CHAPTER XVI

Auto-Encipherment

The term _autokey_ (_autoclave_; “the autokey cipher”), as commonly used, refers to the kind of encipherment shown in Fig. 116, in which a message becomes its own key for applying some one of the multiple-alphabet ciphers — usually the Vigenère. It will be noticed from the figure that the auto-encipherment must be “primed” with a conventional key; and whenever the words _key-length_, _period_, and so on, are used in connection with auto-enciphered cryptograms, their actual reference is to the short initial key. A more accurate term would seem to be _group-length_. But that a term is needed for referring to something akin to the period of the ordinary Vigenère cryptogram can be seen when we consider the mechanics of decipherment:

Figure 116

Vigenère Autokey: C O M E T/S E N D S U P P L I E S T O M O R L E Y S Plaintext: S E N D S U P P L I E S T O M O R L E Y S S T A T I CRYPTOGRAM: U S Z H L M T C O A Y H I Z U S J E S K G J E E R A

Our present initial key, COMET, _key-length 5_, serves to decipher only one _group_ of that length. The five key-letters obtained from this first decipherment will serve to decipher only one more _group_; from this, another five key-letters are obtained, and will decipher a third _group_, and so on. But our _group-length_, sometimes referred to as “period,” includes five individual series of letters, any one of which can be enciphered and deciphered independently of the rest. That is, beginning with _C_, or _O_, or _M_, or _E_, or _T_, and taking each fifth letter, it is possible to proceed straight through to the end, enciphering or deciphering only this one series, or “column.” It will be noticed from the foregoing that the decipherer gets the short end of the bargain. The encipherer knows in advance what the key is, and, to some extent, can apply one cipher alphabet at a time; the decipherer knows only the key to the first group; the rest he must ferret out for himself.

There is, however, a second form of autokey encipherment in which the respective difficulties of encipherer and decipherer would be reversed. This form of auto-encipherment, which can be seen in Fig. 117, makes use of a preliminary key, as in the regular form, but follows this with the enciphered text instead of with the plaintext. Such an encipherment results, occasionally, from the mechanical construction of a cipher machine, and in this case, where the 26 cipher alphabets are in mixed order, and unknown to the decryptor, may present an interesting decryptment problem. But where the cipher is Vigenère (or any other in which the decryptor possesses the full set of cipher alphabets), it can hardly be argued that there is any great problem about a cryptogram which carries its key in full view. We will confine ourselves, then, to the usual form of autokey, as first explained, beginning our studies with a brief glance at the two common practical cases, that of accumulated cryptograms, and that of probable words. Procedure, in the former case, is self-evident. Possessing several cryptograms all initiated with the same preliminary key, we may write their beginnings one below another to form columns, and the first few of these columns will constitute an ordinary case of Vigenère in which every message is known to be the beginning of a sentence. With beginnings discovered, a little industry accomplishes the rest.

The case of probable words, on the other hand, presents some interesting possibilities inherent in the auto-encipherment itself. When the probable word is short (or if a search is to be made for normally frequent trigrams), the task of bringing out and testing the possible key-fragments is made much less onerous by the fact of the purely plaintext key. Being sure of an abundance of excellent sequences, we need consider none but the very best of the deciphered fragments; and for any one considered, the trials need be made only within a very short range of the spot at which it was found. All of this work may be done directly on the cryptogram. A correct sequence, correctly applied, can be followed out in both directions, and will yield, in full, several of the “columns,” and several consecutive letters of the initial key. But if it so happens that the probable word is longer than the initial key, _its first few letters must become the keys for enciphering its last few_. Consider, for instance, the word SIMPLICITY, which has a length of ten letters. If the preliminary key contains only five letters, then, beginning at -_ICITY_, the keys _SIMPL_- will begin to encipher, causing a certain long cryptogram-sequence which, for Vigenère, will always be _A K U I J_. If the preliminary key has six letters, the same word causes a sequence _U Q F N_ when the cipher is Vigenère; if it has seven letters, the cryptogram-sequence will be _A B K_; and even an eight-letter key brings out one certain digram, _L G_. Thus, knowing what the cipher is, and having at our disposal any comparatively long probable words, we may write out these sequences _in advance_ and be ready to look for them in the cryptograms. In addition to whatever words we consider probable, it is obvious that any other long word may encipher itself in the same way, and, if it is one important to the subject matter, is likely to be repeated, causing the cryptogram to show a _long repeated sequence_. Thus, if we find a long repeated sequence in a cryptogram, we are able to try this as a common suffix, _TION_, _MENT_, _ENCE_, _ABLE_, etc., in the expectation of bringing out some common prefix, _CON_, _PRE_, etc.

Figure 117

Key: C O M E T/ U S Z H L O H O S T ..... S E N D S U P P L I E S T O M ..... U S Z H L O H O S T .....

