
repeated cryptogram-sequences, the distance from first-letter to
first-letter is _evenly divisible by the key-length_ — or period (in
the figure, the distance from _V_ to _V_ is 10, which is twice the
key-length, 5). This does not mean that all repeated sequences found
in Vigenère cryptograms are periodic. Often, they are purely
accidental; oftener still, they will be due to the repetition of
alphabets in the key itself, especialiy if it is such a word as
CORCORAN or DESDEMONA. But a distinct majority of them, according to
Kasiski, are caused by periodicity; and if all of the repeated
sequences found in a given cryptogram be examined to find what the
separating interval is in each case, and if all of these intervals be
factored, _the factor which predominates will betray the period of
the cryptogram_.

Figure 102

A common happening in all PERIODIC ciphers:

Vigenère key: C O M E T C O M E T C O M E T C O M
Plaintext: T H E R E I S A N O T H E R Q U E S
REPEATED SEQUENCE: V V Q V . . . . . . V V Q V . . . .

In order to have a look at the Kasiski method, we will consider the

cryptogram shown in Fig. 103; and, to approximate a more troublesome
case, we will assume that no repeated sequences can be found except
those few which have been underscored in the figure. With the
cryptogram-letters serially numbered, in the manner shown, the
distance apart of any two of them is readily learned by subtraction.
The digram _CH_ is found beginning at the 1st letter and again at the
46th letter; 46 minus 1 equals 45, their distance apart. Thus, if
_CH_ is one of the periodic repetitions, the period could be 15, 9,
5, or even 3. The trigram _UBF_, 8th and 63d letters, shows an
interval 55; here, the period could be 11 or 5. Notice that a period
5 has been indicated by both.

Now let us look at Fig. 104, where the method of presentation is once
more a debt to M. E. Ohaver. In this figure, the repeated sequences
have been listed, and each one is accompanied by the two serial
numbers of its two first letters, together with the interval which
was obtained by subtraction. Ohaver’s process provides a column for
each possible factor, beginning with 2 and carried as far as desired.
Opposite each interval, its various possible factors may then be
noted in their correct columns. In the average case, the correct
period will be pointed out by _the column showing the largest number
of entries_. But in this connection, it must be taken into
consideration that _small_ factors 2 and 3, and even factors 4 and 5,
are usually present in considerable numbers, partly as accidentals,
but also because they are factors of the period itself; that is, if
the period is 6, there will surely be factors 2 and 3 for every
factor 6, and there will usually be a few extra appearances due to
accidental repetition.

Figure 103

5 10 15 20 25 30
C H G S L F A U B F X U P H S J D A G Y X M N Z U W W J P D

35 40 45 50 55 60
J S U P L G C G F K R N I M F C H K O A Q A V X O N N U I L

65 70 75 80 85 90
N S U B F N D V P K A I P L S N M Q O H M E U I L B L K Q W

95 100 105 110 115 120

N D V I Y X U I I A Q E U U Y J W C O K O E N M P W W J J J

125 130 135 140 145 150

Q I U O V C M W D O X F C O L F S K U L V B W U N R V G T B

155 160 165 170

B S Q N L U E P H A Q T Q X V A K Q O E

Now, considering our tabulation, and ignoring the fact that short
periods like 2 and 3 are seldom encountered, we find that factors 3
and 5 are present in equal numbers. Often, we are faced with exactly
this problem. Here are two factors which have appeared in approximately
equal numbers. Which one of these actually represents the period?
Ohaver’s recommendations include these: Where two factors seem almost
equally prominent, select the larger if it is a multiple of the
smaller. If one factor is not a multiple of the other, try to select
a period which is a multiple of both (as 15 here, includes both 3 and
5). He points out also that the factor which is the correct key-length
will usually be accompanied, in the tabulation, by quite a number of
its own multiples, growing gradually fewer and fewer as their size
increases. In this respect, our factors 3 and 5 are both disappointing.
If we consider factor 5, we find factors 10 and 15, but not growing
fewer; instead the number increases. We find no factor 20, but we do
find a factor 25; another increase. Or, if we consider factor 3, we
find factors 6 and 9, but no factor 12, and then a sudden increase in
the number of factors 15. This is a case in which the decryptor would
play safe by selecting the period 15.

Figure 104

Tabulation for Finding Period M.E.OHAVER

Repeated Positions - POSSIBLE FACTORS of INTERVALS

Sequence Intervals

C H 46 - 1 = 45 3 5 9 15
U B F 63 - 8 = 55 5 11
U P 33 - 12 = 21 3 7 21
S U 62 - 32 = 30 2 3 5 6 10 15
P L 73 - 34 = 39 3 13
W W J 116 - 26 = 90 2 3 5 6 9 10 15 18
N D V 91 - 66 = 25 5 25

The factors found in the largest number of DIFFERENT intervals are 3 and 5.

The student who cares to examine this matter more closely may do so
by preparing for himself a less haphazard listing of the cryptogram’s
repeated sequences. Perhaps the most satisfactory way of doing this
is to begin by making a general frequency count. Then, in order to
have the more reliable information at once, start the tabulations by
examining those letters whose frequency is only 2; follow this with
an examination of those having a frequency of 3, and so on. The
theory is that letters of these frequencies are much more likely to
belong to only one alphabet, while the letters of higher frequency
have probably been enciphered in several different alphabets, so that
their repeated sequences are not so sure to be periodic. For other
cases in which there may be some doubt, the writer’s advice is to
select large factors in preference to small factors. Or, if the
decision must be made between two factors such as 6 and 7, where a
period of 42 would be necessary in order to include both, simply
select the handiest and give it a trial. With the longer cryptograms,
as we shall see in a moment, an error in the choice is very speedily
discovered; as to the shorter cryptograms, there is one rule which
invariably holds good: _If you meet with any resistance at all_ in
dealing with the kind of ciphers which were shown in the past two
chapters, you have probably selected the wrong period.

Figure 105

Individual Frequency Counts - PERIOD 5

Alphabet 1 Alphabet 2 Alphabet 3 Alphabet 4 Alphabet 5

A 11 11 1 111
B 11 1 11 1
C 111 1 11
D 111 1 1
E 1111 1
F 11 1 1 111
G 1 111 1
H 11 11 1
I 11 11 1111
 J 111 11 1 1
K 1 111 111
L 1 1 11111 11
M 1 111 11
N 11111 11 11 1 1
O 1 11111 1 11
P 111 111 1
Q 1111 1111 1
R 11
S 1111 1 11
T 1 1
U 1 11 11111 11 111 1
V 1 1 111 11
W 11 111 11 1
X 1111 11
Y 111
Z 1

Often, however, where one clue is missing, there will be another

present to take its place. Repeated _trigrams_ are less likely than
repeated digrams to be accidental, and longer repeated sequences are
still less likely to be so. In the present tabulation, we find that
three of the repetitions are trigrams; in all three cases the period
5 is suggested, while only one suggests also a period 3. That is, if
we use a period of 15, two of these trigrams will have to be
considered accidental.

If the period here is 5, then we are dealing with _five simple

substitution alphabets_. These five alphabets have been used over and
over again, always in a given rotation; therefore, if the cryptogram
be rewritten into _five columns_ (it is already conveniently grouped),
the letters in each column will belong to one same alphabet, and it
becomes possible to _take a separate frequency count on each one of
these five alphabets_. These individual frequency counts may be seen
in Fig. 105. Originally, we had a length of 170 letters, and, if the
student desires to take a frequency count on the complete cryptogram,
he will find that he has no truly predominant letters which could
represent some of the letters _E T A O N I R S H_. Instead, he has a
series of frequencies which are all fairly close to 4% of the text
(6 or 7), and which, should he rearrange them in decreasing order,
would have somewhat the following appearance:
10-10-10-9-9-9-8-8-8-7-7-7-7. . . . . .3-2-2-1. He will probably find,
also, that every letter of the alphabet has been used at least once,
something which would be very rare indeed in any normal English text
of 170 letters. But in these five individual frequency counts, each
belonging to a separate alphabet, matters are different. Here, the
alphabets represented have a length of only 34 letters each, and yet,
in the third, fourth, and fifth alphabets, there is one predominant
letter, which could represent _E_, or some other letter which has
taken the place of _E_, while, in the first and second alphabets,
there are some few letters distinctly more prominent than others.
Also, each alphabet has shown some gaps in sequence, where letters of
the class _J K Q X Z_, and possibly also some letters like _B P V W_,
would surely be missing in a normal text of only 34 letters.

A frequency count made on columns is not, of course, normal. We saw

this in dealing with transpositions, when we considered
vowel-distribution. Yet, as length increases, we find that the letters
present in columns begin to approach more and more the proportions
found in normal text; here, with only 34 letters, it would be
possible, in any one of these frequency counts, to assign the letters
to groups of high, moderate, and low frequencies. _Whenever our
frequency counts do not have this general aspect, the period cannot
be correct_. (There are, of course, the very short cryptograms, in
which the actual frequencies are not apparent.) So far, we are dealing
with any cipher whatever of the periodic type, and many of these
ciphers do not make use of simple shifted alphabets, or even of
alphabets which are in any way related to one another.

Now let us consider the one case in which the alphabets are all
“Caesars.” In this case, whether the cipher is Vigenère, Beaufort, or
Porta, we have only to identify one letter in order to identify a
whole alphabet. Suppose we examine, first, alphabet 5, in which the
one outstanding letter, _L_, has appeared 7 times. Does this letter
represent _e_? If _L_ of alphabet 5 represents _e_, then, counting
backward (that is, upward), we find that the letter _a_ will have to
be represented by _H_; this alphabet, then, will be the _H_-alphabet
if the cipher is Vigenère. The letter _H_ has a frequency of only 1,
which, in normal text, is not particularly satisfactory as the
frequency of _a_, but this frequency count has not been taken from
normal continuous text; suppose we examine the rest of the alphabet,
and find out what the frequencies would be for other letters.
Beginning at _H_, and calling letters in the order _a_, _b_, _c_, we
find that this fifth alihabet, provided it is the _H_-alphabet, will
contain: 3 _d_’s, 7 _e_’s, 2 _h_’s, 2 _l_’s, 2 _o_’s, 3 _r_’s,
3 _t_’s, and 3 _y_’s. That is, each letter present which shows a
frequency greater than 1 will represent some plaintext original
which, normally, is of some frequency, the only exception being _y_,
which is a vowel. This is the best we can expect of any columnar
frequency count made on only 34 letters; but more convincing still,
and more reliable, is the fact that out of the entire group
_j k q x z_ we find only _x_, represented once. Alphabet 5, then, is
entirely acceptable as the _H_-alphabet of the Vigenère cipher.

Let us see what we can find out about alphabet 3. Here, the strongly
predominant letter is _U_. But when we attempt to identify this as
_e_, we find that we should have to accept an alphabet containing
3 _q_’s, 2 _x_’s, and 3 _z_’s, all occurring in only thirty-odd
letters of text. We meet with similar trouble when we attempt to
identify _U_ as _t_, as _a_, as _o_, and so on. It is not until we
try it as _s_ that we have good luck, finding only a series of blanks
to represent the letters _b_, _j_, _k_, _q_, _v_, _w_, _x_, and _z_.
And if _U_ represents _s_, this alphabet begins at _C_. Alphabet 3,
then, is entirely acceptable as the _C_-alphabet of the Vigenère
cipher, and we have two of the key-letters: * * _C_ * _H_.

In alphabet 1, the leading letter, _N_, is not so strongly

predominant, and yet, when we assume it as the substitute for _e_,
we find that the rest of the count is satisfactory. Alphabet 1, then,
is acceptable as the _J_-alphabet of the Vigenère cipher and we have
three of the key-letters: _J_ * _C_ * _H_.

In alphabet 2, we find no one leading letter, but the two most

prominent frequencies are standing opposite _E_ and _S_, as if this
count might represent the normal alphabet itself. The absence of _O_
and the presence of only one _T_ is hardly significant in a columnar
count; but further examination shows an excess of _M_’s and _W_’s,
and this is more disturbing. However, a single _K_ has appeared as
the only representative of the group _J K Q X Z_; the low-frequency
letters _B_ and _V_ have appeared but once each; and there is an
absence of _Y_’s to counterbalance those which were too numerous in
one of our other alphabets. So that a detailed examination, and the
failure to identify this as any other alphabet, will lead to its
tentative acceptance as the _A_-alphabet of the Vigenère cipher. (We
can know definitely when we attempt to decipher with it.) With
alphabet 2 accepted as the _A_-alphabet, we now have four of the
key-letters: _J A C_ * _H_. We shall return in a moment to consider
the one which is still missing; but according to those present, it
does not look as if our key is going to develop into a recognizable
word.

Alphabets of the kind we saw in No. 2 can be much more satisfactorily

identified by means of a _graph_. This graph, when the cipher is
Vigenère, is no more than a picture of the normal frequency table.
Ordinarily, it will be a strip of paper on which the normal alphabet
has been written twice in succession, with a straight line standing
at right angles to each letter, this line being long or short
according to the normal frequency of its accompanying letter.

A description of one such graph, suggested by L. H. Patty, will serve

to explain them all: Assuming that the several frequency counts are
standing in a vertical position, as we see them in Fig. 105, and that
the work has been done on quadrille paper, the graph will also be
prepared vertically, and the strip of paper will be quadrille paper
with squares of the same size, so that the spacing, vertically, will
be the same for graph and frequency counts. The graph, however, will
be twice the length of the frequency counts, and will carry the normal
alphabet written twice in succession (except that the final _Z_ can
be omitted). The basis for frequencies can be 200, 100, or any other
basis desired. If the basis is 200, each small square might represent
a frequency of 5, so that a horizontal line placed beside _E_
(frequency 24), would have a length of nearly five of the small
squares. Or, if the basis is 100, each small square might represent a
frequency of 2, and the horizontal line placed beside _E_ (frequency
12), would have a length of six of the small squares. Or, if this
same graph is being made on a typewriter, we might dispense with the
horizontal lines and use a series of diagonals (or 1’s, or asterisks),
after the manner of tally-marks, using whatever number of these is the
actual frequency of the letter per 200, or per 100; this will give a
good clear picture of the normal frequency count. It is understood
that the upper and lower halves of the graph are to be prepared
exactly alike, and that there is to be no skipping of extra spaces
between them. Thus the graph, being twice the length of the frequency
counts, and spaced to match them, can be moved up and down beside each
one of these until some point is found at which the _pattern_ of the
given frequency count bears some resemblance to a pattern found
somewhere on the graph. If no such pattern can be found, the
conclusion is that the frequency count was not made on one of the
simple shifted alphabets; however, due allowance must be made, as in
the case of our alphabet 2, for the difference in length and for the
fact that frequency counts of this kind have been made on columns.
Patty’s graph, so far, is representing only the shifted normal
alphabet; that is, the cipher alphabets belonging to Vigenère,
variant, and Gronsfeld ciphers. If its horizontal lines be made very
heavy, and retraced on the opposite side of the strip, and if the
letters be written on that side, opposite exactly the same horizontal
lines as before, the reverse side of the strip will furnish another
graph for identifying the reversed alphabets of the Beaufort cipher.
Other graphs can be prepared for other kinds of alphabets. For
instance, a graph suitable for examining a series of Porta frequency
counts could be made in two halves, each of double length; the
_A_-to-_M_ half would serve for comparison with the _N_-to-_Z_
halves of the frequency counts, and vice versa.

Figure 106

Another Tabulation for Finding the Period EDWIN LINDQUIST

Repeated Interval List of all PRIME Factors.....

Sequence 2 3 5 7 11....(Etc.)

J C V 24 111 1
C V 13
D D V 36 11 11
D S 12 11 1
S S 8 111
D T J 60 11 1 1
T J 48 1111 1

This was based on a cryptogram whose period was 12. The PRIME
FACTOR 2 is obviously included twice, and the PRIME FACTOR 3 once.

* * *

The Vigenère cipher, and, in particular, the Kasiski method of

solution, have given rise to much research among members of the
American Cryptogram Association. We doubt that any of this research
has ever resulted in any new or valuable discovery. Yet it is
interesting in that it shows a body of amateurs arriving at devices
which are fully as effective or convenient as those proposed by
seasoned cryptanalysts. Carter’s “discovery,” for instance, which we
saw in Fig. 90, was purely his own device; at that time, he had never
heard of the “probable word method” proposed by Commandant Bazeries,
one of the greatest of modern cryptanalysts. A great many of the
first suggestions were directed at methods for making the
trigram-search less tedious; these were largely duplications of a
same idea, involving the use either of a tableau or of a slide; one
example will be shown in the next chapter. The use of graphs, also,
was a sort of simultaneous “invention.” As to Kasiski processes, while
Ohaver’s tabulation had been published, it had been out of print and
was not available for several years. The only information to be had
was the fact that a period could be discovered by factoring intervals
between repetitions, and Edwin Lindquist, finding this rather vague,
devised for his own use the tabulation which is shown as Fig. 106.
This tabulation was made from a cryptogram in which the period was 12.
Lindquist, instead of preparing columns for all possible factors,
prepared them only for _prime factors_, the repeated sequences and
their separating intervals being listed in about the same way as in
Ohaver’s tabulation. Now, taking one of the intervals, as 24: Tally
in column 2, and the interval is reduced to 12. Tally again in column
2, and the interval is reduced to 6. Tally again in column 2, and the
interval is reduced to 3, which is itself a prime factor. Tally a
final time in column 3, and the interval 24 has been reduced to its
prime factors. This process is almost entirely mental, and _very
rapid_. Examining the results: Columns 2 and 3 are very full,
indicating that prime factors 2 and 3 are both included in the period.
But in column 3, the tallies are largely single, indicating that this
factor is included only once in the period; while, in column 2, the
tallies are largely in pairs, indicating that this factor is probably
included twice in the period; had it been included three times, it
would have shown up oftener in threes. Conclusion: The period is
2 x 2 x 3, which is 12. This tabulation will be found fully as
convenient as Ohaver’s, and its results fully as accurate.

Figure 107

The "SHIFT" Method for Identifying Alphabet 4 EDWIN LINDQUIST

Letters apparently of the high-frequency class: I O P U

Their possible originals................E T A O N I R S H

Amount of SHIFT if I represents.. 4 15 8 20 21 0 17 16 1*
" " " " O " .. 10 21 14 0 1* 6 23 22 7
" " " " P " .. 11 22 15 1* 2 7 24 23 8
" " " " U " .. 18 1* 20 6 7 12 3 2 13

A SHIFT of 1 (the B-alphabet) makes all four of these letters the

substitutes for high-frequency originals. It almost certainly
the shift which was made.

Mr. Lindquist also developed his own method for identifying alphabets.
This method, which, in theory, is _graphic_, is not particularly
applicable to the kind of alphabets we have been considering; that is,
it would not be needed when there is so much material. But for shorter
examples, where alphabets contain only ten or fifteen letters each, it
comes close to being that magical thing referred to by Lamb, a
“mechanical crypt-solver.” This method can be examined in Fig. 107,
where it is being applied to our so-far unidentified alphabet 4. An
examination of this alphabet 4 (of Fig. 105) shows that it has four
letters of more prominence than the rest: _I_, _O_, _P_, _U_. These
letters, or most of them, should represent high-frequency originals;
and our method consists in examining them collectively in order to
find out what amount of “shift” must have taken place in order that
some four of the letters _E T A O N I R S H_ would have resulted in
these four particular substitutes. The word “shift” is best understood
by picturing the movement of the lower alphabet on a Saint-Cyr slide.
If the two _A_’s are together, this is the starting position, and the
“amount of shift” is zero. If the _B_-alphabet be moved into position,
we have a _shift of 1_; if the _C_-alphabet be moved into position,
we have a _shift of 2_; and so on. These “shift-numbers,” 0 to 25,
can be written below the letters of the sliding alphabet.

Now, considering only one of our letters, _I_: If this is the

substitute for _e_, the normal alphabet was shifted 4 positions; if
it is the substitute for _t_, the amount of shift was 15; if it is
the substitute for _a_, the amount of shift was 8; and so on through
the rest of the nine letters belonging to the high-frequency group.
Finally, having considered our letter _I_ as the substitute for all
nine of these possibilities, we arrive at a _series of nine
shift-numbers_: 4-15-8-20-21-0-17-16-1. And unless one of these is
the correct shift, the cryptogram-letter I does not represent a
high-frequency letter at all. In the figure, this examination has
been made for all four of the letters _I_, _O_, _P_, and _U_, and
opposite each of these we have the resulting series of nine
shift-numbers. A comparison of the four series of numbers will show
that _each one includes a shift of 1_. A shift of 1, then, that is,
the _B_-alphabet, would have caused all four of our cryptogram-letters
to become substitutes for high-frequency originals. This is almost
certainly the shift which was made; but should the assumption prove
incorrect, then a shift of 7 has appeared in three of the lines, and
the _H_-alphabet would be the next choice. Lindquist’s method was
found so effective for cases of scant material, that two members of
the Association, M. R. Collins and Helen S. Pearson, decided,
independently of each other, to set it up in permanent form, so as
to avoid fresh computations for each new cryptogram.

Figure 108

Tableau Showing SHIFTS for Each Letter of the Alphabet - (MORRIS R. COLLINS)

For VIGENÈRE For BEAUFORT

E T A O N I R S H E T A O N I R S H

22 7 0 12 13 18 9 8 19 A 4 19 0 14 13 8 17 18 7
23 8 1 13 14 19 10 9 20 B 5 20 1 15 14 9 18 19 8
24 9 2 14 15 20 11 10 21 C 6 21 2 16 15 10 19 20 9
25 10 3 15 16 21 12 11 22 D 7 22 3 17 16 11 20 21 10
0 11 4 16 17 22 13 12 23 E 8 23 4 18 17 12 21 22 11
1 12 5 17 18 23 14 13 24 F 9 24 5 19 18 13 22 23 12
2 13 6 18 19 24 15 14 25 G 10 25 6 20 19 14 23 24 13
3 14 7 19 20 25 16 15 0 H 11 0 7 21 20 15 24 25 14
4 15 8 20 21 0 17 16 1 I 12 1 8 22 21 16 25 0 15
5 16 9 21 22 1 18 17 2 J 13 2 9 23 22 17 0 1 16
6 17 10 22 23 2 19 18 3 K 14 3 10 24 23 18 1 2 17
7 18 11 23 24 3 20 19 4 L 15 4 11 25 24 19 2 3 18
8 19 12 24 25 4 21 20 5 M 16 5 12 0 25 20 3 4 19
9 20 13 25 0 5 22 21 6 N 17 6 13 1 0 21 4 5 20
10 21 14 0 1 6 23 22 7 O 18 7 14 2 1 22 5 6 21
11 22 15 1 2 7 24 23 8 P 19 8 15 3 2 23 6 7 22
12 23 16 2 3 8 25 24 9 Q 20 9 16 4 3 24 7 8 23
13 24 17 3 4 9 0 25 10 R 21 10 17 5 4 25 8 9 24
14 25 18 4 5 10 1 0 11 S 22 11 18 6 5 0 9 10 25
15 0 19 5 6 11 2 1 12 T 23 12 19 7 6 1 10 11 0
16 1 20 6 7 12 3 2 13 U 24 13 20 8 7 2 11 12 1
17 2 21 7 8 13 4 3 14 V 25 14 21 9 8 3 12 13 2
18 3 22 8 9 14 5 4 15 W 0 15 22 10 9 4 13 14 3
19 4 23 9 10 15 6 5 16 X 1 16 23 11 10 5 14 15 4
20 5 24 10 11 16 7 6 17 Y 2 17 24 12 11 6 15 16 5
21 6 25 11 12 17 8 7 18 Z 3 18 25 13 12 7 16 17 6

Collins’ device took the form of a tableau, as shown in Fig. 108. In

this figure, the vertical alphabet running through the center is a
list of possible cryptogram-letters. On the side marked “Vigenère,”
the four lines of numbers standing beside the letters _I_, _O_, _P_,
and _U_, are the same as those included in Fig. 107. It will be
noticed that only the first line of numbers (opposite _A_) need be
found from the slide; after that, each column is a series 0 to 25.
The same is true with reference to the Beaufort shifts. These,
incidentally, were computed on the assumption that the Beaufort keys,
_A_, _B_, _C_, _D_. . . . . . . are passing in their normal
alphabetical order beneath the stationary _A_ (as most of us prepare
the Beaufort slide, this is backward). Fig. 109 shows a similar
tableau prepared for the Porta shifts. The zero-position here is the
_AB_-alphabet, a shift of 1 is the _CD_-alphabet, and so on. Collins,
however, did not use the shift-numbers. _He increased these by 1_,
using numbers 1 to 26, which represent the 26 positions of the slide,
or, better, the serial positions in the normal alphabet of the 26
key-letters. Others who have since prepared similar tableaux have
dispensed altogether with numbers, and have used the key-letters
themselves. Doing this, the first row of the Vigenère portion will
show the nine key-letters _W H A M N S J I T_, the second row will
show key-letters, _X I B N O T K J U_, and so on. If the letters
appearing on the slide have been numbered, one method is fully as
convenient as the other, though in dealing with a plaintext key one
would probably prefer the letters. In any case, where some four
letters, such as our _I O P U_ of the foregoing alphabet, have been
found more than once in a given frequency count, it is merely
necessary to find these four letters one by one in the vertical
alphabet and _copy_ their accompanying numbers. It is even possible,
having these three tableaux, to decide whether the frequency counts
taken from a periodic cryptogram represent the alphabets of the
Vigenère, the Beaufort, or the Porta.

Figure 109

Tableau Showing SHIFTS for PORTA

E A I H T O N R S

9 0 5 6 N 6 1 0 4 5 A
10 1 6 7 O 5 0 12 3 4 B
11 2 7 8 P 4 12 11 2 3 C
12 3 8 9 Q 3 11 10 1 2 D
0 4 9 10 R 2 10 9 0 1 E
1 5 10 11 S 1 9 8 12 0 F
2 6 11 12 T 0 8 7 11 12 G
3 7 12 0 U 12 7 6 10 11 H
4 8 0 1 V 11 6 5 9 10 I
5 9 1 2 W 10 5 4 8 9 J
6 10 2 3 X 9 4 3 7 8 K
7 11 3 4 Y 8 3 2 6 7 L
8 12 4 5 Z 7 2 1 5 6 M

Miss Pearson’s device took the form of _strips_, a set of 26 for each
of the three ciphers. Fig. 110 shows the first five of her Vigenère
set as she originally prepared them, using the “position-numbers,”
which are all larger by 1 than those of the tableau. Aside from this,
each strip represents one row from the Vigenère half of Collins’
tableau. But where Collins had arranged his numbers according to the
frequencies of the nine possible originals (so that possibilities
found on the left might have more significance than others found on
the right), Miss Pearson arranged hers in straight numerical order,
and spaced them in such a way that No. 1 is always in the first
column, No. 2 is always in the second column, and so on. Had she used
key-letters, all _A_’s would have been in the first column, all _B_’s
in the second column, and so on. As to the use of these strips:
Presuming that the four leading cryptogram-letters are the same as
before, simply pick out the four strips which are headed by the
letters _I_, _O_, _P_, and _U_, and set them together. If any of the
numbers are duplicated, _you will find them standing in the same
column_. These, remember, are the devices of amateurs, and both will
be found very effective. It will be noticed that the basis is the
finding of key-letters (or numbers) and not the identification of
cipher alphabets.

Now compare these devices with a method proposed by an expert, in

which the basis is the identification of cipher alphabets, and not
their keys: With this method, a tableau is prepared (which could be
arranged like the one of Fig. 85) in which the only letters shown on
any one line are the substitutes for the nine high-frequency letters.
If, for instance, the tableau is intended for the Vigenère cipher,
the top row will contain only the letters _A E H I N O R S T_, _and
the other 17 positions will be left blank_. The second row will
contain only the letters _B F I J O P S T U_, the third will contain
only the letters _C G J K P Q T U V_, and so on. Or, if the tableau
is intended for the Beaufort cipher, the top row will contain only
the letters _A W T S N M J I H_, the second row only the letters
_B X U T O N K J I_, and so on. Thus, after having taken a series of
frequency counts, we may find out, in each of these frequency counts,
which are its leading letters, then consult the prepared tableau to
find out which of its alphabets will show these same leading letters.
An added suggestion is as follows: Prepare the tableau, as described,
using black ink. Then, using red ink, add to each alphabet the
substitutes for _J K Q X Z_ (perhaps, also, for _B P V W_); that is,
the substitutes for those letters which ought to be largely _absent_.
This makes it much easier to decide between two alphabets in which
the more frequent letters have made it seem that one is as likely as
the other. It will be found that letters of low or moderate frequency
are ordinarily as helpful in these ciphers as those of high-frequency;
an instance has been pointed out in which those of the cryptogram can
be more so: Where the question is one of deciding between two possible
periods, a new tabulation can be made using only the sequences found
in connection with those letters which are less frequent in the
cryptogram than others, and thus not so sure to belong to more than
one alphabet.

Figure 110

Strips for Determining SHIFTS HELEN S. PEARSON

SET FOR VIGENÈRE

---------------------------------------------------------------------------------
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
A 1 _ _ _ _ _ _ 8 9 10 _ _ 13 14 _ _ _ _ 19 20 _ _ 23 _ _ _
=================================================================================
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
B _ 2 _ _ _ _ _ _ 9 10 11 _ _ 14 15 _ _ _ _ 20 21 _ _ 24 _ _
=================================================================================
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
C _ _ 3 _ _ _ _ _ _ 10 11 12 _ _ 15 16 _ _ _ _ 21 22 _ _ 25 _
=================================================================================
 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
D _ _ _ 4 _ _ _ _ _ _ 11 12 13 _ _ 16 17 _ _ _ _ 23 24 _ _ 26
=================================================================================
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
E 1 _ _ _ 5 _ _ _ _ _ _ 12 13 14 _ _ 17 18 _ _ _ _ 24 25 _ _
---------------------------------------------------------------------------------

NOTE: The numbers here are POSITION-numbers, instead of SHIFT-numbers. A

shift of zero is "position 1" of a slide. This is also the numerical, or
serial, position of A in the normal alphabet. Most members of the American
Cryptogram Association prefer to dispense with numbers, and use key-letters.

We have seen, then, what can be done in place of the trigram-search in

the case of those longer cryptograms. Having one of only 170 letters,
we first found out its period, and then (presuming that we accepted
the _B_-alphabet in the case of alphabet 4), found out all five of
its key-letters _J A C B H_, and even the type of encipherment
(obviously Gronsfeld), _without having deciphered a single letter of
its message_. We are now in a position to go back and investigate any
which are still unsolved. With Vigenère methods and principles
thoroughly understood, the student is fully in possession of methods
for dealing with any periodic cipher whatever _in which he knows what
the cipher alphabets are_. All that remains, then, is to pick up a
few loose ends, and observe a few variations from the strictly
periodic encipherment, after which we may consider the case of the
unknown cipher alphabets.

116. By NEMO. (A Vigenère? Or a snare and a delusion?)

W L P C V M O G K E E I F M U R W W F H V M F F W E Y X A V U B I C Z
O J M L C H V X Y F K S C U S X I L M G B Q I D B W I F G B I Q Z G Z
H F J Y P M K I G V P T W Y K W Z H W M Z H W I F A P S D N W F H E D
S C X A V O E B Y Y O K C O Y U I H U J L H U D X P P W V V H P F W Y
L G F B V E J M A A G B P I E B A V U V Q L Z N L P W A J W.

117. By NEON. (U.S.Army Cipher Disk. Surely not an advertisement?)

D J T X J M H L M K O M F D T F N E U I G D D N A A U S N S A C F G Y
M Z Y A Q A N M W U W S R B R F J J Q S K A Y B A N B L T O J E R K S
N W X A G T J L Z Y S T V A R B X L K N R L V D U U F O F A K Z L W Y T E E
W.

118. By TITOGI. (What! Another Vigenère? Some collusion here!)

D W P W Z T C G H H Z B B V W F B H I F W Q B L L J D Z R G U M M E S
W B D W L J K X I F Y Z D G K Y I O I K D W P M F H C M S F Q G C E L
J I I H W A M I W L J Z I W S W K V W E.

119. By THE ADMIRAL. (Vigenère).

N S R V K D K S I W J W Y C E C E G K C E B D K N Q Y S J U L X Z O L
X P S U V U T F B S O I N P C R R E U Y O N U F K H K Z D D O J P Q Z
C K J I E N A F J D W B U S J U R C L C J C E P C O K T V F A F P Y X
G K K Y Z V.

120. By THE ADMIRAL. (Beaufort).

Z N J L N Y H C Z D A U D D Z I N H R C Z Y Z K H G B P E C L M L W Y
R O I J Q D T L Q O Z H Q S N D V E S E P E J O Y L S Z O J U P G T K
J F K C U W N S H G W F D T M G K K D W E H L Z R N S B G V E S R A U
K K U M J Z M T K N K F Q L G K C U P Z U S D L W D E Z U B D Y F O D.

121. By DOR. (Another "Aristocrat." - Not hard. No keyword).

A B C D E F G C H G I J A K G F D J F B L M E D M M I M G B A N F L C
L O G J P N F D R F C L N. O G P I M S D A N T D L I F U. F C B G
N B P J E G J F C L E F, K C G A I E D V B F.

CHAPTER XV
Miscellaneous Phases of Vigenère Decryptment

When a Vigenère cryptogram is very short, its alphabets are no longer

readily identified by their graphic appearance. But its period, in
the majority of cases, can still be determined, and it still remains
true that the identification of one letter identifies a whole
alphabet. The example of Fig. 111 contains only 30 letters. With this
cryptogram in the form shown at (a), we are still dependent upon the
search for trigrams and short words, but the case is modified by the
presence of a repeated trigram. Unless this repetition, _ZIL_, is
accidental, it indicates a maximum period of 12, and the cryptogram
is long enough to provide another interval 12, with another trigram,
_EUK_, upon which any key-fragment brought out at _ZIL_ can be tested
in order to see whether or not it will bring out another good
sequence. When it finally does, the intermediate trigrams (those at
intervals 6 or 4) can be tried, in the hope of finding a shorter
period.

Figure 111

(a) (b)
Z I L T F R U I Y T J R Z I L 1 2 3 4 5 6
x x x Z I L T F R
U I Y T J R
K A R O I E A O A E U K L W K. Z I L K A R
x O I E A O A
E U K L W K

But assuming a case in which we have no repeated sequences at all, we

almost never meet with a Vigenère cryptogram in which there are no
_repeated single letters belonging to a same cipher alphabet_. These
repeated single letters can be tabulated with their separating
intervals, _and these intervals factored in exactly the same way as
intervals between repeated sequences_. The evidence, perhaps, will be
less clear, and less reliable, than that obtained through repeated
sequences; as with sequences, the less frequent letters will usually
be more informative than those which are leaders. To illustrate, with
our given example, the single letter _I_ has shown the interval 6
three times, the single letter _R_ has shown it twice, and the single
letters _L_ and _Z_ have shown its multiple. In the average case, the
period will not be so clearly evident as here; however, the example
was not in any way manipulated in order to produce this evidence.
Once the cryptogram of (a) can be rearranged as at (b), we no longer
have before us the piecemeal decipherments and piecemeal tests which
are necessary where a period is likely to be anything at all.
Whatever key-fragments can be brought out at _ZIL_, or on another
trigram, need be tested only on the three columns which contain the
trigram. Even presuming that the evidence has been inconclusive
between two or more periods, the cryptogram, necessarily a short one,
can be written into each of these probable periods, and the two or
more resulting blocks, standing side by side, can be considered more
or less simultaneously. Here, with our period determined as 6, the
columns of (b) are very short, and the number of trials and erasures
should not be many.

For this kind of case, however, many solvers have a preference for
the purely mechanical method which is detailed in Fig. 112. _Sheet 1_
of this figure has been prepared from the first column of our
cryptogram, which included the letters _Z U Z O E_. _Sheet 2_ has
been prepared from the second column, which included the letters
_I I I I U_; and _sheet 3_ has been prepared from the third column,
which included the letters _L Y L E K_. In each case, the column of
cryptogram letters, as it first stands, is also the _A_-decipherment.
With each letter used as a point of beginning, a series of normal
alphabets may be laid out, as in the figure, and the resulting 25
new columns on every sheet will show the other 25 possible
decipherments. But if these decipherments have been caused to
progress in the normal alphabetical direction, and if the cipher is
Vigenère, the key-letters which produce these deciphered columns will
have to run backward in the alphabet. These can be added at the tops
or bottoms of their columns, and can, if desired, be written in red
ink, or otherwise distinguished.

Figure 112

Sheet No. 1 (For Column 1 of b, preceding figure)

KEYS: a z y x w v u t s r q p o n m l k j i h g f e d c b
Z A B C D E F G H I J K L M N O P Q R S T U V W X Y
U V W X Y Z A B C D E F G H I J K L M N O P Q R S T
Z A B C D E F G H I J K L M N O P Q R S T U V W X Y
O P Q R S T U V W X Y Z A B C D E F G H I J K L M N
E F G H I J K L M N O P Q R S T U V W X Y Z A B C D

Sheet No. 2 (For Column 2 of b, preceding figure)

KEYS: a z y x w v u t s r q p o n m l k j i h g f e d c b
I J K L M N O P Q R S T U V W X Y Z A B C D E F G H
I J K L M N O P Q R S T U V W X Y Z A B C D E F G H
I J K L M N O P Q R S T U V W X Y Z A B C D E F G H
I J K L M N O P Q R S T U V W X Y Z A B C D E F G H
U V W X Y Z A B C D E F G H I J K L M N O P Q R S T

Sheet No. 3 (For Column 3 of b, preceding figure)

KEYS: a z y x w v u t s r q p o n m l k j i h g f e d c b
L M N O P Q R S T U V W X Y Z A B C D E F G H I J K
Y Z A B C D E F G H I J K L M N O P Q R S T U V W X
L M N O P Q R S T U V W X Y Z A B C D E F G H I J K
 E F G H I J K L M N O P Q R S T U V W X Y Z A B C D
K L M N O P Q R S T U V W X Y Z A B C D E F G H I J

Fig. 113 shows what modifications would be necessary if the sheets

were being prepared for one of the Beauforts. For the variant
Beaufort, the only difference lies in the fact that key-letters must
progress in the same alphabetical direction as their decipherments.
With the true Beaufort, however, the making of an _A_-decipherment
does not mean a simple copying of cryptogram letters, as in the other
two ciphers; this _A_-decipherment must first be made; after that,
the series of normal alphabets can be extended as before, and the
key-letters will progress in the same alphabetical direction as their
deciphered columns.

Now, assuming that these sheets have actually been prepared, say on
quadrille paper, the various columns of decipherment may be examined,
and a check-mark placed beside each column in which the series of
letters appears to represent a “good” decipherment. With longer
columns, those may be checked which contain the largest percentages
of letters _E T A O N I R S H_, without too many of the letters
_J K Q X Z_; with shorter columns, perhaps those are “best” in which
any repeated letters are chiefly vowels, it being remembered that
when the cryptogram contains repeated sequences, as well as repeated
single letters, the possible identity of these repeated digrams or
trigrams must also be taken into consideration. With all of the
apparently good columns checked for attention, _sheet 1_ may be
creased vertically so as to place any desired column on the extreme
right, and this column may then be laid directly against any desired
column of _sheet 2_ for an observation of the resulting digrams. If
these appear to be satisfactory, then _sheet 2_ may also be creased
vertically, and the series of apparently good digrams may be laid
directly against any desired column of _sheet 3_ for an observation
of the resulting trigrams. And so on, if desired, to a possible
_sheet 4_, or _5_, or _6_, though, as a rule, the first three sheets
will be found sufficient. While the method, as indicated, is intended
to be mechanical, that is, largely visual, it would be possible,
where uncertainty exists between two given combinations, to copy
these and subject them to a digram test. But this should not be
necessary in a case where key-letters, as well as their deciphered
columns, are expected to set up good combinations in order to form a
plaintext key-word.

Figure 113

If column Z U Z O E were VARIANT: If column Z U Z O E were BEAUFORT:

KEYS: a b c d e f g ..... KEYS: a b c d e f g .....

