CHAPTER XV

Miscellaneous Phases of Vigenère Decryptment

When a Vigenère cryptogram is very short, its alphabets are no longer readily identified by their graphic appearance. But its period, in the majority of cases, can still be determined, and it still remains true that the identification of one letter identifies a whole alphabet. The example of Fig. 111 contains only 30 letters. With this cryptogram in the form shown at (a), we are still dependent upon the search for trigrams and short words, but the case is modified by the presence of a repeated trigram. Unless this repetition, _ZIL_, is accidental, it indicates a maximum period of 12, and the cryptogram is long enough to provide another interval 12, with another trigram, _EUK_, upon which any key-fragment brought out at _ZIL_ can be tested in order to see whether or not it will bring out another good sequence. When it finally does, the intermediate trigrams (those at intervals 6 or 4) can be tried, in the hope of finding a shorter period.

Figure 111

(a) (b) Z I L T F R U I Y T J R Z I L 1 2 3 4 5 6 x x x Z I L T F R U I Y T J R K A R O I E A O A E U K L W K. Z I L K A R x O I E A O A E U K L W K

But assuming a case in which we have no repeated sequences at all, we almost never meet with a Vigenère cryptogram in which there are no _repeated single letters belonging to a same cipher alphabet_. These repeated single letters can be tabulated with their separating intervals, _and these intervals factored in exactly the same way as intervals between repeated sequences_. The evidence, perhaps, will be less clear, and less reliable, than that obtained through repeated sequences; as with sequences, the less frequent letters will usually be more informative than those which are leaders. To illustrate, with our given example, the single letter _I_ has shown the interval 6 three times, the single letter _R_ has shown it twice, and the single letters _L_ and _Z_ have shown its multiple. In the average case, the period will not be so clearly evident as here; however, the example was not in any way manipulated in order to produce this evidence.

Once the cryptogram of (a) can be rearranged as at (b), we no longer have before us the piecemeal decipherments and piecemeal tests which are necessary where a period is likely to be anything at all. Whatever key-fragments can be brought out at _ZIL_, or on another trigram, need be tested only on the three columns which contain the trigram. Even presuming that the evidence has been inconclusive between two or more periods, the cryptogram, necessarily a short one, can be written into each of these probable periods, and the two or more resulting blocks, standing side by side, can be considered more or less simultaneously. Here, with our period determined as 6, the columns of (b) are very short, and the number of trials and erasures should not be many.

For this kind of case, however, many solvers have a preference for the purely mechanical method which is detailed in Fig. 112. _Sheet 1_ of this figure has been prepared from the first column of our cryptogram, which included the letters _Z U Z O E_. _Sheet 2_ has been prepared from the second column, which included the letters _I I I I U_; and _sheet 3_ has been prepared from the third column, which included the letters _L Y L E K_. In each case, the column of cryptogram letters, as it first stands, is also the _A_-decipherment. With each letter used as a point of beginning, a series of normal alphabets may be laid out, as in the figure, and the resulting 25 new columns on every sheet will show the other 25 possible decipherments. But if these decipherments have been caused to progress in the normal alphabetical direction, and if the cipher is Vigenère, the key-letters which produce these deciphered columns will have to run backward in the alphabet. These can be added at the tops or bottoms of their columns, and can, if desired, be written in red ink, or otherwise distinguished.

Figure 112

Sheet No. 1 (For Column 1 of b, preceding figure)

KEYS: a z y x w v u t s r q p o n m l k j i h g f e d c b Z A B C D E F G H I J K L M N O P Q R S T U V W X Y U V W X Y Z A B C D E F G H I J K L M N O P Q R S T Z A B C D E F G H I J K L M N O P Q R S T U V W X Y O P Q R S T U V W X Y Z A B C D E F G H I J K L M N E F G H I J K L M N O P Q R S T U V W X Y Z A B C D

Sheet No. 2 (For Column 2 of b, preceding figure)

KEYS: a z y x w v u t s r q p o n m l k j i h g f e d c b I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H U V W X Y Z A B C D E F G H I J K L M N O P Q R S T

Sheet No. 3 (For Column 3 of b, preceding figure)

KEYS: a z y x w v u t s r q p o n m l k j i h g f e d c b L M N O P Q R S T U V W X Y Z A B C D E F G H I J K Y Z A B C D E F G H I J K L M N O P Q R S T U V W X L M N O P Q R S T U V W X Y Z A B C D E F G H I J K E F G H I J K L M N O P Q R S T U V W X Y Z A B C D K L M N O P Q R S T U V W X Y Z A B C D E F G H I J

Fig. 113 shows what modifications would be necessary if the sheets were being prepared for one of the Beauforts. For the variant Beaufort, the only difference lies in the fact that key-letters must progress in the same alphabetical direction as their decipherments. With the true Beaufort, however, the making of an _A_-decipherment does not mean a simple copying of cryptogram letters, as in the other two ciphers; this _A_-decipherment must first be made; after that, the series of normal alphabets can be extended as before, and the key-letters will progress in the same alphabetical direction as their deciphered columns.