Note that the cryptogram itself is the key, except that the first five letters are missing. To decrypt, With any alphabet, need merely find where to begin using it!

More fascinating, by far, than its practical aspects, however, are the possibilities presented by the autokeyed cryptogram for analytical attack. The devices immediately to follow are described by General Givierge in his _Cours de cryptographie_, and are credited by him to Commandant Bassières.

First, it is possible to discover the length of the short preliminary key, or, at any rate, to confine this to certain definite probabilities. This key, as we have seen, governs a definite group-length, or “period.” If this group-length, say, is 5, then, barring the first and final groups, every plaintext letter will be enciphered by the letter standing five positions to its left, and will, in its own turn, serve to encipher the one standing five positions to its right. Since all plaintexts are filled with repeated letters, roughly half of them separated by even intervals, it stands to reason that there will be many occasions on which the letter standing five positions to the left and the one standing five positions to the right will be the same letter. That is, we must often find the encipherment pattern of Fig. 118. Some one letter, as _S_, is repeated at an interval of exactly twice the group-length, with some other letter, as _R_, standing at exactly the group-length interval from both of the _S_’s. The first _S_ enciphers _R_, and _R_ enciphers the second _S_. Or, if the repeated letter is _T_ and the intermediate one is _L_, then _T_ enciphers _L_, and _L_ afterward enciphers _T_. Where the cipher is Vigenère, the result, in the cryptogram, is _a repeated letter standing at_ _exactly the group-length interval_. If the cipher is one of the Beauforts, the same pattern produces _a pair of complementary letters separated by exactly the group-length interval_.

Figure 118

S . . . . R T . . . . L S . . . . R . . . . S T . . . . L . . . . T J . . . . J E . . . . E

Now, in order to consider the value of this observation, let us examine the cryptogram of Fig. 119, an autokeyed Vigenère, which, for convenience, is presented in groups of the correct length, 7. According to Bassières, should we inspect this cryptogram for repeated single letters, noting, in each case, the interval of separation, the correct group-length, 7, will be present among those intervals which are noted oftenest, and, in many cases, will be the one which predominates. For making such an examination, perhaps the simplest plan would be that of listing the possible group-lengths at the tops of a series of columns, beginning with group-length 1 and carrying them as far as desired. The counts could then be made by placing a tally mark in the proper column for each time that a given interval is noted. The results of this examination, as compared with the Kasiski examination for a period, may be studied in Fig. 120. At (a), where the leading intervals of our cryptogram have been listed with their frequencies, it is noticeable that the correct group-length, 7, is not represented by the predominating interval or even by the one which is second in frequency; it is merely present among the five leaders. But we find other cryptograms, not necessarily of great length, in which some one letter, as _V_, will be repeated five or six times in succession at exactly the group-length interval, and its evidence amply confirmed in other repetitions. Then, as at (b), we may find some fairly good clue, leading us to give the first trial to the correct group-length; and again we are left, clueless, to try out five or six different group-lengths before striking the correct one. Results, then, are variable, and the only certainty, at any rate in a short cryptogram, is that of being able to limit the group-length to a given few. With the group-length determined, or with one selected for trial, we may take our choice of two processes.

Figure 119

L C N D M E E L C N O Y G T B G X V N D G S S H W A W J Q E V L H O W Y I J W L E X A P V E C L B H D Q E K U W W G R H X J F B D Y P I P K Q D W A R G U W R L G N I Q S L V L E S P H E U T X B O N D H V X D C O U D S J T F J N U Q N Q L A A I L M Z U X I E W O B Y I W E H P D Q

* * *

_Process 1_ (_Bassières_). With group-length 7, as we have seen, our cryptogram includes seven independent series, or “columns,” of letters. By beginning at the 1st letter, and taking the 1st, 8th, 15th, 22d, etc., letters, we may decipher _series 1_ independently of the others; or, by beginning at the 2d letter, and taking the 2d, 9th, 16th, etc., letters, we may decipher _series 2_; and so with the other five series. Many persons, before doing this, will rewrite this cryptogram into seven _columns_, which permits that the decipherment of a series be done straight down its column, and for that reason the word “column” is sometimes used to describe what we have called here a “series.” In order to understand the first of the Bassières processes, we need consider only _series 1_, it being understood that whatever applies to any one of the seven series applies equally well to the other six.

Figure 120 (a) (b) Interval 8, found 8 times Possible Reason for L C N " 16, " 8 " " 4, " 6 " T H E o r e m/G E T t i.. " 5, " 6 " G E T t i n g T H E b a.. " 7, " 6 " Z L Y . . . . Z L Y . .