Z A B C D E F ..... Z - B C D E F G H .....
U V W X Y Z A ..... U - G H I J K L M .....
Z A B C D E F ..... Z - B C D E F G H .....
O P Q R S T U ..... O - M N O P Q R S .....
E F G H I J K ..... E - W X Y Z A B C .....

An interesting version of this method, as shown by Admiral Elliott

Snow, included the following variations: To begin with, in extending
the alphabets, the decryptor omits altogether the letters
_J K Q X Z_, and perhaps one or two others of extremely low
frequency, simply leaving the blank spaces which indicate their
alphabetical positions. This makes the work more rapid, and, in
addition, the presence of these blank spaces in any column of
decipherment, advertises at once that the column is probably not a
very good one. But Admiral Snow’s columns were not columns; they were
_rows_. A given series of letters: as _Z U Z O E_ of our foregoing
_sheet 1_, is laid out horizontally, and its decipherments are
extended vertically. The spacing on each row is arranged to
correspond with the period; that is, the letters _Z U Z O E_, instead
of being continuous, are spaced six columns apart if the period is 6,
and their decipherments, of course, are spaced in the same way. The
sheets may now be creased horizontally between rows, and one sheet
placed against another in such a way that the resulting digrams are
all standing on diagonals, but have appeared at exactly their
cryptogram distance apart. The student should experiment with both
arrangements and decide which one he likes.

It has been pointed out by C. A. Castle, another of our members, that

the foregoing method will find its chief application, not on a single
cryptogram, but as applied to a case which, so far, we have not
considered in connection with the substitution ciphers: One in which
the decryptor has in his possession five or six cryptograms, all very
brief, but all enciphered with the same key. Here, we have the common
practical case, to be handled in somewhat the same way as the last of
our transposition examples; the cryptograms can be written one below
another, thus forming a series of columns in which every column has
been enciphered with the same cipher alphabet. If this case happens
to involve a comparatively short period, it is possible to take
intervals between repeated sequences found in two different
cryptograms, using the intervals indicated by the number of columns
between the first letter of one sequence and the first letter of its
repetition. Castle’s example, however, was not based on a short key,
but upon an extremely long one, and his five or six messages were
merely fragments, each one of which was _known to be the beginning
of an English sentence_. In the English language, about half of all
initial letters used are found in the group _T A O S H I_ and more
than another one-fourth are found in the group _W C B P F D M_. Thus,
having a series of beginnings in which the first column will include
only initial letters, the number of truly acceptable decipherments
on any _sheet 1_ will usually be quite limited. In addition, with
vowels known to have a fondness for second and third positions in
words, there should be little difficulty in selecting decipherments
from _sheets 2_ and _3_.

* * *

While we have described this device as having been written out on

sheets of paper, there are many persons who prefer to have at hand
a series of cardboard strips which will set up the “sheets”
mechanically. If each of the strips carries the normal alphabet
written twice in succession, it is possible to adjust five of the
strips so as to place the letters _Z U Z O E_ one below another in
the form of a column and automatically set up the other 25 columns.
The strips can be loose, or may form part of a slide. Slides, in
fact, may be used for many purposes, and are well worth preparing
for any kind of cipher which the decryptor expects to encounter a
great many times. The members of the American Cryptogram Association,
who solve a great many Vigenères, Beauforts, and so on, as a matter
of recreation, have practically all “invented” slides (or tableaux)
which will, to some extent, do away with the irksome task of carrying
out a trigram-search. These are prepared in various ways, and
variously used, though the principle for all is about the same as
that indicated in Fig. 114. They are usually referred to as
_decrypting slides_, and the single stationary alphabet, sometimes a
list of key-letters and sometimes not, will be called “the decrypting
alphabet.” C. Stanley Lamb, who is by no means the only “inventor”
of the device illustrated, has this in several different forms,
according to the purpose for which he intends to use it. Notice that
the card, as we have placed it, shows the stationary single alphabet
running contrary to the others, for use on the Vigenère cipher, and
that this card need merely be reversed in order to have a single
stationary alphabet running parallel to the others, for use on the
two Beauforts. As to the sliding double alphabets, there may be as
many of these as the operator feels like setting up; if the device
is being used to assist in the trigram search, three will be needed.

Figure 114

One Form of "DECRYPTING SLIDE" C. STANLEY LAMB

For VIGENÈRE, the "Decrypting Alphabet" runs backward:

| a z y x w v u t s r q p o n m l k j i h g f e d c b |
( A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H ...
( A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E ...
( A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H
I ...
| z y x w v u t s r q p o n m l k j i h g f e d c b a |

As this is shown, it has been set for the decipherment of a trigram H D G, and
every possible decipherment can be read from the slide without changing its
present adjustment. The entire list of frequent trigrams can be used as trial
keys:

Trial Keys: T H E A N D T H A E N T I O N T I O F O R (Etc.)

H D G
Fragment of True Key: O W C H Q D O W G D Q N Z P T O V S C P P (Etc.)

To explain its use: The decryptor here is dealing with a sheet of

trigrams. Each one of these trigrams is to be deciphered as _THE_,
_AND_, _THA_, and so on, following the list of normally frequent
trigrams, and the resulting key-fragments are to be written down for
comparison with one another, in the hope that some two or more will
be duplicates, or will contain overlapping letters. The first of
these cipher trigrams is _HDG_. These three cipher-letters, found on
the three slides, are placed, in order, below _A_. Now, on the first
of the slides, every possible decipherment for _H_ is standing
opposite its key-letter, found in the “decrypting alphabet”; on the
second slide, every possible decipherment for _D_ is standing
opposite the the proper key-letter; and on the third slide, every
possible decipherment for G. To know, then, what key-letters will be
deciphered by _THE_, find _T_ on the first slide and note key-letter
_O_; find _H_ on the second slide and note key-letter _W_; find _E_
on the third slide and note key-letter _C_; the complete key-fragment
is _OWC_. This may be written down, Then, _without changing the
adjustment of the device_: For _AND_, key-fragment _HQD_, and so on
down the list.

Where the cipher is Vigenère, the text-letters may be found in the

“decrypting alphabet” and their keys on the slides, without changing
results. But with either of the Beauforts, a key is specifically a
key and not a text-letter. Thus, when the card is reversed, and the
same process applied for one of the Beauforts, the student must be
careful as to where he finds his letters _T H E_ in each of the two
ciphers. This peculiar relationship of Vigenère-variant-Beaufort is
not hard to untangle if all three of the encipherments are considered
to be purely mathematical operations of addition and subtraction. If
we must add two numbers, as 5 and 10, it makes no difference whether
we call it the sum of 5 plus 10 or the sum of 10 plus 5. But where we
must perform a subtraction, there are two separate cases.

In straight Vigenère encipherment, the process is _addition_, in which

text-letters may be considered to have the values 1 to 26 (their
serial positions in the normal alphabet), while key-letters may be
considered to have the values 0 to 25 (the amount of alphabetical
shift represented by each one). Thus, the encipherment of _J_ by _P_
(10 plus 15) will not result differently from the encipherment of
_P_ by _J_ (16 plus 9); in both cases, we obtain _Y_, alphabetical
value 25.

In variant Beaufort, we have one of the _subtractions_: _Message

minus key_, with the occasional necessity for “borrowing” 26 in order
to make a subtraction possible. Thus, _J_ enciphered by _P_ (10 minus
15) does not give the same result as _P_ enciphered by _J_ (16 minus
9). In the first case (after borrowing 26), we obtain _U_, or 21,
while in the other case we obtain _G_, or 7.

In the true Beaufort, we have the other _subtraction_: _Key minus

message_. This time, we value the key-letters 1 to 26, and the
text-letters 0 to 25. Thus, _J_ enciphered by _P_ (9 taken from 16)
results in _G_, or 7, while _P_ enciphered by _J_ (16 taken from 9)
results in _U_, or 21. Our results, then, are exactly the reverse of
those obtained in the other subtraction.

If these mathematical comparisons be understood, or simply kept in

mind, it will always be possible, whenever a decryptment process has
been explained in connection with only one of the encipherments, to
examine its “mathematical” details and learn from these in just what
respects it would have to be modified in order that it may be applied
with equal success to the other two encipherments. There is another
interesting possibility which may have escaped the student’s notice.
If he will turn back to Fig. 98, in which the same message, using the
same key, was enciphered in both of the Beauforts, one encipherment
coming out as _K K Z B B I Z_. . . . . and the other as
_Q Q B Z Z S B_. . . . . , he will notice that these two cryptograms
are complementary from beginning to end. If we saw any reason for
doing so, we might convert either one of the Beaufort cryptograms to
the other form, and apply its probable word with its own slide.

* * *

Now, having seen the great vulnerability of the famous “indecipherable

cipher,” suppose we glance at some of the devices which have been used
for doing away with its periodicity. One such device, that of
_auto-encipherment_ (_autokey_, _autoclave_), has been given its own
separate chapter (the one immediately following), not because of its
value as a cipher, but because of the very interesting decryptment
problem it presents. A second device, the details of which may be
examined in Fig. 115, consists in the use of a very long nonrepeating
key, the popular name for which is “running key.” The value of such a
key, for practical purposes, we have already seen; it was a key of
this kind which Castle had used on his five or six
cryptogram-beginnings. In single examples, however, it gives more
trouble. Unless there is a probable word, its message and key must be
dug out bit by bit, and if the encipherment is Vigenère, any recovered
fragments can belong equally well to the message or to the key.
However, with its key known to be purely plaintext, no fragments need
be considered except those which are usable combinations, and since
the “running key cipher” makes a fascinating puzzle, a specimen has
been included among the practice cryptograms. The original of this,
apparently, was the Hermann cipher. This employed a slide which was
identical with the Saint-Cyr slide except that the stationary alphabet
carried an extra cell (position) marked “index” to be used instead of
the Saint-Cyr index _A_. As the writer saw this, the index-cell was
standing just ahead of _A_, so that the resulting encipherment would
have been that of a Saint-Cyr slide on which the letter _Z_ was
serving as index-letter.

Figure 115

Vigenère with a "Running Key"

Key-letters: M Y C O U N T R Y T I S ...
Plaintext letters: S E N D S U P P L I E S ...
Cryptogram: E C P R M H I G J B M K ...

Of other devices aimed at destroying periodicity, quite a few have

been based in some way on _key-interruption_. A key-word is selected,
as INDEPENDENCE, but the encipherer breaks off before completely using
his rotation, so that the completed cryptogram will be enciphered very
irregularly by such a key as INDEP INDEPEND I IN INDEPENDENC IND
INDEPEN. . . . . . Sometimes this is found as a word-spacing device,
the key beginning over with each new word, though naturally not with
word-separations showing in the cryptograms. But in the average case,
the key-interruption takes place at the discretion of the encipherer;
sometimes the agreement with his correspondent allows him to break
off as he pleases without any sort of signal, leaving the decipherer
to discover the interruptions through the fact that he can no longer
decipher; again, he may use an indicator, as _J_. In the latter case,
he must encipher any _J_’s which may happen to occur in his message
by using the _I_-substitute; then, whenever he decides to break the
key, he first enciphers a _J_. Thus, whenever the decipherer brings
out the letter _J_, he knows that his key is to begin over with the
encipherment of the next letter. It will be noticed that in all of
these cases, the decipherer will have to do his work one letter at
a time.

There is another of these devices which apparently destroys

periodicity and is aimed at throwing all of this onerous work upon
the shoulders of the decryptor without at the same time punishing the
legitimate decipherer. This consists in shortening the two alphabets
of the key, so as to leave some extra letter, which will never be used
in any cryptogram. Encipherment, in this case, is accomplished in the
regular way, producing a periodic cryptogram. The extra letter may
then be inserted at points throughout the cryptogram wherever it can
do the most harm. The decipherer, knowing that this one letter is
always null, need merely erase it. But if this device is to be really
useful, the omitted letter must not be always the same, and this
trouble can be overcome as follows: In the shortening of the plaintext
alphabet, we omit always the unwanted letter, as _J_. But in
shortening the cipher alphabet, we omit first one letter and then
another, according to agreement, and insert _J_ in its place. The
decipherer, knowing what letter is null, erases it; but the decryptor,
granting that he knows what the process is, will still have to
experiment with various letters before he learns which one (or more)
of the 26 is the null of the moment.

Shortened alphabets are not uncommon in ordinary use. We meet with

25-letter alphabets in European examples, the letter _W_ having been
omitted for telegraphic reasons. This case can usually be
distinguished from the one which precedes by the fact that the letter
_W_ is never found in a frequency count, and it presents only the
minor trouble that the ordinary 26-letter slide will not make the
decipherments, so that it becomes necessary to prepare another on
which the letter _W_ is not present. This case can, of course, be
simulated by making use of a 24-letter alphabet.

These devices, taken as a whole, have added little, if at all, to the

security of the straight-alphabet ciphers, though, for the most part,
they have succeeded admirably in rendering their ciphers totally unfit
for general purposes. Considered as single examples, they can, of
course, prove troublesome. We trust that this will not be the case
with some one or two of the appended practice cryptograms, but if so,
we recommend that the student postpone them for a later investigation.
Concerning example No. 122, he may find that some of the material
presented in Chapter XVI applies also to the “running key”
encipherment; with others, a trigram-search may assist in developing
the interrupted key-word; and in one case, a clever decryptor should
find a way for applying his Kasiski method.

122. By SABIO. (Vigenère with Running Key. SENT, AGENT, STOP, IMPREGNATED).

A R U N N I N G K E Y S O Q M A V Q X K L U E R S Z S S R F A H A I V
X W E T N K Z Q N V R A G W V E T F W N L K A T A I B S Z U H P E X U
B W W A S P N F F C. (These are a trifle tedious, but not inhuman).
• • • • • •• •• ••

123. By NEON. (Porta, with key-interruption. Plenty of trigrams!)

A P V K W T P K P V Y G Q P G A K J Z W J N I X J U Q O U K P V W F U
R F X N K C K P R K Q K W F U R G J O V Z O K G X J V Q S W T F K D L
L Y Q L X Z E F L Y U J V Z C X G Q L J M T X W K K P V T V B Y K X P
F J Z Q X B V C O V V H X Z K J Z U Y.

124. By WHOSIT. (Beaufort, with key-interruption. THEY, WHEN, IN, ON, UP, etc).

M X Y F U H P M J B C X O C K A L Q E D B Q A E P R B Z L G L W M J B
Z Z C S A A L A O E K K C W L L J B P H U W B L F Q O R B Z L A O E M
A L O K F P V H Y U Y H Y J L X O L X Z.
125. By B. Natural. (Gronsfeld, with key-interruption).

S O W H Z G H O C V V W L F F F X O F H H X Q S I H S O Y P P H K T Q
H Z F Y J Q G Q H O B X V X O F L R J L F W E A E F H O G G V O F E T
Y M U X O F T H S N F B U A O B W H V C V V H V A O F Q M A G V N H S
S C F U X O F V H E L O A O J O E C V V E Y F A V S N I P L E O U P W
T A G P Q K E T.

126. By TRYIT. (Gronsfeld, with interruptors. MY, TO, THE, OF, IS, BE, WHICH).

R H X G A P A S R E C Z T R T W Z A J Z S G Q A Z M T P E A U X G K Y
Z F W Z S G Q Y O E Y F C T P W B G K O D P W N D X Z A W F O W H T Z
B M O H K Q P K V K S Q N D J Z S L Z X L C R T T N H S H W.

127. By B. NATURAL. (Vigenère. One letter reserved as interruptor. Look out!)

P N B Y C A N D V N P N F Y Z G V N W E J N S I T T T Z B L N O S L N
X R N I L Z H N H M D X D X B Z N B I K W Z H N D J N B M D T N O I K
N E I I H T W Q M F A T N P Q U N T J W D C X N G I C X P Z B L N O S
L N O I J N O S L G N H S C K T Q D N X W N R I I I L M J T R N U M D
T.

CHAPTER XVI
Auto-Encipherment

The term _autokey_ (_autoclave_; “the autokey cipher”), as commonly

used, refers to the kind of encipherment shown in Fig. 116, in which
a message becomes its own key for applying some one of the
multiple-alphabet ciphers — usually the Vigenère. It will be noticed
from the figure that the auto-encipherment must be “primed” with a
conventional key; and whenever the words _key-length_, _period_, and
so on, are used in connection with auto-enciphered cryptograms, their
actual reference is to the short initial key. A more accurate term
would seem to be _group-length_. But that a term is needed for
referring to something akin to the period of the ordinary Vigenère
cryptogram can be seen when we consider the mechanics of decipherment:

Figure 116

Vigenère Autokey: C O M E T/S E N D S U P P L I E S T O M O R L E Y S

Plaintext: S E N D S U P P L I E S T O M O R L E Y S S T A T I
CRYPTOGRAM: U S Z H L M T C O A Y H I Z U S J E S K G J E E R A

Our present initial key, COMET, _key-length 5_, serves to decipher

only one _group_ of that length. The five key-letters obtained from
this first decipherment will serve to decipher only one more _group_;
from this, another five key-letters are obtained, and will decipher a
third _group_, and so on. But our _group-length_, sometimes referred
to as “period,” includes five individual series of letters, any one
of which can be enciphered and deciphered independently of the rest.
That is, beginning with _C_, or _O_, or _M_, or _E_, or _T_, and
taking each fifth letter, it is possible to proceed straight through
to the end, enciphering or deciphering only this one series, or
“column.” It will be noticed from the foregoing that the decipherer
gets the short end of the bargain. The encipherer knows in advance
what the key is, and, to some extent, can apply one cipher alphabet
at a time; the decipherer knows only the key to the first group; the
rest he must ferret out for himself.

There is, however, a second form of autokey encipherment in which the

respective difficulties of encipherer and decipherer would be
reversed. This form of auto-encipherment, which can be seen in Fig.
117, makes use of a preliminary key, as in the regular form, but
follows this with the enciphered text instead of with the plaintext.
Such an encipherment results, occasionally, from the mechanical
construction of a cipher machine, and in this case, where the 26
cipher alphabets are in mixed order, and unknown to the decryptor,
may present an interesting decryptment problem. But where the cipher
is Vigenère (or any other in which the decryptor possesses the full
set of cipher alphabets), it can hardly be argued that there is any
great problem about a cryptogram which carries its key in full view.
We will confine ourselves, then, to the usual form of autokey, as
first explained, beginning our studies with a brief glance at the two
common practical cases, that of accumulated cryptograms, and that of
probable words. Procedure, in the former case, is self-evident.
Possessing several cryptograms all initiated with the same preliminary
key, we may write their beginnings one below another to form columns,
and the first few of these columns will constitute an ordinary case
of Vigenère in which every message is known to be the beginning of a
sentence. With beginnings discovered, a little industry accomplishes
the rest.

The case of probable words, on the other hand, presents some

interesting possibilities inherent in the auto-encipherment itself.
When the probable word is short (or if a search is to be made for
normally frequent trigrams), the task of bringing out and testing the
possible key-fragments is made much less onerous by the fact of the
purely plaintext key. Being sure of an abundance of excellent
sequences, we need consider none but the very best of the deciphered
fragments; and for any one considered, the trials need be made only
within a very short range of the spot at which it was found. All of
this work may be done directly on the cryptogram. A correct sequence,
correctly applied, can be followed out in both directions, and will
yield, in full, several of the “columns,” and several consecutive
letters of the initial key. But if it so happens that the probable
word is longer than the initial key, _its first few letters must
become the keys for enciphering its last few_. Consider, for instance,
the word SIMPLICITY, which has a length of ten letters. If the
preliminary key contains only five letters, then, beginning at
-_ICITY_, the keys _SIMPL_- will begin to encipher, causing a certain
long cryptogram-sequence which, for Vigenère, will always be
_A K U I J_. If the preliminary key has six letters, the same word
causes a sequence _U Q F N_ when the cipher is Vigenère; if it has
seven letters, the cryptogram-sequence will be _A B K_; and even an
eight-letter key brings out one certain digram, _L G_. Thus, knowing
what the cipher is, and having at our disposal any comparatively long
probable words, we may write out these sequences _in advance_ and be
ready to look for them in the cryptograms. In addition to whatever
words we consider probable, it is obvious that any other long word
may encipher itself in the same way, and, if it is one important to
the subject matter, is likely to be repeated, causing the cryptogram
to show a _long repeated sequence_. Thus, if we find a long repeated
sequence in a cryptogram, we are able to try this as a common suffix,
_TION_, _MENT_, _ENCE_, _ABLE_, etc., in the expectation of bringing
out some common prefix, _CON_, _PRE_, etc.

Figure 117

Key: C O M E T/ U S Z H L O H O S T .....
S E N D S U P P L I E S T O M .....
U S Z H L O H O S T .....

Note that the cryptogram itself is the key, except that the
first five letters are missing. To decrypt, With any
alphabet, need merely find where to begin using it!

More fascinating, by far, than its practical aspects, however, are

the possibilities presented by the autokeyed cryptogram for analytical
attack. The devices immediately to follow are described by General
Givierge in his _Cours de cryptographie_, and are credited by him to
Commandant Bassières.

First, it is possible to discover the length of the short preliminary

key, or, at any rate, to confine this to certain definite
probabilities. This key, as we have seen, governs a definite
group-length, or “period.” If this group-length, say, is 5, then,
barring the first and final groups, every plaintext letter will be
enciphered by the letter standing five positions to its left, and
will, in its own turn, serve to encipher the one standing five
positions to its right. Since all plaintexts are filled with repeated
letters, roughly half of them separated by even intervals, it stands
to reason that there will be many occasions on which the letter
standing five positions to the left and the one standing five
positions to the right will be the same letter. That is, we must
often find the encipherment pattern of Fig. 118. Some one letter,
as _S_, is repeated at an interval of exactly twice the group-length,
with some other letter, as _R_, standing at exactly the group-length
interval from both of the _S_’s. The first _S_ enciphers _R_, and _R_
enciphers the second _S_. Or, if the repeated letter is _T_ and the
intermediate one is _L_, then _T_ enciphers _L_, and _L_ afterward
enciphers _T_. Where the cipher is Vigenère, the result, in the
cryptogram, is _a repeated letter standing at_ _exactly the
group-length interval_. If the cipher is one of the Beauforts, the
same pattern produces _a pair of complementary letters separated by
exactly the group-length interval_.

Figure 118

S . . . . R T . . . . L
S . . . . R . . . . S T . . . . L . . . . T
J . . . . J E . . . . E

Now, in order to consider the value of this observation, let us

examine the cryptogram of Fig. 119, an autokeyed Vigenère, which, for
convenience, is presented in groups of the correct length, 7.
According to Bassières, should we inspect this cryptogram for
repeated single letters, noting, in each case, the interval of
separation, the correct group-length, 7, will be present among those
intervals which are noted oftenest, and, in many cases, will be the
one which predominates. For making such an examination, perhaps the
simplest plan would be that of listing the possible group-lengths at
the tops of a series of columns, beginning with group-length 1 and
carrying them as far as desired. The counts could then be made by
placing a tally mark in the proper column for each time that a given
interval is noted. The results of this examination, as compared with
the Kasiski examination for a period, may be studied in Fig. 120. At
(a), where the leading intervals of our cryptogram have been listed
with their frequencies, it is noticeable that the correct group-length,
7, is not represented by the predominating interval or even by the
one which is second in frequency; it is merely present among the five
leaders. But we find other cryptograms, not necessarily of great
length, in which some one letter, as _V_, will be repeated five or
six times in succession at exactly the group-length interval, and its
evidence amply confirmed in other repetitions. Then, as at (b), we
may find some fairly good clue, leading us to give the first trial to
the correct group-length; and again we are left, clueless, to try out
five or six different group-lengths before striking the correct one.
Results, then, are variable, and the only certainty, at any rate in a
short cryptogram, is that of being able to limit the group-length to
a given few. With the group-length determined, or with one selected
for trial, we may take our choice of two processes.

Figure 119

L C N D M E E L C N O Y G T B G X V N D G S S H W A W J Q E V L H O W
Y I J W L E X A P V E C L B H D Q E K U W W G R H X J F B D Y P I P K
Q D W A R G U W R L G N I Q S L V L E S P H E U T X B O N D H V X D C
O U D S J T F J N U Q N Q L A A I L M Z U X I E W O B Y I W E H P D Q

* * *

_Process 1_ (_Bassières_). With group-length 7, as we have seen, our

cryptogram includes seven independent series, or “columns,” of letters.
By beginning at the 1st letter, and taking the 1st, 8th, 15th, 22d,
etc., letters, we may decipher _series 1_ independently of the others;
or, by beginning at the 2d letter, and taking the 2d, 9th, 16th, etc.,
letters, we may decipher _series 2_; and so with the other five series.
Many persons, before doing this, will rewrite this cryptogram into
seven _columns_, which permits that the decipherment of a series be
done straight down its column, and for that reason the word “column”
is sometimes used to describe what we have called here a “series.” In
order to understand the first of the Bassières processes, we need
consider only _series 1_, it being understood that whatever applies
to any one of the seven series applies equally well to the other six.

Figure 120
(a) (b)
Interval 8, found 8 times Possible Reason for L C N
" 16, " 8 "
" 4, " 6 " T H E o r e m/G E T t i..
" 5, " 6 " G E T t i n g T H E b a..
" 7, " 6 " Z L Y . . . . Z L Y . .
Now, considering Fig. 121: If the unknown first key-letter was _A_,
then the first plaintext letter, found by deciphering with key _A_,
was _L_, and this became the key for enciphering the eighth letter.
If the key which enciphered the eighth letter was _L_, then the
eighth letter, found by deciphering with key _L_, was _A_, and this
became the key for enciphering the fifteenth letter. Following out
this decipherment to the end of _series 1_, we find that the plaintext
letters must have been _L A B R Z Z B_, etc., as given in full in the
figure. A glance at the complete series will show that this
decipherment is not a particularly good one. If another decipherment
be carried out, on the hypothesis that the original first key-letter
was _B_, we obtain the series _K B A S Y A A_, etc., which starts out
fairly well, but which, when completed, will contain two _K_’s, one
_Z_, two _B_’s, and one _P_. If a third decipherment be carried out,
on the hypothesis that the original first key-letter was _C_, we
obtain the series _J C Z T X B Z_, etc., which is a poor decipherment
from the beginning. A trial and error method might consist in making
these decipherments one at a time directly on the cryptogram, erasing
one when it is obviously poor, and trying to add the next series
whenever one proves acceptable.

Figure 121

Keys: A L A B
L C N D M E K L C N O Y G T B G X V N D G S S H W A W J......
Plaintext: L A B R

Series 1, (Key A): L A B R Z Z B G Q L F R B G H H C Y Z J.

The Bassières process, however, consists in setting up the entire 26

possible decipherments as these are shown in Fig. 122. In this figure,
the original cryptogram-letters of _series 1_ are standing in a column
at the extreme left. The 26 possible decipherments are also standing
in the form of columns, each decipherment headed by the key with which
it was initiated. If the group-length 7 is correct, then one of these
26 columns shows the original plaintext letters.

Now let us examine, not the columns, but the rows, of this tableau,
and find out just how troublesome it is going to be to prepare
tableaux of the same kind for _series 2_, _series 3_, and possibly
others. The key-letters, across the top, constitute a normal
alphabet, and below this each row contains the 26 decipherments for
some one letter of _series 1_. On the odd-numbered rows, the
decipherments for the odd-numbered letters are alphabetically
arranged, but progressing in a direction contrary to that of their
keys, as if these odd letters represented Vigenère encipherment. On
the even-numbered rows, the decipherments for the even-numbered
letters are also alphabetically arranged, but are progressing
parallel to their keys, as if these even-numbered letters might
represent variant Beaufort encipherment. Evidently, then, the
_A_-decipherment is the only one which must actually be carried out;
afterward, the preparation of the tableau is a matter of extending
alphabets. With similar tableaux prepared for the remaining six
series, we have seven sheets, and on each one of these there is one
column showing the correct decipherment of the series, headed by the
correct key-letter. Thus, our solution is to be the mechanical one
of the preceding chapter. On each one of the tableaux, the apparently
“good” decipherments may be checked for attention; the sheets may be
creased between columns, and the “good” decipherments of one tableau
may be placed directly in contact with those of another.

Figure 122

SERIES No. 1, Prepared as a Tableau. (Corresponds to SHEET No. 1 of Figure 112).

THE
CIPHER The 26 Decipherments, with Keys
LETTERS

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z (Keys)

L L K J I H G F E D C B A Z Y X W V U T S R Q P O N M ←
L A B C D E F G H I J K L M N O P Q R S T U V W X Y Z →
B B A Z Y X W V U T S R Q P O N M L K J I H G F E D C ←
S R S T U V W X Y Z A B C D E F G H I J K L M N O P Q →
Q Z Y X W V U T S R Q P O N M L K J I H G F E D C B A
Y Z A B C D E F G H I J K L M N O P Q R S T U V W X Y
A B A Z Y X W V U T S R Q P O N M L K J I H G F E D C
H G H I J K L M N O P Q R S T U V W X Y Z A B C D E F
W Q P O N M L K J I H G F E D C B A Z Y X W V U T S R
B L M N O P Q R S T U V W X Y Z A B C D E F G H I J K
Q F E D C B A Z Y X W V U T S R Q P O N M L K J I H G
W R S T U V W X Y Z A B C D E F G H I J K L M N O P Q
S B A Z Y X W V U T S R Q P O N M L K J I H G F E D C
H G H I J K L M N O P Q R S T U V W X Y Z A B C D E F
N H G F E D C B A Z Y X W V U T S R Q P O N M L K J I
O H I J K L M N O P Q R S T U V W X Y Z A B C D E F G
J C B A Z Y X W V U T S R Q P O N M L K J I H G F E D
A Y Z A B C D E F G H I J K L M N O P Q R S T U V W X
X Z Y X W V U T S R Q P O N M L K J I H G F E D C B A
I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I

* * *

_Process 2_ (_Bassières_). Fig. 123 shows the second of the Bassières

processes. With 7 decided upon as the group-length, we make up a
_trial key_ having the right number of _A_’s, and decipher the
cryptogram. The new cryptogram, produced in this way, is _periodic_,
and its period, for Vigenère, will be twice the group-length, in the
present case 14. In Fig. 124, where this new cryptogram has been
repeated, written into its period, it is possible to check its
periodicity: It has two repeated sequences, _C J B_ and _W G_, at
suitable intervals, and while these are very few, their evidence is
amply supported by the fact of repeated single letters in every
column. When the periodicity is not confirmed in this way, it can
be assumed that the chosen group-length was not correct.

The make-up of this new cryptogram is not hard to understand if it is

noticed that what we have done is to carry out simultaneously the
seven _A_-decipherments of seven tableaux like that of Fig. 122. We
saw there that the odd-numbered letters of a series react as Vigenère
encipherment and the even-numbered letters as variant Beaufort. With
seven _A_-decipherments made at once, the same will apply to
odd-numbered and even-numbered _groups_. Thus, our new cryptogram
has seven columns enciphered in Vigenère and another seven enciphered
in variant Beaufort. The original seven-letter initial key-word will
decipher both sets of columns; for the first seven, it must be
applied in the Vigenère manner, and, for the other seven, in the
variant Beaufort manner.

Figure 123

a a a a a a a L C N D M E K A A A L M C J B G X K B B X R M K M Z V M
L C N D M E K L C N O Y G T B G X V N D G S S H W A W J Q E V L H O W
L C N D M E K A A A L M C J B G X K B B X R M K M Z V M Z S L Z I T K

Z S L Z I T K Z Q Y X D L N B Z X H Z A O G E T X L U I Q C Y K M P X
Y I J W L E X A P V E C L B H D Q E K U W W G R H X J F B D Y P I P K
Z Q Y X D L N B Z X H Z A O G E T X L U I Q C Y K M P X L B A F W A N

L B A F W A N F C W V V G H R P P L S C J B W G A M Q G G I O T L L I
Q D W A R G U W R L G N I Q S L V L E S P H E U T X B O N D H V X D C
F C W V V G H R P P L S C J B W G A M Q G G I O T L L I H V T C M S U

H V T C M S U H Z K Q X B L C O K A Q P A Y M Y L W K U Z W G L S R E
O U D S J T F J N U Q N Q L A A I L M Z U X I E W O B Y I W E H P D Q
H Z K Q X B L C O K A Q P A Y M Y L W K U Z W G L S R E J A Y W X M M

New Cryptogram: L C N D M E K A A A L M C J - B G X K B B X...........(Etc.)

As to why this encipherment reduces to alternate Vigenère and variant

Beaufort groups, this is best understood by resorting once more to
the “mathematical” aspects of the Vigenère cipher. In a previous
discussion, we have said that Vigenère encipherment consists in the
“addition” of key to message, and that variant Beaufort encipherment
(which, in Vigenère, would be _decipherment_), consists in the
“subtraction” of key from message. In the beginning, our plaintext
is a series of groups, as _A_, _B_, _C_, _D_, _E_, etc. and the first
encipherment operation consists in the _addition_ of a key, as _X_,
but only to the first group, _A_. To encipher group _B_, we add _A_;
to encipher group _C_, we add _B_, and so on, so that when the
auto-encipherment is complete, we have a cryptogram in which the
groups are made up as follows:

_1st_: _2d_: _3d_: _4th_: _5th_:

_A plus X_ _B plus A_ _C plus B_ _D plus C_ _E plus D_. . . . . .
(etc.)

Figure 124

The New Cryptogram from Figure 123

L C N D M E K A A A L M C J
B G X K B B X R M K M Z V M
Z S L Z I T K Z Q Y X D L N
B Z X H Z A O G E T X L U I
Q C Y K M P X L B A F W A N
 F C W V V G H R P P L S C J
B W G A M Q G G I O T L L I
H V T C M S U H Z K Q X B L
C O K A Q P A Y M Y L W K U
Z W G L S R E J A Y W X M M
1 2 3 4 5 6 7 1 2 3 4 5 6 7
(Vigenère) (Variant Beaufort)

Now, remembering what the mathematical valves were for key-letters,

the trial key, made up entirely of _A_’s, is made up entirely of
_zeros_. When we subtract zero from the first group, we leave it
unchanged, that is, the first cryptogram group is still _A plus X_
(plaintext _plus key_, or Vigenère). When we subtract _A plus X_
from the second group, this cancels the _A_ of both, and leaves _B
minus X_ (plaintext _minus_ _key_, or variant). When we subtract this
from the third group, we cancel the two _B_’s, leaving _C plus X_,
again Vigenère. When we subtract this from the fourth group, we
cancel the two _C_’s, leaving _D minus X_, again variant Beaufort.
And so to the end. Always we come out with the original plaintext
group plus or minus _X_, the key. Those groups which are _plus X_
are Vigenère, and those which are _minus X_ are variant. And _X_,
in all, is the same: the original preliminary key. A comparison
of the same kind applied to the two Beauforts (or a few trials made
on actual groups, if the student is not mathematically disposed) will
show whether or not the auto-enciphered Beauforts can also be reduced
to periodic form, and, if so, what their period is likely to be. In
the case of the true Beaufort, it may be necessary to straighten out
a quirk as to the application of the _trial key_.

Figure 125

Tables of High-Frequency Co-Efficients PHILLIP D. HURST

VIGENÈRE (Cipher Letters)

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
E a e h i n o r s t
T h i n o r s t a e
K A a e h i n o r s t
e O n o r s t a e h i
y N n o r s t a e h i
s I s t a e h i n o r
S i n o r s t a e h
H t a e h i n o r s
R n o r s t a e h i
6 4 1 - 4 4 4 4 4 2 3 4 3 2 3 2 1 4 4 2 2 6 4 2 2 4

BEAUFORT (Cipher Letters)

True Beaufort: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
...VARIANT... A Z Y X W V U T S R Q P O N M L K J I H G F E D C B
E e a t s r o n i h
T t s r o n i h e a
K A a t s r o n i h e
e O o n i h e a t s r
y N n i h e a t s r o
s I i h e a t s r o n
 S s r o n i h e a t
H h e a t s r o n i
R r o n i h e a t s
9 4 1 2 4 3 3 3 2 3 3 3 3 4 3 3 3 3 2 3 3 3 3 2 1 4

PORTA (Cipher letters)

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
E r s t n o a e h i
T n o r s t e h i a
K A n o r s t a e h i
e O n o r s t h i a e
y N t n o r s h i a e
s I r s t n o a e h i
S n o r s t e h i a
H r s t n o a e h i
R n o r s t h i a e
3 3 3 2 4 4 3 2 3 4 6 5 3 4 2 3 4 4 - 2 3 3 3 3 3 2

* * *

While the foregoing methods are intensely interesting as an example

of what can be learned by analyzing the structure of a cipher, most
members of the American Cryptogram Association, in practical work,
prefer methods of their own which are quicker in giving results.
These methods, for the most part, have subordinated other
considerations to certain original observations concerning the use
of the purely plaintext key. Where message and key, as in the case
of the autokey and “running key” encipherment, are each made up of
normal text, with both members including the normal 70% of
high-frequency letters, it becomes inevitable that high-frequency
letters in the key and high-frequency letters in the message will be
paired again and again as the co-efficients of cryptogram-letters,
so that cryptograms enciphered with this kind of key must contain a
great many letters caused by this kind of co-incidence. For
convenience in making use of this fact, each member has his own
ideas. Phillip D. Hurst, for instance, prepared a set of tables of
about the kind shown in Fig. 125, one table for each
multiple-alphabet cipher with which he expected to deal. As these
are shown, the alphabet across the top of any table is a list of
possible cryptogram-letters, each cryptogram-letter heading its own
column; and each column contains only those letters which are
themselves members of the high-frequency group _E T A O N I R S H_,
and which, if enciphered by another letter from the same group, would
result in the cryptogram-letter standing at the top of the column.
The key, in each case, can be found at the left. Hurst says that he
always attacks a cryptogram at the _second letter_, on the theory
that this particular letter is likely to have been a frequent one in
both the message and the key. He then attempts to follow out _series
2_, or, if the group-length has not previously been determined, to
find this series. To explain, without going into too much detail, the
second letter in our foregoing autokeyed Vigenère was _C_. A glance
at the table for Vigenère shows that this letter can result from only
one pair of high-frequency co-efficients, _O_ enciphered by _O_.
Hurst will make his first trial on _series 2_, beginning with initial
key-letter _O_, and come out with the correct decipherment at his
very first attempt! With other letters, as _V_ or _A_, it might be
necessary to make as many as six trials, but, as we have seen, it is
hardly ever necessary to carry a trial very far in order to see that
the decipherment is going to be a poor one. The second letter, of
course, will not necessarily give results; but the cryptogram,
remember, is filled with these vulnerable letters, and a decipherment
may be started with any letter whatever and carried out in both
directions.

Figure 126

Where the KEY is a Segment of Ordinary PLAINTEXT:

Estimated Rank of the Cryptogram Letters and Their Frequencies Per 10,000

Figured by C. Stanley Lamb From Table of Ohaver.

VIGENÈRE

V A I S ERL WHB XGM FOZ K N T P U J Y C Q D

344 314 304 296 (Intermediate) 150 112 84 84 84 72 72 64 49 --

BEAUFORT
& VARIANT

A N E W O M Z BQK JRT HVF GUDX P L S I Y C

480 262 246 246 196 196 191 (Intermediate) 121 121 104 104 57 57

PORTA

K N L E RMF TWP UYQ XGC AVI BJZ D H O S

329 300 282 275 (Intermediate) 132 113 97 --

Another method, originated by C. Stanley Lamb, differs from Hurst’s

chiefly in that his observations were made from _digrams_ and not
from single letters. Originally, Lamb had been collaborating with
Admiral Snow in establishing frequency counts for various kinds of
ciphers, so that when the system was unknown, it would be possible
to tell one from another. Fig. 126, for instance, gives a rough
estimate as to what the rank and frequency should be for each letter
in the kind of cipher we have under consideration. Finding a
reasonably long cryptogram in which the letters _D_ and _Q_ have
ranked among the last, with letters _V_, _A_, _I_, and _S_ ranking
among the first, we have a fairly good reason for suspecting that the
encipherment was accomplished with a very long Vigenère plaintext key.