Now, assuming that these sheets have actually been prepared, say on quadrille paper, the various columns of decipherment may be examined, and a check-mark placed beside each column in which the series of letters appears to represent a “good” decipherment. With longer columns, those may be checked which contain the largest percentages of letters _E T A O N I R S H_, without too many of the letters _J K Q X Z_; with shorter columns, perhaps those are “best” in which any repeated letters are chiefly vowels, it being remembered that when the cryptogram contains repeated sequences, as well as repeated single letters, the possible identity of these repeated digrams or trigrams must also be taken into consideration. With all of the apparently good columns checked for attention, _sheet 1_ may be creased vertically so as to place any desired column on the extreme right, and this column may then be laid directly against any desired column of _sheet 2_ for an observation of the resulting digrams. If these appear to be satisfactory, then _sheet 2_ may also be creased vertically, and the series of apparently good digrams may be laid directly against any desired column of _sheet 3_ for an observation of the resulting trigrams. And so on, if desired, to a possible _sheet 4_, or _5_, or _6_, though, as a rule, the first three sheets will be found sufficient. While the method, as indicated, is intended to be mechanical, that is, largely visual, it would be possible, where uncertainty exists between two given combinations, to copy these and subject them to a digram test. But this should not be necessary in a case where key-letters, as well as their deciphered columns, are expected to set up good combinations in order to form a plaintext key-word.

Figure 113

If column Z U Z O E were VARIANT: If column Z U Z O E were BEAUFORT:

KEYS: a b c d e f g ..... KEYS: a b c d e f g ..... Z A B C D E F ..... Z - B C D E F G H ..... U V W X Y Z A ..... U - G H I J K L M ..... Z A B C D E F ..... Z - B C D E F G H ..... O P Q R S T U ..... O - M N O P Q R S ..... E F G H I J K ..... E - W X Y Z A B C .....

An interesting version of this method, as shown by Admiral Elliott Snow, included the following variations: To begin with, in extending the alphabets, the decryptor omits altogether the letters _J K Q X Z_, and perhaps one or two others of extremely low frequency, simply leaving the blank spaces which indicate their alphabetical positions. This makes the work more rapid, and, in addition, the presence of these blank spaces in any column of decipherment, advertises at once that the column is probably not a very good one. But Admiral Snow’s columns were not columns; they were _rows_. A given series of letters: as _Z U Z O E_ of our foregoing _sheet 1_, is laid out horizontally, and its decipherments are extended vertically. The spacing on each row is arranged to correspond with the period; that is, the letters _Z U Z O E_, instead of being continuous, are spaced six columns apart if the period is 6, and their decipherments, of course, are spaced in the same way. The sheets may now be creased horizontally between rows, and one sheet placed against another in such a way that the resulting digrams are all standing on diagonals, but have appeared at exactly their cryptogram distance apart. The student should experiment with both arrangements and decide which one he likes.

It has been pointed out by C. A. Castle, another of our members, that the foregoing method will find its chief application, not on a single cryptogram, but as applied to a case which, so far, we have not considered in connection with the substitution ciphers: One in which the decryptor has in his possession five or six cryptograms, all very brief, but all enciphered with the same key. Here, we have the common practical case, to be handled in somewhat the same way as the last of our transposition examples; the cryptograms can be written one below another, thus forming a series of columns in which every column has been enciphered with the same cipher alphabet. If this case happens to involve a comparatively short period, it is possible to take intervals between repeated sequences found in two different cryptograms, using the intervals indicated by the number of columns between the first letter of one sequence and the first letter of its repetition. Castle’s example, however, was not based on a short key, but upon an extremely long one, and his five or six messages were merely fragments, each one of which was _known to be the beginning of an English sentence_. In the English language, about half of all initial letters used are found in the group _T A O S H I_ and more than another one-fourth are found in the group _W C B P F D M_. Thus, having a series of beginnings in which the first column will include only initial letters, the number of truly acceptable decipherments on any _sheet 1_ will usually be quite limited. In addition, with vowels known to have a fondness for second and third positions in words, there should be little difficulty in selecting decipherments from _sheets 2_ and _3_.