Now, considering Fig. 121: If the unknown first key-letter was _A_, then the first plaintext letter, found by deciphering with key _A_, was _L_, and this became the key for enciphering the eighth letter. If the key which enciphered the eighth letter was _L_, then the eighth letter, found by deciphering with key _L_, was _A_, and this became the key for enciphering the fifteenth letter. Following out this decipherment to the end of _series 1_, we find that the plaintext letters must have been _L A B R Z Z B_, etc., as given in full in the figure. A glance at the complete series will show that this decipherment is not a particularly good one. If another decipherment be carried out, on the hypothesis that the original first key-letter was _B_, we obtain the series _K B A S Y A A_, etc., which starts out fairly well, but which, when completed, will contain two _K_’s, one _Z_, two _B_’s, and one _P_. If a third decipherment be carried out, on the hypothesis that the original first key-letter was _C_, we obtain the series _J C Z T X B Z_, etc., which is a poor decipherment from the beginning. A trial and error method might consist in making these decipherments one at a time directly on the cryptogram, erasing one when it is obviously poor, and trying to add the next series whenever one proves acceptable.

Figure 121

Keys: A L A B L C N D M E K L C N O Y G T B G X V N D G S S H W A W J...... Plaintext: L A B R

Series 1, (Key A): L A B R Z Z B G Q L F R B G H H C Y Z J.

The Bassières process, however, consists in setting up the entire 26 possible decipherments as these are shown in Fig. 122. In this figure, the original cryptogram-letters of _series 1_ are standing in a column at the extreme left. The 26 possible decipherments are also standing in the form of columns, each decipherment headed by the key with which it was initiated. If the group-length 7 is correct, then one of these 26 columns shows the original plaintext letters.

Now let us examine, not the columns, but the rows, of this tableau, and find out just how troublesome it is going to be to prepare tableaux of the same kind for _series 2_, _series 3_, and possibly others. The key-letters, across the top, constitute a normal alphabet, and below this each row contains the 26 decipherments for some one letter of _series 1_. On the odd-numbered rows, the decipherments for the odd-numbered letters are alphabetically arranged, but progressing in a direction contrary to that of their keys, as if these odd letters represented Vigenère encipherment. On the even-numbered rows, the decipherments for the even-numbered letters are also alphabetically arranged, but are progressing parallel to their keys, as if these even-numbered letters might represent variant Beaufort encipherment. Evidently, then, the _A_-decipherment is the only one which must actually be carried out; afterward, the preparation of the tableau is a matter of extending alphabets. With similar tableaux prepared for the remaining six series, we have seven sheets, and on each one of these there is one column showing the correct decipherment of the series, headed by the correct key-letter. Thus, our solution is to be the mechanical one of the preceding chapter. On each one of the tableaux, the apparently “good” decipherments may be checked for attention; the sheets may be creased between columns, and the “good” decipherments of one tableau may be placed directly in contact with those of another.

Figure 122

SERIES No. 1, Prepared as a Tableau. (Corresponds to SHEET No. 1 of Figure 112).

THE CIPHER The 26 Decipherments, with Keys LETTERS

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z (Keys)

L L K J I H G F E D C B A Z Y X W V U T S R Q P O N M ← L A B C D E F G H I J K L M N O P Q R S T U V W X Y Z → B B A Z Y X W V U T S R Q P O N M L K J I H G F E D C ← S R S T U V W X Y Z A B C D E F G H I J K L M N O P Q → Q Z Y X W V U T S R Q P O N M L K J I H G F E D C B A Y Z A B C D E F G H I J K L M N O P Q R S T U V W X Y A B A Z Y X W V U T S R Q P O N M L K J I H G F E D C H G H I J K L M N O P Q R S T U V W X Y Z A B C D E F W Q P O N M L K J I H G F E D C B A Z Y X W V U T S R B L M N O P Q R S T U V W X Y Z A B C D E F G H I J K Q F E D C B A Z Y X W V U T S R Q P O N M L K J I H G W R S T U V W X Y Z A B C D E F G H I J K L M N O P Q S B A Z Y X W V U T S R Q P O N M L K J I H G F E D C H G H I J K L M N O P Q R S T U V W X Y Z A B C D E F N H G F E D C B A Z Y X W V U T S R Q P O N M L K J I O H I J K L M N O P Q R S T U V W X Y Z A B C D E F G J C B A Z Y X W V U T S R Q P O N M L K J I H G F E D A Y Z A B C D E F G H I J K L M N O P Q R S T U V W X X Z Y X W V U T S R Q P O N M L K J I H G F E D C B A I J K L M N O P Q R S T U V W X Y Z A B C D E F G H I

* * *

_Process 2_ (_Bassières_). Fig. 123 shows the second of the Bassières processes. With 7 decided upon as the group-length, we make up a _trial key_ having the right number of _A_’s, and decipher the cryptogram. The new cryptogram, produced in this way, is _periodic_, and its period, for Vigenère, will be twice the group-length, in the present case 14. In Fig. 124, where this new cryptogram has been repeated, written into its period, it is possible to check its periodicity: It has two repeated sequences, _C J B_ and _W G_, at suitable intervals, and while these are very few, their evidence is amply supported by the fact of repeated single letters in every column. When the periodicity is not confirmed in this way, it can be assumed that the chosen group-length was not correct.