Figure 127

(a) Preparation of the mixed alphabet............ C U L P E • • R

A B D F G H I J
K M N O Q S T V
W X Y Z

C A K W U B M X L D N Y P F O Z E G Q H S I T R J V
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26
 (b) ENCIPHERMENT - Auxiliary Key X, or 8:

Plaintext: S E N D S U P P L I E S T O M O R
FIRST Substitution: 21 17 11 10 21 5 13 13 9 22 17 21 23 15 7 15 24
AUTOKEY (Addition): 8 21 17 11 10 21 5 13 13 9 22 17 21 23 15 7 15
C R Y P T O G R A M... 29-38-28-21-31-26-18-26-22-31-39-38-44-38-22-22-39-
════════
══════════════

L E Y T O M O P R O W S T O P
9 17 12 23 15 7 15 24 24 15 4 21 23 15 13
24 9 17 12 23 15 7 15 24 24 15 4 21 23 15
33-26-29-35-38-22-22-39-48-39-19-25-44-38-28.
══════════════ ════════
xxxxxxxxxxx xxxxx

(c) Detail of DECIPHERENT:

Cryptogram Numbers: 29 38 28 21 31 26 18 26 ...

AUTOKEY (Subtraction): 8 21 17 11 10 21 5 13 ...
PRIMARY CRYPTOGRAM...... 21 17 11 10 21 5 13 13 ...
Re-Substitution......... S E N D S U P P ...

(d) Vigenère Autokey - What Happens to REPEATED SEQUENCES with a ONE-LETTER KEY:

Key... X/ T H E M O N T H E X T
Text... T H E M O N T H E X T E
A L A L

But for short cryptograms, Lamb did not find these characteristic
frequency counts half so convincing as the presence in a cryptogram
of certain _digrams_, which appeared to be characteristic for each
cipher, since he was always able to find from 7 to 10 of them in each
100 letters. By making use of the high-frequency digrams (_th_, _he_,
_er_, _in_, _an_, and so on), he then established lists of cipher
digrams which were very characteristic indeed for each type of
encipherment. Thus, in attacking an autokey, it is possible to make
a good beginning with such a digram as _VV_ (_er_-_re_) or _XK_
(_th_-_ed_), if the cipher is Vigenère, and work in both directions.

“_Key-Length 1_.” — Many writers are inclined to make a special case

of the autokey in which the “priming” is done with a single letter,
not that this actually constitutes a different cipher, but because
of the decryptment curiosities which can be brought to light in
connection with it. For instance: Having a cryptogram fragment
. . . . . . ._W S Y Q L A H T G B_. . . . . known to be Vigenère
autokey, initiated with a single letter, can you find instantly the
trigrams _SAY_ and _HAT_? Would you have any reason for trying the
word _WAS_? Of the many interesting observations which have come the
writer’s way with reference to the one-letter initial key, only one
has seemed to present the germ of an additional decryptment method.
This observation was one made by Ohaver in connection with a cipher
in which the substitutes were numbers. The cipher itself can be
examined in Fig. 127.

The first step, (a), consists in the preparation of a simple

substitution key in which the plaintext alphabet is in mixed order
and the cipher alphabet is made up of the numbers 1 to 26. The
encipherment, shown at (b), involves two steps. First, there must be
a simple substitution, using the key of (a), and this results in a
_primary cryptogram_. Afterward, this primary cryptogram, preceded
by an initial key-number, is _added to itself_. In the discussion to
follow, our objective will be that of _recovering the primary
cryptogram_ (and not the plaintext, which would have to be found
later by simple substitution methods). Decipherment, indicated at
(c), consists in reversing the two steps of the encipherment: A
series of subtractions restores the primary cryptogram, and is
followed by the resubstitution of letters. At (d) we have a Vigenère
fragment for comparison. The essential fact to be noticed in (d) is
the behavior of repeated sequences when the group-length is 1. Any
repeated sequence in the plaintext continues to show a repetition in
the cryptogram which is shorter by one letter than the original. Even
the repeated digrams will give repeated single letters.

Figure 128

A TRIAL-Decipherment (M. E. OHAVER)

The Cryptogram: 29 38 28 21 31 26 18 26 22 31 39 38 44 38 22 22 39
9 20 18 10 11 20 6 12 14 8 23 16 22 22 16 6 16
20 18 10 11 20 6 12 14 8 23 16 22 22 16 6 16 23
════════

33 26 29 35 38 22 22 39 48 39 19 25 44 38 28
23 10 16 13 22 16 6 16 23 25 14 5 20 24 14
1O 16 13 22 16 6 16 23 25 14 5 20 24 14 14
════════

Now, putting aside the fact of the mixed plaintext alphabet (since we
do not intend to recover the letters) we have here a cipher which, to
all intents and purposes, is the Vigenère autokey initiated with a
single letter. In place of the letters _A_ to _Z_ we have numbers 1
to 26, and the encipherment is a series of additions. In the
corresponding Vigenère case, the group-length 1 will usually show up
plainly in the number of doubled letters — “letters repeated at
interval 1.” And with the group-length determined as 1, it is
possible to begin with some given initial key, as _A_, and either
reproduce the plaintext or convert the autokeyed cryptogram to a
periodic one in which the period is 2 (twice the group-length).
Considering the analogy between the two cases, it should be possible
to do the same thing here. That is, it should be possible to take the
autokeyed cryptogram of (b), initiate its decipherment with some
number chosen between 1 and 26, and either reproduce the primary
cryptogram or convert the autokeyed cryptogram to a periodic one in
which the alternate numbers will belong to two cipher alphabets.
Where this reduction has been carried out in Fig. 128, the initial
decipherment was made with key 9 in order to avoid a discussion of
negative numbers. Also, the fact of numbers will usually limit the
range of the trial keys: here, the first number, 29, was not
enciphered by adding any number smaller than 3.

Now, looking at Fig. 129, let us compare the new cryptogram of Fig.
128 with the primary cryptogram of Fig. 127(b), and see whether or
not it has the expected formation. Between the two cryptograms (the
supposedly periodic one obtained from the trial decipherment and the
one we hope to recover), there is a constant numerical difference in
the pairs of corresponding substitutes, and this difference,
throughout, is alternately plus and minus. Further comparisons can
be made, if the student so desires, by initiating other partial
decipherments with trial-keys 10, 11, 12, etc. Always, the constant
numerical difference persists, and always it is alternately plus and
minus. Moreover, for every time that the initial key-number increases
in size, there is a corresponding decrease in all numbers occupying
the odd serial positions and a corresponding increase in all numbers
occupying the even positions.

Figure 129

Comparison of TRIAL DECIPHERMENT with TRUE DECIPHERMENT

True decipherment - (See Figure 127): 21 17 11 10 21 5 13 13 9

22...
Trial decipherment of Figure 128: 20 18 10 11 20 6 12 14 8
23...
CONSTANT DIFFERENCE: 1 -1 1 -1 1 -1 1 -1 1 -1

We have, then, a periodic cryptogram whose period is 2, and two

cipher alphabets, consisting of numbers, in which the only difference
is one of size. But these substitutes, unlike those of the Vigenère,
will not be placed in normal alphabetical order; to complete the
solution by one of the general methods, it may become necessary to
take a number of frequency counts. For instance, considering the
first of the two Bassières processes, it would be possible to set up
the same tableau (Fig. 122), causing numbers to run alternately
backward and forward (and beginning again at 1 whenever the number 26
is reached). In this way, one of the columns would contain the
primary cryptogram, and a frequency count taken on the numbers of
that column should resemble a simple substitution frequency count.

Considering the second of the Bassières processes, the autokeyed

cryptogram is already reduced to a period of 2; the subsequent
solution of the periodic cryptogram belongs to the general case of
the next chapter; that is, a case in which the cipher alphabets are
in mixed order but parallel. But we have, here, a special method, and
a short-cut. The only difference between our two cipher alphabets is
a matter of size in all corresponding substitutes. If we can find out
what this numerical difference is, we have only to increase or
decrease the size of the numbers in one of the cipher alphabets and
bring it to the level of the other. Our short-cut, as pointed out by
Ohaver, lies in repeated sequences (or even repeated single letters)
in the autokeyed cryptogram. A glance back at the plaintext of the
foregoing example will show that two repetitions were pointed out:
_STO_ and _TOMOR_, and that these were still present in the primary
cryptogram as 21-23-15 and 23-15-7-15-24. In the autokeyed version,
they were still repeated sequences, but shorter in length: 44-38 and
38-22-22-39.

Had we initiated our trial decipherment with the correct number, 8,

these two repetitions would, of course, have worked back to their
original length. But where this trial decipherment was made with a
different initial key-number (Fig. 128) we find that only one of the
sequences, _TOMOR_, has done this; the other, _STO_, has disappeared.
The explanation for this has been summed up in Fig. 130. One sequence
was repeated at interval 8, which is _even_. When the autokeyed
cryptogram is converted to one having period 2, any interval which is
divisible by 2 will contain a certain number of periods; thus, any
repeated sequence at interval 8, will appear in the periodic
cryptogram as one of the ordinary periodic repetitions. The other
sequence, _STO_, was repeated at interval 17, which is _odd_, and
thus cannot show up as a repetition in any cryptogram whose period
is 2.

It is this repeated sequence found at the odd interval which is to

give us our short-cut. We have only two cipher alphabets, each one
having a substitute for _S_, a substitute for _T_, and a substitute
for _O_. When the repetition occurs at the odd interval, we obtain
_both_ substitutes for _S_, _both_ substitutes for _T_, and _both_
substitutes for _O_. By subtracting one sequence from the other, we
may learn the numerical difference between the two cipher alphabets.
Notice that the difference is _constant_, is _alternately plus and
minus_, and is _divisible by 2_. (One alphabet is larger than the
original, and the other is smaller by the same amount.) Our special
method, then, for a cryptogram known to have been enciphered in this
way, is as follows: First, underscore all repeated sequences which
occur at odd intervals, or, in their absence, the repeated single
letters. Those which are long will almost surely represent
repetitions in the plaintext. Then, selecting a suitable number,
make a trial decipherment and examine the resulting sequences. If,
by any chance, those repetitions found at the odd intervals have
worked back to longer repeated sequences, then the trial key and the
original initial key must have been the same. If not, try subtracting
one result from the other. If both have represented the same
plaintext sequence, the result of the subtraction will be a constant
difference, alternately plus and minus, and divisible by 2. To
restore the primary cryptogram, split this uniform difference, adding
half of it to the numbers of one alphabet, and subtracting half of it
from the numbers of the other alphabet. This, as mentioned in the
beginning, will leave a simple substitution cryptogram still to be
investigated.

Figure 130

Respective Behavior of the Cryptogram's Two Repeated Sequences

Sequence 38-22-22-39 Sequence 44-38

Repeated at interval 8 Repeated at interval 17

Trial Decipherments:

1st occurrence: 22-16- 6-16-23 1st occurrence: 22-22-16

2d occurrence: 22-16- 6-16-23 2d occurrence: 20-24-14
2 -2 2

(This interval was EVEN) (This interval was ODD)

Our explanation, perhaps, has been a little rapid, but the student
who has read carefully will be able to discover the “germ” originally
referred to, and to make his own laboratory tests. Also, there may be
an interesting answer to the following question: When the cipher is
one of the Beauforts (using letters), and the auto-encipherment is
initiated with a single letter, does a trial decipherment, initiated
with some other single letter, result in a period of 2?

128. By ELIA, JR. (Variant, Autokeyed).

O O U J V J M K N C B U Q L P F U L A S A Z F T G M P B V A Y V S Q J
L F A W S P C H A E I U N R S M F V W S S O O H M E B E A M K F A A X
R H K Z R J Q A O I A V M E I B T O P D J G P R J N F R X T I I G X F
K D H X A F T H J Q H L A R K T G D L P S B M V Y E E V A O A C S M U
V U W C V C T S K S M W L O N P A O O H M W W P Y P O H I L G A Z Q B
Q U Z B Q P K M B O V K W J H P J A G D C H X G W Q B K O G Y A K S I
W N W E X Q N U S U C V O E Y H Y J J C B T B V J Q M N S P A R V P X
O A G T A V L V C Z B D I X N F M W U E Z L N N N W B M O X G T C P K.

129. By ELIA, JR. (Beaufort, Autokeyed).

O A N C Q R O Q N Y Z G K P L V G P A I A B V H U O L Z F A C F M A V
Z J H T I L L X V B C Z M M T O W Z W A O Q V P M M Q D L Q K O H K F
G O B T L R A U X Y T Y S F N O C Y G R P M U U H T H E W P O O S R G
R Z Z S L Y G K I A N K M M T O W Z W A O Q V A B E U X W T C T J I O
G L P H T E F U F B R X M U Z V L D B P K N S Y A Q B I V M O H P V L
G Z Y F C C W C O M C A W N A A A E V A W M P E B Q X O D O V P X A T
E M A J A T P M J E A Z Z M D S B B N A A A F G L I D N X A M K H K P
D B B P Q Y.

130. By ELIA, JR. (St. Cyr, Autokeyed).

T B F N Q X E F D G F W E A F X S Q U N I G A H E U N B B J L O B Q P
H F A K A S N X G B P E E J W W L Z J O M L L A P R V Y T N M X H Y V
O S E S Q V O A Q M O G V P A J K P Y I U Z F Q G Y J Y T L D F E L Q
Z L W Y Y U Y Z N E P P F W B R W M E E F R W X J W E P R V Y B U M P
Z Z M T S B U K K B A L K Z I L Q A L Z K K F S X Z U S T G J T H A R
G S B X I W V L Z B Z M P I K Y I U R H R V W C V A U F V L W F Q Z U
D I G F W H T Z M S F B K T Z U T R K I V F Z X W L C A U J P A N V S
E O Z U X G I X D S X M G Q E L Q T V B L E I D I A L L A I N O E N L
V J I O I S W Q T D E C T M.

CHAPTER XVII
Some Periodic Number-Ciphers

The use of numbers in a periodic cipher does not, in itself, create a

problem essentially different from that of the letter-ciphers.
Numbers may, in themselves, cause weakness; we saw such a case in the
last of our autokey examples, where a complete disarrangement in
their order did nothing to conceal their size. But oftener than not,
the weakness lies in the construction of the cipher or in the manner
of its application, and while this is fully as true of letter ciphers,
the numbers, for some reason, appear to be more inviting for certain
kinds of misuse.

In order to observe a weakness which need not have existed, let us

consider the slide partially shown in Fig. 131. The use of two-digit
numbers will furnish a hundred substitutes; but a strip of that
length is awkward to handle, and the constructor of the present slide
has confined its length to forty numbers. Then, since he has only
fifteen different cipher alphabets, and wishes to make use of
word-keys, he has adjusted his 26 key-letters to fit the number of
alphabets. Now if the alphabet of the slide (that is, the _cipher
alphabet_, or series of numbers) is written in straight 1-2-3 order,
and if it is considered that letters may have two or more values, so
that _A_ has the values 1, 27, 53, etc., _B_ the values 2, 28, etc.,
_C_ the values 3, 29, and so on, a slide of this kind is exactly the
equivalent of the Saint-Cyr slide, since any cryptogram accomplished
with it could be promptly converted to a Vigenère cryptogram by
substituting letters for numbers. The keys, of course, might differ.
The constructor of the slide has desired something more difficult.
But instead of carrying his forty numbers through a transposition
block, and really mixing them, he has been content to group them, in
regular order, by their tens. We shall see in a moment what happens
to his cryptograms. But he neglects also an opportunity: Presuming
that his circumstances are such as to make the use of numbers
practical at all, why waste the opportunity to use the full one
hundred substitutes? The remaining sixty numbers might have been
placed on the next two rows, and thus, in every position of the
slide, he could have had two or three optional substitutes for every
letter — a much more difficult case than the simple periodic.

Figure 131

A Slide Carrying a NUMBER-Alphabet (and Keys)

( Plaintext Alphabet - Stationary

(
( A B C D E F G H I J K L
M .....
( 10 20 30 40 50 60 70 80 90 00 11 21 31 41 51 61
71 .....
Sliding Cipher-Alphabet:
Key-letters may be added: A B C D E F G H I J K L M N O)
( * P Q R • S T U * V W X Y Z *)

The addition of key-letters makes it possible to employ a keyword. For the

present
forty-number slide, it was necessary to double them up as in Porta. A slide
having
fifty-one numbers would have accommodated all twenty-six of the key-letters.

The cryptogram of Fig. 132 was enciphered with the slide of the
preceding figure, using the key-word CABLO (equivalent to the
numerical key 30-10-20-21-51), and its period, 5, can be determined
in the usual way. However, we have already seen the Kasiski method;
suppose, here, we look at another, originated by Ohaver; and, since
Ohaver himself, explaining his method in connection with a
number-cipher of much the kind we have here, illustrated with single
numbers instead of with sequences, it seems fitting that it be
illustrated again in the same way.

Figure 132
 Cryptogram Enciphered with the Slide of Figure 131

32 41 31 61 33 12 32 60 91 91 30 81 70 92 92 51 52 61 23 43 71 01 90 61 71
71 41 12 92 51 01 52 12 91 91 80 50 30 92 53 30 81 62 72 62 30 41 00 02 43
71 20 60 41 51 01 81 00 61 81 71 12 12 31 93 61 50 00 32 33 70 41 00 52 33
22 50 20 51 92 80 31 61 92 23 11 91 01 13 92 81 51 12 91 91 01 30 90 21 82
90 50 01 21 23 70 20 60 01 82 90 31 20 51 91 22 51 12 91 32 12 50 51 51 33
71 10 01 13 92 40 50 91 61 51 60 52 42 91 91 61 01 90 61 43 11 31 60 41 92
51 50 01 02 92 81 21 60 21 33 70 21 60 13 72 70 80 60 21 23 01 90 80 91 43
30 32 20 63 32 80 01 90 61 23 70 90 01 21 82 72 51 30 12 91 50 01 00 62 82
40 50 40 21 53 12 50 12 91 32 12 90 01 81 92 11 41 80 13 92 22 10 21 61 43
11 31 60 21 82 60 32 60 51 92 61 01 42 21 82 22 10 51 63 22 11 01 40 91 51
22 01 90 61 62 30 91 12 42 32 61 12 12 61 33.

As pointed out more than once, those characters having the highest
frequencies in periodic cryptograms will nearly always have derived
these high frequencies because of their occurrence in more than one
of the cipher alphabets; while those having the lower frequencies
will more often represent repetitions in some one cipher alphabet.
Thus, when we find, in the present cryptogram, that the numbers 02,
53, and 63, have each a frequency of 2, it seems reasonable to
suppose, for each number, that its two occurrences were in a single
cipher alphabet; that is, that each one is a periodic repetition.
Now, considering Fig. 133, and confining our observations, for the
moment, to the number 02, we find that this number, in the cryptogram,
occupies serial positions 49 and 154. Having first laid out a series
of columns headed by the various possible periods, 2, 3, 4, 5.
. . . . , we use each possible period in turn as a divisor, first
applying them all to the serial number 49, and then applying them
all to the serial number 154, each time setting down, in the proper
column, _the remainder from the division_. This remainder tells us,
each time, into what cipher alphabet the number 02 would fall, should
the cryptogram be rewritten into the period indicated at the top of a
given column. Still confining our observations to the number 02: It
is seen, under possible period 2, that if this were the period, then
the two occurrences of the number 02 would be in different alphabets.
The same can be seen under possible periods 4, 6, 8, 9, 10. But if
the period were 3, both occurrences of our number would fall into
alphabet 1; if it were 5, both occurrences would fall into alphabet
4; if it were 7, both occurrences would fall into alphabet 7
(remainder zero indicates the final alphabet of the given period).
Here, then, it would appear that possible periods 3, 5, and 7, are
more likely than the rest, as far as the tabulation goes. When
exactly the same observations are made for the number 53, it appears
that the most likely periods are 3 and 5. And when these observations
are made again for the number 63, only the period 5 is indicated as a
likely one. Since the period 5 has been indicated oftener than any
other, this is probably the correct period, as we happen to know
that it is.

When the same method is applied to repeated sequences, the serial

numbers can be those of the repeated first number. And it may, of
course, be applied to letters, just as the Kasiski method might have
been applied here. As to why Ohaver might have preferred this method
in dealing with numbers, let us examine, in the figure, the entire
column under possible period 5. The Ohaver method, unlike the
Kasiski, not only indicates the period, but, in addition, shows the
exact alphabet of that period into which a repeated number will fall.
The number 02 is shown as belonging to alphabet 4 ; the number 53 as
belonging to alphabet 5; and the number 63 as belonging to alphabet
4. It is thus possible to see that the very small number 02 and the
very large number 63 belong to a same cipher alphabet; and since a
range of over sixty numbers cannot correspond to only twenty-six
letters, we may conclude at once that the numbers on the slide were
not in consecutive order. Often, our information is exactly the
opposite.

Figure 133

An OHAVER Method for Finding Period

P O S S I B L E P E R I O D S
Substitute Serial Position 2 3 4 5 6 7 8 9 10 ...

02 49 1 1 1 4 1 0 1 4 9 ...
154 0 1 2 4 4 0 2 1 4 ...

53 40 0 1 0 0 4 5 0 4 0 ...
205 1 1 1 0 1 2 5 7 5 ...

63 179 1 2 3 4 5 4 3 8 9 ...
244 0 1 0 4 4 6 4 1 4 ...
X
X

* * *

Returning, now, to our cryptogram: In the beginning, we probably made

a general frequency count; if not, we now have the five individual
counts to be taken. And, as previously mentioned, a frequency count
made on numbers is much more conveniently accomplished on a 10 x 10
chart than by sorting and listing the numbers. The moment our five
frequency counts are made, in the present case, two facts become
evident: Each count includes only fifteen or twenty _different_
numbers, with about the frequency-distribution of simple substitution;
and, while the tens-digits have included a full series, the units
have never run beyond 3. The cipher, then, is a simple periodic; had
multiple substitutes been used, the frequency counts would have
included more different numbers, and with frequencies more uniformly
distributed. As to the series of numbers, two probabilities are
suggested, and these, in effect, are the same thing: The numbers may
have run in straight order into the thirties, and with each number
reversed; or: the numbers may have been grouped by tens. It is
further possible that the whole series runs backward, or that the
tens do, or the units, or sections of a certain length; and some
uncertainty may arise as to the rank, in the series, of the digit
zero; this digit is ordinarily last, but occasionally is ranked
first. It is, of course, possible that the series of numbers is well
mixed, but the chances are that it is merely methodized; the person
who uses numbers in a simple periodic cipher is not usually one who
knows the dangers of regularity in a cipher alphabet.

Figure 134
 A Series of PARALLEL Frequency Counts Which Can Be LINED UP By PATTERN

10 . 111 . . .
20 . 11 111 . .
30 11111 1 11 . .
40 11 . 11 . .
50 1 11111 1111 . . .
60 11 . 11111 1111 . .
70 11111 . 1 . .
80 111 1 11 . .
90 11 111 11111 . .
00 . . 11111 . .
11 11111 . . . .
21 . 11 1 11111 111 .
31 . 1111 1 1 .
41 . 11111 . 11 .
51 11 111 11 1111 1111
61 1111 . 11 11111 1111 .
71 11111 . . . 1
81 11 111 . 1 1
91 . 11 1 11111 111 11111 1
01 1111 11111 11 11111 1 1 .
12 1111 11 11111 111 1 .
22 11111 . . . 1
32 1 111 . 1 1111
42 . . 11 1 .
52 . 111 . 1 .
62 . . 1 1 11
72 1 . . 1 1
82 . . . . 11111 1
92 . . . 1111 11111 1111
02 . . . 11 .
13 . . . 1111 .
23 . . . 1 1111
33 . . . . 11111 1
43 . . . . 11111
53 . . . . 11
63 . . . 11 .
73 . . . . .
83 . . . . .
93 . . . . 1
03 . . . . .

We may try, then, to restore his original arrangement (or an

equivalent one), placing beside it the five frequency counts in their
five columns, as shown in Fig. 134. The probable arrangements are
very few, and the placing of tally-marks opposite their numbers is
very rapid, since this, at each trial, is a mere matter of
copying them from their charts. Once the correct rearrangement is
reached, notice, in the figure, the appearance of the five frequency
counts. Insofar as is ever likely to happen with columnar counts,
_all five have followed the same graph_. This, of course, is the
simplest case; the finding of the encipherer’s original order, so
that every frequency count has followed the graph of the normal
alphabet. Any substitute can be identified, as in Vigenère, by its
serial position in its own alphabet; and where numbers are used,
there is seldom any doubt as to what number comes first in its
alphabet. The shortest road to solution would be as follows: Prepare
a temporary slide _exactly like the one which was used_ (except that
we have no way of knowing what the key-letters were), mark the points
at which the five alphabets begin, and decipher with the slide.

There are many other cases, hardly more difficult, in which our
rearrangement of numbers results, not in the original order, but in
an _equivalent order_. We could, for instance, arrive at a
rearrangement in which we have taken each third number, or each fifth
number, of the original cipher alphabet, so that our rearranged
numbers are following plaintext letters in the order
_A D G J_. . . . or _A F K P_. . . . ; thus, all of our frequency
counts would be following one same graph, though not the graph of the
normal alphabet. The problem here is to make sure that their graphs
are all the same graph, and then subject them to the process called
“lining up.”

Figure 135

The LINING UP of the Frequency Counts of Figure 134

┌1st┐ ┌2d ┐ ┌3d ┐ ┌4th┐ ┌5th┐ TOTALS

│ │ │ │ │ │ │ │ │ │
│ 30│11111 │ 10│111 │ 20│111 │ 21│11111111 │ 51│1111 23 *
│ 40│11 │ 20│11 │ 30│11 │ 31│1 │ 61│ 7
│ 50│1 │ 30│1 │ 40│11 │ 41│11 │ 71│1 7
│ 60│11 │ 40│ │ 50│ │ 51│1111 │ 81│1 7
│ 70│11111 │ 50│111111111│ 60│111111111│ 61│111111111│ 91│111111 38 *
│ 80│111 │ 60│ │ 70│1 │ 71│ │ 01│ 4
│ 90│11 │ 70│ │ 80│11 │ 81│1 │ 12│ 5
│ 00│ │ 80│1 │ 90│11111 │ 91│11111111 │ 22│1 15 *
│ 11│11111 │ 90│111 │ 00│11111 │ 01│1 │ 32│1111 18 *
│ 21│ │ 00│ │ 11│ │ 12│1 │ 42│ ** 1
│ 31│ │ 11│ │ 21│1 │ 22│ │ 52│ ** 1
│ 41│ │ 21│11 │ 31│1 │ 32│1 │ 62│11 6
│ 51│11 │ 31│1111 │ 41│ │ 42│1 │ 72│1 8
│ 61│1111 │ 41│11111 │ 51│11 │ 52│1 │ 82│111111 18 *
│ 71│11111 │ 51│111 │ 61│11 │ 62│1 │ 92│111111111 20 *
│ 81│11 │ 61│ │ 71│ │ 72│1 │ 02│ 3
│ 91│ │ 71│ │ 81│ │ 82│ │ 13│ ** 0
│ 01│1111 │ 81│111 │ 91│1 │ 92│1111 │ 23│1111 16 *
│ 12│1111 │ 91│11 │ 01│111111 │ 02│11 │ 33│111111 20 *
│ 22│11111 │ 01│1111111 │ 12│11111111 │ 13│1111 │ 43│11111 29 *
│ 32│1 │ 12│11 │ 22│ │ 23│1 │ 53│11 6
│ 42│ │ 22│ │ 32│ │ 33│ │ 63│ (V) 0
│ 52│ │ 32│111 │ 42│11 │ 43│ │ 73│ 5
│ 62│ │ 42│ │ 52│ │ 53│ │ 83│ ** 0
│ 72│1 │ 52│111 │ 62│1 │ 63│11 │ 93│1 8
│ 82│ │ 62│ │ 72│ │ 73│ │ 03│ ** 0
265

To show the handling of all such cases (which would include our final
autokey example), let us assume that the five frequency counts of our
figure, though still following a common graph, are not following that
of the normal alphabet. In this case, granting that all fifty-letter
frequency counts will vary considerably from the normal, it is not
quite so obvious that their pattern is the same; we shall have to cut
them apart (preferably having copied numbers beside their frequencies)
and place them side by side for a comparison of their graphs. Where
this has been done, in Fig. 135, their similarity is plain in spite
of some discrepancies, and the moving up or down of any one or more
of the counts (which could be done so as to include another position,
since the range of the numbers is only 25 per alphabet) does not
result in greater similarity. If the alignment of this figure is
correct, then all numbers found on any one row are substituting for
one same original; thus, the added frequencies on any one row will be
the total frequency of some one letter in a 265-letter text, and all
of these totals, collectively, should resemble a frequency count
taken on a simple substitution cryptogram of that length. To just
what extent this is true may be seen at the right side of the figure.
The nine leading letters have totalled 74%, where we normally expect
70%; but any single example can provide its surprises, and the excess
4% is not on the wrong side of the ledger. The other end of the count,
as would be expected of the group _J K Q X Z_, is comparatively blank.

Figure 136

The NIHILIST Number-Substitution

The "Checkerboard" Alphabet:

1 2 3 4 5

1 A B C D E 13 = C
2 F G H I K 34 = O
3 L M N O P 32 = M
4 Q R S T U 15 = E
5 V W X Y Z 44 = T

Encipherment, with Keyword COMET:

S E N D S U P P L I E S T O ....
Text... 43 15 33 14 43 45 35 35 31 24 15 43 44 34 ....
Key.... 13 34 32 15 44 13 34 32 15 44 13 34 32 15 ....
56 49 65 29 87 58 69 67 46 68 28 77 76 49 ....

This cryptogram is usually seen without grouping: 56-49-65-29-87-58.....

Our substitutes, remember, are assumed to be in mixed order. We do

not know what letter is represented by the five numbers of the top
row, or by the five numbers of any other row. To proceed with
solution, we shall have to assign arbitrary values, calling the top
row _A_ (or 01), the second row _B_ (or 02), the third row _C_ (or
03), and so on; and when all of these substitutions have been made
on the cryptogram, _the case has been reduced to one of simple
substitution_. The mechanics by which the substitutions are made can
be exactly those of the other case: Prepare a temporary slide, on
which the numbers run in the order decided upon, and slide this
against the normal alphabet (or any other); the result is a simple
substitution cryptogram which can be solved by simple substitution
methods. This case, first in one form and then in another, is
encountered again and again; and however it may seem that its cause,
in some one example, is a different one, yet the fault in all such
examples is the same: The basic cipher alphabet (the primary one
from which others are derived), either by its actual construction
or by the method of its application, was not truly a mixed alphabet.

* * *

In some of the periodic ciphers, the basic cipher alphabet is a

“checkerboard” of the kind we saw in Chapter XI, the substitutes
being two-digit numbers which will point out the columns and rows of
their originals. This primary alphabet, however, seldom appears
unchanged in the cryptograms, as “position 1” often does when a slide
is used, or as the _A_-alphabet often does in the Vigenère cipher.
Instead, we find a series of secondary cipher alphabets all of which
have been derived from the primary one according to a mathematical
process.

In view of the fact that any cipher which will necessarily double the
lengths of messages is of doubtful value, it seems inadvisable here
to do more than mention the infinite multiplicity of processes which
would be possible; but with checkerboards, it is difficult to imagine
any usable process which would not result in parallel frequency
counts; that is, counts which all follow the same graph and thus are
capable of being “lined up.” With most of these, in fact, the
difference between any two of the (secondary) cipher alphabets will
be a difference in _size_ which is uniform from _A_ to _Z_. (Often,
the same result is produced with slides.) Here, then, we may content
ourselves with a glance at one such cipher which is interesting
rather than important. In Fig. 136, we have another of the Nihilist
ciphers. Its primary alphabet is that most famous of checkerboards,
the _Polybius square_, said to have been the invention of the ancient
Greek historian, and certainly well known in his era as the basis for
a signalling system — a capacity, incidentally, in which it still
serves. We are showing it here in what seems to be the favorite
version: The alphabet of the square is the normal one, normally
arranged, with _J_ the missing letter; and the order of reading for
the two digits is row-column. It should be understood, however, that
these details, in practice, are quite variable.

For the Nihilist encipherment, the message is first subjected to a

simple substitution, using the checkerboard key. A key-word, treated
in the same way, is repeated often enough to pair one key-number with
each message-number, and the final cryptogram is formed by adding
these pairs of numbers. Decipherment, of course, will be the
subtraction of key-numbers from the finished cryptogram and the
resubstitution of letters. We have, then, another periodic cipher,
not essentially different from those already seen. Any number in the
checkerboard can become a key, to be applied periodically at some
given interval, and thus may govern one of the 25 possible cipher
alphabets. It would be possible to lay out any one of these cipher
alphabets, simply by adding a given amount to each number of the
primary one; if all of them were written one below another, and if
the primary alphabet were written across the top and along one side,
we should have a tableau which could be used in identically the
manner described for the use of the Vigenère tableau.

Decryptment, too, can parallel that of the Vigenère: The period of a

cryptogram can be found through repeated sequences, or, in their
absence, through repeated single numbers, and individual frequency
counts can be taken on the several alphabets of the period. If the
arrangement of letters in the checkerboard is that of the figure, or
any other strictly alphabetical one to which the order of the numbers
can be adjusted, these frequency counts will all follow the graph of
the normal alphabet, with allowance made for the missing letter. Or,
if the arrangement of letters in the checkerboard is not strictly
alphabetical, then the several frequency counts, no matter how badly
mixed, will still be parallel; they will all follow one graph, and
thus can be “lined up.” Very often, however, given the opportunity
to examine and analyze a cipher, it becomes possible to formulate for
it a special method which is much more rapid than the general one;
Ohaver, who first published a special method for the Nihilist, has
compared this cipher to a leaky boat in the open ocean.

Notice that its primary alphabet contains only the digits 1-2-3-4-5.
The maximum difference among these is 4; and the addition of any same
number to all of them does not change this fact; the maximum
difference between any two of the sums would still be 4. But the
number which is added during encipherment is also a number containing
no digit other than 1-2-3-4-5; thus any number found in a cryptogram
can be considered as carrying two separate additions, one for tens
and one for units. Even when two 5’s are added together, the result
is an all-revealing zero; the “carried” digit 1 can be mentally
“borrowed” back, causing the zero to become 10, and decreasing by 1
the size of the digit which precedes the zero. Specifically: Finding
in a cryptogram the number 40, we may regard this as having only
3 tens, with 10 units; or finding the number 110, we may regard it
as having 10 tens and 10 units. Thus, there is never a time when it
is impossible to see the tens and units as having been separately
added; if we find, in a Nihilist cryptogram, the two numbers 29 and
87, with a difference greater than 4 in their respective tens-digits,
we may say promptly that they were not enciphered with the same key;
no digit whatever added to any two digits of the original square can
produce a difference greater than 4. But if the two cryptogram
numbers are 30 and 77, where the difference in the tens-digits
appears, at first glance, to be only 4, the presence of the zero
must be taken into account; thus, the number 30 has only 2 tens,
and the difference between 2 and 7 is greater than 4; therefore,
the numbers 30 and 77 could not have been enciphered with the same
key. It is interesting, also, to note that the digit 2, found in a
cryptogram, can have been produced in only one way: the addition of
1 and 1; and that the digit 0, found in a cryptogram, can only have
been produced by the addition of 5 and 5. Either one of these digits
gives away its key; but, further than this, the cipher provides four
“give-away” numbers, 22, 30, 102, and 110, the presence of any one
of which in a cryptogram will give away the key to a whole cipher
alphabet.

Figure 137

Cryptogram by EDWIN LINDQUIST: Final Investigation of

Supposed Period 4
24-66-35-77-37-77-55-59-55-45-55-88-28-66-46-
24 66 35 77
88-37-67-33-59-58-65-45-66-67-58-44-55-34-79- 37 77 55 59
55 45 55 88
44-59-55-45-42-87-28-76-43-78-46-86-26-67-24- 28 66 46 88
37 67 33 59
85-26-67-28-76-26-78-46-65-65-88-36-49-54-67- 58 65 45 66
67 58 44 55
 28-65-42-88-36-49-44-89-57-58-54-66-47-67-26. 34 79 44 59
55 45 42 87
28 76 43 78
46 86 26 67
24 85 26 67
28 76 26 78
46 65 65 88
36 49 54 67
28 65 42 88
36 49 44 89
57 58 54 66
47 67 26

(Acceptable throughout)

Now, to look at Ohaver’s special method, let us consider the

cryptogram of Fig. 137, prepared by another “inventor” of exactly
the same method. It can be noted, first, that this cryptogram has
not resulted from the addition of a single number throughout, since
it contains pairs of numbers like 24-88, 42-87, and so on, which
have a greater difference than 4 in either their tens or their units.
Now, using a bit of scratch-paper, we may, if we like, scribble down
a series of possible periods, 2, 3, 4, 5, 6, and so on, to be crossed
off as fast as we eliminate them. Considering these, one by one:

_Period 2_: With a thumbnail on the first number, 24, and another on
the third number, 35, we may run quickly through the cryptogram
comparing numbers found at interval 2; that is, the first and third
numbers, the second and fourth, the third and fifth, and so on, until
stopped by the two numbers 33 and 38, whose difference, in the units,
is greater than 4, showing that their key was not the same. Period 2,
then, is eliminated.

_Period 3_: Here we are stopped short at the very first comparison.
The numbers 24 and 77, found at the first interval 3, have a
difference greater than 4 in their tens, and thus cannot have been
enciphered with the same key. Period 3 is also eliminated.

_Period 4_: Starting again, and comparing numbers taken at interval

4, we are able to go all the way to the end of the cryptogram without
finding any two numbers whose difference, either in tens or in units,
is greater than 4. The numbers compared, however, included only those
which would have been adjacent in their columns. To make sure that
period 4 is possible, we must see numbers collectively in each of
the four columns, and this is best done by recopying the cryptogram
into its apparently possible period 4. Further examination, made
individually on each column, still shows no two numbers in any one
column whose difference, either in tens or in units, is greater than
4. It is possible, then, that each of the four columns was enciphered
with a single key; and while this is not absolute proof that the
period 4 is correct, those cases are extremely rare in which a period
found in this manner is not the correct one. With period 4 accepted,
and given as much material as we have, perhaps we can also discover
just what key-number was added to primary numbers in order to produce
each of the four alphabets. Considering alphabets one at a time, and
examining separately the tens and the units:

_Alphabet 1_: The tens-half of the first column contains a digit 2;

and since this can only have been produced by the addition of 1 and 1,
the only possible key-digit here is 1. (We have already ascertained
that all digits in this column could have had a same key.) The
units-half has a range of 4-5-6-7-8, the maximum range possible.
The smallest digit which can result in 8 is 3, and the largest which
can result in 4 is 3; that is, the only digit which can result in all
of the digits 4-5-6-7-8 is 3, so that the only possible key-digit
here is 3. Conclusion: The key which produced the first cipher
alphabet must have been 13, _since it cannot possibly be anything
else_.

_Alphabet 2_: The tens-half of the second column ranges over the
full five digits 4-5-6-7-8 (key 3), and the units-half ranges over
the digits 5-6-7-8-9 (key 4). The key which produced the second
cipher alphabet is 34.

_Alphabet 3_: The tens-half of the third column contains the

“giveaway” digit 2, and the units-half contains this digit also.
The key which produced the third cipher alphabet is 11.

_Alphabet 4_: The tens-half of the fourth column ranges only over
the digits 5-6-7-8, with nothing to indicate whether the missing one
is 4 or 9. Thus, the key to the tens might have been either 3 or 4,
though it could not have been anything else. The units have the full
range of digits, 5-6-7-8-9, key 4. In the fourth cipher alphabet,
then, we cannot tell immediately whether the key is 34 or 44.
Granting, however, that the arrangement of letters in Lindquist’s
key-square was the same as that of Fig. 136, the substitution of
letters for numbers may suggest which of the two numbers, 34 or 44,
is the correct key. With one of these we obtain letters _C O A O_,
and, with the other, _C O A T_, a word (The student might find it
of interest to decipher this cryptogram and learn what the minister
had to say).