* * *

While we have described this device as having been written out on sheets of paper, there are many persons who prefer to have at hand a series of cardboard strips which will set up the “sheets” mechanically. If each of the strips carries the normal alphabet written twice in succession, it is possible to adjust five of the strips so as to place the letters _Z U Z O E_ one below another in the form of a column and automatically set up the other 25 columns. The strips can be loose, or may form part of a slide. Slides, in fact, may be used for many purposes, and are well worth preparing for any kind of cipher which the decryptor expects to encounter a great many times. The members of the American Cryptogram Association, who solve a great many Vigenères, Beauforts, and so on, as a matter of recreation, have practically all “invented” slides (or tableaux) which will, to some extent, do away with the irksome task of carrying out a trigram-search. These are prepared in various ways, and variously used, though the principle for all is about the same as that indicated in Fig. 114. They are usually referred to as _decrypting slides_, and the single stationary alphabet, sometimes a list of key-letters and sometimes not, will be called “the decrypting alphabet.” C. Stanley Lamb, who is by no means the only “inventor” of the device illustrated, has this in several different forms, according to the purpose for which he intends to use it. Notice that the card, as we have placed it, shows the stationary single alphabet running contrary to the others, for use on the Vigenère cipher, and that this card need merely be reversed in order to have a single stationary alphabet running parallel to the others, for use on the two Beauforts. As to the sliding double alphabets, there may be as many of these as the operator feels like setting up; if the device is being used to assist in the trigram search, three will be needed.

Figure 114

One Form of "DECRYPTING SLIDE" C. STANLEY LAMB

For VIGENÈRE, the "Decrypting Alphabet" runs backward:

| a z y x w v u t s r q p o n m l k j i h g f e d c b | ( A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H ... ( A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E ... ( A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I ... | z y x w v u t s r q p o n m l k j i h g f e d c b a |

As this is shown, it has been set for the decipherment of a trigram H D G, and every possible decipherment can be read from the slide without changing its present adjustment. The entire list of frequent trigrams can be used as trial keys:

Trial Keys: T H E A N D T H A E N T I O N T I O F O R (Etc.) H D G Fragment of True Key: O W C H Q D O W G D Q N Z P T O V S C P P (Etc.)

To explain its use: The decryptor here is dealing with a sheet of trigrams. Each one of these trigrams is to be deciphered as _THE_, _AND_, _THA_, and so on, following the list of normally frequent trigrams, and the resulting key-fragments are to be written down for comparison with one another, in the hope that some two or more will be duplicates, or will contain overlapping letters. The first of these cipher trigrams is _HDG_. These three cipher-letters, found on the three slides, are placed, in order, below _A_. Now, on the first of the slides, every possible decipherment for _H_ is standing opposite its key-letter, found in the “decrypting alphabet”; on the second slide, every possible decipherment for _D_ is standing opposite the the proper key-letter; and on the third slide, every possible decipherment for G. To know, then, what key-letters will be deciphered by _THE_, find _T_ on the first slide and note key-letter _O_; find _H_ on the second slide and note key-letter _W_; find _E_ on the third slide and note key-letter _C_; the complete key-fragment is _OWC_. This may be written down, Then, _without changing the adjustment of the device_: For _AND_, key-fragment _HQD_, and so on down the list.

Where the cipher is Vigenère, the text-letters may be found in the “decrypting alphabet” and their keys on the slides, without changing results. But with either of the Beauforts, a key is specifically a key and not a text-letter. Thus, when the card is reversed, and the same process applied for one of the Beauforts, the student must be careful as to where he finds his letters _T H E_ in each of the two ciphers. This peculiar relationship of Vigenère-variant-Beaufort is not hard to untangle if all three of the encipherments are considered to be purely mathematical operations of addition and subtraction. If we must add two numbers, as 5 and 10, it makes no difference whether we call it the sum of 5 plus 10 or the sum of 10 plus 5. But where we must perform a subtraction, there are two separate cases.

In straight Vigenère encipherment, the process is _addition_, in which text-letters may be considered to have the values 1 to 26 (their serial positions in the normal alphabet), while key-letters may be considered to have the values 0 to 25 (the amount of alphabetical shift represented by each one). Thus, the encipherment of _J_ by _P_ (10 plus 15) will not result differently from the encipherment of _P_ by _J_ (16 plus 9); in both cases, we obtain _Y_, alphabetical value 25.