The make-up of this new cryptogram is not hard to understand if it is noticed that what we have done is to carry out simultaneously the seven _A_-decipherments of seven tableaux like that of Fig. 122. We saw there that the odd-numbered letters of a series react as Vigenère encipherment and the even-numbered letters as variant Beaufort. With seven _A_-decipherments made at once, the same will apply to odd-numbered and even-numbered _groups_. Thus, our new cryptogram has seven columns enciphered in Vigenère and another seven enciphered in variant Beaufort. The original seven-letter initial key-word will decipher both sets of columns; for the first seven, it must be applied in the Vigenère manner, and, for the other seven, in the variant Beaufort manner.

Figure 123

a a a a a a a L C N D M E K A A A L M C J B G X K B B X R M K M Z V M L C N D M E K L C N O Y G T B G X V N D G S S H W A W J Q E V L H O W L C N D M E K A A A L M C J B G X K B B X R M K M Z V M Z S L Z I T K

Z S L Z I T K Z Q Y X D L N B Z X H Z A O G E T X L U I Q C Y K M P X Y I J W L E X A P V E C L B H D Q E K U W W G R H X J F B D Y P I P K Z Q Y X D L N B Z X H Z A O G E T X L U I Q C Y K M P X L B A F W A N

L B A F W A N F C W V V G H R P P L S C J B W G A M Q G G I O T L L I Q D W A R G U W R L G N I Q S L V L E S P H E U T X B O N D H V X D C F C W V V G H R P P L S C J B W G A M Q G G I O T L L I H V T C M S U

H V T C M S U H Z K Q X B L C O K A Q P A Y M Y L W K U Z W G L S R E O U D S J T F J N U Q N Q L A A I L M Z U X I E W O B Y I W E H P D Q H Z K Q X B L C O K A Q P A Y M Y L W K U Z W G L S R E J A Y W X M M

New Cryptogram: L C N D M E K A A A L M C J - B G X K B B X...........(Etc.)

As to why this encipherment reduces to alternate Vigenère and variant Beaufort groups, this is best understood by resorting once more to the “mathematical” aspects of the Vigenère cipher. In a previous discussion, we have said that Vigenère encipherment consists in the “addition” of key to message, and that variant Beaufort encipherment (which, in Vigenère, would be _decipherment_), consists in the “subtraction” of key from message. In the beginning, our plaintext is a series of groups, as _A_, _B_, _C_, _D_, _E_, etc. and the first encipherment operation consists in the _addition_ of a key, as _X_, but only to the first group, _A_. To encipher group _B_, we add _A_; to encipher group _C_, we add _B_, and so on, so that when the auto-encipherment is complete, we have a cryptogram in which the groups are made up as follows:

_1st_: _2d_: _3d_: _4th_: _5th_: _A plus X_ _B plus A_ _C plus B_ _D plus C_ _E plus D_. . . . . . (etc.)

Figure 124

The New Cryptogram from Figure 123

L C N D M E K A A A L M C J B G X K B B X R M K M Z V M Z S L Z I T K Z Q Y X D L N B Z X H Z A O G E T X L U I Q C Y K M P X L B A F W A N F C W V V G H R P P L S C J B W G A M Q G G I O T L L I H V T C M S U H Z K Q X B L C O K A Q P A Y M Y L W K U Z W G L S R E J A Y W X M M 1 2 3 4 5 6 7 1 2 3 4 5 6 7 (Vigenère) (Variant Beaufort)

Now, remembering what the mathematical valves were for key-letters, the trial key, made up entirely of _A_’s, is made up entirely of _zeros_. When we subtract zero from the first group, we leave it unchanged, that is, the first cryptogram group is still _A plus X_ (plaintext _plus key_, or Vigenère). When we subtract _A plus X_ from the second group, this cancels the _A_ of both, and leaves _B minus X_ (plaintext _minus_ _key_, or variant). When we subtract this from the third group, we cancel the two _B_’s, leaving _C plus X_, again Vigenère. When we subtract this from the fourth group, we cancel the two _C_’s, leaving _D minus X_, again variant Beaufort. And so to the end. Always we come out with the original plaintext group plus or minus _X_, the key. Those groups which are _plus X_ are Vigenère, and those which are _minus X_ are variant. And _X_, in all, is the same: the original preliminary key. A comparison of the same kind applied to the two Beauforts (or a few trials made on actual groups, if the student is not mathematically disposed) will show whether or not the auto-enciphered Beauforts can also be reduced to periodic form, and, if so, what their period is likely to be. In the case of the true Beaufort, it may be necessary to straighten out a quirk as to the application of the _trial key_.