* * *

Any sufficiently long cryptogram, then, will reveal both its period
and its key, and this regardless of how the letters were arranged in
the encipherer’s checkerboard. It may then be deciphered with its own
key, and the case, at worst, becomes one of simple substitution. With
shorter cryptograms, we often find, as here, that some one or more of
the cipher alphabets could have had two or more possible keys. This
happening, presuming that the alphabetical arrangement of the square
is a known one, or one easily reconstructed, presents no real
problem; a little experimentation on the cryptogram will show which
keys bring out a message. When the alphabet of the square is an
unknown mixed one, the problem may vary according to length, and the
number of key-combinations which are found to be possible. If, for
instance, the case resembles that of our preceding cryptogram, where
only one alphabet out of four was in doubt, then, remembering that
the Nihilist cipher alphabets are of a kind whose frequency counts
can be “lined up,” we might take frequency counts on the several
alphabets, and supply the missing numbers of the doubtful one by
making its pattern match that of the rest. With several alphabets
in doubt, which could only happen when frequency counts are too scant
to betray their graph, it might become necessary to decipher the
periodic cryptogram with each possible combination of key-numbers,
each time obtaining a new cryptogram, and accept, among these new
cryptograms, the one whose general frequency count seems most likely
to be that of a simple substitution. The correct cryptogram, in this
case, should also contain some fresh repetitions; that is,
repetitions which were not present in the periodic one. As to the
three examples which follow, there should be little difficulty in
deciding whether or not the Nihilist cipher is represented.

131. By B. NATURAL.

45 68 48 46 60 78 45 78 24 59 35 67 50 75 38 58 53 60 65 26 54 46 68 55 38 67 42
69 56 59 24 59 70 54 30 85 32 90 44 46 45 56 79 54 30 86 22 78 27 26 44 49 78 75
38 54 55 78 47 27 45 49 89 44 49 88 42 59 56 49 42 86 50 52 26 55 42 60 47 36 22
50 78 65 50 76 35 78 28 59 26 50 68 54 60 76 25 87 28 29 55 58 59 73 59 97 54 69
66 57 26 46 78 65 48 76 45 57 47 29 65 79 77 55 30 57 35 89 45 49 53 46 66 75 57
97 55 68 28 47 22 66 66.

132. By PICCOLA. (Keyword, CRYPT. Fifth alphabet contains Q. But: Can you
rearrange the numbers on the strip before taking frequencies?

15 20 23 18 03 15 26 12 26 25 03 30 40 14 20 09 20 25 11 15 17 25 16 02 29
30 25 21 18 03 11 16 27 30 26 10 02 21 17 01 06 25 13 01 25 03 30 23 26 23
06 27 12 11 20 12 22 16 18 03 29 20 19 01 19 17 19 12 12 20 02 11 14 18 19
13 20 38 11 23 19 01 19 01 27 30 16 21 01 23 17 24 22 25 03 19 26 21 11 28
11 17 16 21 03 13 20 28 05 20 06 26 13 11 26 11 16 27 26 16 02 26 18 05 25
06 03 16 03 03 30 26 16 27 28 10 02 16 02 29 06 26 27 11 24 15 20 23 13 15
11 25 13 05 24 28 20 40 27 19 19 30 27 19 19 13 02 23 21 28 11 30 14 28 03
18 26.

133. By PICCOLA. (If you recognize this gem of literature, you are beyond the
draft age. It got around the censor in 1918).

20 08 17 29 15 09 01 05 08 29 24 11 06 05 10 26 13 22 06 01 18 19 05 03 16 24 13
16 04 08 07 19 12 18 24 11 17 09 07 27 26 22 01 15 21 21 10 03 06 22 03 18 04 22
20 06 07 24 12 19 10 19 10 30 10 19 16 24 13 16 04 08 23 01 10 10 23 10 09 05 08
17 21 22 09 15 21 21 10 03 06 06 21 20 12 22 21 08 18 19 23 05 02 01 11 34 19 27
12 06 02 15 10 22 03 03 02 11 12 19 10 11 19 27 13 12 18 24 19 13 24 15 07 16 16
16 26 20 04 05 11 29 26 20 03 10 19 10 23 11 16 19 13 16 04 08 25 17 05 24 20 20
23 09 10 25 20 25 02 05 07 16 26 20 04 05 11.

134. By DAN SURR. (Should you be worried at finding this in Daughter's boudour?)

A B C D E F G E H D G E F J E K H D L J D G J M M J D G J M E
E F J E O J E L F A C B D G. - P G M G.

CHAPTER XVIII
Periodic Ciphers with Mixed Alphabets

Periodic cryptograms in which the cipher alphabets are mixed are

nearly always produced by means of slides. Before discussing these
ciphers, it may be well to clarify a few terms which otherwise could
leave room for uncertainty. We have, for instance, two, and sometimes
three, key-words. There is a primary one (sometimes two) used in the
preparation of the slide, and a secondary one, often called the
“specific” key, which is used, as in Vigenère, for the encipherment
of cryptograms. Since we shall have practically no occasion to
mention the primary key-word (or words), any references which are
made here to a key-word, unless clearly seen to refer to the
preparation of a mixed alphabet, can be understood as meaning the
secondary one, that is, the specific key which selects the cipher
alphabets. Perhaps it is also advisable to call attention once more
to the existence of a primary cipher alphabet (the basic one which is
written twice in succession on the slide) and of the 26 secondary
cipher alphabets which can be derived from it by placing it in its 26
possible positions. These are usually referred to simply as “the
alphabets,” while the basic one is more commonly called “the sliding
alphabet.” All, of course, are the same alphabet except for their
points of beginning.

To see clearly what is meant by an “equivalent slide,” the student

may make an experiment: First, form a temporary slide, using any two
26-letter alphabets, and use the slide to encipher a short message.
Now form another temporary slide on which the two alphabets of the
preceding slide (both treated by exactly the same plan) have been
rearranged so that their letters are taken at every interval 3 (or at
every interval 5, or 7, or 9 — any interval whatever that is not
divisible by 2 or 13), and with care taken always to maintain this
constant interval even when the 26th letter is reached and the 1st
reappears. Then, using this new slide in the same way as before,
encipher the same message with the same key, and compare this new
cryptogram with the first. Finally, an _alphabetical_ interval (or
distance) between two letters will mean their distance apart in the
normal alphabet, while a _lineal_ interval (or distance) will mean
their distance apart in any alphabet whatever. That is, the
_alphabetical_ distance from _A_ to _B_ is invariably 1 (position),
while their _lineal_ distance apart on a slide, or in the rows or
columns of a tableau, could be anything from 1 to 25. Where these
intervals must be mentioned often, the distance from _A_ to _B_ will
be referred to more briefly as “the distance _AB_.”

* * *

Now let us consider the four slides of Fig. 138, which are being
designated (arbitrarily) as belonging to _Types I_, _II_, _III_, and
_IV_, in what would seem to be the order of their potential
resistance to decryptment. Their actual resistance, however, might
depend largely upon the manner of their use, and we are assuming
throughout the chapter that the encipherment process is identically
that described for the Saint-Cyr cipher: The upper alphabet, in all
cases, is to be the plaintext one; the index-letter is always the
initial one of this plaintext alphabet; and, for the encipherment of
cryptograms, the letters of the chosen key-word are to be found in
the lower alphabet and brought one by one to stand below the
index-letter in order to set up their cipher alphabets. Also, for
our immediate purposes, we are neglecting certain precautions the
advisability of which will be seen later: First, the mixed alphabets
have all been left undisturbed with their primary key-words (CULPEPER,
DAMASCUS) and their alphabetical sequences in plain view; in practice,
such alphabets ought to be carried through a transposition block, or
otherwise made to appear incoherent. Second, the index-letter should
never be _A_ (or any other frequent letter) unless the details of
encipherment are varied. (We might, for instance, consider that the
index-letter is in the sliding alphabet and that keys are in the
upper.)
 Figure 138

SLIDE - TYPE I.

Plaintext: C U L P E R Z Y X W V T S Q O N M K J I H G F D B A
CIPHER: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C.....

══════════════════════════════════════════════════
a b c d e f g h i j k l m n o p .......

Key A: Z Y A X E W V U T S R C Q P O D .......
Key B: A Z B Y F X W V U T S D R Q P E .......
Key C: B A C Z G Y X W V U T E S R Q F .......
══════════════════════════════════════════════════

SLIDE - TYPE II.

Plaintext: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
CIPHER: C U L P E R Z Y X W V T S Q O N M K J I H G F D B A C U L.....

══════════════════════════════════════════════════
a b c d e f g h i j k l m n o p .......

Key A: A C U L P E R Z Y X W V T S Q O .......
Key B: B A C U L P E R Z Y X W V T S Q .......
Key C: C U L P E R Z Y X W V T S Q O N .......
══════════════════════════════════════════════════

SLIDE - TYPE III.

Plaintext: C U L P E R Z Y X W V T S Q O N M K J I H G F D B A
CIPHER: C U L P E R Z Y X W V T S Q O N M K J I H G F D B A C U L.....

══════════════════════════════════════════════════
a b c d e f g h i j k l m n o p .......

Key A: B D A F P G H I J K M U N O Q L .......
Key B: D F B G L H I J K M N C O Q S U .......
Key C: A B C D E F G H I J K L M N O P .......
══════════════════════════════════════════════════

SLIDE - TYPE IV.

Plaintext: D A M S C U B E F G H I J K L N O P Q R T V W X Y Z
CIPHER: C U L P E R Z Y X W V T S Q O N M K J I H G F D B A C U L.....

══════════════════════════════════════════════════
a b c d e f g h i j k l m n o p .......

Key A: C R P A Z Y X W V T S Q U O N M .......
Key B: A E L B R Z Y X W V T S C Q O N .......
Key C: U Z E C Y X W V T S Q O L N M K .......
══════════════════════════════════════════════════

In the _Type I_ slide, the cipher alphabet is in normal order, and

“slides against” a mixed plaintext alphabet. In _Type II_, we find a
mixed cipher alphabet “sliding against” the normal one; in _Type III_,
we find this mixed cipher alphabet “sliding against” itself; and in
_Type IV_, we find it “sliding against” another, and different, mixed
alphabet. Every slide, used in any manner, has an equivalent _tableau_
and while tableaux are seldom used, it is very important that we carry
in mind a clear picture of their appearance; otherwise we shall find
it difficult to understand how slides can be restored with only
partial information. The imaginary tableau which is to serve this
purpose, using any one of the four slides in the manner specified, is
formed as follows: The plaintext alphabet, _with letters in exactly
the order of the slide_, appears at the top. The 26 cipher alphabets,
standing below and parallel to the plaintext one, are all seen in
exactly the order of the slide, _and are shifted, one letter at a
time, exactly as the normal alphabet is shifted in the Vigenère
tableau_. Thus, exactly as in Vigenère, _the columns of this imaginary
tableau are duplicates of the rows_. Keys, if considered, would repeat
the first column of such a tableau. This tableau, as mentioned, is
imaginary. Should the encipherer or the decipherer actually desire to
make use of a tableau in preference to the slide, he would probably
prefer one in which both his plaintext alphabet and his key alphabet
are running in normal order, so that letters are easier to find. To
form this tableau, he would begin by laying out, in normal order, his
plaintext alphabet and his key-alphabet, and then lay out his 26
cipher alphabets in the manner explained in connection with the
Beaufort alphabets. Each of the four slides of the figure is
accompanied by a partial tableau of this kind, and it will be noticed
there that we have only one case in which the (secondary) cipher
alphabets bear any resemblance to the primary one. This tableau, too,
should be well understood, since the cipher alphabets recovered from
cryptograms will be like those of the figure.

Figure 139

5 10 15 20 25 30
Y V N G K Y E G D P Z E A Y K H S M D Q K K W S J I Q V I O
P E I T E A v c I c c c v

35 40 45 50 55 60
K C F K Q J P M L B J X G K C Z D B G N G Q B D Q M E O N K
I T c v I T H T H E P E c E c E

65 70 75 80 85 90
X T Y A D D D G J R X R X F W G D A Y T Q S G G C G P B Y O
H H I E H A I P H E E v

95 100 105 110 115 120

C L W K C B I C F E Z D G J W K U F K C B U I Z Y B K E K C
T H A T H I I c T H A c E A c T H

125 130 135 140 145 150

G K T A O Q C B Y Q U U F Z G G Z Y F N F M J V Z B L Q J U
E c H v E c c E E v A

155 160 165 170 175 180

V M M J T A E F V S M E N K Q J E I Z Y A L Q Y R X R X F R
v W E v E T c E E W
 185 190 195 200 205 210
O U F V S V V V V P K T B K C G O M I K B Q V Z N B I N A O
c v c v I E T H E v A c c E A H v

215 220 225 230 235 240

C E V V J F V U Z S B K M K C G P M D T K K Y A D D D Y Z C
E c v E A c v T H E v I c H H E H

245 250 255 260 265 270

B T K V S G Q W I T Z D A K P G W B I O N D G R C H P B H U
A M v E c T H A T E E v H I H E

275 280 285 290 295 300

G K T Q H G U V Z N Y X M L H F S M D Q K K W Z Q U D A M T
E c E c c E v v c I c E c H A

305 310 315 320 325 330

Z D B J O P E U L R Y U G K U Z E U S J Z D B O D R E S I O
T H E v E c I T T E T H E E v

335 340 345

R L A B L J R S Z Q Y Q V F L
A L E c c c

* * *

Of our four slides, only the _Type I_ is radically different from the
rest. Since its basic cipher alphabet is not a mixed one, it makes
little difference what has been done to its plaintext alphabet.
Notice, in the partial tableau which accompanies it, that the
difference between one cipher alphabet and another is purely a matter
of alphabetical shift (or of “size,” if we wish to replace all of
these letters with numbers). Properly speaking, this cipher belongs
to the case of the preceding chapter; it is presented here largely as
a warning of what could happen through misuse of the _Type I_ slide.
In the remaining three cases, the sliding alphabet is a mixed one; a
series of frequency counts taken from cryptograms cannot be “lined up”
unless letters can be placed in the right order before these frequency
counts are taken. The “right” order may be the original one of the
cipher alphabet, or an equivalent order in which the original letters
are taken at a constant interval. In these cases, as with any other
periodic cipher, the period is found in the usual way. Individual
frequency counts are then taken on the several cipher alphabets, and
these are examined in the hope of finding a known alphabetical graph;
that is, the graph of some mixed alphabet recovered from previous
decryptments — (but notice also the _C_-alphabet under the _Type III_
slide!). It can also be ascertained whether or not the frequency
counts have followed one common graph, whether any two or more have
followed one graph, and so on. But when it is found that the frequency
counts are those of unknown mixed alphabets, then each alphabet is to
be treated by simple substitution methods. Here, the principles will
still be those of Chapter IX, and we will examine, as briefly as
possible, the mechanical phases of their application.

Our cryptogram, shown in Fig. 139, is already written into its

correct period, 5, with a few substitutions already made, and a few
letters noted as vowels or consonants (_v_-_c_). With the period
determined as 5, and alphabets found to be in an unknown mixed order,
our next step is the preparation of a contact sheet (contact chart,
contact count) for each one of the five alphabets, the usual form
being that shown in Fig. 140. The necessary number of sheets is
prepared in advance by writing the normal alphabet through the
center, and each is numbered to show what alphabet it represents.
It may also carry the numbers of the two contacting alphabets (those
in parentheses in the figure). Then, if the cryptogram is properly
grouped, so that all first letters of groups belong to alphabet 1,
all second letters to alphabet 2, and so on, the putting down of
contact letters is very rapid.

Illustrating with alphabet 2: Start with its first letter, _V_; find
_V_ in the prepared alphabet numbered 2; place on its left side the
_Y_ of alphabet 1; place on its right side the _N_ of alphabet 3.
Pass on to the next letter, _E_: contacts are _Y_-_G_. Pass on to the
third letter, another _E_: contacts are _Z_-_A_. And so on to the end
of alphabet 2. Each contact chart, of course, will serve also as a
frequency count and as a graph. The five graphs should now be
compared with one another in the hope that some two or more may
represent the same alphabet. Such a key-word as DENSE, for instance,
makes use twice of the _E_-alphabet, thus doubling the amount of
material in one of the alphabets. In our present case, it is found
that the five alphabets are all different. Now, just as in simple
substitution, we wish to determine, for each of the five alphabets,
what letters are apparently representing vowels, and what letters are
more likely to be consonants. For this purpose, some of our
“pointers” are still available, and are just as valid as in
Chapter IX.

Figure 140

(5) 1 (2) (1) 2 (3)

YT A EL A
CSNKZYCC B IUKLQIKT B
OO C LE QK C FB
DD D DD ZZUNZDZGDZ D BGAGYAGABB
E RZPCJMAMZY E GAOFNIVUUS
HJN F MVS F
HUPSCCGCCWN G QDPKZOPQWKU G
CK H SP H
J I Q BB I CN
LQBQ J PXER J
QTPWOQ K KCUTKK KGKBGBK K WETMYTW
L RABC L WQQA
SQ M EE VF M JM
O N D N
R O U G O M
O P E HGGJ P MBMB
OT Q SC YGBGI Q VBVWV
OD R EL JXX R XXS
S FQH S MGM
T BKX T YBK
QQ U UD YGOUBK U FIFFVG
SU V MV FVY V NVU
W G W B
RRK X TRR YJ X GM
QRNK* Y VEXUQ Y
 JUTTECP Z EDDDDED G Z Y

(2) 3 (4) (3) 4 (5) (4) 5 (1)

LDDDE A YYKMB YNTY A DOOD A

DDPWTCPQD B GDYYKIHJO A B L L B J
I C F C RZKKKKKGK C
ZGBBGGGBH
D MMBMG D PQQTQ OAA D DDR
K E K E F E Z
UEUUC F KKZVV VXYCX F WENRL F
UDDSDXE G DKJGJRK GBN G KNC Z G G
H B H U LQ H GF
EU I ZZ SBWMV I OKTOO I
M J V BMQGG J RWUTO SVS J IFZ
T K V GAMBMEFWGF K QCCCCQCCPU INYG K YHXB
L UMM L BHR FB L J*
SXPKOMPS M DLJIKDLD A M T M
IEV N GKA O N K ZZFG N GFBY
E O N B O D IJIAAYI O
KCQCNPR
P P KVD P ZKG
LL Q JY T Q H ZZDKYDKD Q
KJMUJKUY
R G R C LFYJ R XXOY
RE S IZ UW S JJ VZVV S MVBG
KK T AQ T MIDJY T QAKZZ
EEV U ZLS U KHJ U VGZ
QUEQVQ V IVZVZF KVVFFJ V ZSSPJS V
KQLK W SKIZ W JF W GK
RR X FF X X
DKZT Y AFAZ QBBAA Y KTOQR ZZ Y BA
Z SWVYUVIFI Z YGYNSCNQQ V Z B

Figure 141

Consideration of Alphabet No. 1

Letter: Frequency: LOW-FREQUENCY CONTACTS VARIETY OF CONTACT

Left Right Total* Left Right Total*
B (v) 7 2 3 5 6 6 12
G (v)(= E?) 11 5 3 8 8 8 16
K (v) 6 2 1 3 5 4 9
Z (c) 7 4 - 4 6 2 8

(*) These observations are not absolute, as in simple substitution.

In Fig. 141 we may see some data and probable conclusions concerning
alphabet 1. By frequency alone, the four letters _B_, _G_, _K_, _Z_,
of this alphabet might all be vowels. When variety of contact is
considered in conjunction with frequency, it is noted that _Z_ shows
no variety on its right. And when contacts with low-frequency letters
are also considered (from information present on sheets 5 and 2; in
the figure, frequencies of 1, 2, or 3 were considered to be low), it
is found that in this respect, too, the letter _Z_ stands apart from
the others. These observations, usually, are mental, and conclusions
for any one alphabet must often be modified by what is seen in other
alphabets. It may be found satisfactory to begin by selecting only
the most _obvious vowel_, or vowels, in each alphabet, and to circle
these, or otherwise indicate them, not only on their own sheets, but
also on the two adjacent sheets where they are found again as contact
letters. When this has been done, the less obvious vowels may be
considered again with an additional “pointer,” whether or not they
show too much contact with the more obvious vowels. Fig. 142 shows,
for each alphabet, the probable conclusions which would be reached
after examining the contact sheets of Fig. 140, and before any
confirmation is attempted. The next step in order is that of
indicating them on the cryptogram itself, and the examination of long
segments in which no vowels have been marked. At this stage, too, the
total number of spotted vowels may be computed to find out how much
of the expected 40% is still missing. Up to this point we have
nothing new, and nothing particularly difficult. Whether or not the
subsequent work is to become difficult depends chiefly upon the
amount of material per alphabet, though granting that the presence of
probable words materially alters the case of the shorter cryptogram.

Figure 142

Conclusions for the Five Alphabets

Alphabet No. Vowels Consonants

1 B G K * Z
2 E D K Q U
3 B G M * V
4 V Z K
5 O C Q

(*) When B and G appear as vowels in two different alphabets,

the graphic appearance of these two alphabets (1 and 3) should
be given another inspection. It happens they are not the same.

If the most frequent of the spotted vowels in each alphabet can be

safely assumed as _e_, the establishment of other vowel-identities
can follow the rules of Chapter IX: The high-frequency vowel which
practically never touches _e_ is _o_; and the one which follows it
is _a_; vowels of lower frequency may precede or follow _e_, but no
vowel should touch it very often. And if, in addition, the most
frequent of the spotted consonants in a given alphabet can be safely
assumed as _t_, then _h_ of the next alphabet will seldom be out of
reach. A very material aid here is found in those _repeated digrams_
(and trigrams) whose letters are already labeled as vowels or
consonants. We find, for instance, _ZD_, alphabets 1-2, occurring
five times, and with both letters already spotted as consonants.
This is very likely to represent _th_, especially when further
examination shows it continued as a repeated _ZDB_, with _B_ already
quite likely to represent the _e_ of alphabet 3. Then the contacts of
_D_, alphabet 2, supposed to represent _h_, have also pointed out a
probable new vowel, _A_, in alphabet 3. Again, we find _KC_,
alphabets 4-5, occurring six times, and with both letters already
spotted as consonants — another probable _th_ — followed three times
by _G_, alphabet 1, already likely to represent _e_, and twice by
_B_, which could thus represent _a_ (the famous English _the_, _tha_).
And similarly we might continue with a long demonstration.

* * *

Returning, now, to our mechanical operations: Dealing, as we are,

with five different alphabets, it becomes imperative that we keep
track of substitutes; otherwise, with all of our numerous trials and
erasures, it is almost impossible to know what substitutes have been
identified and what substitutes are still available for
identification. Also, totally apart from this matter of convenience,
we shall probably want these five lists of substitutes for use on
future cryptograms. This applies to any series of cipher alphabets,
whether or not they are in any way related to one another. But it is
very seldom indeed that a series of cipher alphabets used in the same
cryptogram will be unrelated alphabets. Nearly always, they will have
resulted from the use of a slide, and when this is true, the recovery
of alphabets and parts of alphabets enables us to reconstruct the
slide. The usual plan for recording substitutes is to lay out a
plaintext alphabet in _A B C_ order and then, directly below it, to
rule off several rows of cells, one row for each cipher alphabet.
Thus, any substitute, identified in any alphabet, may be written
directly below its presumed original and on the row which corresponds
to its particular cipher alphabet. We sometimes speak of such a
set-up as a “key-frame” or “key-skeleton,” though a better name,
probably, would be “partial tableau.” (Every row, if completed, will
show one cipher alphabet of the kind we saw in the partial tableaux
of Fig. 138.) Such a “key-frame” for our present cryptogram can be
seen in Fig. 143. At (a) of this figure we have the first tentative
identifications. The most frequent vowel in each of the first four
cipher alphabets has been assumed as _e_ (in practice, the _O_ of
alphabet 5 would also be assumed as _e_). The _ZD_ of alphabets 1-2
and the _KC_ of alphabets 4-5 have both been assumed as _th_, and
after each _th_, we are trying one letter as _a_. The five rows of
this set-up we may now speak of as “alphabets.” At (b) we are
beginning to speculate as to what kind of slide has been used.

Suppose that the cryptogram has been enciphered with a _Type II_
slide. If so, our plaintext alphabet, in the key-frame, is already
arranged like the one on the slide; and when this is true, as may be
seen by glancing back at Fig. 138, the recovered cipher alphabets
will also build up with their letters in exactly the same order as
that of the slide, and, in the end, if fully completed, will show a
picture of the original sliding alphabet taking five of its possible
positions.

Examining the first cipher alphabet of (a), we note that the _lineal_
distance from _B_ to _G_ is 4 positions. If our hypothesis is correct,
then the lineal distance _BG_ will have to be 4 positions in all of
the other alphabets. The third alphabet contains a _B_; measuring 4
positions to the right of this letter, we find that _G_ of the third
alphabet would fall below _i_, and thus would be the substitute for
_i_ in the third alphabet. To see whether or not this is likely, we
return to the contact sheet, where we find that _G_ has already been
spotted as a vowel (see the list in Fig. 142). So far, so good. Then,
the first cipher alphabet of (a) shows the lineal distance _BZ_ as
19 positions. Returning to the third alphabet, and measuring 19
positions to the right of _B_, we find that _Z_, in this alphabet,
would fall below _x_. Examination of the contact chart shows that
_Z_ has not been used in the third alphabet, making it satisfactory
as the substitute for _x_. Still good. Again, the third alphabet
shows the distance _AB_ as 4 positions. Still pursuing our hypothesis,
the first alphabet must also contain an _A_ standing 4 positions to
the left of _B_. If so, it will fall below _w_, and the frequency of
_A_, in the first alphabet is found to be 2, which is satisfactory as
that of _w_. With _G_ and _Z_ added to alphabet 3, and with _A_ added
to alphabet 1, we may now turn our attention to alphabet 4, which
contains a _Z_, and, by making similar observations there, we may add
to the 4th cipher alphabet the letters _A B G_, and, to the 1st and
3d alphabets, the letter _K_. Thus we arrive at (b) through what is
ordinarily referred to as the “symmetry of position” existing among
the several cipher alphabets.

Figure 143

(a)
a b c d e f g h i j k l m n o p q r s t u v w x y z
1 - B G Z
2 - E D
3 - A B
4 - Z K
5 - C

(b)
a b c d e f g h i j k l m n o p q r s t u v w x y z
1 - B G K Z A
2 - E D
3 - A B G K Z
4 - Z A B G K
5 - C

But the second and fifth alphabets cannot yet be combined with the
other three, since neither of these contains any letter in common
with them, and thus we have no point from which to measure lineal
distances. We know, however, that if our hypothesis is correct, the
letters _A B G K Z_, in these alphabets also, will be found at
exactly the same lineal distances as before. It would be possible to
prepare a sort of slide on which these letters, written twice in
succession, are spaced as in the other three alphabets, and use this
in experimenting with alphabets 2 and 5.

The cryptogram, as we first saw it, showed all substitutions which

are possible from (b) of Fig. 143, together with a few _v_-_c_
notations which were listed in Fig. 142 but not further investigated.
In case the student cares to complete solution, he might refer to
certain precautions mentioned at the beginning of the chapter.
Notice, in the last figure, the lineal distance from _G_ to _K_;
what letters would you feel inclined to try in the three intervening
positions? Or notice the distance _BG_. What letter is very likely
to have been taken here for use in the key-word, and where is it
likely to stand in that word? If the index-letter was _A_, does it
seem possible that the _a_-substitutes could all be selected in
advance directly from the contact sheets? Would this be possible if
the encipherment process were varied so that an index, selected in
the sliding alphabet, were brought to stand below keys in the
stationary one? The cryptogram is known to contain the word SUPPOSE,
and the period is 5. Is there any room here for _pattern_ methods?

* * *

Our _Type II_ slide, then, unlike the remaining three, builds up
automatically in the key-frame, _owing to the simple fact that we
are able to set down the plaintext alphabet in the encipherer’s
original order_. The method of solution, so far as we know, was
first published (1883) by Auguste Kerckhoffs, who seems to have
originated the term “symmetry of position.” The invention of the
cipher is credited to “a member of the (French) Commission on
Military Telegraphy.”

If these parallel cipher alphabets are to be avoided in the

key-frame, but still using a _Type II_ slide, General Sacco has
suggested that the encipherment process be altered as follows: Let
the index-letter and the key-letter both be found in the upper
alphabet. Slide the plaintext letter to stand below the index-letter,
and use the substitute which will then be standing below the
key-letter. This, of course, would have to be letter-by-letter
encipherment, and represents one of those rare cases in which a
slide is less convenient and rapid than its equivalent tableau. If
this tableau be laid out in full, as explained for Beaufort alphabets,
it shows, on its 26 rows, 26 cipher alphabets not one of which appears
to be at all related to the others. One of these (the one in which
index-letter and key-letter are the same) will be the normal alphabet.
We may find the original sliding alphabet, however, by looking at
_columns_. Such a tableau is exactly equivalent to the _Delastelle
tableau_ if the _Z_-alphabet be made the normal one. Delastelle’s
tableau was described as follows: Using the mixed alphabet, fill in
the tableau by columns, beginning each column with whatever letter,
in the mixed alphabet, follows the plaintext letter shown above the
column. This causes the final alphabet to come out in _A B C_ order.
The Delastelle tableau is not nearly so easy to reconstruct as that
of the ordinary _Type II_ slide; the method, however, will be plain
enough when we have understood the reconstruction of _Types III_ and
_IV_.

* * *

The _Type I_ slide, as pointed out in the beginning, is somewhat out

of place in the present chapter; every frequency count will follow
the graph of the mixed plaintext alphabet, so that all can be “lined
up” by their common pattern. Having letters, and not numbers, the
“top” of a frequency count may be anywhere; it is usually best to
prepare at least one of the frequency counts of double length in
order to effect the alignment. Granting, however, that for some
reason the common pattern of the frequency counts has not been
recognized, then the method of decryptment would be exactly the same
as for any other case of mixed alphabets.

Fig. 144 shows the development of the key-frame in this case. At (a),
some substitutes have been correctly identified in each of four cipher
alphabets. But long before reaching this stage, the most careless of
decryptors must have noticed that the difference between any two
cipher alphabets is purely a matter of alphabetical shift. This is
particularly visible as between alphabets 3 and 4, where the
alphabetical interval is only 1; examination of alphabets 1 and 2
shows that wherever both substitutes are present, their alphabetical
difference is 14; and further examination shows that the alphabetical
distance from alphabet 2 to alphabet 3 is 17. The use, here, of a
Saint-Cyr slide enables us to arrive very quickly at (b). The
alphabets of (b) are, of course, secondary cipher alphabets, and the
primary one obviously runs in normal order (or, at worst, in a
strictly methodized order which is easily obtainable from the normal
one). What we still lack, in order to reconstruct the slide, is the
mixed plaintext alphabet, and this can be recovered as at (c). Write
out the normal alphabet (known to be the original cipher alphabet),
then, using any one of the secondary alphabets, place originals above
their substitutes wherever these are known. In the given example, all
missing letters can be filled in by alphabetical sequence; and even
though the index-letter was one of low frequency, and thus was not
used in the message, the student should have no trouble whatever in
discovering the key-word which governs the four cipher alphabets.

* * *

In considering the reconstruction of the remaining two slides, we

shall have to keep clearly in mind the _imaginary tableau_ on which
the plaintext alphabet has exactly the order of the one on the slide,
so that cipher alphabets, also, have exactly the order of the one on
the slide, and are shifted one letter at a time, as in the Vigenère
tableau. For one thing, we are going to call some of these alphabets
by numbers, or refer to them as odd-numbered and even-numbered
alphabets. Thus, with the alphabet we have been using, the _first_
alphabet in the imaginary tableau is position 1 of the slide:
_C U L P E R Z Y X W V T_. . . . . . , the _second_ alphabet is
position 2 of the slide: _U L P E R Z_. . . . . . . , the _third_
alphabet is position 3 of the slide: _L P E R Z Y_. . . . . , and so
on to the _26th_ alphabet, which is the final position of the slide:
_A C U L_. . . . . But over and above this, it must be remembered
that _the columns of this imaginary tableau are duplicates of the
rows_, just as they are in the Vigenère tableau. We do not, of course,
recover any of these alphabets in the order mentioned, since our
plaintext alphabet of the key-frame must necessarily be arranged in
its _a_-_b_-_c_ order. For instance, the _fourth_ alphabet, which,
in the imaginary tableau, begins with its key-letter, _P_, and runs
in the order _P E R Z Y X W V T_. . . . . , comes out in one of our
examples (_Type III_ slide) as _L U P C Y A B D_. . . . . , and in
the other (_Type IV_ slide) as _E W Y P V T S_. . . .

Figure 144

The Alphabets from a TYPE I Slide:

(a)
a b c d e f g h i j k l m n o p q r s t u v w x y z

1 - L . . J Q . H G F . . . . B A . . R Y X . . . . . .
2 - Z . . . E . . . T . . C Q . O . . . . . B . . . . .
3 - Q P . O V N . . . . I . . G F U . . D C . B A . Y .
4 - R . . P W . . M L . J . . . G . . . . D . . . . . .

(b)
a b c d e f g h i j k l m n o p q r s t u v w x y z

1 - L K . J Q I H G F . D O C B A P . R Y X N W V . T .
 2 - Z Y . X E W V U T . R C Q P O D . F M L B K J . H .
3 - Q P . O V N M L K . I T H G F U . W D C S B A . Y .
4 - R Q . P W O N M L . J U I H G V . X E D T C B . Z .

(c) Alphabet No. 1:

Plaintext: o n m k . i h g f d b a . u l p e r . y . w v t s .
CIPHER (Rearranged): A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

* * *

The _Type III_ slide is, in many respects, the most interesting
member of its family. With every alphabet taking exactly the same
order (that is, the plaintext alphabet, the key-alphabet, and all
cipher alphabets in the imaginary tableau), it parallels the Vigenère
in every particular except the order of the 26 letters. It has a
corresponding Beaufort form, and a corresponding variant in which
complementary keys are based on the order of the mixed alphabet. Its
14th alphabet, like the _N_-alphabet of the Vigenère, is reciprocal
throughout. And its first alphabet, like the _A_-alphabet of the
Vigenère, is a duplicate of the plaintext alphabet. This was pointed
out in connection with the slide of Fig. 138, where key-letter and
index-letter were both _C_. There are two ciphers, then (the _Type
III_ slide and the Delastelle tableau), in which we are sometimes
able to find, among a number of mixed frequency counts, a single one
which follows perfectly the graph of the Vigenère _A_-alphabet.
Concerning the 14th alphabet, however, we are dealing altogether,
here, with a 26-letter alphabet; and some of what follows is being
explained on the theory that the number 26 contains no factors other
than 2 and 13. If the student will give his careful attention to
_reasons_, as well as to methods, he will be able to adjust these
methods to alphabets of other lengths, as, for instance, the very
common 25-letter alphabet met with in foreign texts. The first
alphabet, of course, duplicates the plaintext alphabet regardless of
what alphabet-length is being considered, and thus, whenever a
_Type III_ slide has been used, we are always in full possession of
one of the cipher alphabets.

Figure 145

The Alphabets from a TYPE III Slide:

Behavior of an EVEN-NUMBERED Alphabet

1st Alphabet (Always normal): A B C D E F G H I J K L M N O P Q R S T U V W X Y

Z
4th Alphabet: L U P C Y A B D F G H R I J K Z M X N O E Q S T V
W

For an EQUIVALENT SLIDE, follow the chain AL-LR-RX-XT-TO......

A L R X T O K H D C P Z W S N J G B U E Y V Q M I F
L R X T O K H D C P Z W S N J G B U E Y V Q M I F A
(1)........... ═ ═ ═
(2)................. ═══ ═══ ═══ ═══ ═══

To find the ORIGINAL SLIDE from the EQUIVALENT one:

 (1) Either take letters constantly at interval 9, which is the interval V-W-X:

R Z Y X W V T S Q O N M K J I H G F D B A C U L P E (R)
X W V T S Q O N M K J I H G F D B A C U L P E R Z Y (X)

(2) Or: Spread the letters apart so that the alphabetical sequences K(JI)H,
Z(YX)W,
etc. are standing at the right interval, always maintaining the alphabet-
length,
26, and intertwine. Both alphabets are the same in this slide:

(The interbals A . . L . . R . . X . . T . . O . . K . . H . . D .
are always odd, . C . . P . . Z . . W . . S . . N . . J . . G . . B
3, 5, 7, etc.) . . U . . E . . Y . . V . . Q . . M . . I . . F . .

Behavior of an ODD-NUMBERED Alphabet

1st Alphabet: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
3d Alphabet: U C L A Z B D F G H I E J K M R N Y O Q P S T V W X

1st HALF-CHAIN: 2d HALF-CHAIN:

A U P R Y W T Q N K I G D (A) B C L E Z X V S O M J H F (B)

Spread the letters of each half, trying interval 2, interval 4, interval 6, and
so
on, treating both halves alike, until the intertwining of the two will set up
some
alphabetical sequences:

. A . U . P . R . Y . W . T . Q . N . K . I . G . D
B . C . L . E . Z . X . V . S . O . M . J . H . F .

Now, granting that we have completed the decryptment of a message, we

have before us a key-frame in which several cipher alphabets are at
least partially recovered. With one alphabet fully known in advance,
the recovery of another full alphabet usually enables us very quickly
to restore the original slide, or an equivalent slide. The ideal case
is that in which we recover one of the even-numbered alphabets (except
No. 14). The recovery of an odd-numbered alphabet will, at times,
leave us with thirteen possibilities; while the recovery of the 14th
alphabet could be useless, provided we have no other information. The
method of reconstruction can be followed in Fig. 145.

First, we have the perfect case, one in which an even-numbered

alphabet (the 4th) has been recovered in full. We begin by writing
this recovered cipher alphabet letter for letter below (or above)
the one which is always known to us; thus the two substitutes for
_a_ are in a same column, the two substitutes for _b_ are in a same
column, the two substitutes for _c_ are in a same column, and so on.
The columns themselves are not in their original order, but the two
alphabets, throughout, are running parallel, just as they would in
the imaginary tableau, and thus the _columnar distance is uniform_
which separates each pair of substitutes; that is, the _vertical_
distances _AL_, _BU_, _CP_, _DC_, _EY_, etc., are all equal in the
imaginary tableau. If these be rearranged in such a way that the
last letter of each pair is the beginning letter of the next, we
have a chain _AL_-_LR_-_RX_-_XT_-_TO_-_OK_. . . . . made up entirely
of equal vertical intervals, from which the repeated letters may be
dropped: _A L R X T_. . . . . , leaving us a series of 26 letters
known to be equally spaced in the columns of the tableau. Then,
remembering that the columns of this tableau are duplicates of its
rows, we have also a series of 26 letters known to be equally spaced
on the rows. That this series of letters, _A L R X T_. . . . ,
_sliding against itself_, produces exactly the results of the
original series, the student may ascertain for himself; also that a
number of other _equivalent slides_ can be formed by taking letters
of this series at any constant interval which is not divisible by 2
or 13. The total number possible is eleven, of which one was the
original. An equivalent slide, of course, is all that we actually
need for enciphering and deciphering cryptograms. But where
alphabetical sequences existed in the original alphabet, two methods
are shown for obtaining it without writing out the entire eleven
possibilities: (1) Find, at some constant interval, the letters of
an alphabetical, or nearly alphabetical, sequence, as the (reversed)
_V W X_ of the figure, standing at interval 9; the taking of all
letters at this interval brings back the original order. (2) Find
pairs of consecutive letters, as the (reversed) _HK_, _WZ_, _GJ_,
which, if all spread apart to the same extent (some odd interval, as
3 of the figure), would then be standing at their normal alphabetical
intervals, or nearly so. Lay out the 26 positions, and spread the
entire alphabet, maintaining the common interval even after the 26th
position is reached. The figure shows this on several rows; in
practice, there is only one.