In variant Beaufort, we have one of the _subtractions_: _Message minus key_, with the occasional necessity for “borrowing” 26 in order to make a subtraction possible. Thus, _J_ enciphered by _P_ (10 minus 15) does not give the same result as _P_ enciphered by _J_ (16 minus 9). In the first case (after borrowing 26), we obtain _U_, or 21, while in the other case we obtain _G_, or 7.

In the true Beaufort, we have the other _subtraction_: _Key minus message_. This time, we value the key-letters 1 to 26, and the text-letters 0 to 25. Thus, _J_ enciphered by _P_ (9 taken from 16) results in _G_, or 7, while _P_ enciphered by _J_ (16 taken from 9) results in _U_, or 21. Our results, then, are exactly the reverse of those obtained in the other subtraction.

If these mathematical comparisons be understood, or simply kept in mind, it will always be possible, whenever a decryptment process has been explained in connection with only one of the encipherments, to examine its “mathematical” details and learn from these in just what respects it would have to be modified in order that it may be applied with equal success to the other two encipherments. There is another interesting possibility which may have escaped the student’s notice. If he will turn back to Fig. 98, in which the same message, using the same key, was enciphered in both of the Beauforts, one encipherment coming out as _K K Z B B I Z_. . . . . and the other as _Q Q B Z Z S B_. . . . . , he will notice that these two cryptograms are complementary from beginning to end. If we saw any reason for doing so, we might convert either one of the Beaufort cryptograms to the other form, and apply its probable word with its own slide.

* * *

Now, having seen the great vulnerability of the famous “indecipherable cipher,” suppose we glance at some of the devices which have been used for doing away with its periodicity. One such device, that of _auto-encipherment_ (_autokey_, _autoclave_), has been given its own separate chapter (the one immediately following), not because of its value as a cipher, but because of the very interesting decryptment problem it presents. A second device, the details of which may be examined in Fig. 115, consists in the use of a very long nonrepeating key, the popular name for which is “running key.” The value of such a key, for practical purposes, we have already seen; it was a key of this kind which Castle had used on his five or six cryptogram-beginnings. In single examples, however, it gives more trouble. Unless there is a probable word, its message and key must be dug out bit by bit, and if the encipherment is Vigenère, any recovered fragments can belong equally well to the message or to the key. However, with its key known to be purely plaintext, no fragments need be considered except those which are usable combinations, and since the “running key cipher” makes a fascinating puzzle, a specimen has been included among the practice cryptograms. The original of this, apparently, was the Hermann cipher. This employed a slide which was identical with the Saint-Cyr slide except that the stationary alphabet carried an extra cell (position) marked “index” to be used instead of the Saint-Cyr index _A_. As the writer saw this, the index-cell was standing just ahead of _A_, so that the resulting encipherment would have been that of a Saint-Cyr slide on which the letter _Z_ was serving as index-letter.

Figure 115

Vigenère with a "Running Key"

Key-letters: M Y C O U N T R Y T I S ... Plaintext letters: S E N D S U P P L I E S ... Cryptogram: E C P R M H I G J B M K ...

Of other devices aimed at destroying periodicity, quite a few have been based in some way on _key-interruption_. A key-word is selected, as INDEPENDENCE, but the encipherer breaks off before completely using his rotation, so that the completed cryptogram will be enciphered very irregularly by such a key as INDEP INDEPEND I IN INDEPENDENC IND INDEPEN. . . . . . Sometimes this is found as a word-spacing device, the key beginning over with each new word, though naturally not with word-separations showing in the cryptograms. But in the average case, the key-interruption takes place at the discretion of the encipherer; sometimes the agreement with his correspondent allows him to break off as he pleases without any sort of signal, leaving the decipherer to discover the interruptions through the fact that he can no longer decipher; again, he may use an indicator, as _J_. In the latter case, he must encipher any _J_’s which may happen to occur in his message by using the _I_-substitute; then, whenever he decides to break the key, he first enciphers a _J_. Thus, whenever the decipherer brings out the letter _J_, he knows that his key is to begin over with the encipherment of the next letter. It will be noticed that in all of these cases, the decipherer will have to do his work one letter at a time.