Figure 125

Tables of High-Frequency Co-Efficients PHILLIP D. HURST

VIGENÈRE (Cipher Letters) A B C D E F G H I J K L M N O P Q R S T U V W X Y Z E a e h i n o r s t T h i n o r s t a e K A a e h i n o r s t e O n o r s t a e h i y N n o r s t a e h i s I s t a e h i n o r S i n o r s t a e h H t a e h i n o r s R n o r s t a e h i 6 4 1 - 4 4 4 4 4 2 3 4 3 2 3 2 1 4 4 2 2 6 4 2 2 4

BEAUFORT (Cipher Letters) True Beaufort: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z ...VARIANT... A Z Y X W V U T S R Q P O N M L K J I H G F E D C B E e a t s r o n i h T t s r o n i h e a K A a t s r o n i h e e O o n i h e a t s r y N n i h e a t s r o s I i h e a t s r o n S s r o n i h e a t H h e a t s r o n i R r o n i h e a t s 9 4 1 2 4 3 3 3 2 3 3 3 3 4 3 3 3 3 2 3 3 3 3 2 1 4

PORTA (Cipher letters) A B C D E F G H I J K L M N O P Q R S T U V W X Y Z E r s t n o a e h i T n o r s t e h i a K A n o r s t a e h i e O n o r s t h i a e y N t n o r s h i a e s I r s t n o a e h i S n o r s t e h i a H r s t n o a e h i R n o r s t h i a e 3 3 3 2 4 4 3 2 3 4 6 5 3 4 2 3 4 4 - 2 3 3 3 3 3 2

* * *

While the foregoing methods are intensely interesting as an example of what can be learned by analyzing the structure of a cipher, most members of the American Cryptogram Association, in practical work, prefer methods of their own which are quicker in giving results. These methods, for the most part, have subordinated other considerations to certain original observations concerning the use of the purely plaintext key. Where message and key, as in the case of the autokey and “running key” encipherment, are each made up of normal text, with both members including the normal 70% of high-frequency letters, it becomes inevitable that high-frequency letters in the key and high-frequency letters in the message will be paired again and again as the co-efficients of cryptogram-letters, so that cryptograms enciphered with this kind of key must contain a great many letters caused by this kind of co-incidence. For convenience in making use of this fact, each member has his own ideas. Phillip D. Hurst, for instance, prepared a set of tables of about the kind shown in Fig. 125, one table for each multiple-alphabet cipher with which he expected to deal. As these are shown, the alphabet across the top of any table is a list of possible cryptogram-letters, each cryptogram-letter heading its own column; and each column contains only those letters which are themselves members of the high-frequency group _E T A O N I R S H_, and which, if enciphered by another letter from the same group, would result in the cryptogram-letter standing at the top of the column. The key, in each case, can be found at the left. Hurst says that he always attacks a cryptogram at the _second letter_, on the theory that this particular letter is likely to have been a frequent one in both the message and the key. He then attempts to follow out _series 2_, or, if the group-length has not previously been determined, to find this series. To explain, without going into too much detail, the second letter in our foregoing autokeyed Vigenère was _C_. A glance at the table for Vigenère shows that this letter can result from only one pair of high-frequency co-efficients, _O_ enciphered by _O_. Hurst will make his first trial on _series 2_, beginning with initial key-letter _O_, and come out with the correct decipherment at his very first attempt! With other letters, as _V_ or _A_, it might be necessary to make as many as six trials, but, as we have seen, it is hardly ever necessary to carry a trial very far in order to see that the decipherment is going to be a poor one. The second letter, of course, will not necessarily give results; but the cryptogram, remember, is filled with these vulnerable letters, and a decipherment may be started with any letter whatever and carried out in both directions.

Figure 126

Where the KEY is a Segment of Ordinary PLAINTEXT:

Estimated Rank of the Cryptogram Letters and Their Frequencies Per 10,000

Figured by C. Stanley Lamb From Table of Ohaver.

VIGENÈRE

V A I S ERL WHB XGM FOZ K N T P U J Y C Q D 344 314 304 296 (Intermediate) 150 112 84 84 84 72 72 64 49 --

BEAUFORT & VARIANT

A N E W O M Z BQK JRT HVF GUDX P L S I Y C 480 262 246 246 196 196 191 (Intermediate) 121 121 104 104 57 57

PORTA

K N L E RMF TWP UYQ XGC AVI BJZ D H O S 329 300 282 275 (Intermediate) 132 113 97 --

Another method, originated by C. Stanley Lamb, differs from Hurst’s chiefly in that his observations were made from _digrams_ and not from single letters. Originally, Lamb had been collaborating with Admiral Snow in establishing frequency counts for various kinds of ciphers, so that when the system was unknown, it would be possible to tell one from another. Fig. 126, for instance, gives a rough estimate as to what the rank and frequency should be for each letter in the kind of cipher we have under consideration. Finding a reasonably long cryptogram in which the letters _D_ and _Q_ have ranked among the last, with letters _V_, _A_, _I_, and _S_ ranking among the first, we have a fairly good reason for suspecting that the encipherment was accomplished with a very long Vigenère plaintext key.