If the recovered alphabet is an odd-numbered one, the same plan is

followed, but results in a chain of only 13 letters; it is necessary
to begin with some other letter, not included among the first 13, and
form another 13-letter chain. Having absolutely no additional
information, we cannot combine these two halves with certainty unless
the original alphabet contained some alphabetical, or nearly
alphabetical sequences. Presuming that it did, the method ordinarily
described for combining the two halves is that of the figure. Spread
the letters of the two halves (plan 2 of the preceding case),
treating both halves exactly alike, until a point is found at which
the two halves can be intercombined to show alphabetical sequences.

For this case, however, George C. Lamb, the author of Chapter X,

suggests another plan which would seem to be more direct and less
troublesome than the standard one. Lamb, incidentally, is to be
congratulated here for his entirely new observation: If the two
half-chains can be properly adjusted with reference to each other,
_each pair of letters, regardless of the order, will be a digram
belonging to the original mixed alphabet_. The reason for this
division into halves, of the odd-numbered alphabets, is probably
self-evident: One half contains only odd letters (1-3-5-7-9.
. . . . . . . .) and the other contains only even letters
(2-4-6-8-10. . . . . . .). If both halves were recovered in this
order, and if one half were written directly below the other with
letters 1-2 standing together, then the other pairs would also be
standing together: 3-4, 5-6, 7-8, and so on. We seldom recover them
in straight order; but whatever rearrangement has taken place in one
of the halves has taken place, also, in the other half; should one be
recovered with letters in the order 1-7-13-19-25-5-11. . . . (each
third letter in a series 1-3-5-7. . . . .), then the other will be
recovered with letters in the order 2-8-14-20. . . . . . (each third
letter in a series 2-4-6. . . . . .), though neither half necessarily
begins with the first letter of its series. If, then, we are able to
place together letters 1-2, the other pairs will also be adjusted,
perhaps in the order 1-2, 7-8, 13-14, 19-20, and so on. These pairs
may then be taken at some regular interval and will bring back the
original order 1-2, 3-4, 5-6, and so on.

Figure 146

Another Method for Combining the two Half-Chains of an Odd-Numbered Alphabet

(Originated by GEORGE C. LAMB)

With a Type III slide, based on the key-word EXCORIATE, the 7th alphabet, as
recovered from a cryptogram would come out as shown: H K B L A M N P........

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
H K B L A M N P G Q S U V W D Y Z F E J X C O T R I

The second half-chain, started with D, must be re-adjusted so as to plece in

correspondence the alphabetical sequences PQ, YZ, FG, MN, etc.

1st HALF-CHAIN: A H P Y R F M V C B K S E
2d HALF-CHAIN: (d l u x) T J Q Z I G N W O D L U X

Each corresponding pair of letters was a digram in the original cipher alphabet.
Taking some two letters, as FG, which form an alphabetical sequence, look for
another pair, such as HJ, which may be its continuation. HJ having been found
at the interval 9, try taking pairs at the interval 9:

FG HJ KL MN PQ SU VW YZ EX CO RI AT BD (FG)

Lamb’s method, applied to an actual cipher alphabet, can be seen in

Fig. 146. The first half-chain, if started at _A_, will include the
letters _B_ and _C_, so that the second half-chain would probably
have been started at _D_. But _AD_ will not be a correctly adjusted
digram. It is necessary to look for one which forms an alphabetical
sequence, as _FG_; and when the two halves are adjusted so that _F_
and _G_ are together, other alphabetical, or nearly alphabetical,
sequences are also found to be adjusted, as _MN_, _VW_, _BD_, _KL_,
making it likely that we have found some digrams belonging to the
original mixed alphabet. With this adjustment reached, it is found
that pairs can be taken at the constant interval 9,
_AT_-_BD_-_FG_-_HJ_. . . . . , thus bringing back the original cipher
alphabet.

Presuming that the original alphabet did not contain these

alphabetical sequences, then there are thirteen possible adjustments
for the two half-chains, and any one of these could be the original
alphabet (or its equivalent). But it must not be forgotten that in
an actual case our key-frame always contains portions of other cipher
alphabets; and if the foregoing principle has been well understood,
it may be readily seen how we could make use of these in order to
determine which of the thirteen possible adjustments is correct.
Even the recovery of the 14th cipher alphabet (which results in
thirteen 2-letter chains), would not be useless with this other
information present always in every key-frame. The _Type III_ slide,
in fact, can often be reconstructed without possessing any fully
recovered cipher alphabet. This cipher is very popular with members
of the American Cryptogram Association, and is usually known, for no
very good reason, as “the Quagmires cipher.”

* * *

In the case of the _Type IV_ slide, we do not begin reconstruction

with one complete cipher alphabet already in our possession. It
becomes necessary that we recover two, the perfect case being that
in which one is an odd-numbered alphabet and the other an
even-numbered one. We will follow this case in Fig. 147, where the
two recovered alphabets are Nos. 4 and 7. This tableau, like the
preceding one, has columns which are duplicates of its rows, and to
see our preceding case again (with its one modification), let us
begin by looking only at the three alphabets immediately below the
heading. One of these, the plaintext alphabet, shown in lower-case
letters, we will disregard for a moment, giving our attention only
to the two cipher alphabets.

Figure 147

The Alphabets from a TYPE IV Slide:

Plaintext letters: a b c d e f g h i j k l m n o p q r s t u v w x y z
(1) 4th Alphabet: E W Y P V T S Q O N M K R J I H G F Z D X B A C U L
(2) 7th Alphabet: Y S V Z Q O N M K J I H X G F D B A W C T U L P E R

A CHAIN Started with ab

ab ys vd qx nt jp gl bi sf du xm tz pw lr io fk uh me zc wa ry ov kq hn ej cg
(ab)
EW UZ BP GC JD NH SK WO ZT PX CR DL HA EF OI TM XQ RV LY AE FU IB MG QJ VN YS

REARRANGEMENT of this CHAIN:

ab bi io ov vd du uh hn nt tz zc cg gl lr ry ys sf fk kq qx xm me ej jp pw wa
EW WO OI IB BP PX XQ QJ JD DL LY YS SK KF FU UZ ZT TM MG GC CR RV VN NH HA AE

A Reconstructed EQUIVALENT Slide:

Plaintext: a b i o v d u h n t z c g l r y s f k q x m e j p w
CIPHER: E W O I B P X Q J D L Y S K F U Z T M G C R V N H A

ORIGINAL Slide, Found by Taking Letters at the Interval 5:

b u c s m a d z y x w v t .......
W X Y Z R E P L U C A B D .......

These two alphabets, like the two from the Type _III_ slide, are
running parallel in the imaginary tableau, so that we have, as
before, a series of 26 _vertical_ distances, _EY_, _WS_, _YV_, and
so on, all known to be equal in the columnar direction and therefore
known to be equal distances on any row. A chain may be started,
exactly as in the other case, _EY_, _YV_, _VQ_, _QM_, _MI_. . . . . ,
resulting in a series of equally-spaced letters _E Y V Q M I F A L R_.
. . . . . which is either the original cipher alphabet, or the
original one with letters taken at some odd interval other than 13.
It is, however, only the _cipher alphabet_; the mixed _plaintext
alphabet_ must still be found. This may be done, as in the case of
the _Type I_ plaintext alphabet, by using either of the two cipher
alphabets which were first recovered and setting originals above
their substitutes. If this is done with our cipher alphabet in the
order _E Y V Q M I F A L R_. . . . . . , then the plaintext alphabet
comes out in the order _a c e h k o r w z m_. . . . . . , and we have
an equivalent slide. If we first rearrange the sliding alphabet (each
9th letter of the series _E Y V Q_. . . .), we obtain the plaintext
alphabet also rearranged.

Continuing, now, with the rest of our figure: The method we have just
seen was based on a tableau, and our equal intervals were all
vertical. In the figure, we are dealing purely with horizontal
distances, and our method is based, not on a tableau, but on a
_slide_ (as it was with the _Type II_). Our 4th and 7th (secondary)
cipher alphabets, after all, are merely two different positions of
the same slide. If we select any two letters, as _a_ and _b_ of the
plaintext alphabet, and find that their substitutes are, respectively,
_E_ and _W_, in alphabet 4, then the lineal distance _ab_ in the
stationary alphabet must be exactly equal to the lineal distance _EW_
in the sliding one; if this were not true, the letters could not have
coincided as they do. Then, if we find the same substitutes, _E_ and
_W_, in alphabet 7, and note that, in this position of the slide,
they have coincided, respectively, with plaintext letters _y_ and
_s_, then the distance _EW_ in the sliding alphabet must be exactly
equal to the distance _ys_ in the stationary one. It follows from
this that _ys_ and _ab_ are equal in the stationary alphabet. If we
begin again with the lineal interval _ys_, we find that this is equal
to _UZ_ of alphabet 4, and that _UZ_, found again in alphabet 7, is
equal to _vd_. Here, then, is another interval, _vd_, which is equal
to both ab and _ys_. And so we may continue, forming a chain made up
of these known equal intervals, _ab_, _ys_, _vd_, _qx_, etc., for the
plaintext alphabet, and _EW_, _UZ_, _BP_, _GC_, for the cipher
alphabet. Sometimes we return to _ab_ (_EW_) without having included
all 26 letters, and in that case (unless the number of letters
included is a divisor of 26), it becomes necessary to abandon _ab_,
and try starting with some other interval, as _ac_.

Figure 148

Some EXERCISES in the RECONSTRUCTION OF ALPHABETS

Plaintext ....... A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Exercise 1: Q * Z A X B O C N * E R F P V G * Y M U I * W * T L

Exercise 2: U V D W S X K Y H Z C F R J Q L I N G P T O M E A B

Exercise 3: H J G K F P E Q O R S T D M B U V W X A Y Z C L I N

Exercise 4: (1) V N U X J Y Z D Q E M P O W C K R I A T L S B F G H
(2) H S G J R K L N F P Q B U I V A W C X Y T Z D E M O

Exercise 5: (1) G X Y Z M H A F T R L K E V Q U O J W I P N S B C D
(2) E * G J I K * L B * * U T C V W * Q D X S * * * * *

The keywords, all selected by Mr. A. F. SEMPER, do not contain any

 repeated letters. The TYPES of slide, respectively, are: I, III, III,
IV, and III. In the 5th exercise, the completely recovered alphabet
is a "number 14." (See also practice-cryptogram No. 46).

Here, as in the case of the _Type III_ slide, we sometimes obtain two
13-letter chains; but in the fortunate case of having recovered in
full both an odd-numbered and an even-numbered cipher alphabet, we
end the chain with every letter represented twice, both in the
stationary alphabet and in the sliding one. Pairs of letters
(representing horizontal intervals) can then be rearranged as in the
other case, the second letter of one becoming the first letter of the
next (in both series), and the dropping out of duplicated letters
gives us an equivalent slide. In the figure, starting with _ab_
(_EW_), we find a plaintext alphabet _a b i o v d u_. . . . . and a
cipher alphabet _E W O I B P X_. . . . . . This, as mentioned, is one
of eleven possible equivalent slides, of which one is the original.
Here, the original can be found by taking letters at interval 21. In
the figure, letters were taken at interval 5, a result of observing
the sequence _W X Y Z_ standing at that interval in the lower
alphabet, and the slide comes out in reverse order. This is still an
equivalent slide, and the decryptor may or may not care to decide
which alphabet runs backward.

Since the reconstruction of these mixed-alphabet slides is probably

the most fascinating subject in the whole field of cryptanalysis,
several problems are being appended in Fig. 148. In all of these,
Semper has selected key-words or phrases to contain no repeated
letters. With reference to the practice cryptograms, only one of
those submitted was thought to have enough alphabet-length for purely
analytical attack. The others, even with their probable words or
partial translations, will still require some work. The periods of
these examples are said to be, respectively, 6, 7, 8, 3, and (?).

135. By NEMO. (Type II. Partial solution: WHEN JACK BOOMER,GREEN RIVER,WYO,B..)

T E R P J Y D B N Q S A I M B X B L Y M D O B I T Z P T I H K O K A G
M Y Q R X T D W U U X B O B Q Y D B W Z S V Z G C U P R Z S W V O D M
T Q Z C A T S M Y Q F D B H Z Q U T I H F S V S Y N F U L Z G L B G D
M T R M U C N A J M I Y N Q O F B D P Q L G X U Y W U I P C A Y N J N
X S B K W I J G R L G I B.

136. By NEMO. (Type III. Partial solution: ALOIS STEPHEN,YOUNG VIENNESE CHARGED
W..)

H G K S T I L O Y D B O L E G A Z N G P D U W P B D R V Z Q Y Z X F L
Q S B H S L T U Q P S Z G X V A Y T G B C B X K H U R I E D M D X B T
O E P S A R I N K X K J B I T P Y I X R I U Z Y O M I M H P H B E J D
N E B S E F L B F D B H F J B F N L G P L J M I B O G T A W D U E Q E
Z T Y U S I.

137. By THE SQUIRE. (Type III. Probable words: AMERICAN CONSTITUTION.

GLADSTONE).

H T F M R S R T Y E O V P D S Z L A X B A C N T N A K X R C S Z K G O
Q U O F A Z R E T D S V I W K W T E L K F R P R B I H I N A S W R R S
B O H T F L A D D L U B U F M Q O J A G I L I D W T Z I M M R H L L V
K W U J S.
138. By ALII KIONA. (Is this a diplomatic telegram?)

L L D R K Y C R F A S E V S U K T D U L X V K E V C A B L Y U P Y M R
K B E X U B T E L W P J F P T I I U Q Q K T F C T P S K Q L W N D A P
B F A E S N M P R K A P T T S H F K B Z R M G P P Y V M S A I F N P Z
A L T S U S A U D N L X A A Z Y P U C H K N P Y V M S I A X K K D B E
T P S A T P K P S Y V T A Y E A P B T E L W P J F P T A X N.

139. By PICCOLA. (This is a straight-alphabet cipher. Won't tell which one!)

A N D N Y L M Y X N K D L R P G C X G Q N A A R Z L D E P L G I A W Q
N E I O G A G P Q G Z V D E I E Z R H A Y P L B P N A G E L N V A G T
D H O K H V G T I N D O L S F C P L R T.

CHAPTER XIX
Polyalphabetical Encipherment Applied by Groups

Any one of the multiple-alphabet ciphers may change keys at each new
group instead of with each consecutive letter. As a rule, this kind
of encipherment is never found except in connection with very simple
ciphers, and the intact plaintext groups, each one standing on its
own key-line, are readily discovered by the decryptor who takes the
precaution of cutting out a segment from his cryptogram and “running
down the alphabet,” first treating the original letters and then, if
necessary, their complements. Porta encipherment, in any form, is
rare, but its cryptograms can be subjected to the same process,
provided the letters of the tested segment are first enciphered in
the _AB_-alphabet, and the subsequent extensions properly carried out.

Figure 149

The "PHILLIPS" Cipher

1 C U L P E* 2 R Z Y X W 2 R Z Y X W 2 R Z Y X W
2 R Z Y X W 1 C U L P E* 3 V T S Q O 3 V T S Q O
3 V T S Q O 3 V T S Q O 1 C U L P E* 4 N M K I H
4 N M K I H 4 N M K I H 4 N M K I H 1 C U L P E*
5 G F D B A 5 G F D B A 5 G F D B A 5 G F D B A

(1) (2) (3) (4)

Plaintext: T R Y M A....... C D O N A....... L D O N T....... H A T M U..
CIPHER: K T Q D C....... T X N F R....... I X C F L....... C R K L D..

2 R Z Y X W 3 V T S Q O 3 V T S Q O 3 V T S Q O
3 V T S Q O 2 R Z Y X W** 4 N M K I H 4 N M K I H
4 N M K I H 4 N M K I H 2 R Z Y X W** 5 G F D B A
5 G F D B A 5 G F D B A 5 G F D B A 2 R Z Y X W**
1 C U L P E* 1 C U L P E* 1 C U L P E* 1 C U L P E*

(5) (6) (7) (8)

..... R P H Y P....... R O P O S....... I T I O N....... C U R L
Y.
..... T W G Q W....... M R O R X....... W K W N Z....... T S U Q
P.
With mixed alphabets of any kind, a number of cases may arise,
according to whether groups are of uniform length, or of varying
lengths, or, in fact, represent word-lengths; or, in the one case of
uniform groups, according to the length of these groups, or the
amount of material available, or as to how much is known in advance,
and so on. From among so many possibilities, suppose we select the
case of accumulated short messages, and, at the same time, take a
brief look at a cipher which, according to its description, was
actually intended for group-by-group application. This cipher, which
may be examined in Fig. 149, was described in an early issue of
_The Cryptogram_ as having been used for military purposes, and was
called the “Phillips” system. The text of the figure “Try Macdonald
on that Murphy proposition. Curly” includes eight five-letter groups,
thus requiring eight cipher alphabets. The key, as originally prepared,
is a mixed 25-letter alphabet written into a 5 x 5 square, of which
the five rows can be cut apart to form five horizontal strips. It may
also be set up with anagram blocks. This is alphabet 1 (or block 1),
and serves to encipher the first five-letter group. The method of
substitution will be explained in a moment. Alphabet 2 (block 2) is
derived from the first by moving line 1 so that it stands between
lines 2 and 3. Alphabets 3, 4, and 5 are derived by continuing to
move the original line 1 so that it stands, successively, between
lines 3 and 4, between lines 4 and 5, and at the bottom of the square.
Alphabets 6, 7, and 8 are derived by moving the original line 2
according to the same plan. For puzzle purposes, these movements may
continue as they apparently began. Line 2 may be given its one
remaining shift, which places it at the bottom of the square, and
lines 3, 4, and 5 may then be moved downward in the same way as the
first two; some puzzlers, in fact, will afterward continue by treating
columns. But according to the description (the only one the writer has
ever seen of this cipher), the eighth cipher alphabet is the last. For
the encipherment of the next eight groups, either the square is
restored to its original set-up and the same eight alphabets used
again, or the first key is abandoned altogether in favor of an
entirely new one.

Now, considering any one block, as No. 1, the method of substitution

is as follows: Each letter is to be replaced by the one standing
immediately to its right on the descending diagonal. If the given
letter happens to stand at the extreme right side of the square, it
is to be replaced by one standing at the extreme left and on the next
line below. If it happens to stand on the bottom row of the square,
it is to be replaced by one standing on the top row and in the next
column to the right. One letter, in fact, requires both of these
(mental) adjustments; the letter which occupies the lower right-hand
corner is to be replaced by the one occupying the upper left-hand
corner. If the foregoing is well understood, is is quite obvious that
our key-square is, to all intents and purposes, a rhombus formed with
five diagonals. One diagonal is complete, as _C Z S I A_ of block 1.
The other four break off at the right and are continued from the left,
as _L X O N F_ of block 1; or, if you prefer, break off at the bottom
and are continued from the top, as _N F L X O_ of block 1. It should
be obvious, also, that any one of these five diagonals can be
considered as beginning with any one of its five letters without in
the least changing the encipherment. Thus, each diagonal furnishes
what is called _cyclical encipherment_. But, as a matter of fact, the
entire square involves cyclical encipherment: The placing of line 1
at the bottom of the square, or of column 1 on the right side of the
square, or the transfer of several lines or columns, or of both, will
not have any influence whatever on substitutes; for this, it is
necessary to alter the 1-2-3-4-5 order of these rows or columns.
Alphabet 5, then, will be the same as alphabet 1; and if the plan of
the puzzlers be followed, this same alphabet continues to reappear
for the encipherment of each fourth group, blocks 1, 5, 9, 13, 17,
and so on, of a long cryptogram, eventually giving a great deal of
material in one cipher alphabet. Moreover, groups having a length of
five letters will carry some very visible simple substitution patterns.
Now suppose we look at Fig. 150.

These eight cryptograms have all come from one source. The general
frequency count has shown a missing letter, _J_, suggesting the use
of a square, and we have suspected the cipher as “Phillips.” With
cryptograms arranged one below another, as shown, the first five
columns are presumably enciphered with block 1 of that cipher, the
next five columns with block 2, and so on; thus, we presumably have
40 letters each belonging to alphabets 1, 2, and 3, and almost that
number belonging to alphabet 4, that is, enough material for frequency
counts which will show whether or not they have been taken on simple
substitution alphabets. While 40 letters of text are very few, we
could, eventually, solve any simple substitution cryptogram of that
length, or any mixed-alphabet periodic whose alphabets have furnished
40 letters each. In the present case, our first alphabet has furnished
eight known word-beginnings; we have one column known to contain only
initials, and followed by two others which are very likely to be the
hiding-place of vowels. This does not mean that we should have no
preliminary struggles, but in the end there are plenty of clues to
set us on the right road: The predominant letters of alphabet 1 are
_A_, _B_, _O_, _K_, _U_ (practically sure to contain _e_, _t_, and
one of the vowels _a_ or _o_). The column of initials repeats both
_A_ and _T_ (to be compared against a list _t s a_. . . .). The
second and third columns, combined, include _B_ and _O_, three times
each, with _O_ found in the initial column also (both could be vowels,
and _O_ probably represents _a_, though _i_ is also frequently found
as an initial). If _A_, by frequency and initial position, be tried
as _t,_ then the other repeated initial, _T_, can be tried as _s_.
This assumption brings out, in the fourth message, a pattern
_s_ - _t_ _t_ -, in which the second letter, _B_, would have to be a
vowel, either _e_ or _o_, since it has been doubled, with _e_
appearing more likely in the given pattern and also in that of the
sixth message, _s_ - - - _s_. The letter _O_, which under the
encipherment scheme could not possibly be its own substitute, can be
assumed, by frequency, as _a_, rather than _i_.

Figure 150

1. A F S X O S G Y F O N P Y O A K O A D G F Z K S Z O Y Z Y L A W A C F.

2. H O U A L H L E D H D L Y G A V D W A K.

3. K O N B K A X U O N H I Q P L B A Z F F S Y F D R R L Y F.

4. T B A A M A F Q E Z U M A I X G F S K B.

5. D K O A C Y B Y E N I M O W D L E G A D O H C Y U U R G.
 6. T B B X T O M M D A S I A A Y D Z.

7. O U S U B U L O I Y G A K X M A K W E L.

8. A K R U W A N A L O N N F M S K A X E U.

General Frequency Count:

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
25 8 3 10 6 11 7 5 5 . 11 10 7 7 15 2 2 4 8 3 10 1 5 6 12 6

Frequency Count on Alphabet 1, Only:

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
6 5 1 1 . 1 . 1 . . 4 1 1 1 5 . . 1 2 3 4 . 1 2 . .

These first correct substitutions are all shown on the left side of
Fig. 151, on the lines marked (a). Surely the next identification
would be the _m_ of _seems_, and probably, too, the _l_ of _settl_. . .
With the vowel _a_ already identified, the repeated _OU_ would be
tried as _an_, and the repeated _KO_ as _ha_, using the digram list.
These are the substitutions marked (b), and from this it is but a
step to the assumptions marked (c). On the right side of this figure,
we are proceeding into alphabet 2. A frequency count here has shown
that the leading letters of this alphabet are _A_, _O_, _Y_, two of
which, _A_ and _O_, were also leaders in alphabet 1. It is one
peculiarity of the “Phillips” cipher that a change in alphabets means
a change in only fifteen of the substitutes, the remaining ten
continuing to represent the same originals as in the preceding
alphabet. Concerning _A_, we can see, from the third and fourth
messages, that it has not continued to represent _t_; but _O_, in the
sixth message, has rather suggested the word _all_ and even the
expression _all right_, which would carry us on into the third
alphabet. From this point onward, then, we are in the same fortunate
position as the decryptor who intercepts his message partly in cipher
and partly in plaintext. With the context as a guide, we need not
worry as to what happens at the ninth group.

Figure 151

First Alphabet Second Alphabet

1. A F S X O S G Y F O ...
(a) t . . . a . . . n a
(b) t . . m a . . o n a
(c) t r y m a . . o n a (Try ma...)

2. H O U A L H L E D H ...
(a) . a . t . . . . . .
(b) . a n t . . s u r .
(c) c a n t . e s u r e (Can't be sure...)

3. K O N B K A X U O N ...
(a) . a . e . i . . a .
(b) h a . e h i m . a t
(c) h a v e h i m . a t (Have him ...)
 4. T B A A M A F Q E Z ...
(a) s e t t . i . g . a
(b) s e t t l i n g u .
(c) s e t t l i n g u p (Settling up ...)

5. D K O A C Y B Y E N ...
(a) . . a t . . . . . .
(b) . h a t . o y o u t
(c) w h a t . o y o u t (What do you t...)

6. T B B X T O M M D A ...
(a) s e e . s a l l . i
(b) s e e m s a l l r i
(c) s e e m s a l l r i (Seems all ri...)

7. O U S U B U L O I Y ...
(a) a . . . e . . a . .
(b) a n . n e . s a . o
(c) a n y n e w s a . o (Any news abo...)

8. A K R U W A N A L O ...
(a) t . . . . i . i . a
(b) t h . n . i t i s a
(c) t h i n k i t i s a (Think it is a...)

Frequency Count on Alphabet 2, Only:

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
5 1 . 2 3 2 1 2 1 . . 3 2 3 5 . 1 . 1 . 2 . . 1 4 1

Presumably, during all of this time, we have been recording

substitutes in a key-frame. We have recovered fifteen of these in
alphabet 1, and also a number in alphabet 2. Those recovered from
alphabet 1 are shown at the top of Fig. 152. _O_ is the substitute
for _a_, _A_ is the substitute for _t_, _T_ is the substitute for
_s_, and _S_ is the substitute for _y_. Thus, if the cipher is
“Phillips,” then, in the original key-square, the two letters _A O_
were consecutive on one of the diagonals, the two letters _T A_ were
consecutive, the two letters _S T_, and the two letters _Y S_, so
that the complete diagonal must have been _Y S T A O_, and even
though the letter _o_ was not used at all in alphabet 1, we know that
its substitute must have been _Y_, since these diagonals may be
considered to begin with any one of the five letters. By beginning
at _c_-_H_, and following out another such chain, we may find another
complete diagonal, _C H K W D_; and, in addition, we may find parts
of diagonals. All of these are shown at (b).

Figure 152

An Alphabet No. 1 - Taken from a Key-Frame:

Plaintext: a b c d e f g h i . k l m n o p q r s t u v w x y z
SUBSTITUTES: O . H . B . . K R . W M X U . . . F T A . N D . S .

(a)
A T S Y Y
O A T S S
 T
A
(b) O
*Y C E I L *V
S H B R M N
T K F *X U
A *W
O D

(c) (d) (e)

N D .│S│ S . N D . S I N D E . N D . S I N D E S
U C│.│T . T . U C B T R U C T . U C . T R U C B
.│H│L A H L A . . H L A F . L A . . H L A F . H
│.│K M O . K M O . . K M O . K M O . . K M O . .
│ │V W X Y . V W X Y . V W X Y V W X Y . V W X Y .

Whether or not we can go further than this, without consulting other

cipher alphabets, depends upon whether or not the original key-square
contained some of those alphabetical, or nearly alphabetical,
sequences which so often betray the poorly-mixed alphabet; usually,
these are most easily found toward the _X Y Z_ end of the normal
alphabet. In the given case (b), we are able to find the letters _V_,
_W_, _X_, and _Y_, each standing on a separate diagonal; thus, by
readjusting the beginning-points of their diagonals so as to place
these letters at the bottom, we are able to set together four of
these diagonals in the order shown at (c), leaving only the
part-diagonals _E B_ and _I R F_ still to be added. Their length will
show that _I R F_ belongs to the missing diagonal, but _E B_, by its
length, could belong to any one of three diagonals. Further
developments can be carried out with the rhomboid adjustment of (c),
or, if this is confusing, the conversion to a square can be made
immediately. The student may decide for himself which he prefers of
the two developments marked (d) and (e). Notice that this restoration
of the key-square can take place not only from a single alphabet, but
with only 15 substitutes known in that alphabet. But without the aid
of alphabetical sequences, we must, in the first place, have 20
substitutes, four for each diagonal, in order to recover the full
diagonals, after which, each one is entirely independent of the other
four, so that they cannot be adjusted and combined without consulting
one or more of the other alphabets. Here, the method varies a little,
according to just what we can recover, though a hasty glance at the
perfect case will serve to show the general path for all. To see this
as rapidly as possible, we will assume that we have recovered from
alphabet 1 the full five diagonals, and that, in alphabets 2, 3, and
4, we have discovered the substitutes for _e_, and also the originals
for which _E_ has been the substitute.

A careful consideration of the cipher itself will show that no letter

can have more than four different substitutes: the four letters in
the next column to its right which are not on the same line with
itself. Also, that no letter may act for more than four different
originals: the four letters in the next column to its left which are
not on the same line with itself. Any letter, in order to take all
four substitutes and act for all four originals in four successive
alphabets, must have started on the top line, which is the moving one.
 Figure 153

Five Complete Diagonals Recovered From Any Alphabet No.1

Y C E I V
S H B R N
T K L F U
A W M P G
O D X Z Q

\ ↓
Y \ V │ │
S\I N│ E │ D E S I N
T\R│U C B │ U C B T R
A│F G H L │ F G H L A
│O\P Q K M│ O P Q K M
│ \Z W│X X Y Z V W
│ \ │D
↑

Now, considering Fig. 153: Our five recovered diagonals are imagined
to be those of a well-mixed square, so that we have no discoverable
sequences. It has been found that the letter _e_, in alphabets 1, 2,
3, and 4, has taken, successively, the substitutes _B_, _H_, _Q_, and
_Z_, and that the cipher-letter _E_ has served, successively, as the
substitute for _x_, _u_, _f_, and _o_. The four letters _B H Q Z_,
then, must all have stood in a single column _in exactly the order
named_; and the four letters _X U F O_ must have stood in another
column, two positions to the left of the first, but with a minor
difference in the order: some other letter (the one on the same line
as _E_) must have intervened between _X_ and _U_. The order in this
column, then, must have been _U F O X_. Our first step toward
combining the five diagonals is that of adjusting four of them so as
to set up the column _B H Q Z_. This automatically sets up four
letters of the other column _U F * X_ (_D_) — in the figure, the
_X D_ is present, but has not been adjusted to the _U F_ * — after
which, the fifth diagonal can be added to the others by placing the
_O_ of the column _U F O X_ (_D_). Now, since the letter _E_ has
taken, successively, all four of its substitutes and all four of its
originals, it must, in alphabet 1, have been standing on the top row.
Two parallel lines (if desired) can be ruled across the set-up to
show the top and bottom of the square, and two others (placed
anywhere, so long as they mark a width of five columns) may be ruled
to show the two sides. The outside letters, _Y_, _V_, and _D_, may
all be transferred to the opposite ends of their diagonals, after
which the rhomboid is easily adjusted to the form of a square.

It will be seen from what precedes that group-by-group encipherment

offers little, if anything, that is new, and no problems or theories
which the student could not figure out with what he has learned of
substitutions. Solving the actual cryptograms, of course, could
present some difficulties, according to the individual case.

Of the practice cryptograms to follow, No. 140 follows the plan of

the puzzlers, and should not prove very difficult in spite of its
brevity. No. 141 is also a “Phillips,” while No. 142 has been
enciphered with a mixed-alphabet slide applied to five-letter groups.
140. By NEMO. ("Phillips." Probable word: ASSOCIATION)

N D Q T F Q Z C N G B U Z H X N L U K Y F T E E W N R G U R M O X Q X
E Q Z L B G X H W F F N R P X P X V D D F I T G S E W R T I I T Z X E
R V W A R I S P E Y I G R Q C.

141. By PICCOLA. (This is the real McCoy - in 1938. But times change).

(a) K G E U H C K T S X P C K N C A D F X Q C B X T
(b) O U T U I U B F S B Q A P H N B Y Z X X L R U G
(c) O F U O S K H Q T K P W Q F E T B W W X P K B O K G H
(d) B L A M R P G X B W G C W K Q Z I A Q C U H Y R C
(e) G U C O S B B L P S B Q D K P G P K D S R C T B L I
(f) X R O S U I T T F G Y P C M C K F T F X O S R B H O A G M
(g) B O I B V B U K E E B D K B C O B Y W B T B M U H O O A B
(h) Y C U Y U T B I T F H S A N P H C W T.

142. By PICCOLA. (Direct examination - Snowball vs. Snowball).

(q) H F X L F M B L R N I N J W P Z Z G I S B B O Z X S F S H R
H T A T M R O F V ? (a) S X F U R R W X I Q S S.
(q) U F V H C N T I T T F O E J X O G N S G X U S O E H I V L X
E A T ? (a) U R Q Q T W E X U W I T O S.
(q) H C W R U Q U I T T F Y O Q I U D R S G X Z W H G F E T P C
J E M K Q F I N D O E E Z B L ? (a) U R Q Q T W.
(q) U R S U F U G J R E D V T O V E C Z X Z U Z G X S D S H C Q
K E X Z W I O V I R M H D W B D Z R R M ? (a) U R Q T D H T T H I
J S S.
(q) X C Q H R E M Z L T T O P A V H U L E B O Y O G N U F V X T
Z L E K S W F A V N ? (a) X R L L Q E W L T C O S P W V C Z L E B
D W Y I Z F I S R D T W C E Z T T A S G O L E.

143. By PICCOLA. (Can you guess what cipher? "Foregoing" refers to No. 141).

R N N G T R I O O H E I T T A F N D E N O G E L G E Y F I R D A I S E.

CHAPTER XX
Vigenère with Key-Progression

Before leaving the study of multiple-alphabet ciphers, we will

consider briefly the process which, in its simplest form, would be
that shown in Fig. 154. The initial key, in each of three examples,
is _A_, and a long key has been formed by causing the initial one to
progress in the normal alphabet according to an agreed index. In the
first example, the progression index is 1, in the second, it is 2,
and in the third, it is 25 (or minus 1). The resulting long key will
govern a period, which is 26 or 13, according to whether the
progression index is odd or even. This encipherment, logically, would
be applied with a cipher disk. The initial key, as _A_ of the
examples, would indicate the starting position of the revolving disk,
the first letter being enciphered with the disk in this initial
position, after which the disk is made to revolve, so many angles at
a time, without further reference to key-letters. For this kind of
cryptogram, the solution is purely mechanical. A series of alphabets
may be extended, with each cryptogram letter as a beginning, and the
message can be found following a diagonal path in the resulting
set-up.

Figure 154

Forms of Key-Progression

Keys: A B C D E F G... A C E G I K M... A Z Y X W V U...

S E N D... S E N D... S E N D...
S F P G... S G R J... S D L A...

This type of key-progression can be decrypted by "running down the

alphabet," and watching the diagonals for plaintext.

A much commoner scheme, when using a cipher disk, is that of following

a series of irregular shifts in accordance with a numerical key. If,
for instance, the initial position has been established and the first
letter enciphered in that position, and if the numerical key is
3-5-2-1-6, the disk will now be revolved 3 positions for encipherment
of the second letter, 5 positions for encipherment of the third
letter, 2 positions for encipherment of the fourth letter, and so on,
so that the disk must move 17 positions during encipherment of five
letters. This can produce a very long period indeed, especially when
the collective shifts result in an odd number.

Figure 155

Progressing Key: C U L P E P E R D V M Q F Q F S E W N R ...

Plaintext: T H E R E I S O T H E R C A U S E F O R ...
Partial Encipherment: V B P G . . . . W C Q H . . . . . . . I ...

Substantially the same encipherment as the foregoing can be had with

a slide and a key-word, as indicated in Fig. 155. The progression
index, in this figure, is 1. The preliminary key-word, CULPEPER,
enciphers the first eight letters, then moves forward in the alphabet
and becomes _D V M Q F Q F S_ for the encipherment of the next eight,
_E W N R G R G T_ for the encipherment of the third eight, and so on.
In its practical application, one column could be taken at a time.
Notice, however, in Fig. 156, that when a key-letter progresses in
the alphabet, the possible substitutes for any one letter will also
progress, and to exactly the same extent. If the encipherment is
Vigenère or Beaufort proper, this progression is in the same
alphabetical direction as that of key-letters, while the variant
encipherment causes the substitutes to progress in the contrary
direction. Probably, then, the most convenient method of application,
and the one least likely to result in errors, would be that of Fig.
157. The cryptogram is first enciphered as an ordinary periodic, and
the progression is added later, using group-by-group encipherment.
Thus, as we receive the cryptogram, our repeated _ther_ has been
enciphered once as _V B P G_, again as _W C Q H_, and possibly, later
on, as _A G U L_, and the only period we shall be able to find, using
the regular methods, will be 26 x 8, or, if the progression index is
an even number, 13 x 8. But notice, in the same figure, comparisons
(a) and (b).
 Figure 156

Vigenère and Beaufort Progression Variant Progression

Progressing Key: A B C D E..... Progressing Key: A B C D E.....

Plaintext letter: H H H H H..... Plaintext Letter: H H H H H.....

Cipher letter (V) H I J K L..... Cipher letter: H G F E D.....

(B) T U V W X.....

Vigenère, it will be remembered, has been compared to the mathematical

process of addition. If the key-digram _CU_ be added to the plaintext
digram _TH_, their sum is the cipher-digram _VB_. The alphabetical
distance from _C_ to _U_ is 18, the alphabetical distance _TH_ is 14,
and the alphabetical distance _VB_ is 6 or could be 26 plus 6, 52 plus
6, and so on. It is a fact that when we “add” the two digrams _CU_
and _TH_, we actually do add their separating intervals, 18 and 14,
since we obtain a sum 32 in that of the cipher digram _VB_. It is
also an easily verified fact that the same reasoning applies to the
subtractions of the two Beauforts. The student who cares to
investigate may make use of the tableau shown as Fig. 158; to find
quickly the distance from one letter to another, find the first of
these at the left, the second at the top, and the alphabetical
interval between the two is shown in the cell of intersection. If it
is desired to know the reverse interval, find the first letter at the
top and the second at the side. Now notice, carefully, that when any
digram progresses in the alphabet, as _CU_ would become _DV_, _EW_,
_FX_, and so on, in a series of periods, _it does not change its
alphabetical interval_; in all of these digrams, the distance apart
of the two component letters is still 18. Thus, while our period
vanishes, the alphabetical intervals which represent it are still
present in the cryptogram; we have only to find these intervals,
subject them to a Kasiski examination, and convert the cryptogram to
an ordinary Vigenère.

Figure 157

Initial Key-word: C U L P E P E R C U L P E P E R C U L P E P E R
Plaintext: T H E R E I S O T H E R C A U S E F O R T H I N...
PRIMARY Cryptogram: V B P G I X W F V B P G G P Y J G Z Z G X W M E...

Progression Key: A B C
FINAL Cryptogram: V B P G I X W F W C Q H H Q Z K I B B I Z Y N G...

(a)
C U (key) plus T H (plaintext) equals V B (cipher).
(b)
Interval 18 plus interval 14 equals (32 less 26) = 6

Figure 158

Tableau for Finding ALPHABETICAL INTERVALS

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
 A 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25
A
B 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
B
C 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
C
D 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
D
E 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21
E
F 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
F
G 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
G
H 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
H
I 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
I
J 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
J
K 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
K
L 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14
L
M 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12 13
M
N 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11 12
N
O 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10 11
O
P 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9 10
P
Q 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8 9
Q
R 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7 8
R
S 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6 7
S
T 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5 6
T
U 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4 5
U
V 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3 4
V
W 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2 3
W
X 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1 2
X
Y 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 1
Y
Z 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0
Z

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Fig. 159 shows the preparation of the cryptogram: The alphabetical

interval from _K_ to _O_ is 4, that from _O_ to _S_ is 4, that from
_S_ to _X_ is 5, and so on. If these numbers are placed directly
below the first letter, as shown, the computation of their _lineal_
intervals apart is less confusing than when they are placed between
the two. As to repetitions, each repeated single number may represent
a repeated digram, each repeated sequence of two numbers may represent
a repeated trigram, and so on. Only the longer of these possibilities
have been underscored.