There is another of these devices which apparently destroys periodicity and is aimed at throwing all of this onerous work upon the shoulders of the decryptor without at the same time punishing the legitimate decipherer. This consists in shortening the two alphabets of the key, so as to leave some extra letter, which will never be used in any cryptogram. Encipherment, in this case, is accomplished in the regular way, producing a periodic cryptogram. The extra letter may then be inserted at points throughout the cryptogram wherever it can do the most harm. The decipherer, knowing that this one letter is always null, need merely erase it. But if this device is to be really useful, the omitted letter must not be always the same, and this trouble can be overcome as follows: In the shortening of the plaintext alphabet, we omit always the unwanted letter, as _J_. But in shortening the cipher alphabet, we omit first one letter and then another, according to agreement, and insert _J_ in its place. The decipherer, knowing what letter is null, erases it; but the decryptor, granting that he knows what the process is, will still have to experiment with various letters before he learns which one (or more) of the 26 is the null of the moment.

Shortened alphabets are not uncommon in ordinary use. We meet with 25-letter alphabets in European examples, the letter _W_ having been omitted for telegraphic reasons. This case can usually be distinguished from the one which precedes by the fact that the letter _W_ is never found in a frequency count, and it presents only the minor trouble that the ordinary 26-letter slide will not make the decipherments, so that it becomes necessary to prepare another on which the letter _W_ is not present. This case can, of course, be simulated by making use of a 24-letter alphabet.

These devices, taken as a whole, have added little, if at all, to the security of the straight-alphabet ciphers, though, for the most part, they have succeeded admirably in rendering their ciphers totally unfit for general purposes. Considered as single examples, they can, of course, prove troublesome. We trust that this will not be the case with some one or two of the appended practice cryptograms, but if so, we recommend that the student postpone them for a later investigation. Concerning example No. 122, he may find that some of the material presented in Chapter XVI applies also to the “running key” encipherment; with others, a trigram-search may assist in developing the interrupted key-word; and in one case, a clever decryptor should find a way for applying his Kasiski method.

122. By SABIO. (Vigenère with Running Key. SENT, AGENT, STOP, IMPREGNATED).

A R U N N I N G K E Y S O Q M A V Q X K L U E R S Z S S R F A H A I V X W E T N K Z Q N V R A G W V E T F W N L K A T A I B S Z U H P E X U B W W A S P N F F C. (These are a trifle tedious, but not inhuman). • • • • • •• •• ••

123. By NEON. (Porta, with key-interruption. Plenty of trigrams!)

A P V K W T P K P V Y G Q P G A K J Z W J N I X J U Q O U K P V W F U R F X N K C K P R K Q K W F U R G J O V Z O K G X J V Q S W T F K D L L Y Q L X Z E F L Y U J V Z C X G Q L J M T X W K K P V T V B Y K X P F J Z Q X B V C O V V H X Z K J Z U Y.

124. By WHOSIT. (Beaufort, with key-interruption. THEY, WHEN, IN, ON, UP, etc).

M X Y F U H P M J B C X O C K A L Q E D B Q A E P R B Z L G L W M J B Z Z C S A A L A O E K K C W L L J B P H U W B L F Q O R B Z L A O E M A L O K F P V H Y U Y H Y J L X O L X Z.

125. By B. Natural. (Gronsfeld, with key-interruption).

S O W H Z G H O C V V W L F F F X O F H H X Q S I H S O Y P P H K T Q H Z F Y J Q G Q H O B X V X O F L R J L F W E A E F H O G G V O F E T Y M U X O F T H S N F B U A O B W H V C V V H V A O F Q M A G V N H S S C F U X O F V H E L O A O J O E C V V E Y F A V S N I P L E O U P W T A G P Q K E T.

126. By TRYIT. (Gronsfeld, with interruptors. MY, TO, THE, OF, IS, BE, WHICH).

R H X G A P A S R E C Z T R T W Z A J Z S G Q A Z M T P E A U X G K Y Z F W Z S G Q Y O E Y F C T P W B G K O D P W N D X Z A W F O W H T Z B M O H K Q P K V K S Q N D J Z S L Z X L C R T T N H S H W.

127. By B. NATURAL. (Vigenère. One letter reserved as interruptor. Look out!)

P N B Y C A N D V N P N F Y Z G V N W E J N S I T T T Z B L N O S L N X R N I L Z H N H M D X D X B Z N B I K W Z H N D J N B M D T N O I K N E I I H T W Q M F A T N P Q U N T J W D C X N G I C X P Z B L N O S L N O I J N O S L G N H S C K T Q D N X W N R I I I L M J T R N U M D T.