Figure 127

(a) Preparation of the mixed alphabet............ C U L P E • • R A B D F G H I J K M N O Q S T V W X Y Z

C A K W U B M X L D N Y P F O Z E G Q H S I T R J V 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

(b) ENCIPHERMENT - Auxiliary Key X, or 8:

Plaintext: S E N D S U P P L I E S T O M O R FIRST Substitution: 21 17 11 10 21 5 13 13 9 22 17 21 23 15 7 15 24 AUTOKEY (Addition): 8 21 17 11 10 21 5 13 13 9 22 17 21 23 15 7 15 C R Y P T O G R A M... 29-38-28-21-31-26-18-26-22-31-39-38-44-38-22-22-39- ════════ ══════════════

L E Y T O M O P R O W S T O P 9 17 12 23 15 7 15 24 24 15 4 21 23 15 13 24 9 17 12 23 15 7 15 24 24 15 4 21 23 15 33-26-29-35-38-22-22-39-48-39-19-25-44-38-28. ══════════════ ════════ xxxxxxxxxxx xxxxx

(c) Detail of DECIPHERENT:

Cryptogram Numbers: 29 38 28 21 31 26 18 26 ... AUTOKEY (Subtraction): 8 21 17 11 10 21 5 13 ... PRIMARY CRYPTOGRAM...... 21 17 11 10 21 5 13 13 ... Re-Substitution......... S E N D S U P P ...

(d) Vigenère Autokey - What Happens to REPEATED SEQUENCES with a ONE-LETTER KEY:

Key... X/ T H E M O N T H E X T Text... T H E M O N T H E X T E A L A L

But for short cryptograms, Lamb did not find these characteristic frequency counts half so convincing as the presence in a cryptogram of certain _digrams_, which appeared to be characteristic for each cipher, since he was always able to find from 7 to 10 of them in each 100 letters. By making use of the high-frequency digrams (_th_, _he_, _er_, _in_, _an_, and so on), he then established lists of cipher digrams which were very characteristic indeed for each type of encipherment. Thus, in attacking an autokey, it is possible to make a good beginning with such a digram as _VV_ (_er_-_re_) or _XK_ (_th_-_ed_), if the cipher is Vigenère, and work in both directions.

“_Key-Length 1_.” — Many writers are inclined to make a special case of the autokey in which the “priming” is done with a single letter, not that this actually constitutes a different cipher, but because of the decryptment curiosities which can be brought to light in connection with it. For instance: Having a cryptogram fragment . . . . . . ._W S Y Q L A H T G B_. . . . . known to be Vigenère autokey, initiated with a single letter, can you find instantly the trigrams _SAY_ and _HAT_? Would you have any reason for trying the word _WAS_? Of the many interesting observations which have come the writer’s way with reference to the one-letter initial key, only one has seemed to present the germ of an additional decryptment method. This observation was one made by Ohaver in connection with a cipher in which the substitutes were numbers. The cipher itself can be examined in Fig. 127.

The first step, (a), consists in the preparation of a simple substitution key in which the plaintext alphabet is in mixed order and the cipher alphabet is made up of the numbers 1 to 26. The encipherment, shown at (b), involves two steps. First, there must be a simple substitution, using the key of (a), and this results in a _primary cryptogram_. Afterward, this primary cryptogram, preceded by an initial key-number, is _added to itself_. In the discussion to follow, our objective will be that of _recovering the primary cryptogram_ (and not the plaintext, which would have to be found later by simple substitution methods). Decipherment, indicated at (c), consists in reversing the two steps of the encipherment: A series of subtractions restores the primary cryptogram, and is followed by the resubstitution of letters. At (d) we have a Vigenère fragment for comparison. The essential fact to be noticed in (d) is the behavior of repeated sequences when the group-length is 1. Any repeated sequence in the plaintext continues to show a repetition in the cryptogram which is shorter by one letter than the original. Even the repeated digrams will give repeated single letters.