Figure 159

(5) (10) (15) (20)

K O S X M Y M M Q Y T K N G Z W L T Z L
4 4 5 15 12 14 0 4 8 21 17 3 19 19 23 15 8 6 12 22

(25) (30) (35) (40)

H C G F A P J Y K W A T Z P Q X U J Z P
21 4 25 21 15 20 15 12 12 4 19 6 16 1 7 23 15 16 16 6

(45) (50) (55) (60)

V C Z Q A R F P V Y U Y C R C X M X G I
7 23 17 10 17 14 10 6 3 22 4 4 15 11 21 15 11 9 2 21

(65) (70) (75) (80)

D U X Q Y M T E V V S C X J L J D A E Y
17 3 19 8 14 7 11 17 0 23 10 21 12 2 24 20 23 4 20 4

(85) (90) (95) (100)

C S F P J W F V J V Q V E G A N G K B B
16 13 10 20 13 9 16 14 12 21 5 9 2 20 13 19 4 17 0 17

(105) (110) (115) (120)

S C P Z B H G I D Z J A N Z I Y E Z P T
10 13 10 2 6 25 2 21 22 10 17 13 12 9 16 6 21 16 4 -

Figure 160

Repeated Intervals Lineal Interval Possible Factors

4-4 KOS-UYC 51 - 1 = 50 2 5 10
15-12 XMY-JYK 27 - 4 = 23
21-17-3-19 YTKNG-IDUXQ 60 - 10 = 50 2 5 10
23-15 ZWL-XUJ 36 - 15 = 21 3 7
21-15 FAP-CXM 55 - 24 = 31
7-23 QXU-VCZ 41 - 35 = 6 2 3 6
16-6 ZPV-IYE 115 - 39 = 76 2 4 19
17-10 ZQA-BSC 100 - 43 = 57 3 19
10-17 QAR-ZJA 110 - 44 = 66 2 3 6 11
15-11 CRC-XMX 56 - 53 = 3 3
9-2 XGI-VEG 92 - 58 = 34 2 17
2-21 GID-GID 107 - 59 = 48 2 3 4 6 8 12
17-0 EVV-KBB 98 - 68 = 30 2 3 5 6 10
13-10 SFP-CPZ 102 - 82 = 20 2 4 5 10
20-13 PJW-GAN 94 - 84 = 10 2 5 10
9-16 WFV-ZIY 114 - 86 = 28 2 4 7

Fig. 160 shows the application of a modified Kasiski examination.

Notice the prominence of small factors 2 and 3, caused, often, by
repeated alphabetical intervals in the key itself. In the given case,
the period 10 would probably be the choice, though period 5 is
correct; in practice, we should probably consider possible digrams as
well as longer sequences. Accepting period 10, we have still to learn
the progression index, and for this we must consider letters, all of
which are shown in the second column of the same figure. Taking the
longest repetition, most likely to be reliable, the two first letters
are _Y_ and _I_; their alphabetical distance apart is 10, and their
lineal distance apart in the cryptogram is 50. If the accepted period,
10, is correct, it has taken five periods to produce the alphabetical
shift of 10, therefore the shift per period (the progression index)
is 10 divided by 5; or 2. This, of course, has taken for granted that
the encipherment is either Vigenère or Beaufort. Considered as a
possible variant Beaufort, where the progression is backward, the
alphabetical interval from _Y_ to _I_ is 16, which is not divisible
by 5, the number of periods. But this progression might have covered
the entire alphabet and then included 16, or it might have covered
the alphabet twice, and so on, before including 16. We must make it
divisible by 5, adding 26, then another 26, and so on, until we
obtain a total progression of 120. This, divided by 5, gives the
progression index as “minus 24” — the same as a normal progression of
2. In Fig. 161, the cryptogram has been re-written into the accepted
period 10, and the figures in parentheses at the right of each group
will indicate the amount of alphabetical shift when the progression
index is 2. A constant progression of 2 per group would correspond to
the application of a Vigenère key _A C E G_. . . . . , so that the
Saint-Cyr slide will serve for quickly converting the cryptogram to
its periodic form, and this is shown in Fig. 162. The period, as
mentioned, is actually 5, though this makes no difference in the
final results.

Figure 161 Figure 162

K4 O4 S5 X15M12Y14M0 M4 Q8 Y21 (A) K O S X M Y M M Q Y

T17K3 N19G19Z23W15L8 T6 Z12L22 (2) (C) R I L E X U J R X J

H21C4 G25F21A15P20J15Y12K12W4 (4) (E) D Y C B W L F U G S

A19T6 Z16P1 Q7 X23U15J16Z16P6 (6) (G) U N T J K R O D T J

V7 C23Z17Q10A17R14F10P6 V3 Y22 (8) (I) N U R I S J X H N Q

U4 Y4 C15R11C21X15M11X9 G2 I21 (10) (K) K O S H S N C N W Y

D17U3 X19Q8 Y14M7 T11E17V0 V23 (12) (M) R I L E M A H S J J

S10C21X12J2 L24J20D23A4 E20Y4 (14) (O) E O J V X V P M Q K

C16S13F10P20J13W9 F16V14J12V21 (16) (Q) M C P Z T G P F T F

Q5 V9 E2 G20A13N19G4 K17B0 B17 (18) (S) Y D M O I V O S J J

S10C13P10Z2 B6 H25G2 I21D22Z10 (20) (U) Y I V F H N M O J F

J17A13N12Z9 I16Y6 E21Z16P4 T- (22) (W) N E R D M C I D T X

 Figure 163

MATHEMATICAL FORMULA - C. H. PRICE

X = AD x P
LD
P = Period AD = Alphabetical Distance
X = Progression Index LD = Lineal Distance

As Applied to the Supposed Repeated Trigram KOS-UYC, Positions 1, 51:

X = 10 P = P
50 5

BUT: P and X must be integers • • If P = 5, then X = 1

(and P must be a divisor of 50) • If P = 10, then X = 2
(Periods of 25, 50, are unlikely)

For those who like mathematics, Fig. 163 shows a method used by one
of our collaborators for determining both the period and the
progression index directly from the cryptogram. Price also preferred
to find alphabetical intervals by writing the normal alphabet into a
block, five letters to the line, with _Z_ standing alone on the last
line; thus, except for watching _Z_ occasionally, the distance from
one letter to another could be counted by fives. It is understood, of
course, that we do not accept the evidence obtained from only one of
the supposed repeated sequences; too many of these will be accidental,
and many of those which are actually periodic have not represented
repeated digrams, but merely repeated intervals. Naturally, too, the
progression index need not be a small number; the disk encipherment,
mentioned in the beginning, showed a progression of 17 for each period
5. This disk encipherment, incidentally, has been dealt with in a most
interesting manner in Givierge’s _Cours de cryptographie_.

* * *

We have seen, then, all of the essentials of polyalphabetical

encipherment. With the cipher alphabets known to the decryptor,
practically all of the multiple-alphabet ciphers will be solved by
suitable modifications of processes described for Vigenère. When
alphabets are not known, his problem, always, is that of collecting
as many as possible of the substitutes belonging to each alphabet,
so that he may determine both the order of the letters and the
relationship of alphabets to one another.

144. By THE SQUIRE.

S O V F O G S G U F V I J R I F M O U I C F T T I K Z Y Z Z Z U I F Q
Q L O W U V A F J F I W W L N C R G J F E M V V N N C D H W T A J N W
A R D B. yallyyayyayalyyaaallayaaaylalllaylyayyallyyayaylalllyyall.

145. By NEMO.

Y Y I Z C U O F Y V H Q Y H T B E B S X P T S Y C R M R X L X E A G U
Y L P U Q B U U Q N Y U S O Q M O O S P U G I J I I F F F A L I R G G
F G E H H N T E G Y Z S M C O F U D E M X O G I K K V B N K W K P Q X
M G D L A I F N H M X T U M E Z X Y Z G N A P D W C D M N C T T H N J F
D.

146. By PICCOLA. (We wouldn't throw monkey-wrenches for anything!)

X E I T B B B B V M X R S J P Y L K E N Y K S Z K F R W L G S A Y E A
V I X I X D U V D U R J G E I B A N Z F H D C C Y C O Y R V A B K W B
R H F K K F X S E J Y T F N L R N I V K V K Q H I Q H I J L P G O U J
V F C F T S H L I D V D D M P.

147. By DAN SURR. (Might try this without bothering about its progression!)

E C G M H T Y T A J B T H N G A W K L I B E M N R H T D G N G P D A O
Q A X R P Z P F H D D X I E A U B S Y C I X C W V R H P B O I X Y P Y
D V W N R N X O O K K I H F O X D S V L V W W C L I H Z H V W R L H W
M M I E E A H G Q Y R S R L K L W Z T J A Y W F N S S U C V Z L P X P
S E E E Y R T H D H T Z N U P U R M G K Z N T Y E Q D E Z E N N H W M
I N R L P S S W P Y M C R U B J Z Y C R N L M A S M E U C L R M D Y R
N E S T O B V J E U D V L O T S Q B J H B N R L B V D X J P X N I G F
I C Q J Y Q Z X Q G K B L F Q U B Q K N E L S S L Y G T L F L T D Z Z
Y K E E R H K L W L I M R N J S O O J P Q C A U D M E I B B Q X A H C
V A J C M G X B I C D K V C L G Q I B S C F V F W Q N A X I D R Z S X
R B I W R C Q R.

148. By PICCOLA. (When is a tramp not a tramp?)

E R N I C D M R A S T A A P H T P I L T Q V A A S N E A E E R O O L R.

CHAPTER XXI
Polygram Substitution — The Playfair Cipher

Polygram substitution contemplates the encipherment of several letters

collectively: Digrams are to be replaced with other digrams, or with
three-digit numbers; trigrams are to be replaced with other trigrams,
or with four-digit numbers; and so on, the substitute for an
individual letter being entirely dependent upon the combination in
which it happens to occur. Many devices have been contrived for
accomplishing this. For pair-encipherment, tableaux of the general
kind shown in Fig. 164 are fairly common.

Figure 164

A M E R I C N B D F G H J K L O P Q S T U V W X Y Z

E AA BA CA DA EA FA GA HA IA JA KA LA MA NA OA PA QA RA SA TA UA VA WA XA YA ZA
Q AB BB CB DB EB FB GB HB IB JB KB LB MB NB OB PB QB RB SB TB UB VB WB XB YB ZB
U AC BC CC DC EC FC GC HC IC JC KC LC MC NC OC PC QC RC SC TC UC VC WC XC YC ZC
A AD BD CD DD ED FD GD HD ID JD KD LD MD ND OD PD QD RD SD TD UD VD WD XD YD ZD
L AE BE CE DE EE FE GE HE IE JE KE LE ME NE OE PE QE RE SE TE UE VE WE XE YE ZE
I AF BF CF DF EF FF GF HF IF JF KF LF MF NF OF PF QF RF SF TF UF VF WF XF YF ZF
T AG BG CG DG EG FG GG HG IG JG KG LG MG NG OG PG QG RG SG TG UG VG WG XG YG ZG
Y AH BH CH DH EH FH GH HH IH JH KH LH MH NH OH PH QH RH SH TH UH VH WH XH YH ZH
B AI BI CI DI EI FI GI HI II JI KI LI MI NI OI PI QI RI SI TI UI VI WI XI YI ZI
 C AJ BJ CJ DJ EJ FJ GJ HJ IJ JJ KJ LJ MJ NJ OJ PJ QJ RJ SJ TJ UJ VJ WJ XJ YJ ZJ
D AK BK CK DK EK FK GK HK IK JK KK LK MK NK OK PK QK RK SK TK UK VK WK XK YK ZK
F AL BL CL DL EL FL GL HL IL JL KL LL ML NL OL PL QL RL SL TL UL VL WL XL YL ZL
G AM BM CM DM EM FM GM HM IM JM KM LM MM NM OM PM QM RM SM TM UM VM WM XM YM ZM
H AN BN CN DN EN FN GN HN IN JN KN LN MN NN ON PN QN RN SN TN UN VN WN XN YN ZN
J AO BO CO DO EO FO GO HO IO JO KO LO MO NO OO PO QO RO SO TO UO VO WO XO YO ZO
K AP BP CP DP EP FP GP HP IP JP KP LP MP NP OP PP QP RP SP TP UP VP WP XP YP ZP
M AQ BQ CQ DQ EQ FQ GQ HQ IQ JQ KQ LQ MQ NQ OQ PQ QQ RQ SQ TQ UQ VQ WQ XQ YQ ZQ
N AR BR CR DR ER FR GR HR IR JR KR LR MR NR OR PR QR RR SR TR UR VR WR XR YR ZR
O AS BS CS DS ES FS GS HS IS JS KS LS MS NS OS PS QS RS SS TS US VS WS XS YS ZS
P AT BT CT DT ET FT GT HT IT JT KT LT MT NT OT PT QT RT ST TT UT VT WT XT YT ZT
R AU BU CU DU EU FU GU HU IU JU KU LU MU NU OU PU QU RU SU TU UU VU WU XU YU ZU
S AV BV CV DV EV FV GV HV IV JV KV LV MV NV OV PV QV RV SV TV UV VV WV XV YV ZV
V AW BW CW DW EW FW GW HW IW JW KW LW MW NW OW PW QW RW SW TW UW VW WW XW YW ZW
W AX BX CX DX EX FX GX HX IX JX KX LX MX NX OX PX QX RX SX TX UX VX WX XX YX ZX
X AY BY CY DY EY FY GY HY IY JY KY LY MY NY OY PY QY RY SY TY UY VY WY XY YY ZY
Z AZ BZ CZ DZ EZ FZ GZ HZ IZ JZ KZ LZ MZ NZ OZ PZ QZ RZ SZ TZ UZ VZ WZ XZ YZ ZZ

The tableau proper includes a full list of the 676 possible two-letter
combinations, while two external alphabets will furnish another
possible 676 two-letter combinations. With the plaintext marked off
into pairs, the encipherment of a pair is usually accomplished by
finding its two letters in the two external alphabets, where they act
as co-ordinates, and replacing this pair with the one which is found
at the cell of intersection. Thus, using the tableau of the figure,
and the order row-column, the substitute for _th_ would be _LG_; or,
using the order column-row, _TN_. With a tableau like that of the
figure (notice the straight unshifted alphabets), it is also possible
to encipher by what is ordinarily considered the decipherment process,
finding the plaintext pair inside the tableau and replacing it with
the two co-ordinates. But many of these tableaux are filled in a
thoroughly haphazard manner, and when this is the case, only the
ordinary encipherment plan is really feasible; in fact, the decipherer
has trouble in finding his cryptogram pairs, and it is usually
necessary that a second tableau be prepared especially for
decipherment purposes. On the other hand, it is very easy to construct
a mixed tableau in such a way that all of its encipherment is
reciprocal, and in this case there is no need for a second tableau,
since encipherment and decipherment are the same process. In most
forms of tableau, one or both of the external alphabets may be made
to slide and for the most part external alphabets are readily
changeable. But the tableaux themselves will have to be of more or
less fixed nature. Those which are safest are least readily
reconstructed from memory, and even those most easily remembered are
not set up very rapidly.

Another common method for pair encipherment can be understood from

the following description: Picture a chart of 100 cells which is
divided sharply into four quarters; that is, having much the
appearance of a 100-cell Fleissner grille. Each of the four quarters
is a 5 x 5 square and contains a 25-letter alphabet. At least two of
these alphabets are mixed, usually with different keys. To encipher
a pair, find its two letters in two different squares, and substitute
two others which occupy certain relative positions in the other two
squares.

Figure 165
 The "SLIDEFAIR" Cipher -(H. F. GAINES)

Key: H E R C U L E S

Plaintext: SE ND DI AM ON DS TO AM
CIPHER:..... XZ ZR RU KC TI HO KX US

ST ER DA MM ON DA YW EE
..... MZ NI JU KO TI PO SC MW

KW IT HO UT FA IL
..... PR PM XY RW GZ AT

Cryptogram taken off:

X Z Z R R U K C T I H O K X U , etc.

The writer’s own contribution, accomplished with a slide, may be

examined in Fig. 165; the slide used in the example was the Saint-Cyr,
and details are self-explanatory, except for the method of enciphering
pairs, which was as follows: To encipher those of the _H_-column,
bring the _H_-alphabet into position on the slide; then, for each
pair, find its first letter in the upper alphabet and its second
letter in the lower one; imagine these to be standing at the two ends
of a diagonal, and substitute the two letters from the two ends of
the corresponding cross-diagonal, taking the upper one first. Where
the two plaintext letters happen to coincide (as would be the case
with a pair _EL_ using the _H_-alphabet of the Saint-Cyr slide) use
the two letters which have also coincided immediately to their right
(as _FM_ for _EL_ in the given case).

Occasionally, such a tableau as that of Fig. 164 is made to serve

(not very successfully) for trigram encipherment. A third external
alphabet is added beside one of the others, so that the two which are
parallel will make provision for the encipherment of a third letter
simultaneously with the encipherment of each pair. But for trigram
encipherment, another type of tableau is commoner: The tableau proper
is not a list of pairs, but an alphabet square such as could be
prepared for one of the mixed-alphabet slides of Chapter XVIII, and
is accompanied by four external alphabets, two on the left and two
across the top. The exact details of construction are not always the
same, and the methods prescribed for using such a tableau are
sometimes quite devious, but results are fairly uniform: We obtain
cryptograms in which enciphered pairs have alternated with enciphered
(sometimes _not_ enciphered!) single letters.

In all of the foregoing, no system has been mentioned which the

student will not be able to analyze for himself. At worst, he has a
case very much like simple substitution, except that he would require
a great deal more material, and would use a digram chart instead of a
frequency list. Otherwise, he usually finds that he has merely a
variation of pure periodic encipherment. There are, of course, more
effective methods. Trigrams, tetragrams, and other polygrams, found
in alphabet squares, can always be considered as geometrical figures,
and replaced with other series of letters in related geometrical
figures; and Lester S. Hill, in the American Mathematical Monthly,
has described an “algebraic” method which appears practical, provided
a machine is used. These methods, however, even granting that some
are practical and not too unwieldy for use, are entirely beyond our
present scope, and we will spend our few remaining pages on a cipher
of a less cumbersome nature and presenting far more points of interest.

Figure 166

The PLAYFAIR Cipher

KEY Encipherment Some Equivalent Keysquares

C U L P E (1) bl = IB L P E C U N O Q S T Y Z V W X
R A B D F ez = FE B D F R A V W X Y Z P E C U L
G H I K M (2) cl = UP I K M G H C U L P E D F R A B
N O Q S T ce = UC Q S T N O R A B D F K M G H I
V W X Y Z (3) th = OM X Y Z V W G H I K M S T N O Q
ht = MO

Example:

SE ND DI AM ON DS TO AM ST ER DA MX MO ND AY WE EK WI TH OU TF AI LX.
TP SR BK FH QO KY NQ FH TN CF FB IZ HT SR DW ZU PM XH OM WA ZM BH BL.

* * *

_The Playfair cipher_, which may be examined in Fig. 166, requires

no apparatus other than pencil and paper. Its key is the usual
5 x 5 square, based on a key-word, and filled in by any agreed plan
(preferably not by straight horizontals). For encipherment, the
plaintext is marked off into pairs, and these pairs are enciphered
according to three very simple rules:

1. If the two letters of the pair are found in the same column in
the key-square, replace each letter with the one directly beneath it;
and if one letter stands at the bottom of the column, use the one
standing at the top of the same column. With the key of the figure,
_ha_ becomes _OH_; _wa_ becomes _UH_.

2. If the two letters of the pair are found in the same row in the
key-square, replace each letter with the one immediately to its right;
and if one letter stands at the extreme right end of the row, use the
one standing at the extreme left end of the same row (_os_ becomes
_QT_; _st_ becomes _TN_).

3. If the two letters of the pair have a diagonal relationship in the

key-square (and these are usually in the majority), consider them to
be standing at the diagonally opposite corners of an imaginary small
rectangle, and substitute for each letter that letter of the other
diagonal which stands on the same row with itself (_bu_ becomes _AL_,
not _LA_). The decipherment rules, as usual, are the same rules in
reverse.

* * *

Notice that this encipherment is _cyclical_. So long as the order

1-2-3-4-5 is maintained in both columns and rows, it makes no
difference whatever how many columns are transferred from one side
to the other, or how many rows are transferred from top to bottom.
This may be investigated in the three equivalent squares of the
figure. Notice, too, that our three rules do not make any provision
for the case in which the two letters of a pair are the same. If,
in marking off the plaintext into pairs, we encounter a pair which
is a double, it becomes necessary to dispose of this, usually by
inserting a null which will throw the second letter into the next
pair. Occasionally we find a sequence such as LESS SEVEN, in which
it is necessary to do this twice in succession: _LE Sx Sx SE VE
Nx_. An unpaired final letter also requires a null (unless left
unenciphered), and when five-letter groups are to be used, it often
becomes necessary to complete a final group by adding nulls.

The foregoing description and rules are those of the original

Playfair cipher. Many encipherers, however, will vary the rules,
especially the one concerning doubles; perhaps one letter will be
omitted or replaced with a null; sometimes one double is replaced
with another; occasionally an encipherer will separate every doubled
letter in the message whether or not this is necessary. We meet,
too, with variant forms. A 24-letter alphabet will be used in a
4 x 6 rectangle, or a 27-letter alphabet (with character &) will
be used in a 3 x 9 rectangle. One variation, attributed to W. W.
Rouse-Ball, uses the standard key-square with the standard rule 3,
but varies the two rules for lineal encipherment. Rule 1: If the two
letters of the pair stand in a column, use the two letters immediately
to their right. Rule 2: If they stand in a row, use the two letters
immediately beneath them. In all of these cases, presuming the method
to be known, the degree of difficulty would be the same as if the
standard system had been used; otherwise, it is only necessary to
keep in mind the fact that variations occasionally occur. We will
give our attention, then, to the standard encipherment. But before
entering into the subject of decryptment, let us look carefully at
the system itself.

Primarily, we have a _fixed_ substitution. No plaintext pair ever has

more than one substitute pair; and no substitute pair ever changes
its original. We might say that the Playfair is, in effect, a “simple
substitution” based on an “alphabet” of 600 pairs; and, just as in
simple substitution proper, the Playfair cryptograms will very often
contain long repeated sequences which represent whole words. Again,
the reversal of a plaintext pair means the reversal of its substitute
pair, and vice versa, so that the discovery of any one equation (as
_th_ = _OM_) always means the discovery of another (as _ht_ = _MO_);
and if, in addition, the encipherment was a rectangular one (rule 3),
we obtain also the two reciprocal equations (as _om_ = _TH_, and _mo_
= _HT_). The two lineal encipherments, however (rules 1 and 2), are
not reciprocal. But notice particularly that, in spite of the polygram
theory, each letter has its individual substitutes. No letter in the
key-square may have more than five of these; the four which are
standing on its own line, and the one which stands directly beneath
it. It may be learned, too, by writing out the 24 (or 48) possible
pairs for any one given letter, that the letter standing immediately
to its right in the key-square is twice as likely as any one of the
other four to act as its substitute; and, further than this, that any
letter which is paired with it will be limited to eight possible
substitutes, all of which must be found either in the column or on
the row of the letter itself. To clarify this important point, let us
assume that the letter in question is _E_, and that the key-square is
that of Fig. 166. The letter _E_ may have only the substitutes _C_,
_U_, _L_, _P_, and _F_, with _C_ twice as likely to be used as any
one of the other four. Any letter which is paired with _E_ must take
one of the following substitutes: _U L P E F M T Z_.

Naturally, then, those letters which, in the key-square, are standing

on the same row or in the same column with the normally frequent
letters will have high frequencies in the cryptograms; in fact, the
two or three which predominate in a given cryptogram will practically
always be letters which, in the key-square, were standing in the same
row or column with _E_ or _T_ (in English). Moreover, if any letter
has been identified once as the substitute for _E_, there is a most
excellent chance that it can be identified again as the substitute
for _E_. Say, for instance, that _CF_ has been identified, or assumed,
as the substitute for _er_. This means that _C_ is individually the
substitute for _e_, and when another pair _CT_ is found to be of some
frequency, it can be tried as the substitute for _en_, _es_, _et_,
and so on. Single-letter frequencies, then, will play an important
part in the decryptment of the Playfair. But the process will rest
fundamentally upon the frequencies of digrams, and will follow, in
general, three steps repeated over and over in the same rotation:

1. Certain pairs are identified, or assumed, as the substitutes for

certain digrams.

2. These pairs and their supposed originals are set together in such
a way as to start the reconstruction of the key-square.

3. Substitutions are made on the cryptogram and further pairs are

identified.

When probable words exist, the work of solution becomes more or less
mechanical, as we shall see. At worst, we may begin at the beginning
of the cryptogram and work straight through until we find the word.
But very often, a really probable word is repeated, and even repeated
more than once. In the latter case, we are sure to find the long
repeated sequence in the cryptogram; while a word repeated only once
may have been divided into two different sets of pairs, as:
_ex_-_ec_-_ut_-_io_-_n_ and _e_-_xe_-_cu_-_ti_-_on_. But notice, here,
what the two encipherments would be, using our key-square of the
figure: _LZ CU EO HQ x_ and _x ZL UL QM QO_. These two sequences have
five letters in common, _L Z U O Q_, and, in addition, when considered
together, show the letters _E C U O_ of the word “execution.” This
does not invariably happen, but is far from uncommon. Nor is the word
“execution” the only one which produces reversal (_ex_ in one sequence,
_xe_ in the other). Then, too, there are many words like “commission”
which, regardless of the point at which the division begins, will
always end in the same set of pairs: _mi_-_s?_-_si_-_on_.

Granting an absence of probable words, the difficulties of solution

are almost entirely dependent upon the amount of material available.
A pair-count will be made in the usual chart-form (but only on the
divided pairs, and not “straddling” from one pair to another), and
pairs will be identified by frequency, by the frequency with which
they are found reversed, by the possibility of their letter-combinations
in a key-square, and so on. We will not attempt, here, to go into a
detailed demonstration, since every case is individual in its details,
and success, in all of them, is dependent largely upon the decryptor’s
own persistence. But in order to see sketchily what some of the
routine might be, we will make use of the very short example shown
in Fig. 167.

In the usual case, there has been a preliminary frequency count on

single letters in order to find out what the cipher is. The appearance
of this frequency count has more or less negatived the possibility of
simple substitution, and the next step has been a Kasiski tabulation
in the hope of finding a period. This tabulation, in any pair-system,
will bring out a predominant factor 2, and, since many of the supposed
digram systems actually do produce periods, the two supposed alphabets
would have been examined for that possibility. But pair-systems, as a
rule, will leave a wide-open trail: Repeated sequences, in the
majority of cases, will include an _even_ number of letters (that is,
an exact number of pairs), and will begin largely at the _odd_ serial
positions (that is, at the beginnings of pairs). The Playfair shows
this a little less distinctly than some of the others, because of the
fact that substitutes for single letters are so limited in number.

It is sometimes said of the Playfair that it can be distinguished

from other ciphers by (1) the fact that cryptograms contain an even
number of letters, (2) the fact that only 25 letters are represented
in its general frequency count, (3) the fact that when the cryptogram
is marked into pairs, no pair will be a doubled letter, and (4) the
presence of long repeated sequences at irregular intervals. As
conclusive evidence, these are debatable points, but all are good
supporting evidence, provided a proper confession can be extracted
from the pair-chart: (5) When the cryptogram has been marked off into
pairs, and the pairs counted, the result should bear much resemblance
to a count made on the same number of normal digrams. Even on an
extremely long cryptogram, over half of the cells will be blank,
since a normal text never uses more than about 300 of the possible
676 combinations; there will be a certain group of predominant pairs
followed by a group of moderate frequencies; and, with any appreciable
length, there will be a generous sprinkling of reversals. In preparing
the cryptogram, a great deal of convenience may be had by placing
frequency figures beside their digrams, by marking long repeated
sequences, noticeable reversals, and so on; and many persons like to
list the most prominent pairs and the most prominent reversals.

Figure 167

HR5 KY3 LD ZX NQ2 EO ND EC TC TI2 AD CT AK RH LB2 GT SN AN

UN2 ON DR HX PE BN ZC DT KV EQ2 HD AO HR5 DU RP TQ OB DE2

QD2 HR5 KY3 YA2 HZ HB BU KZ EQ2 XG TI2 BI KY3 RI CQ HR5 CE CO

SX RM BC TH CG QD2 RK NQ2 IT DC WT FV2 UB2 YA2 GU HE CZ NU2

LB2 IQ2 YK FV2 UB2 IQ2 WD QB UN2 KM DE2 TD KA HR5 NU2 OU

Frequency Count - Rearranged:

D H B C N Q R T K U E A I O Y Z G X L V F M P S W J
14 12 11 11 11 11 11 11 10 10 9 7 7 6 6 5 4 4 3 3 2 2 2 2 2 -

List of REVERSALS "Chart of Probable Position"

 HR 5 - RH 1 EC - CE E T/ D H B C N Q R K U
KY 3 - YK 1 TC - CT D H
UN 2 - NU 2 AK - KA B C N Q R
UB 2 - BU 1 ZC - CZ K U
TI 2 - IT 1 DT - TD

The Playfair has also a rather characteristic frequency count. Notice,

in the figure, where the general count has been rearranged in the
order of decreasing frequencies, that the gradation from high to low
is somewhat less even than in a periodic; frequency 8, for instance,
is skipped altogether, and we have a sort of modified high-frequency
group. Sometimes we find from one to three letters of great prominence
before the downward gradation begins.

Concerning the “chart of probable position,” most solvers prefer

simply to keep this in mind, while others will actually set it down
and make it the basis of their solution. With 176 letters of text,
the average frequency of letters is about 7 (176 divided by 25). Any
letter whose frequency is above that average is very likely to have
been standing on the same row or in the same column of the key-square
as _E_ or _T_, and the two or three which lead the list are
practically sure to have been substitutes for one of these two
letters.

With cryptograms of the present length, or even with those of 400 to

600 letters, it is very uncertain as to whether or not the leading
pair will represent _th_, or the leading reversal _er_-_re_. Here, in
fact, we have no reversal of a definitely frequent character, and our
one prominent pair, _HR_, might just as well represent _st_, _at_,
_it_, _on_, _re_, _se_, or any other normally frequent digram capable
of being used at the beginning of a sentence. Presuming, however, that
it might represent _th_, we know that this digram is followed almost
altogether by vowels, and is followed with remarkable frequency by
_e_ and _a_; we know also that letters have individual substitutes.
Thus, we might begin solution by listing (or noting) those pairs
which, in the cryptogram, have followed the supposed _th_: _KY_,
_DU_, _KY_, _CE_, _NU_, assuming that their first letters, _K_, _D_,
_C_, _N_, have probably represented vowels, and that, of these, _D_,
_C_, and _N_, which rank high in the list of single-letter
frequencies, are very likely to have represented _e_. We may attempt
to identify these five pairs by working down the list of normal
digrams, taking only those of _v_-_c_ formation. If, in addition, it
is assumed that the key-square has been filled by straight
horizontals, certain assumptions can be made through possible
alphabetical sequence; for instance, the _U_ of _DU_ and _NU_ may
have stood on the same line with _R_ _S_ _T_ (_U_). There is a
further field for suggestions to be found in _patterns_, such as
_TI BI_, in which the two _I_’s could represent the same letter.
And where the square is filled by straight horizontals, it is
often possible to identify such a sequence as _HZ_ _HB_ as a “split
double,” since the null used in these cases is often _X_, and _Z_
may well represent _X_ by alphabetical position, It is even possible
to guess here a doubled _L_, since _H_ and _L_ are not far apart in
the alphabet. (It may be, of course, that the two _H_’s represent two
different letters.) The foregoing, then, has indicated the general
path. If the student desires to follow out a detailed demonstration
made on a cryptogram of only moderate length, a most excellent
exposition can be found in the appendix to the Macbeth translation of
Langie’s “Cryptography” (Dutton). It was written by Lt. Commander
W. W. Smith of the U. S. Navy, and generally speaking, attacks the
identifications of pairs as follows:

Having placed frequency figures beside their digrams, find those

points at which two pairs of high frequency are consecutive (not
necessarily a repeated sequence), and attempt to identify these
tetragrams as frequent tetragrams of the language: _ther_, _ered_,
_ened_, _tion_, _atio_, _ment_, _beca_, and so on. We have one here,
provided a frequency of 3 can be considered important: _HR_ _KY_.
Since this happens also to be repeated, it probably represents a word,
as _that_, _this_, _they_.

Another good demonstration, provided the student has access to it in

his public library, is found in Colonel Parker Hitt’s “Manual for the
Solution of Military Ciphers.” This manual is an elementary work
intended for the preliminary instruction of soldiers, and the attack
is made on the assumption of a key-square filled by straight
horizontals. With a square of the kind we are using, most of the
vowels and high-frequency letters will be standing on the upper two
rows, and letters on the first two or three rows will have a much
higher frequency than those of the last two or three. In fact, it can
often be detected that the letters _V W X Y Z_ were standing on the
bottom row as an intact alphabetical sequence, for the simple reason
that they have no frequency in the cryptogram.

Colonel Hitt’s demonstration begins with the usual pair-count, made

on a chart. He selects from this chart the (approximately) ten letters
having the _widest variety of contact_, including, if necessary, the
vowel or so which would have to be present in a key-word; and these
letters are assumed to have stood on the upper rows of the key-square.
The remaining (approximately) fifteen letters are then set up in
their alphabetical sequence and are assumed to have stood on the
lower rows in about that order. They are not, of course, known to be
correctly placed; the set-up merely gives a concrete idea as to where
letters ought to have stood. Then, following the military case of
abundant material, it is assumed that the leading pair will represent
_th_ (sure to be followed often by _e_), or, if _th_ is not the
leader, then _he_ (sure to be preceded often by _t_). With a few
obvious identifications made in the usual way, letters begin to
arrange themselves on the upper rows, and a gradual adjustment takes
place which corrects the few wrong assumptions of the lower rows, so
that the key-square is restored far in advance of solution. When a
short key-word has been used, it is not impossible, by following
Colonel Hitt’s suggestions, to pick out all of the key-letters, guess
the word, and decipher with the key-square. Other demonstrations,
based, respectively, on French and Italian language characteristics,
can be found in General Givierge’s _Cours de cryptographie_ and in
General Sacco’s _Manuale di crittografia_. (In the French work, the
cipher is referred to simply as “orthogonal and diagonal substitution.”)

* * *

It will be seen from the foregoing that the initial difficulty lies
in the correct identification of the first few pairs, and this, in a
short cryptogram, is no small difficulty. By whatever means it is
found possible to make these first tentative identifications, the
operation which is to admit or disprove their correctness is step
No. 2, in which we set them up as equations and then attempt to
replace them into their connected relationships in the key-square. If
this cannot be done, they cannot be correct; and, on the other hand,
it would be an extremely rare case indeed in which we could combine
as many as five or six such equations into one framework and then
find them incorrectly matched. To understand “equations,” suppose we
look at Fig. 168.

Figure 168

POSSIBLE RELATIONSHIPS

(a) A 3-letter Equation (b) A 4-letter Equation

Vertical Horizontal Vertical Horizontal Rectangular

I
T K I . K
H T H R . I K . S Y . .
R S Y . S
Y

(c) Impossible Equations: (d) Possible Equations:

co nd em na ti on -c on de mn at io n-
EO ND EC TC TI AD EO ND EC TC TI AD CT

Assuming that the beginning pairs of our cryptogram, _HR KY_,

represent the word _this_, we have two equations, _HR_ = _th_, and
_KY_ = _is_. The first of these has only three different letters,
since _H_ is common to both members, while the second has four
different letters. With the first case (a), one of the lineal
encipherments must have been used, and the common letter, _H_, must
have stood between the other two, with its plaintext partner coming
first and its cryptogram partner coming last. We do not know whether
these three letters stood in a column or in a row, but we do know
that they were consecutive. This relationship may be expressed simply
as _T H R_, even though, in the actual square, the letters may have
been partly at the end of the row (or column) and partly at the
beginning: _H R * * T_ or _R * * T H_. Encipherment, remember, is
cyclical, and we may come out with any one of numerous “equivalent
squares.” With the second equation (b), the positions of letters are
not so definite. In either of the lineal encipherments, _IK_ must be
in direct sequence and _SY_ must be in direct sequence; either
sequence may have come first, and we do not know the exact location
of the fifth letter. Concerning their possible rectangular
encipherment, all we know is that there must have been a parallel
relationship; their distance apart, laterally or vertically, might
have been anything permitted by the key-square. As to the rest of the
figure, suppose that we have reason to suspect the presence in this
cryptogram of the word “condemnation.” The equations of (c) are
totally impossible, since, in Playfair, no letter may be its own
substitute. Those of (d) are not only possible, but probable, since
we find many letters from the word itself.

Figure 169
 Equations of (d),(Fig.168) Possible Combinations

1 2 3 4 5 6 7 8

O D O
N O N D E D E C N O N D O
D C D E N O N D E C
E C D E C
C

9 10 11 12

M
T M . T O N D E C
. M T . N C . . . .
N C . N T M
C

13 14 15 16

A O N D E C O N D E C
T A T I . . . .
I A A T I M
T M
I

To learn whether or not the word “condemnation” does (or could) occur
here, we proceed as in Fig. 169. The first of the five equations may
have had either one of the relationships marked 1 and 2, and the
second may have had either of the relationships marked 3 and 4. These
two equations have a letter _D_ in common, and it must not be
impossible to form a combination which will represent both. This, as
it happens, can be done in four different ways, marked 5, 6, 7, and 8,
and we do not know which of the four is most likely. The third
equation, which has four different letters, may have had any one of
relationships 9, 10, and 11. These, fortunately, show two letters,
_N_ and _C_, which are also present in combinations 5, 6, 7, and 8,
and with two common letters, there will not be so many possible
adjustments as when we had only one. Nos. 9 and 10, for instance,
cannot possibly combine with any one of combinations 5, 6, 7, and 8;
both of these have demanded that the letters _NC_ be in direct
sequence, where the first four combinations will not permit this. We
may begin, then, by discarding Nos. 9 and 10. But No. 11, which we
have retained, demands of _C_ and _N_ only that they be on the same
row. This is not permitted by any one of combinations 5, 6, or 7, and
these also may be discarded. But No. 8 shows them on the same row;
thus Nos. 8 and 11 may be further combined, and we have the
combination marked 12. The fourth equation, another lineal one, may
have had either of the relationships marked 13 and 14, and both of
these will combine easily with the combination marked 12, so that
again we have more than one possibility, as indicated under numbers
15 and 16. As to which of these is correct, the fifth equation,
_io_ = _AD_, is impossible to one, and has automatically been set up
in the other.

* * *
We are safe, now, in making substitutions on the cryptogram. This
means not only the five pairs originally identified, together with
their reversals and possible reciprocals, but all others which can be
derived from combination 16, such as _om_ = _CA_, or _dm_ = _CI_, or
_en_ = _DC_, together with their reversals and possible reciprocals.
Then, too, there will be many partial equations, such as those
indicated in Fig. 170, where one letter of a pair can be identified.
Usually time is saved by taking cryptogram pairs just as they come
and filling in as many letters as possible; in this way, patterns are
sometimes brought out, and thus we come back to step 1: the
identification of more pairs. With the key-square beginning to shape
up, the “chart of probable position” may be used to good advantage.
For instance, what about the letters _H_ and _B_ which were very high
in the frequency list?

Figure 170

O * * E N * E DE EC
. . . .
A T I M

Once a beginning is made, the cipher is broken, though just how

rapidly we may proceed with the solution depends chiefly upon the
manner in which the square has been filled. The presence of
alphabetical sequences (either horizontal or vertical) will often
enable us to complete the key-square independently of the cryptogram;
but the badly mixed square must usually be built up to the very end,
and we must sometimes be satisfied with one of the “equivalents” in
place of the square originally used. If the student cares to make a
fresh beginning of his own, this same cryptogram contains the word
RECONSTRUCT.