Figure 128

A TRIAL-Decipherment (M. E. OHAVER)

The Cryptogram: 29 38 28 21 31 26 18 26 22 31 39 38 44 38 22 22 39 9 20 18 10 11 20 6 12 14 8 23 16 22 22 16 6 16 20 18 10 11 20 6 12 14 8 23 16 22 22 16 6 16 23 ════════

33 26 29 35 38 22 22 39 48 39 19 25 44 38 28 23 10 16 13 22 16 6 16 23 25 14 5 20 24 14 1O 16 13 22 16 6 16 23 25 14 5 20 24 14 14 ════════

Now, putting aside the fact of the mixed plaintext alphabet (since we do not intend to recover the letters) we have here a cipher which, to all intents and purposes, is the Vigenère autokey initiated with a single letter. In place of the letters _A_ to _Z_ we have numbers 1 to 26, and the encipherment is a series of additions. In the corresponding Vigenère case, the group-length 1 will usually show up plainly in the number of doubled letters — “letters repeated at interval 1.” And with the group-length determined as 1, it is possible to begin with some given initial key, as _A_, and either reproduce the plaintext or convert the autokeyed cryptogram to a periodic one in which the period is 2 (twice the group-length). Considering the analogy between the two cases, it should be possible to do the same thing here. That is, it should be possible to take the autokeyed cryptogram of (b), initiate its decipherment with some number chosen between 1 and 26, and either reproduce the primary cryptogram or convert the autokeyed cryptogram to a periodic one in which the alternate numbers will belong to two cipher alphabets. Where this reduction has been carried out in Fig. 128, the initial decipherment was made with key 9 in order to avoid a discussion of negative numbers. Also, the fact of numbers will usually limit the range of the trial keys: here, the first number, 29, was not enciphered by adding any number smaller than 3.

Now, looking at Fig. 129, let us compare the new cryptogram of Fig. 128 with the primary cryptogram of Fig. 127(b), and see whether or not it has the expected formation. Between the two cryptograms (the supposedly periodic one obtained from the trial decipherment and the one we hope to recover), there is a constant numerical difference in the pairs of corresponding substitutes, and this difference, throughout, is alternately plus and minus. Further comparisons can be made, if the student so desires, by initiating other partial decipherments with trial-keys 10, 11, 12, etc. Always, the constant numerical difference persists, and always it is alternately plus and minus. Moreover, for every time that the initial key-number increases in size, there is a corresponding decrease in all numbers occupying the odd serial positions and a corresponding increase in all numbers occupying the even positions.

Figure 129

Comparison of TRIAL DECIPHERMENT with TRUE DECIPHERMENT

True decipherment - (See Figure 127): 21 17 11 10 21 5 13 13 9 22... Trial decipherment of Figure 128: 20 18 10 11 20 6 12 14 8 23... CONSTANT DIFFERENCE: 1 -1 1 -1 1 -1 1 -1 1 -1

We have, then, a periodic cryptogram whose period is 2, and two cipher alphabets, consisting of numbers, in which the only difference is one of size. But these substitutes, unlike those of the Vigenère, will not be placed in normal alphabetical order; to complete the solution by one of the general methods, it may become necessary to take a number of frequency counts. For instance, considering the first of the two Bassières processes, it would be possible to set up the same tableau (Fig. 122), causing numbers to run alternately backward and forward (and beginning again at 1 whenever the number 26 is reached). In this way, one of the columns would contain the primary cryptogram, and a frequency count taken on the numbers of that column should resemble a simple substitution frequency count.

Considering the second of the Bassières processes, the autokeyed cryptogram is already reduced to a period of 2; the subsequent solution of the periodic cryptogram belongs to the general case of the next chapter; that is, a case in which the cipher alphabets are in mixed order but parallel. But we have, here, a special method, and a short-cut. The only difference between our two cipher alphabets is a matter of size in all corresponding substitutes. If we can find out what this numerical difference is, we have only to increase or decrease the size of the numbers in one of the cipher alphabets and bring it to the level of the other. Our short-cut, as pointed out by Ohaver, lies in repeated sequences (or even repeated single letters) in the autokeyed cryptogram. A glance back at the plaintext of the foregoing example will show that two repetitions were pointed out: _STO_ and _TOMOR_, and that these were still present in the primary cryptogram as 21-23-15 and 23-15-7-15-24. In the autokeyed version, they were still repeated sequences, but shorter in length: 44-38 and 38-22-22-39.

Had we initiated our trial decipherment with the correct number, 8, these two repetitions would, of course, have worked back to their original length. But where this trial decipherment was made with a different initial key-number (Fig. 128) we find that only one of the sequences, _TOMOR_, has done this; the other, _STO_, has disappeared. The explanation for this has been summed up in Fig. 130. One sequence was repeated at interval 8, which is _even_. When the autokeyed cryptogram is converted to one having period 2, any interval which is divisible by 2 will contain a certain number of periods; thus, any repeated sequence at interval 8, will appear in the periodic cryptogram as one of the ordinary periodic repetitions. The other sequence, _STO_, was repeated at interval 17, which is _odd_, and thus cannot show up as a repetition in any cryptogram whose period is 2.