* * *

Figure 171

S E N D D D S T O A R D A M M
I A M O N M X S T E O N D A Y

The Playfair has been, in its day, a very effective cipher, and is
still good for many purposes. It can be rendered much safer if
subjected to the process called _seriation_. This process may be
examined in Fig. 171. Here, the text is “Send diamonds to Amsterdam
Monday,” and the agreed _seriation index_ is 5. The text is written
in pairs of five-letter lines, so that each ten-letter segment forms
five _vertical pairs_, _SI_, _EA_, _NM_, etc., and these are the
pairs which undergo the digram encipherment (notice the treatment of
the doubled _S_ in the second group). If the key-square is that of
Fig. 166, the first ten-letter segment is enciphered _QK_, _UF_,
_TG_, _SA_, _RS_, and the cryptogram may be taken off in that order,
or by taking the upper and lower lines separately:
_Q U T S R_ _K F G A S_. Seriation, it will be noticed, adds a
transposition to a substitution, so that what we have here is
combination cipher. This case, in short examples, is extremely
difficult; it is mentioned only by way of general information, and
is not included in the practice cryptograms which follow.

149. By NEMO. (Playfair. Probable words: ENEMY AGENTS).

OS CF WD OG DR AN PO AS OA DH SD EH XK FU CN DR PF UK SD.

150. By NEMO. (Playfair. Probable words: AUTHORIZED, EMERGENCY).

PK HL PG RI YH YN HQ IF YF GY ZL EB YF UK NK NG FL FG OL BD GX GK FC PK HG NV AC ZL
KH PK FG FK RZ FG RQ XO IB PB BD LE MV KG GY OL AD FK OR FC LK YN HL LK KZ IF EF AX
NG ON BV IK BI PK IO HQ IF AG LX YA FK AD YG KO AK EG TO OH BI RB OL ON KM FO PK KY
PR EF DZ IF AY QH CZ OK IQ WP FG LF DM CA VO GW PK NG KX KO LH AG NB RT NG KO KH HK
OX ML GP ML PB QD RB OH EB LH NK NG FC PK KY QS LH NE IQ WP FG.

151. By PICCOLA. (Figure 164; new external alphabets. THE, THIS, CHARACTER).

NF BJ HT MD NF WJ GD UC HN FW QI CE HP NF IA SE HS HS LG QA IY QD HV CC LB NF IA IA
CL GA RJ BD NM MA SY KU RD FT HC US HN GH VJ UA SY UL HN XJ EG QQ CJ LB NF KJ CN CS
UK GJ MD NF IA FK NQ GJ XX.

152. By PICCOLA. ("Slidefair." Probable word: DESCENT).

AA FS AF XY GJ BD UI AA PW GN IV QZ RC NK CC WA FT QQ PR GP TT WF PS JS QC HM DI XC
AH JP FB DC EW OX UG GP UI US CV GP MH QR OG JI ZR.

153. By DAN SURR. (Playfair. History: Detective Gettamann, investigating the

murder of Francis V. Bacon, well-known traveler, explorer, and
connoisseur, has found this message in an envelope addressed
to Wm. K. Pierce, former traveling companion of the deceased.
Death had occurred during sleep; caused by strangulation with
red silk thread. Only clues found: a few grains of sand on the
kitchen floor and what appears to be an oriental turban).

YG NG CR FV FZ RI OU KZ CW OW BQ GQ IH HL YW EG NG QM WX RT KP VE CA IG QI VD QI GN
GZ IZ QY QR HY NG XN AB AK OX NY WC WC TN OX DH NE IH IH YR IS QY WC HI UI UI IR QE
WS RW LG WR AB GW VW CA RQ XM ER QM RE CW ZI RQ XW QW GH YC AY YO VO NE RL PG CG WI
NX VW CA NX QM LH IG RQ WT GO UI GZ EG XN IW OU XT WO LH IG RQ XM WS QY TX IR IQ XM
OG DU AB RM AK UM RG ZR XA PM RW LD KG HI XK LC RT KP VE FO NX XK WR WS QY UR ZX YL
AT UI RH TR AV WS DH WQ PM AK IW OU WT DE IR WX RQ XZ SI GU QN IR XN IR YN IG GY TR
ZX YU RU YL IQ YA RU KG QM PD QM IY HA WS FE RW GH RB HA QI QM GI QC QR UL WV AB NX
GO HA FR IY QY BM QM YH NG IQ RU YL IQ BL PO QM RU GU IR TX SI GQ LQ DX XO EV BM CR
FV GV AB GE RZ GQ YH HA RW YM NE YM BL VW PS.

CHAPTER XXII
Highlights of Fractional Substitution

Fractional substitution requires a cipher alphabet of the “multifid”

type; that is, one in which the symbols are composed of two or more
units, as in the Bacon and Trithemius alphabets (Chapter II: Figs. 3
and 4), the various “checkerboards” (Chapter XI), and so on. Polygram
“alphabets” are also of this type, and seriation is a forrn of
fractional substitution.

Among the older fractionals, we find a system called the “Pollux,” in

which the basis was the Morse telegraphic alphabet. There were three
units, the dot, the dash, and a separator (made necessary by the
irregular lengths of the substitutes). There was a first substitution
in which the letters of the text were replaced with their Morse
symbols, including the space. The resulting cryptogram, composed
entirely of the units dot, dash, space (. — x), was then subjected to
a second substitution, using a small cipher alphabet (either digits
or letters) in which each one of the three units might have any one
of several different substitutes, chosen at will. For instance, a dot
might be replaced with any one of digits 1, 8, 5, 6, a space with any
one of digits 3, 9, 0, and a dash with any one of digits 2, 4, 7.

Figure 172

Delastelle's "BIFID" Substitution -(Keyword Feature Added by M. E. OHAVER)

Preparation of Alphabet: Checkerboard Key: Substitutes:

G E N • R A L 1 2 3 4 5 S = 43
B C D F H I K E = 15
M O P Q S T U 1 G B M V E N = 24
V W X Y Z 2 C O W N D D = 25
3 P X F Q Y
4 R H S Z A
5 I T L K U
Preliminary Substitution:

S E N D S U P P L I E S T O M O R L E Y S R I G H T A W A Y.
4 1 2 2 4 5 3 3 5 5 1 4 5 2 1 2 4 5 1 3 4 4 5 1 4 5 4 2 4 3
3 5 4 5 3 5 1 1 3 1 5 3 2 2 3 2 1 3 5 5 3 1 1 1 2 2 5 3 5 5

Re-Substitution:

41 22 45 33 54 53 51 35 51 45 21 31 53 22 12 45 13 43 21 35 53
R O A F K L I Y I A C P L O B A M S C Y L

45 14 54 21 11 22 53 43 55 Transmitted:
A V K C G O L S U.
R O A F K L I Y I A C P L O B, etc.

We find also a number of systems called “Collon” in which the basis

is some one of the “checkerboards.” The text is subjected to a simple
substitution in the agreed alphabet, and the resulting cryptogram is
then subjected to a transposition, usually seriation, this being the
final operation.

A similar system called the “Mirabeau” uses an alphabet of the same

type as that of the _Polybius square_, in which only the digits
1-2-3-4-5 are significant. The remaining digits are all null, and
numbers like 67 or 88 may be inserted at will. Numbers are written
vertically (tens below units); then, in the taking off of the
cryptograms, the whole series of units is taken first, and the second
half of the cryptogram includes all of the tens-digits. In all of
these forms, the undesirable features are self-evident. The later
devices have added another operation: the regrouping of the scattered
units, and their reconversion into letters.

Classic examples are those described by Delastelle as “bifid” and

“trifid” (terms, incidentally, which some of our own writers find
objectionable, as they do also the term “multifid”). Delastelle’s
“bifid” cipher was of the kind shown in Fig. 172. A two-unit alphabet
must be used, and all possible two-unit combinations must be
convertible into letters. Any desired seriation-length may be agreed
upon, though it should not be divisible by 2. In the figure, the
key-word GENERAL, 7 letters, governs the seriation-length as well as
the mixing of the key-square, a feature suggested by Ohaver. The
substitution is identical with that of the Polybius square, except
that the two units of the substitute are written vertically below the
original. Digits are then grouped horizontally in pairs, treating one
seven-letter group at a time (if the seriation index is 7), and these
pairs are replaced with letters from the same key-square. It will be
noticed that we have here a form of polygram substitution, in which
one seven-letter group has been replaced with another. Also, that
possible errors have been confined by the seriation feature to their
own seven-letter group.

Figure 173

A Fractional Substitution Based on Morse Symbols - M.E.OHAVER

The Alphabet, Arranged by Group-Lengths:

E . S ... H .... B -...

T - U ..- V ...- X -..-
R .-. F ..-. C -.-.
W .-- ü ..-- Y -.--
I .. D -.. L .-.. Z --..
A .- K -.- ä .-.- Q --.-
N -. G --. P .--. ö ---.
M -- O --- J .--- ch ----

S E N D S U P
... . -. -.. ... ..- .--. Reverse digits, and re-group:
3 1 2 3 3 3 4 4 3 3 3 2 1 3
.... -.- ... ... .- . --.
H K S S A E G

Delastelle’s “trifid” cipher was of the same kind, except that a

three-unit alphabet was required, resulting in three rows of units.
It would have been the same as that of Fig. 4, Chapter II, but with
the French accented _E_ replacing the character _&_. All combinations
of three units must be re-convertible into letters.

Fig. 173 shows a form of “mutilation” cipher once published by

Ohaver. Beyond stating that its only key is the group-length (7 in
the example), we leave the student to figure it out for himself.

As an example of recent use (1918), we are told on excellent

authority that the Germans, for quite a long time during the World
War, used a field cipher of the following description: There was a
preliminary substitution using a key-square of the Nihilist type,
except that the external co-ordinates were letters, and not digits,
and were chosen in such a way that the five or six letters used were
letters having very distinctive Morse symbols; this was for the
avoidance of telegraphic errors. In some cases a 5 x 5 square was
used, containing only a 25-letter mixed alphabet, and in others a
6 x 6 square containing a 26-letter mixed alphabet and all of the
digits. The preliminary cryptogram obtained from this first
encipherment was then written into a transposition block and taken
off by columns, using key-word columnar transposition. The
cryptograms were not afterward shortened by resubstitution, but were
always twice as long as their messages, and never contained any other
letters than the five (or six) originally used as co-ordinates. This
German Field Cipher proved very effective until finally broken by the
great French analytical genius, Georges Painvin.

We shall make no attempt, here, to go into the decryptment of these

ciphers. The Delastelle “bifid” is, perhaps, a practical cipher, and
the student may try his own hand at analyzing the example. The other
examples should give no trouble.

154. By PICCOLA. (Delastelle's "Bifid." - Repeated words: AMERICA(N), ATTEMPT,

REPORT, THAT, THE, OF, TO. Other short words: FROM, WITH,
BEEN, HAVE. Likely words: REPORT, AGENT, CONFIRM, CABLE, etc).

Q I N H P R M L M G R N B M A H G T O L O O E L O A O D R I N H W R O
A A B M M I M M W I B M D A B T H D I L T H T H I N T L A Q M C A M F
I V N K Y N O F H B I I T R F Q L A D K V Q I N H P R M R B H S L L U
A B M E T S O A A B M M I M M I B P I V R Q F T K H I R D F G N I E M
A B E N I L M M P A S I F I O P L Y C C R C I T W I V W M F G I O O S
O E R O I K Q I E F O V N V M Q T D R S I O E R I B U Q C D O A L L A
P L A A O O C A Q O M E I D C N T I U L O L Z D G.

The mixed alphabet here was placed in the square by straight horizontals. History:
Message intercepted following a report that on the tenth of August an attenpt had
been made to enter the American embassy in a country where Royalists are opposed to
a group of radicals.

155. By PICCOLA. (Fractional. - Not so hard).

3 3 3 2 3 1 1 1 2 3 2 2 1 3 1 1 1 1 3 1 3 3 1 1 3 2 2 1 2 2 1 1 2 3 1
2 3 3 2 1 2 3 3 1 1 3 2 1 1 2 1 2 2 2 3 1 2 2 2 3 1 1 2 2 1 2 3 2 3 2
2 1 2 3 1 3 3 2 3 1 1 2 2 1 3 2 1 2 2 3 2 1 3 1 2 2 2 2 3 2 3 2 2 2 2
3 1 1 1 3 1 2 3 2 1 1 2 2 2 3 2 3 1 3 2 2 2 2 1 2 3 1 2 2 1 2 1 2 2 1
1 2 2 3 2 3 2 2 3 2 2 2 3 2 2 3 3 1 2 2 3 1 2 1 3 1 1 1 1 2 1 3 3 3 3
1 2 3 3 3 2 1 3 3 1 1 1 1 2 2 3 1 1 3 1 1 1 1 1 1 1 1 3 2 2 1 2 3 2 2
2 1 2 1 2 1 2 2 2 3 3 2 2 1 3.

156. By PICCOLA. (Fractional. - Nor is this very hard).

E D C Y B A Z C B Z A V W X C X B A E Y D C B V A E D W B X A E Y Z D
A E Z V W D C A E D X C B Y D Y Z V C B W B A Z V E W X B X A E Y D C
B V A E W D C X A E Y Z D C E Z V D W C B E D X C B Y A Z D C B V W A
A E D C B A E E W D C B X Y D C Y Z B V A B A Z V E W X A E W D C X Y
E D Y Z C B V E D C W B A X E D Z V C B A C B V W A X Y X B Y A E D Z
E Y Z D V W C W E D X C B A D Y Z V C B A D C W B A X E E D C B A V E
D C X Y B Z A E D C B A E W D Y Z C B V A B A Z V E W X E D V W C X Y
X D C Y B A Z C Z B A V E W B A E W D X Y E D X Y C Z V V E D W C B A.

CHAPTER XXIII
Investigating the Unknown Cipher
When the type of encipherment is unknown, the decryptor’s first
problem may concern the probable language used in the plaintext, and
this he is usually able to determine from the source and history of
the cryptogram.

His second problem is the major classification, and this, too, is

usually simple, since transposition, as a rule, can be recognized by
its appearance. It must, however, respond to a group-test, and for
cases in which this is needed, the approximate percentages for English
can be taken as follows:

Vowels, with or without Y, about 40% (Variation limits: 35% to 45%)

Consonants L N R S T about 30% (Variation limits: 25% to 35%)
Consonants J K Q X Z about 2% (May be influenced by nulls).

The 5% variation is suggested in the Parker Hitt Manual. In this

connection, it should be pointed out that an apparent transposition
with exactly 40% of vowels and 100% evenness in their distribution
is suspicious. Many of the checkerboard systems result in this way,
and also some of the codes based on pronounceable five-letter groups.
Then, too, it is easily possible to construct a simple substitution
cipher alphabet in such a way that the resulting cryptograms will
resemble transposition, and even respond satisfactorily to a
group-test. It should be carefully ascertained that a supposed
transposition cryptogram does not contain the many repeated sequences
which belong to simple substitution. As to those transpositions which
do show an appreciable number of repeated digrams, they will probably
have undergone one of the route transpositions, especially one in
which columns were taken off in alternating directions.

* * *

Concerning the characteristics of simple substitution, these have

been seen throughout the text; we have normal frequencies attached
to the wrong letters, and we have those numerous repetitions of
various lengths, occurring at all kinds of intervals, which are never
found in a transposition. Here, too, we may apply a group-test, based
only on the relative frequencies of letters. The five most frequent
are supposed to represent the letters _E T A O N_ or their equivalents,
and should total about 45% of the text. The nine most frequent should
total about 70%; the eleven most frequent well over 75%; the five of
lowest frequency (which would include all of those totally absent)
should correspond to the normal behavior of the group _J K Q X Z_.

* * *

If the simple substitution frequency count is present without the

repeated sequences, then we probably have a combination of simple
substitution with transposition. It becomes necessary to rewrite
the cryptogram into various new arrangements until one is found which
will bring back the repeated sequences. Ordinarily, the simplest
kinds of transposition will have been used; sometimes the
transposition will have taken place in a complete-unit block, and
there will be a clue in the total number of letters present in the
cryptogram.

* * *
When all letters are present in the frequency count (or all but one
or two in the possible cases of 25-letter and 24-letter alphabets),
a period-investigation is usually indicated. The case of periodics
has been seen at considerable length, though a final hint might be
added for the detection of a possible Porta encipherment. One of our
many collaborators, F. R. Carter, suggests that any Porta cryptogram,
periodic or otherwise, ought to show from 52% to 53% of letters _N_
to _Z_ — the opposite of normal.

The characteristics of digram-encipherment have been mentioned. Other

polygram ciphers show corresponding characteristics, according to the
polygram length, though the trail grows fainter as polygrams grow
longer. A trigram-system, for instance, might be present when the
cryptogram is evenly divisible into three-letter groups; it might
suggest period 3, and might even show repeated sequences whose length
is a multiple of 3 and which begin at serial positions such as 1, 4,
7, 10, which are the beginnings of trigrams. A great many of the
trigram systems will show only repeated digrams beginning at these
serial positions, or separated by intervals which are divisible by 3.

A 5 x 5 square is often suggested in the fact of a missing letter;

but the fact of 26 letters does not deny one, since the careful
encipherer may make use of his missing _J_ instead of using _I_
exclusively. Great evenness in frequencies may suggest one of the
key-lengthening devices, such as autokey and progressing key; and
the practical absence of repeated sequences will usually mean that
a transposition has been added to a substitution. It is never a bad
idea, in a puzzling example, to make the various digram-counts (in
chart form): An actual digram count, in which every letter is
considered the beginning of a digram; a pair-count on separated
pairs, as in Playfair; the two counts which could be made with the
cryptogram marked off into three-letter groups; and the kind of
pair-count which could be made in Playfair if the first
cryptogram-letter were omitted. Many devices, as mentioned, may be
uncovered simply by “running down the alphabet.” And if the
cryptogram has come from an amateur “inventor,” it may be a case
of digging into one’s memory for previous “inventions.” With this
last case, however, the “inventor” very often fails to submit
material in proportion to the amount of complication he has introduced.

* * *

Of the examples to follow, there is none in which the system may not
be learned through analysis, unless perhaps the final unnumbered
cryptogram, and the material, in every case, should be suffcient for
solution.

No. 163 follows Mr. Berkley’s encipherment plan, illustrated just

above it.

No. 164 is said to have been taken from a German spy serving in the
American army in France. This applies, however, to the first fifty
groups only; the remainder was added to increase the length and to
emphasize the plan followed by the spy.

No. 166 was accompanied by a plot:

“Supposed to have been found on the body of a man floating in San

Diego Bay. Autopsy shows death by drowning. Victim was a local banker
who had disappeared a few days earlier. Wife says no financial
worries. No money missing. Banker had prospered during depression.
Was yachting enthusiast. Our hero solved the cipher with the
unconscious assistance of a radio crooner. Tragedy occurred in
_August, 1932_.” The date was doubly underscored, but those who have
read the message have found no reason for this and no explanation
for the “crooner.”

157. By PICCOLA.

C S R Z V Y P Q Z J K H K V Q U U C V M R T W Z N G H Q S A K O X P M
H D R W A J D F Q D F S R Z Z C G X P A J J T Z U L H T G S A H X J J
L T R N N Z P B Z G R E B N F Y G E J N M T N J J Q H P J X M O B J A
L X I A I C P F J O O F R N H.

158. By PICCOLA.

O C E E A T T I T K S N D T D S T H O O Y E A O E E P E B O T Y T A O
A D S E O E T F T T T H R V W C T H O Y L T O O H L R B T T U H R R V
R A W O B R U A O Y E H H L A B N E R L R K V C R I O N S E I D R U E
R I P.

159. By TITOGI.

A H Y N U H C E S T I T N D O R F E H R W E A T F N R F P A O T M A T
L H R E I O T N R L O D R H E E A T E S C T D I N W T S T O E A T S I
T E C D U T M S O T R L D O N G N I I S O F A E T L I T A S.

160. By PICCOLA. (Veiled reference to crypt No. 166?)

(a) H Z M Q L D N N D Z S P R F S K L L L L. (b) L I L V M S T Z U G
D H Z U Q X L L L L. (c) T V I U M F R U O Y U Q Y P S F W X L L.
(d) L I L V M F P O E Y Z K F D V U E L L L. (e) G K P V D Z T A Y T
B F Y Y C F I U L L. (f) Q B F P W Y C L U D V P Z Z O S W Y N C.
(g) Q B R T F F G V T U E N S Z H B Q E R L.

161. By PICCOLA.

E G W G W G E G T U C L C U O X G K Z T E G O B G B Y L W M I Q N K Q
Y E N F S C L H M N Y B X S E T N I W O C E G C B F C T C S Z T V G B
E A E G T U R K F K B E G K X B C T G Z Y L X C H Y E G C U O X Y T Q
F A D Q T T C U N B O G C O H X C E W E C U V E G C O C X Y X G B E A
Y T K X F Q C O T B X N E G T U C O N T O P E L E K U V U N T O C N G
N G B K W C E E C S Z K W N H E I K C C R E G C T E G T U R K F K T B
R G M W X C F G Q N I C E B P E E W E N B K I Y F K F D O F E G N U C
B G M T Z T F X C E W E C F V D T T U Z T E N E G W G L F M C T O V L.

162. By PICCOLA.

S P P A S T A S E F U N M T E H S O O A E S L E I C T R C H V U G S E
L Y R E M E N E E R O S N E H I R A E T O R N S H M O D R O P E A O R
P O S R Y P D O I N O C K G T.

The "NICODEMUS" Cipher (Harold Berkley) SPECIMEN ENCIPHERMENT

Key: M E T H O D I C M E T H O D I C M E T...
6 3 8 4 7 2 5 1 6 3 8 4 7 2 5 1 6 3 8...
Cryptogram:
 T H I S I S E N A N S P O S E D E T C...
C I P H E R E D U S I N G T H E PFGVT VUHDG LMRIV
I V V I G E N E S A M E K E Y F ZOPUH MMVNB FOUDQ WSURF
R E A N D A F T O R B O T H O P BIOTP FGHRU VWHKR RWEVV
E R W A R D T R E R A T I O N S WULVA MPGWV MGEAQ CUYHW LBFUT.

163. By PICCOLA.

T Y D Q V W P A Z O M B W B I R K F I O O G W C O G E F L T Q M S R F
X T C J C M A W P P Q M E X V O Q C O C Z F S F W V F E V E R S A B E
C V J J W S I P P H M M K O X V Y I D B D B C I S Y N L J C Y F K C W
E N Z E I T J V L Z M I L I I R W K R O O S Z A W E K J V J G F M Q K
G F N C K H P B R D L V I A P E S L V M D J Z Z V F Z F F R D B A D P
Q W E N L A L O E K M F M F W X O K D W D G C K K K C Q R V.

164. By VULPUS.

P E N A R C P F T I Q E V A T E N B L A T K Q F O A R E N E U I P E P
F U K X I L C N F Q E P C V B T A W A O B N C O E T I N D W B N A R D
Q F O F N B V C P E P G V G P A V A P B P F O A O B S C L B V B T F W
A N E W B T C S D N F M A N A O E V A R A R C T K Q E N B M B Q F V E
V B X K O A P E T B U I P F O F Q E L E O B R D R B Q F U A W A S C U
K L F P E W B O C O D N A M E L G V F V A N C N D M F N B V D T D L E
P F V I T I Q E Q F O C O A U C L F L A O B M E P E N A S D L B T K L
H N E P D. ..... U I L A L B O B M A V K M G U K R F P F U B U D M
F W E T A T I Q E V B R C M B W A N F Z I L E N A Q F W B T C R D T B
T K O E P E U A V A O F N B S C Z K V B W C U B O A L F O B M E X I T
D Q C Q D W A P F Q E N A L A.

165. By PICCOLA. (Again that No. 166?)

R O V L L A B T L D L B C Q M P X L B A F B T C T A T C O R L T O L C
R H P D T X L Y O A E L B X P H L X B T X X Q L D R G L T K X R L G D
B K L D P P L O H L Y O A E L K O M X B L H O E L V C R R C R J L T K
D T L R C I N X P L L L T K X L R C I N X P L V D B L V O R L P O R J
L D J O L F Y L I O P O R X P L M D E N X E L K C T T L V K O L O H H
X E X G L T O L I O Q M E O Q C B X L H O E L T V O L I X R T B L B C
R I X L K X L V D B L D F P X L T O L B X R G L T K X L B O P A T C O
R L F Y L E X T A E R L Q D C P L L B T C P P L C T L V O A P G L F X
L V O E T K L D R O T K X E L R C I N X P L T O L H C R G L O A T L T
K X L N X Y L L T K C B L Q A B T L F X L T K X L X W M P D R D T C O
R L O H L T K X L E X H X E X R I X L T O L D L I E O O R X E L D R G
L T K X L X Q M K D B C B L O R L D L G D T X L L M L B L T K X L T V
O L I X R T B L K D B L R O T L Y X T L F X X R L M D C G L.

166. By CACHE. (Contributor, C. H. Price, died without explaining his key).

03 65 12 45 58 28 06 41 72 14 22 03 02 17 36 88 25 20 55 77 74 51 23 45 41 42 30 24
36 61 96 09 07 78 05 44 08 06 55 92 16 93 02 15 36 37 40 87 41 01 33 77 06 36 27 54
48 29 16 78 92 66 03 10 38 17 45 23 72 96 73 01 49 25 72 38 92 72 24 55 48 08 40 92
28 01 72 96 02 04 74 61 06 99 30 45 72 69 74 93 77 23 55 36 24 93 47 84 76 35 32 89
87 76 77 64 51 96 58 43 76 02 81 38 87 69 89 55 99 23 79 55 51 06 99 71 74 69 89 84
27 25 22 39 42 53 19 93 41 66 09 75 87 37 91 87 90 91 43 19 40 30 38 16 96 22 69 38
78 02 74 92 47 25 77 91 15 40 24 45 07 07 96 48 44 15 12 06 99 44 93 19 25 23 55 30
45 87 96 18 01 78 44 29 45 86 47 69 48 30 66 44 03 41 66 37 38 22 06 42 41.
59.

Here is one which nobody has ever been able to decrypt:

V Q B U P P V S P G G F P N U E D O K D X H E W T I Y C L K X R Z A P
V U F S A W E M U X G P N I V Q J M N J J N I Z Y K B P N F R R H T B
W W N U Q J A J G J F H A D Q L Q M F L X R G G W U G W V Z G K F B C
M P X K E K Q C Q Q L B O D O Q J V E L.

APPENDIX

ENGLISH FREQUENCY AND SEQUENCE DATA

(Compiled from the MEAKER Digram Chart)

Order and Frequency of Order and Frequency of

Single Letters Leading DIGRAMS

E 1231 L 403 B 162 TH 315 TO 111 SA 75 MA 56

T 959 D 365 G 161 HE 251 NT 110 HI 72 TA 56
A 805 C 320 V 93 AN 172 ED 107 LE 72 CE 55
O 794 U 310 K 52 IN 169 IS 106 SO 71 IC 55
N 719 P 229 Q 20 ER 154 AR 101 AS 67 LL 55
I 718 F 228 X 20 RE 148 OU 96 NO 65 NA 54
S 659 M 225 J 10 ES 145 TE 94 NE 64 RO 54
R 603 W 203 Z 9 ON 145 OF 94 EC 64 OT 53
H 514 Y 188 EA 131 IT 88 IO 63 TT 53
TI 128 HA 84 RT 63 VE 53
AT 124 SE 84 CO 59 NS 51
Group Percentages: ST 121 ET 80 BE 58 UR 49
EN 120 AL 77 DI 57 ME 48
A E I O U 38.58% ND 118 RI 77 LI 57 WH 48
OR 113 NG 75 RA 57 LY 47
L N R S T 33.43%
List of Common REVERSALS:
J K Q X Z 1.11%
ER RE ON NO TE ET ST TS
E T A 0 N 45.08% ES SE IN NI OR RO IS SI
AN NA EN NE TO OT ED DE
E T A O N I S R H 70.02% TI IT AT TA AR RA OF FO

Order of the Leading TRIGRAMS

In 10,000 Letters of Semi-Military Text - PARKER HITT

THE ENT FOR NCE OFT

AND ION NDE EDT STH
THA TIO HAS TIS MEN

INITIAL LETTERS OF WORDS:

Order, as found by M. E. OHAVER ... T A O S H I W C B P F D M R, etc.

Order, as found by H. O. YARDLEY .. T O A W B C D S F M R H I Y, etc.

FINAL LETTERS OF WORDS:

Order, as found by M. E. OHAVER ... E S T D N R O Y, etc.

 Order, as found by H. O. YARDLEY .. E T D N S R Y, etc.

NOTE: Lists of terminals (letters, digrams, trigrams); of common affixes,

short words, and common pattern-words, can be found in the booklet
"CRYPTOGRAM SOLVING", obtainable from the author, M.E.Ohaver, at
Columbus, Ohio.

X J M M T V O Z B N Q M F B T F S F N J U G P S U I J T B E ?

COMPARATIVE TABLE OF SINGLE-LETTER FREQUENCIES (Per 100)

ENGLISH GERMAN FRENCH ITALIAN SPANISH PORTUGUESE

A 7.81 A 5. A 9.42 A 11.74 A 12.69 A 13.5

B 1.28 B 2.5 B 1.02 B .92 B 1.41 B .5
C 2.93 C 1.5 C 2.64 C 4.50 C 3.93 C 3.5
D 4.11 D 5. D 3.38 D 3.73 D 5.58 D 5.
E 13.05 E 18.5 E 15.87 E 11.79 E 13.15 E 13.
F 2.88 F 1.5 F .95 F .95 F .46 F 1.
G 1.39 G 4. G 1.04 G 1.64 G 1.12 G 1.
H 5.85 H 4. H .77 H 1.54 H 1.24 H 1.
I 6.77 I 8. I 8.41 I 11.28 I 6.25 I 6.
J .23 J ... J .89 J ... J .56 J .5
K .42 K 1. K ... K ... K ... K ...
L 3.60 L 3. L 5.34 L 6.51 L 5.94 L 3.5
M 2.62 M 2.5 M 3.24 M 2.51 M 2.65 M 4.5
N 7.28 N 11.5 N 7.15 N 6.88 N 6.95 N 5.5
O 8.21 O 3.5 O 5.14 O 9.83 O 9.49 O 11.5
P 2.15 P .5 P 2.86 P 3.05 P 2.43 P 3.
Q .14 Q ... Q 1.06 Q .61 Q 1.16 Q 1.5
R 6.64 R 7. R 6.46 R 6.37 R 6.25 R 7.5
S 6.46 S 7. S 7.90 S 4.98 S 7.60 S 7.5
T 9.02 T 5. T 7.26 T 5.62 T 3.91 T 4.5
U 2.77 U 5. U 6.24 U 3.01 U 4.63 U 4.
V 1.00 V 1. V 2.15 V 2.10 V 1.07 V 1.5
W 1.49 W 1.5 W ... W ... W ... W ...
X .30 X ... X .30 X ... X .13 X .2
Y 1.51 Y ... Y .24 Y ... Y 1.06 Y ...
Z .09 Z 1.5 Z .32 Z .49 Z .35 Z .3

Vowel Percentages:

English German French Italian Spanish Portuguese

40% 40% 45% 48% 47% 48%

Percentages for L N R S T:

33% 34% 34% 30% 31% 29%

NOTES: ENGLISH frequencies, which may be compared with those of Mr. Meaker,
(A, 8.05; B, 1.62; C, 3.20; etc.), were taken from M.E.OHAVER.
FRENCH, ITALIAN, and SPANISH frequencies were taken from a count
made by the author. All four counts are based on 10,000 letters
of literary text, and the dropping of the decimal point gives
the actual count. The frequencies given for GERMAN and PORTUGUESE
 are approximations, reduced from other texts, probably military.

Chart Showing Normal CONTACT PERCENTAGES - Compiled by F. R. CARTER

(Based on a Digram Chart by M.E.OHAVER)

%
%
V. C.
V. C.
19 81 P4 L4 C5 D5 M5 N6 S6 W7 T8 R8 E11 H14 A N21T17S12R10L8 D5 C4 M4
6 94
55 45 Y4 B4 N5 T5 U8 D9 O9 S10A16E16 B E34L17U11O9 A7 Y5 B4 R4
70 30
61 39 U4 O5 S8 N13A13I18E20 C H19O19E17A13I7 T6 R4 L4
K4 59 41
52 48 R4 I5 L6 A10N29E39 D E16I14T14A10O8 S6 U5
54 46
8 92 C4 B4 E5 M5 V5 D5 S5 L5 N6 T6 R11H24 E R15D10S9 N8 A7 T6 M5 E4
C4 O4 W4 21 79
69 31 S4 N5 F5 D5 A6 I7 E12O41 F T22O21E10I9 A7 R5 F5 U4
52 48
36 64 O4 D4 U5 R5 I9 E9 A10N48 G E14H14O12R10A8 T6 F5 W4
I4 S4 42 58
7 93 G4 E5 W5 S7 C9 T62 H E50A23I12O7
90 10
13 87 F4 M4 W5 E6 N6 L8 D8 S8 R9 H11T14 I N25T13S10O8 C7 R4 E4 M4
A4 L4 17 83
28 72 Y7 W7 T7 S7 N7 E7 C7 B7 A14M29 J U35O29A12E12M6 W6
88 12
53 47 Y5 U5 I5 N7 A11R13E13O15C18 K E34I21N10A9 T7 S6
68 32
52 48 N4 P4 T6 I7 B7 U7 O10E11L11A17 L E19I15Y12L12O9 A8 D7 U4
65 35
69 31 S4 D4 M5 R5 I12A13O16E24 M E26A17O12I11P5 M5
71 29
89 11 U7 E14O22A23I24 N D16T14G12E10A7 S7 O7 I6
C5 32 68
21 79 M4 O4 D4 L4 P4 H5 N6 E6 C7 F7 S8 I8 R9 T11 O N20F14R11U10T6 M5 L5 S4
W4 O4 18 82
47 53 R4 L4 T4 N4 I4 P6 M6 A7 O8 U10E16S17 P O17E16A15R15L8 U6 P6 T5
I5 S4 59 41
20 80 O10N10L10E10D10R20S30 Q U100
100 --
70 30 P5 I5 U5 T7 A13O16E30 R E23O12A11T11I10S7 Y4
61 39
48 52 D4 T4 O6 U6 R7 N8 S9 I11A16E18 S T19E11O10I9 S9 A8 H6 P5
U4 41 59
43 57 U4 O5 D6 T6 F7 R7 E8 I10N10S13A14 T H39I10O10E8 A7 T6 R4
38 62
35 65 P5 F5 T5 L5 B6 D8 S9 O30 U N18S13T13R12L10P7 B4 C4
8 92
88 12 R6 U10O16A16I16E30 V E65I14O9 A8
99 1
 48 52 G4 D4 Y5 N9 S10T11O16E23 W A27H16I16E15O11N4
80 20
95 5 U5 N5 I16E74 X P29T19I14A14U10C5 K5 O5
38 62
24 76 B4 N8 A8 T13E14R15L25 Y A15O12S12T9 W7 H5 I5 E5
D4 M4 B4 38 62
88 12 O12N12A25I50 Z E43I43W14
86 14

All figures indicate PERCENTAGES. - Taking any one letter, as A: On the left,
it was contacted
14% of the time by H, 11% by E, etc., and 81% of its total contacts on that
side were consonants.
On the right, it was contacted 21% of the time by N, and 94% of the time by
consonants.

Chart Showing FREQUENCIES of English DIGRAMS - Prepared by O. PHELPS MEAKER

(Actual Count Made on 10,000 Letters of Literary Text).

A B C D│ E│ F G H I J K L M N O P Q R S T U V W
X Y Z
A 1 8 44 45│131│21 11 84 18 34 56 54 9 21 57 75 56 18 15 32
3 11 805
B 32 18│ 11│ 2 2 1 7 7 9 7 18 1 4 13 14 5
11 162
C 39 12 4│ 64│ 9 1 2 55 8 1 31 18 14 21 6 17 3
5 10 320
D 15 10│107│ 1 1 1 16 28 2 118 16 16 6 9 11 4
4 365
E 58 55 39│ 39│25 32 251 37 2 28 72 48 64 3 40 148 84 94 11 53 30
1 12 5 1231
F 10 1 12│ 23│14 3 2 27 5 8 94 6 13 5 1 1
3 228
G 18 2│ 20│ 1 1 10 1 75 3 6 6 1 12
5 161
H 46 3│ 15│ 6 16 5 1 9 3 7 3 30 315 2 48
5 514
I 16 6 15 57│ 40│21 10 72 8 57 26 37 13 8 77 42 128 5 19 37
4 18 2 718
J 2 1│ 1│ 1 1 3 1
10
K 10 8 │ 2│ 8 3 3 5 11 2
52
L 77 21 16 7│ 46│10 4 3 39 55 10 17 29 12 6 12 28 4
6 1 403
M 18 1 9│ 43│ 3 1 1 32 4 5 7 44 15 14 14 9 1
4 225
N 172 5│120│ 2 3 2 169 3 1 3 9 145 12 19 8 33 10
3 719
O 2 11 59 37│ 46│38 23 46 63 4 3 28 28 65 23 28 54 71 111 2 6 17
1 28 794
P 31 1 7│ 32│ 3 1 1 3 2 16 7 29 26 8 24 8 17 2
4 7 229
Q 1 1│ 14│ 2 2
20
R 101 6 7 10│154│ 4 21 8 21 2 5 113 42 18 6 30 49 1
5 603
S 67 5 1 32│145│ 8 7 3 106 2 12 6 51 37 3 39 41 32 42 3
17 659
T 124 38 39│ 80│42 13 22 88 1 19 6 110 53 14 63 121 53 45 6
1 21 959
U 12 25 16 8│ 7│11 8 2 4 8 13 12 96 7 20 6 30 22 1
1 1 310
V 24 4│ 16│ 1 14 2 4 13 5 2 4 1
3 93
W 7 1 9│ 41│ 4 2 7 1 3 5 2 15 36 1 10 27 16 2
14 203
X │ 17│ 1 1 1
20
Y 27 19 6│ 17│ 1 1 1 3 47 3 14 4 2 17 4 21 1
188
Z 1 │ │ 4 2 1
1 9

To learn the frequency of any digram, find its first letter at the top,
find its second
letter at the side, and observe the figure in the cell at which the column
headed by the
first letter crosses the row headed by the second. Frequency for EA, 131;
for AE, zero.

SOME FOREIGN LANGUAGE DATA

NOTE: Frequencies of letters, and their order, are fixed quantities

in any language. Group frequencies, however. are fairly constant
in every language. (These may be computed from the Comparative
Table for any desired group in the languages given.) Of the material
which follows, portions came from Lange and Soudart, and from
Valerio,
but exact sources were not in every case furnished to the author.

G E R M A N

Order of single letters: E N I R S A D T U G H O L B M C F W Z K V P (J Q X Y)

Order of digrams: EN ER CH DE GE EI IE IN NE ND BE EL TE UN ST DI NO UE SE AU RE
HE

Order of trigrams: EIN ICH DEN DER TEN CHT SCH CHE DIE UNG GEN UND NEN DES BEN
RCH

Order of tetragrams: ICHT KEIT HEIT CHON CHEN CHER URCH EICH DERN AUCH SCHA SCHE

SCHI SCHO SCHU (Furnished by JOSEPH ARTHOLD).

Peculiarities:

C is practically always followed by H (or K), and SC by H.

Word-length is normally greater than in English.
 F R E N C H

Order of single letters: E A I S T N R U L O D M P C V Q G B F J H Z X Y (K W)

Order of digrams: ES EN OU DE NT TE ON SE AI IT LE ET ME ER EM OI UN QU

Order of trigrams: ENT QUE ION LES AIT TIO ANS ONT ANT OUR AIS OUS

Peculiarities:
Q followed by U and a second vowel.
Four and five vowels may be found in sequence ("J'ai oui dire.."), but
E seldom touches the other vowels. D and M contact E about 75% of
the
time, and L contacts it over 50% of the time. It is unusual to find
more than four consonants in sequence; when five are found in
succession, one is almost surely the final S of a plural word.

Order of doubled letters: S L M R T N P E C F

Order of initials: P A S M C E D T V F R B L G J I Q N O H U Y X Z
Order of finals: E S T R N D A I X Z L C U P F Y

Average word-length: 4.3 letters.

Commonest short words, in order: DE IL LE ET QUE JE LA NE UN LES EN CE SE SON MON
PAS LUI ME AU UNE DES SA QUI EST DU

I T A L I A N

Order of single letters: E A I O N L R T S C D P U M V G H F B Q Z (J X K W Y)

Order of digrams: ER ES ON RE EL EN DE DI TI SI AL AN RA NT TA CO

Order of trigrams: CHE ERE ZIO DEL ECO QUE ARI ATO EDI IDE ESI IDI ERO PAR NTE
STA

Peculiarities:
Q followed by U and a second vowel. H largely preceded by C, in
CHE,CHI,
or sometimes by G in GHE GHI. Z most often part of ZIO or NZA.
The frequencies of the vowels E A I O often exchange places.
Doubling of consonants is very frequent.

Order of doubled letters: L T S C R G P N B M Z F V I D

Order of initials: S P A C D V T M F I G Q R E B L N O U Z H
Order of finals: O E A I (Others, if used: R L D N)

Average word-length: 4.5 letters.

Commonest short words, in order: LA DI CHE IL NON SI LE UNA LO IN PER UN MI IO PIU
DEL MA SE

S P A N I S H

Order of single letters: E A O S N I R L D U C T M P B H Q G V Y J F Z X (K W)

Order of digrams: ES EN EL DE LA OS AR UE RA RE ER AS ON ST AD AL OR TA CO
Order of trigrams: QUE EST ARA ADO AQU DEL CIO NTE OSA EDE PER IST NEI RES SDE

Peculiarities:
Q followed by U and a second vowel. The only doubles are
LL, RR, CC, EE, NN, OO, in the order given, but the latter three
are very rare. Group frequencies somewhat less stable than
in the other languages.

Order of initials: C P A S M E D T H V R U N I L B O F Q G J Z
Order of finals: O A S E N R D L I Z

Average word-length: 4.4 letters.

Commonest short words, in order: DE LA EL QUE EN NO CON UN SE SU LAS LOS ES ME AL
LO SI MI UNA DEL POR SUS MUY HAY MAS

P O R T U G U E S E

Order of single letters: A E O R S I N D M T U C L P Q V F G H B J Z X (K W Y)

Order of digrams: ES OS DE AS RO EN CO DO RE ER NT SE AD OR AO SA TE AR EM QU UE
OD ST

Order of trigrams: QUE ENT NTE DES EST ODE ADO CON STA MEN ADE DOS ARA COM

Much like Spanish. Spanish cion becomes cao; ll becomes lh. Articles drop
the L: os, as, in place of Spanish los, las, etc.

BIBLIOGRAPHY
By W. D. Witt

An extended bibliography of cryptography would fill many pages and

is therefore beyond the scope of this work, but it is hoped that the
following short selected list will be found useful. Some of these
works are out of print or otherwise unobtainable, but may, in some
instances, be found in public libraries or in old bookstores. The
Riverbank Publications may be consulted at The Library of Congress,
Washington, D. C.

More or Less Elementary Works

Boyer, John Q. “The Cryptogram” in Real Puzzles by John Q. Boyer,

Rufus T. Strohm and George H. Pryor, pp. 147-154. Baltimore, 1925.
(Simple substitution ciphers only.)

Buranelli, Prosper, Margaret Petherbridge and F. Gregory Hartswick.

The Cryptogram Book. New York, 1928. (Simple substitution ciphers
only.)

Hitt, Parker (Colonel). The A B C of Secret Writing. New York, 1935.

Lysing, Henry, pseud. (John Leonard Nanovic). Secret Writing. New

York, 1936.
―. The Cryptogram Book. New York, 1937.

Mansfield, Louis C. S. The Solution of Codes and Ciphers. London,

1936.

―. One Hundred Problems in Cipher. London, 1936.

Ohaver, M. E. Cryptogram Solving. Columbus, Ohio, 1933, (Simple

substitution ciphers only.)

Thomas, Paul B. Secret Messages. New York and London, 1928. 2nd
printing, 1929.

Windolph, J. Fred (“Phil Down”). “Cryptograms: Their Construction and

Solution” in A Key to Puzzledom, pp. 53-64. New York, 1906. (Simple
substitution ciphers only.)

Yardley, Herbert Osborne (Major). Yardleygrams. Indianapolis, 1932.

(The London edition (1932) bears the title Ciphergrams.)

Advanced Works

Friedman, William F. (Lt.-Colonel). Elements of Cryptanalysis.

Washington, Gov. Printing Office, 1924. “For Offcial Use Only.”
(Contains a bibliography. Out of print and unobtainable.)

―. See also Riverbank Publications.

Givierge, Marcel (General). Cours de Cryptographie. Paris, 1st

edition, 1925, 2nd edition, 1932.

Hitt, Parker (Colonel). Manual for the Solution of Military Ciphers.

Fort Leavenworth, Kans., 1st edition, 1916, 2nd edition, 1918.

Riverbank Publications. Papers (except No. 19) by W. F. Friedman.

Department of Ciphers, Riverbank Laboratories, Geneva, Illinois.
No. 15, 1917. “A Method of Reconstructing the Primary Alphabet.”
No. 16, 1918. “Methods for the Solution of Running-key Ciphers.”
No. 17, 1918. “An Introduction to Methods for the Solution of
Ciphers.”
No. 18, 1918. “Synoptic Tables for the Solution of Ciphers, and
a Bibliography of Cipher Literature.”
No. 19, 1918. “Formulae for the Solution of Geometrical
Transposition Ciphers,” by Captain Lenox R. Lohr,
with an introduction by W. F. Friedman.
No. 20, 1918. “Several Machine Ciphers and Methods for Their
Solution.”
No. 21, 1918. “Methods for the Reconstruction of Primary
Alphabets.”
No. 22, 1922. “The Index of Coincidence and Its Applications in
Cryptographic Analysis.”

Sacco, Luigi (General). Manuale di crittografia. Rome, 2nd edition,

revised and enlarged, 1936. (The first edition was privately printed
under the title Nozioni di crittografia. Rome, 1930.)

Zanotti, Mario. Crittografia. Milan, 1928.

Miscellaneous (Primarily descriptive of systems, historical, special
essays, etc., usually with little on cryptanalysis.)

Anon. “Cryptography” in Encyclopaedia Britannica, Vol. 6, 14th

edition, New York and London, 1929. (Contains a bibliography.)

Ball, W. W. Rouse. “Cryptographs and Ciphers” in his Mathematical

Recreations and Essays. 7th edition, 1917 and later. (Latest edition
is the 11th, 1939.)

Blair, William. “Cipher in Diplomatic Affairs” in Rees’s Cyclopaedia.

1803-1819.

Candela, Rosario. The Military Cipher of Commandant Bazeries, An

Essay in Decrypting. New York, 1938.

Friedman, William F. (Lt.-Colonel). “Codes and Ciphers” in

Encyclopaedia Britannica, Vol. 5, 14th edition, New York and London,
1929. (Contains bibliography.)

―. “Edgar Allan Poe, Cryptographer” in American Literature, A Journal

of Literary History, Criticism and Bibliography, Vol. 8, No. 3, Nov.
1936, pp. 266-280. Duke University, Durham, N. C.

Hulme, Frederick Edward. Cryptography, or, The History, Principles

and Practice of Cipher-Writing. London, 1898.

Lange, André and E. A. Soudart. Traité de Cryptographie. Paris, 1st

edition, 1925, new edition, 1935. (Contains an extensive bibliography.)

Lange, André. Cryptography. Translated from the French by J. C. H.

Macbeth, London and New York, 1922.

Pratt, Fletcher. Secret and Urgent, The Story of Codes and Ciphers.
Indianapolis, 1939.

Yardley, Herbert Osborne (Major). The American Black Chamber.

Indianapolis and London, 1931. Reprinted, New York, 1933, London,
1934.

THE COMMONEST ENGLISH WORDS

Below are listed the hundred most frequently used words in English.
The figures give occurrences in 242,432 words of English text taken
from fifteen English authors and many newspapers. Compiled by Frank
R. Fraprie, after the rest of the book had been completed.

THE 15568 OR 1101 WHEN 603 ONLY 309

OF 9767 HER 1093 WHAT 570 ANY 302
AND 7638 HAD 1062 YOUR 533 THEN 298
TO 5739 AT 1053 MORE 523 ABOUT 294
A 5074 FROM 1039 WOULD 516 THOSE 288
IN 4312 THIS 1021 THEM 498 CAN 285
THAT 3017 MY 963 SOME 478 MADE 284
IS 2509 THEY 959 THAN 445 WELL 283
I 2292 ALL 881 MAY 441 OLD 282
 IT 2255 THEIR 824 UPON 430 MUST 280
FOR 1869 AN 789 ITS 425 US 279
AS 1853 SHE 775 OUT 387 SAID 276
WITH 1849 HAS 753 INTO 387 TIME 273
WAS 1761 WERE 752 OUR 386 EVEN 272
HIS 1732 ME 745 THESE 385 NEW 265
HE 1727 BEEN 720 MAN 383 COULD 264
BE 1535 HIM 708 UP 369 VERY 259
NOT 1496 ONE 700 DO 360 MUCH 252
BY 1392 SO 696 LIKE 354 OWN 251
BUT 1379 IF 684 SHALL 351 MOST 251
HAVE 1344 WILL 680 GREAT 340 MIGHT 250
YOU 1336 THERE 668 NOW 331 FIRST 249
WHICH 1291 WHO 664 SUCH 328 AFTER 247
ARE 1222 NO 658 SHOULD 327 YET 247
ON 1155 WE 638 OTHER 320 TWO 244

ENGLISH TRIGRAMS

The ninety-eight most frequent English trigrams, combining a count

of 20,000 trigrams by Fletcher Pratt, in “Secret and Urgent,” supposed
not to include overlaps between words, and 5,000 by Frank R. Fraprie,
including overlaps. This table and the following one are not referred
to in the text, having been compiled since the completion of the book.

THE 1182 HER 170 HIS 130 ITH 111

ING 356 ATE 165 RES 125 TED 110
AND 284 VER 159 ILL 118 AIN 108
ION 252 TER 157 ARE 117 EST 106
ENT 246 THA 155 CON 114 MAN 101
FOR 191 ATI 148 NCE 113 RED 101
TIO 188 HAT 138 ALL 111 THI 100
ERE 173 ERS 135 EVE 111 IVE 96

REA 95 INE 73 ORE 65 ART 58

WIT 93 WHI 71 BUT 64 NTE 58
ONS 92 OVE 71 OUT 63 RAT 58
ESS 90 TIN 71 URE 63 TUR 58
AVE 84 AST 70 STR 62 ICA 57
PER 84 DER 70 TIC 62 ICH 57
ECT 83 OUS 70 AME 61 NDE 57
ONE 83 ROM 70 COM 61 PRE 57
UND 83 VEN 70 OUR 61 ENC 56
INT 80 ARD 69 WER 61 HAS 56
ANT 79 EAR 69 OME 60 WHE 55
HOU 77 DIN 68 EEN 59 WIL 55
MEN 76 STI 68 LAR 59 ERA 54
WAS 76 NOT 67 LES 59 LIN 54
OUN 75 ORT 67 SAN 59 TRA 54
PRO 75 THO 66 STE 59
STA 75 DAY 65 ANY 58

ENGLISH DIGRAMS

The one hundred and nine most frequent English digrams, compiled from
a count of 20,000 trigrams by Fletcher Pratt, in “Secret and Urgent,”
supposed not to include overlaps between words, and 5,000 by Frank R.
Fraprie, including overlaps.

TH 1582 RO 275 WI 188 SA 146 CT 111

IN 784 LI 273 HO 184 NI 142 TU 108
ER 667 RI 271 TR 183 RT 142 DA 107
RE 625 IO 270 BE 181 NA 141 AM 104
AN 542 LE 263 CE 177 OL 141 CI 104
HE 542 ND 263 WH 177 EV 131 SU 102
AR 511 MA 260 LL 176 IE 129 BL 101
EN 511 SE 259 FI 175 MI 128 OF 101
TI 510 AL 246 NO 175 NG 128 BU 100
TE 492 IC 244 TO 175 PL 128
AT 440 FO 239 PE 174 IV 127
ON 420 IL 232 AS 172 PO 125
HA 420 NE 232 WA 171 CH 122
OU 361 LA 229 UR 169 EI 122
IT 356 TA 225 LO 166 AD 120
ES 343 EL 216 PA 165 SS 120
ST 340 ME 216 US 165 IL 118
OR 339 EC 214 MO 164 OS 117
NT 337 IS 211 OM 163 UL 115
HI 330 DI 210 AI 162 EM 114
EA 321 SI 210 PR 161 NS 113
VE 321 CA 202 WE 158 OT 113
CO 296 UN 201 AC 152 GE 112
DE 275 UT 189 EE 148 IR 112
RA 275 NC 188 ET 146 AV 111

INDEX

Amateurs, devices proposed by, 132, 140, 152

“Amsco” transposition cipher, 51
Anagramming, 22, 29, 45-50
Anagramming, multiple, 32, 56-68
“Aristocrats,” 69, 72, 88
Auto-encipherment, 146-158

Bacon’s biliteral cipher, 6

Basic cipher alphabet, 164
Bassières processes for autokey, 147-151
Beaufort ciphers, 121
“Bifid” substitution, 210
Book cipher, 106

“Caesar” alphabets, 69, 71, 100, 108, 118, 130

Characteristics of systems, 53, 100, 103, 105, 130, 153, 168,
201-203, 213-214
“Checkerboard” alphabets, 102, 104, 164, 209
Cipher, meaning of, 1
Cipher alphabets, 69, 130, 159, 172, 185
Cipher disks, 108, 111
Cipher disks, special application of, 192
Classification of ciphers, 1
Classification of substitutions, 68
Code, 1, 106
Collon systems, 209
Columnar transposition, 11, 17, 23, 37-52
Columnar transposition, double, 54
“Columns” in autokeyed ciphers, 146
Combination block, 44
Combination cipher, 1, 4, 6, 68, 207, 209, 213, 216
Complements, complementary alphabets, 123
Complete-unit transposition, 9
Concealment cipher, meaning of, 1
Concealment ciphers, 4-8
Consonant-line method for simple substitution, 88
Contact count, 74, 77, 83, 173
Conventional writing, 4
“Crypt,” 72, 91
Cryptanalysis, meaning of, 3
Cryptogram, meaning of, 1
Cryptographic security, 2
Cycle (see period or unit)
Cyclical encipherment, 186, 200

Deciphering alphabet (or key), 71, 104

Decipherment, meaning of, 1
Decoding, meaning of, 2
Decrypt, meaning of, 1
Definitions, miscellaneous, 1, 68-70
Dictionary cipher, 106
Digram, meaning of, 1
Digram count, 83
Digram-solution method for simple substitution, 83
Digram tests, 45, 46, 47, 50
Dissimulated writing, 4
Double-key substitution, meaning of, 68
Double Myszkowsky transposition, 60
Double substitutions, 155, 164, 193
Double transpositions, 18, 54

Empty, or negative, words, 76

Encipherment, meaning of, 1
Encoding, meaning of, 2
“Entry,” 74
Equivalent slide (or alphabet), 169, 180

Factoring, in transpositions, 12, 42

Factoring of intervals to find a period, 128, 132
“Force Method,” 90
Fractional substitution, meaning of, 68
Fractional substitutions, 209-212
Frequency (see statistics)
Frequency counts, 74, 83, 129, 161, 173
“Frequential checkerboard,” 105

German field cipher (the ADFGVX), 210

Grandpré’s word-square, 104-105
Graph, graphic appearance, 106, 131, 173
Grille, Fleissner’s, 26
Grille, Richelieu’s, 4
Grille, Sacco’s indefinite, 12
Grille, turning, 26
Gronsfeld cipher, 117
Group-application in polyalphabetic ciphers, 185
Group percentages (see statistics)

Hermann cipher, 143

Index-letter (or cell), 111, 119, 124, 143, 169

Indicators, 101, 143
Intervals, alphabetical and lineal, 169, 180, 193, 194
Intervals in cryptograms, 43, 127
Inverse alphabets, 69
Irregular transposition, 37-67
Isolating a cipher alphabet, 122

Kasiski method, 127

Key, meaning of, 1
Key-alphabet, 108
“Key-frame” (or “skeleton”), 86, 175, 206
Key-interruption, 143
Key-length, 11, 17, 42, 127, 147
Key-lengthening devices in Vigenère, 143
Key-letter, 108
“Key-phrase” cipher, 103
Keys for simple substitution, 69
Keys, preparation of, 17, 26, 70, 104
Keys, recovery of, 23, 33, 39, 40, 45, 50, 58-63, 64, 85, 106, 124,
150, 157, 163, 164, 167, 175-183, 188-190, 205
Keywords, uses of, 17, 70, 146, 169
Knight’s tour, 10

Legrand’s open-letter cipher, 5

Levine’s concealment ciphers, 7
“Lining up” frequency counts, 162-163
Low-frequencies, assistance from, 99, 100, 129, 136, 138, 160
Low-frequency contacts, 78, 174

Magic squares, 10
Mathematical aspects of multiple-alphabet ciphers, 142, 151, 193, 196
Mechanical methods, 21, 32, 45, 56-58, 133, 138, 149
Military aspects of ciphers, 3, 55
Mirabeau’s cipher, 209
Mixed alphabets, 70, 169
Monoalphabetic substitution, meaning of, 68
Morse alphabet, 210
“Multifid” alphabets, 209
Multi-literal substitutes, 6, 7, 104
Multiple-alphabet ciphers, 108-197
Multiple-alphabet substitution, meaning of, 68
Multiple messages, 56, 85, 140, 146, 185
Multiple-substitutional encipherment, Multiple substitutes, 68, 99,
102, 103, 159
Myszkowsky’s transposition, 51

Negative, or empty, words, 76

“Nicodemus” cipher, 216
Nihilist number-cipher, 164-168
Nihilist transposition cipher, 17, 53
Novelty ciphers, 100, 214
Null cipher, 4
Nulls, legitimate uses of, 37, 55, 110, 201
Nulls, meaning of, 9
Numbers and symbols, encipherment of, 101
Numbers used as substitutes, 154-157, 159-168

Ohaver method for period finding, 160

Open-letter cipher, 4

Pair-count, 202
Pair-encipherment, 198, 199, 200
Parallel frequency counts, 162, 165, 177
“Pattern words,” 73
Pentagram, meaning of, 1
Periodic ciphers, 108-184
“Period” in autokey ciphers, 146
Period, periodicity, 108, 112-114, 127, 138, 166, 195
“Phillips” cipher, 185
Phonetic alphabets, 106
Playfair cipher, 200
“Pointers” for vowel-spotting, 78
Pollux systems, 209
Polyalphabetic ciphers, names of, 108
Polyalphabetic substitution, meaning of, 68
Polyalphabetic substitutions, 108-197
Polybius square, 164, 209
Polygram substitution, meaning of, 68
Polygram substitutions, 198-208
Porta cipher, 118
Primary cipher alphabet, 164, 169
Primary cryptogram (see double transpositions or double substitutions)
Probable word methods, 23, 29, 34, 37, 99, 113, 119, 124, 147,
202, 206
Progression, Progression index, 192
Puncture cipher, 4

“Quagmires” cipher, 182

“Rail fence” transpositions, 12

Reciprocal substitution, 70, 118, 121, 123
Rectangular transposition, 11
“Route cipher,” 14
Route transposition, 11
“Running down the alphabet,” 72, 100, 118, 124, 139, 185, 192, 214
“Running key,” 143

Saint-Cyr cipher, 110

Scytale, 14
Secondary cipher alphabets, 164, 169
Sequence (see statistics)
Seriation, Seriation index, 207, 210
Shift, Shifted alphabets, 69, 70, 72, 108, 119, 133, 172, 177
Short word method for divided cryptograms, 72
Simple substitution, meaning of, 68
Simple substitutions, 69-107
Slides, slide-rules
for decrypting, 141
for encipherment, 110, 119, 123, 169, 170
used in transposition, 13, 61
Specific key, 169
Statistics, some uses of, 14, 18, 21, 40-42, 45-50, 57, 73, 75,
78-85, 88, 113, 130, 141, 150, 153, 174, 187, 201, 202, 213
“Step-up” and “step-down” letters, 89
“Straddling” devices, 105
Strips
used in decryptment of transpositions, 15
used for encipherment of polyalphabeticals, 108
used for decryptment of periodics, 136
Substitutes, 68
Substitution cipher, meaning of, 1
Substitution ciphers, 68-212
Symbols, 68
“Symmetry of position,” 176

Tableaux:
Vigenère, 109
Porta, 118
Beaufort, 121
used for decryptment of periodics, 134
formed in autokey decryptment, 150
high-frequency co-efficients, 152
imaginary, or formed in key-recovery, 170-172, 178
Delastelle, 177
for finding alphabetical intervals, 194
for pair-encipherment, 198
“Taking off” (Transcription), 9, 17, 23, 60
Terminals (see statistics)
Tetragram, meaning of, 1
Transformation device, 102
Transposition, meaning of, 1
Transposition ciphers, 9-67
Trial key, 111, 150
“Trifid” substitution, 210
Trigram, meaning of, 1
Trigram encipherment, 199
Trigram method of solution:
applied to Beaufort, 125
applied to Gronsfeld, 117
applied to Porta, 119
applied to Vigenère, 113
with the use of a slide, 141
Trithème’s alphabet, 7

Unit, 9, 18
United States Army Cipher Disk, 108, 123
United States Army Double Transposition, 54

Variant Beaufort cipher, 121

Variety of contact, 75, 78, 88, 174, 204
Variety count, 75, 88
Vigenère cipher, 108
Vowel-distribution (see statistics)
Vowel-line method for simple substitution, 91
Vowel-solution method, 78, 174

Word-spacers, 100
“Writing-in” (Inscription), 9, 17, 23, 60
Transcriber's Note

The original figures were made with a typewriter, and then lines,
arrows, or circles were added. This file reproduces them as well
as is possible as plain text. Please see the HTML version if you
wish to see the figures with all of their details.

Minor corrections, such as removing extra spaces or punctuation, or

adding missing spaces or punctuation or diacritical marks, were made
without note. Archaic and inconsistent spelling was retained. In two
places, the number of a referenced figure was corrected. Grammar and
spelling were only corrected as in the following list of notable
changes.

In two places, “diagram” was corrected to “digram”.

In three places, “direct” was corrected to “directly”.

In Chapter III, we italicized the first occurrence of “magic square”

because it seemed like the author’s intention. In the same chapter,
“said be clockwise” was corrected to “said to be clockwise”.

In Figure 43, “ISGAY” was corrected to “ISGAU” to match previous

figures and to correct spelling in the plaintext.

In Chapter VII, “those who like method” was corrected to “those who
like this method”.

In Chapter XVIII, “misuse of the Type II slide” was corrected to

“misuse of the Type I slide”.

In Figure 139, “IQCIO” is corrected to “IQVIO”.

In the Appendix, in the list of English trigrams, “WHI 51” was

corrected to “WHI 71”.

Some corrections were made to the exercises in order to rectify the

spelling in their plaintexts or (in one case) to resolve an
inconsistency in its key.

In exercise 33, seven letters were missing. The uncorrected cryptogram

is VINSC FEAEO OHSEF HLEHU NSTNC LTSLC IAESH RHSIR ERMTS ETEPD TOINM
RTTHT TLRUB E.

Exercise 110: “LRSFQ” corrected to “IRSFQ”.

Exercise 115: “FBEHZHWU” corrected to “FBEHZHWG”.

Exercise 116: “HVIYF” corrected to “HVXYF”.

Exercise 128: “JQAOJ” corrected to “JQAOI” and “QNUSG” to “QNUSU”.

Exercise 130: “FBWXJ” corrected to “FRWXJ”.

Exercise 138: “XVKFV” corrected to “XVKEV”.

Exercise 141: “KFTFB” corrected to “KFTFX”.

Exercise 144: “TAJNI WRDB” corrected to “TAJNW ARDB”.

Exercise 145: “TTHNY” corrected to “TTHNJ”.

Exercise 146: “PGOUR” corrected to “PGOUJ” and “VDDMH” corrected

to “VDDMP” (we are not sure about “VFCFT”).

Exercise 147: “UVSYC” corrected to “UBSYC”, “IXYDY” to “IXYPY”,

“VXOOK” to “NXOOK”, and “NNHMM” to “NNHWM”.

Exercise 149: “MS” corrected to “PF”.

Exercise 153: “QY BN QM” corrected to “QY BM QM” and “BL PK QM”
to “BL PO QM”.

Exercise 40 has error(s) in the first 25 letters. We do not know

what was the intention of its creator.

The above list should not be assumed to be correct or complete.

We wish to thank the anonymous proof-readers who volunteered at the

British National Cipher Challenge (www.cipherchallenge.org).

*** END OF THE PROJECT GUTENBERG EBOOK ELEMENTARY CRYPTANALYSIS ***

Updated editions will replace the previous one—the old editions will
be renamed.

Creating the works from print editions not protected by U.S. copyright
law means that no one owns a United States copyright in these works,
so the Foundation (and you!) can copy and distribute it in the United
States without permission and without paying copyright
royalties. Special rules, set forth in the General Terms of Use part
of this license, apply to copying and distributing Project
Gutenberg™ electronic works to protect the PROJECT GUTENBERG™
concept and trademark. Project Gutenberg is a registered trademark,
and may not be used if you charge for an eBook, except by following
the terms of the trademark license, including paying royalties for use
of the Project Gutenberg trademark. If you do not charge anything for
copies of this eBook, complying with the trademark license is very
easy. You may use this eBook for nearly any purpose such as creation
of derivative works, reports, performances and research. Project
Gutenberg eBooks may be modified and printed and given away—you may
do practically ANYTHING in the United States with eBooks not protected
by U.S. copyright law. Redistribution is subject to the trademark
license, especially commercial redistribution.

START: FULL LICENSE

THE FULL PROJECT GUTENBERG LICENSE

PLEASE READ THIS BEFORE YOU DISTRIBUTE OR USE THIS WORK

To protect the Project Gutenberg™ mission of promoting the free

distribution of electronic works, by using or distributing this work
(or any other work associated in any way with the phrase “Project
Gutenberg”), you agree to comply with all the terms of the Full
Project Gutenberg™ License available with this file or online at
www.gutenberg.org/license.

Section 1. General Terms of Use and Redistributing Project Gutenberg™

electronic works

1.A. By reading or using any part of this Project Gutenberg™

electronic work, you indicate that you have read, understand, agree to
and accept all the terms of this license and intellectual property
(trademark/copyright) agreement. If you do not agree to abide by all
the terms of this agreement, you must cease using and return or
destroy all copies of Project Gutenberg™ electronic works in your
possession. If you paid a fee for obtaining a copy of or access to a
Project Gutenberg™ electronic work and you do not agree to be bound
by the terms of this agreement, you may obtain a refund from the person
or entity to whom you paid the fee as set forth in paragraph 1.E.8.

1.B. “Project Gutenberg” is a registered trademark. It may only be

used on or associated in any way with an electronic work by people who
agree to be bound by the terms of this agreement. There are a few
things that you can do with most Project Gutenberg™ electronic works
even without complying with the full terms of this agreement. See
paragraph 1.C below. There are a lot of things you can do with Project
Gutenberg™ electronic works if you follow the terms of this
agreement and help preserve free future access to Project Gutenberg™
electronic works. See paragraph 1.E below.

1.C. The Project Gutenberg Literary Archive Foundation (“the

Foundation” or PGLAF), owns a compilation copyright in the collection
of Project Gutenberg™ electronic works. Nearly all the individual
works in the collection are in the public domain in the United
States. If an individual work is unprotected by copyright law in the
United States and you are located in the United States, we do not
claim a right to prevent you from copying, distributing, performing,
displaying or creating derivative works based on the work as long as
all references to Project Gutenberg are removed. Of course, we hope
that you will support the Project Gutenberg™ mission of promoting
free access to electronic works by freely sharing Project Gutenberg™
works in compliance with the terms of this agreement for keeping the
Project Gutenberg™ name associated with the work. You can easily
comply with the terms of this agreement by keeping this work in the
same format with its attached full Project Gutenberg™ License when
you share it without charge with others.

1.D. The copyright laws of the place where you are located also govern
what you can do with this work. Copyright laws in most countries are
in a constant state of change. If you are outside the United States,
check the laws of your country in addition to the terms of this
agreement before downloading, copying, displaying, performing,
distributing or creating derivative works based on this work or any
other Project Gutenberg™ work. The Foundation makes no
representations concerning the copyright status of any work in any
country other than the United States.

1.E. Unless you have removed all references to Project Gutenberg:

1.E.1. The following sentence, with active links to, or other

immediate access to, the full Project Gutenberg™ License must appear
prominently whenever any copy of a Project Gutenberg™ work (any work
on which the phrase “Project Gutenberg” appears, or with which the
phrase “Project Gutenberg” is associated) is accessed, displayed,
performed, viewed, copied or distributed:

This eBook is for the use of anyone anywhere in the United States and most
other parts of the world at no cost and with almost no restrictions
whatsoever. You may copy it, give it away or re-use it under the terms
of the Project Gutenberg License included with this eBook or online
at www.gutenberg.org. If you
are not located in the United States, you will have to check the laws
of the country where you are located before using this eBook.

1.E.2. If an individual Project Gutenberg™ electronic work is

derived from texts not protected by U.S. copyright law (does not
contain a notice indicating that it is posted with permission of the
copyright holder), the work can be copied and distributed to anyone in
the United States without paying any fees or charges. If you are
redistributing or providing access to a work with the phrase “Project
Gutenberg” associated with or appearing on the work, you must comply
either with the requirements of paragraphs 1.E.1 through 1.E.7 or
obtain permission for the use of the work and the Project Gutenberg™
trademark as set forth in paragraphs 1.E.8 or 1.E.9.

1.E.3. If an individual Project Gutenberg™ electronic work is posted

with the permission of the copyright holder, your use and distribution
must comply with both paragraphs 1.E.1 through 1.E.7 and any
additional terms imposed by the copyright holder. Additional terms
will be linked to the Project Gutenberg™ License for all works
posted with the permission of the copyright holder found at the
beginning of this work.

1.E.4. Do not unlink or detach or remove the full Project Gutenberg™

License terms from this work, or any files containing a part of this
work or any other work associated with Project Gutenberg™.

1.E.5. Do not copy, display, perform, distribute or redistribute this

electronic work, or any part of this electronic work, without
prominently displaying the sentence set forth in paragraph 1.E.1 with
active links or immediate access to the full terms of the Project
Gutenberg™ License.

1.E.6. You may convert to and distribute this work in any binary,
compressed, marked up, nonproprietary or proprietary form, including
any word processing or hypertext form. However, if you provide access
to or distribute copies of a Project Gutenberg™ work in a format
other than “Plain Vanilla ASCII” or other format used in the official
version posted on the official Project Gutenberg™ website
(www.gutenberg.org), you must, at no additional cost, fee or expense
to the user, provide a copy, a means of exporting a copy, or a means
of obtaining a copy upon request, of the work in its original “Plain
Vanilla ASCII” or other form. Any alternate format must include the
full Project Gutenberg™ License as specified in paragraph 1.E.1.
1.E.7. Do not charge a fee for access to, viewing, displaying,
performing, copying or distributing any Project Gutenberg™ works
unless you comply with paragraph 1.E.8 or 1.E.9.

1.E.8. You may charge a reasonable fee for copies of or providing

access to or distributing Project Gutenberg™ electronic works
provided that:

• You pay a royalty fee of 20% of the gross profits you derive from
the use of Project Gutenberg™ works calculated using the method
you already use to calculate your applicable taxes. The fee is owed
to the owner of the Project Gutenberg™ trademark, but he has
agreed to donate royalties under this paragraph to the Project
Gutenberg Literary Archive Foundation. Royalty payments must be paid
within 60 days following each date on which you prepare (or are
legally required to prepare) your periodic tax returns. Royalty
payments should be clearly marked as such and sent to the Project
Gutenberg Literary Archive Foundation at the address specified in
Section 4, “Information about donations to the Project Gutenberg
Literary Archive Foundation.”

• You provide a full refund of any money paid by a user who notifies
you in writing (or by e-mail) within 30 days of receipt that s/he
does not agree to the terms of the full Project Gutenberg™
License. You must require such a user to return or destroy all
copies of the works possessed in a physical medium and discontinue
all use of and all access to other copies of Project Gutenberg™
works.

• You provide, in accordance with paragraph 1.F.3, a full refund of

any money paid for a work or a replacement copy, if a defect in the
electronic work is discovered and reported to you within 90 days of
receipt of the work.

• You comply with all other terms of this agreement for free
distribution of Project Gutenberg™ works.

1.E.9. If you wish to charge a fee or distribute a Project

Gutenberg™ electronic work or group of works on different terms than
are set forth in this agreement, you must obtain permission in writing
from the Project Gutenberg Literary Archive Foundation, the manager of
the Project Gutenberg™ trademark. Contact the Foundation as set
forth in Section 3 below.

1.F.

1.F.1. Project Gutenberg volunteers and employees expend considerable

effort to identify, do copyright research on, transcribe and proofread
works not protected by U.S. copyright law in creating the Project
Gutenberg™ collection. Despite these efforts, Project Gutenberg™
electronic works, and the medium on which they may be stored, may
contain “Defects,” such as, but not limited to, incomplete, inaccurate
or corrupt data, transcription errors, a copyright or other
intellectual property infringement, a defective or damaged disk or
other medium, a computer virus, or computer codes that damage or
cannot be read by your equipment.
1.F.2. LIMITED WARRANTY, DISCLAIMER OF DAMAGES - Except for the “Right
of Replacement or Refund” described in paragraph 1.F.3, the Project
Gutenberg Literary Archive Foundation, the owner of the Project
Gutenberg™ trademark, and any other party distributing a Project
Gutenberg™ electronic work under this agreement, disclaim all
liability to you for damages, costs and expenses, including legal
fees. YOU AGREE THAT YOU HAVE NO REMEDIES FOR NEGLIGENCE, STRICT
LIABILITY, BREACH OF WARRANTY OR BREACH OF CONTRACT EXCEPT THOSE
PROVIDED IN PARAGRAPH 1.F.3. YOU AGREE THAT THE FOUNDATION, THE
TRADEMARK OWNER, AND ANY DISTRIBUTOR UNDER THIS AGREEMENT WILL NOT BE
LIABLE TO YOU FOR ACTUAL, DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE OR
INCIDENTAL DAMAGES EVEN IF YOU GIVE NOTICE OF THE POSSIBILITY OF SUCH
DAMAGE.

1.F.3. LIMITED RIGHT OF REPLACEMENT OR REFUND - If you discover a

defect in this electronic work within 90 days of receiving it, you can
receive a refund of the money (if any) you paid for it by sending a
written explanation to the person you received the work from. If you
received the work on a physical medium, you must return the medium
with your written explanation. The person or entity that provided you
with the defective work may elect to provide a replacement copy in
lieu of a refund. If you received the work electronically, the person
or entity providing it to you may choose to give you a second
opportunity to receive the work electronically in lieu of a refund. If
the second copy is also defective, you may demand a refund in writing
without further opportunities to fix the problem.

1.F.4. Except for the limited right of replacement or refund set forth
in paragraph 1.F.3, this work is provided to you ‘AS-IS’, WITH NO
OTHER WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
LIMITED TO WARRANTIES OF MERCHANTABILITY OR FITNESS FOR ANY PURPOSE.

1.F.5. Some states do not allow disclaimers of certain implied

warranties or the exclusion or limitation of certain types of
damages. If any disclaimer or limitation set forth in this agreement
violates the law of the state applicable to this agreement, the
agreement shall be interpreted to make the maximum disclaimer or
limitation permitted by the applicable state law. The invalidity or
unenforceability of any provision of this agreement shall not void the
remaining provisions.

1.F.6. INDEMNITY - You agree to indemnify and hold the Foundation, the
trademark owner, any agent or employee of the Foundation, anyone
providing copies of Project Gutenberg™ electronic works in
accordance with this agreement, and any volunteers associated with the
production, promotion and distribution of Project Gutenberg™
electronic works, harmless from all liability, costs and expenses,
including legal fees, that arise directly or indirectly from any of
the following which you do or cause to occur: (a) distribution of this
or any Project Gutenberg™ work, (b) alteration, modification, or
additions or deletions to any Project Gutenberg™ work, and (c) any
Defect you cause.

Section 2. Information about the Mission of Project Gutenberg™

Project Gutenberg™ is synonymous with the free distribution of

electronic works in formats readable by the widest variety of
computers including obsolete, old, middle-aged and new computers. It
exists because of the efforts of hundreds of volunteers and donations
from people in all walks of life.

Volunteers and financial support to provide volunteers with the

assistance they need are critical to reaching Project Gutenberg™’s
goals and ensuring that the Project Gutenberg™ collection will
remain freely available for generations to come. In 2001, the Project
Gutenberg Literary Archive Foundation was created to provide a secure
and permanent future for Project Gutenberg™ and future
generations. To learn more about the Project Gutenberg Literary
Archive Foundation and how your efforts and donations can help, see
Sections 3 and 4 and the Foundation information page at www.gutenberg.org.

Section 3. Information about the Project Gutenberg Literary Archive Foundation

The Project Gutenberg Literary Archive Foundation is a non-profit

501(c)(3) educational corporation organized under the laws of the
state of Mississippi and granted tax exempt status by the Internal
Revenue Service. The Foundation’s EIN or federal tax identification
number is 64-6221541. Contributions to the Project Gutenberg Literary
Archive Foundation are tax deductible to the full extent permitted by
U.S. federal laws and your state’s laws.

The Foundation’s business office is located at 809 North 1500 West,

Salt Lake City, UT 84116, (801) 596-1887. Email contact links and up
to date contact information can be found at the Foundation’s website
and official page at www.gutenberg.org/contact

Section 4. Information about Donations to the Project Gutenberg

Literary Archive Foundation

Project Gutenberg™ depends upon and cannot survive without widespread

public support and donations to carry out its mission of
increasing the number of public domain and licensed works that can be
freely distributed in machine-readable form accessible by the widest
array of equipment including outdated equipment. Many small donations
($1 to $5,000) are particularly important to maintaining tax exempt
status with the IRS.

The Foundation is committed to complying with the laws regulating

charities and charitable donations in all 50 states of the United
States. Compliance requirements are not uniform and it takes a
considerable effort, much paperwork and many fees to meet and keep up
with these requirements. We do not solicit donations in locations
where we have not received written confirmation of compliance. To SEND
DONATIONS or determine the status of compliance for any particular state
visit www.gutenberg.org/donate.

While we cannot and do not solicit contributions from states where we

have not met the solicitation requirements, we know of no prohibition
against accepting unsolicited donations from donors in such states who
approach us with offers to donate.

International donations are gratefully accepted, but we cannot make

any statements concerning tax treatment of donations received from
outside the United States. U.S. laws alone swamp our small staff.

Please check the Project Gutenberg web pages for current donation
methods and addresses. Donations are accepted in a number of other
ways including checks, online payments and credit card donations. To
donate, please visit: www.gutenberg.org/donate.

Section 5. General Information About Project Gutenberg™ electronic works

Professor Michael S. Hart was the originator of the Project

Gutenberg™ concept of a library of electronic works that could be
freely shared with anyone. For forty years, he produced and
distributed Project Gutenberg™ eBooks with only a loose network of
volunteer support.

Project Gutenberg™ eBooks are often created from several printed

editions, all of which are confirmed as not protected by copyright in
the U.S. unless a copyright notice is included. Thus, we do not
necessarily keep eBooks in compliance with any particular paper
edition.

Most people start at our website which has the main PG search
facility: www.gutenberg.org.

This website includes information about Project Gutenberg™,

including how to make donations to the Project Gutenberg Literary
Archive Foundation, how to help produce our new eBooks, and how to
subscribe to our email newsletter to hear about new eBooks.