It is this repeated sequence found at the odd interval which is to give us our short-cut. We have only two cipher alphabets, each one having a substitute for _S_, a substitute for _T_, and a substitute for _O_. When the repetition occurs at the odd interval, we obtain _both_ substitutes for _S_, _both_ substitutes for _T_, and _both_ substitutes for _O_. By subtracting one sequence from the other, we may learn the numerical difference between the two cipher alphabets. Notice that the difference is _constant_, is _alternately plus and minus_, and is _divisible by 2_. (One alphabet is larger than the original, and the other is smaller by the same amount.) Our special method, then, for a cryptogram known to have been enciphered in this way, is as follows: First, underscore all repeated sequences which occur at odd intervals, or, in their absence, the repeated single letters. Those which are long will almost surely represent repetitions in the plaintext. Then, selecting a suitable number, make a trial decipherment and examine the resulting sequences. If, by any chance, those repetitions found at the odd intervals have worked back to longer repeated sequences, then the trial key and the original initial key must have been the same. If not, try subtracting one result from the other. If both have represented the same plaintext sequence, the result of the subtraction will be a constant difference, alternately plus and minus, and divisible by 2. To restore the primary cryptogram, split this uniform difference, adding half of it to the numbers of one alphabet, and subtracting half of it from the numbers of the other alphabet. This, as mentioned in the beginning, will leave a simple substitution cryptogram still to be investigated.

Figure 130

Respective Behavior of the Cryptogram's Two Repeated Sequences

Sequence 38-22-22-39 Sequence 44-38 Repeated at interval 8 Repeated at interval 17

Trial Decipherments:

1st occurrence: 22-16- 6-16-23 1st occurrence: 22-22-16 2d occurrence: 22-16- 6-16-23 2d occurrence: 20-24-14 2 -2 2

(This interval was EVEN) (This interval was ODD)

Our explanation, perhaps, has been a little rapid, but the student who has read carefully will be able to discover the “germ” originally referred to, and to make his own laboratory tests. Also, there may be an interesting answer to the following question: When the cipher is one of the Beauforts (using letters), and the auto-encipherment is initiated with a single letter, does a trial decipherment, initiated with some other single letter, result in a period of 2?

128. By ELIA, JR. (Variant, Autokeyed).

O O U J V J M K N C B U Q L P F U L A S A Z F T G M P B V A Y V S Q J L F A W S P C H A E I U N R S M F V W S S O O H M E B E A M K F A A X R H K Z R J Q A O I A V M E I B T O P D J G P R J N F R X T I I G X F K D H X A F T H J Q H L A R K T G D L P S B M V Y E E V A O A C S M U V U W C V C T S K S M W L O N P A O O H M W W P Y P O H I L G A Z Q B Q U Z B Q P K M B O V K W J H P J A G D C H X G W Q B K O G Y A K S I W N W E X Q N U S U C V O E Y H Y J J C B T B V J Q M N S P A R V P X O A G T A V L V C Z B D I X N F M W U E Z L N N N W B M O X G T C P K.

129. By ELIA, JR. (Beaufort, Autokeyed).

O A N C Q R O Q N Y Z G K P L V G P A I A B V H U O L Z F A C F M A V Z J H T I L L X V B C Z M M T O W Z W A O Q V P M M Q D L Q K O H K F G O B T L R A U X Y T Y S F N O C Y G R P M U U H T H E W P O O S R G R Z Z S L Y G K I A N K M M T O W Z W A O Q V A B E U X W T C T J I O G L P H T E F U F B R X M U Z V L D B P K N S Y A Q B I V M O H P V L G Z Y F C C W C O M C A W N A A A E V A W M P E B Q X O D O V P X A T E M A J A T P M J E A Z Z M D S B B N A A A F G L I D N X A M K H K P D B B P Q Y.

130. By ELIA, JR. (St. Cyr, Autokeyed).

T B F N Q X E F D G F W E A F X S Q U N I G A H E U N B B J L O B Q P H F A K A S N X G B P E E J W W L Z J O M L L A P R V Y T N M X H Y V O S E S Q V O A Q M O G V P A J K P Y I U Z F Q G Y J Y T L D F E L Q Z L W Y Y U Y Z N E P P F W B R W M E E F R W X J W E P R V Y B U M P Z Z M T S B U K K B A L K Z I L Q A L Z K K F S X Z U S T G J T H A R G S B X I W V L Z B Z M P I K Y I U R H R V W C V A U F V L W F Q Z U D I G F W H T Z M S F B K T Z U T R K I V F Z X W L C A U J P A N V S E O Z U X G I X D S X M G Q E L Q T V B L E I D I A L L A I N O E N L V J I O I S W Q T D E C T M.