CHAPTER VII

General Methods — Multiple Anagramming, Etc.

In the past few chapters, we have been looking at all of the general methods for decryptment of transpositions. We have seen the use of _factoring_, which determines, for the geometric cipher, what key-lengths are possible, and, for the irregular one, what key-lengths are not. _Vowel-distribution_ has enabled us, in some cases, to determine the length of major units, or has assisted in the restoration of minor units to their original intact groups. _Anagramming_ has been seen throughout: the matching of letters and columns with or without the application of language statistics.

So far, we have been materially assisted by advance knowledge as to what the cipher is. Where the type is unknown, and cannot be promptly identified, and assuming, of course, that the decryptor has no probable words, transpositions, taken as a whole, present confusing problems in the very multiplicity of their possibilities. General Givierge, in his _Cours de cryptographie_, remarks of this case that novices, as a rule, display a tendency to recoil from the cryptogram as if uncertain “which end to pick it up by.” He adds that the best advice he can give is to pick it up _somewhere_ and do _something_, rather than be satisfied to sit all day long and admire the cryptogram!

As to how a type may sometimes be identified, the difference between the regular and irregular types is ordinarily suggested by the number of letters contained in the cryptograms. Irregular types, intended for practical purposes, are nearly always seen in complete five-letter groups, where the geometric cipher usually results in a broken group at the end of its cryptogram. This, of course, is never mandatory upon the encipherer; it merely happens because the only persons making use of such ciphers are those who do not realize the advisability of doing otherwise.

Among the irregular types, a columnar formation can usually be spotted by the “bunching” of vowels at intervals throughout the cryptogram. Then, too, we are still to see those cases in which the exact type of the cipher may not become apparent until after solution is well started.

It is usually well, when a new system is encountered, to analyze it and find out what the transposition finally does to the letters. This can be done by preparing actual cryptograms in which the plaintext letters are serially numbered; or, if the question of vowel-distribution is not involved, by using the serial numbers without the letters, as suggested in a previous chapter. Many ciphers, of course, will not require even this amount of analysis, even though their type, accurately speaking, is irregular. For example, the one shown as Fig. 48, whether or not its rectangle is to be completed, is merely another _route_, so that once having seen it, we might try to follow this route again. But the student who cares to give this cipher his careful consideration must notice that its longer cryptograms would be full of reversed plaintext segments; that these would grow longer and longer with a constant rate of increase, and would always alternate with incoherent segments which, in their turn, would grow shorter and shorter; also that these incoherent segments, if set up as columns, would show plaintext.

The complete-unit cipher, generally speaking, can hardly present any real complexities. Consider, for instance, the following variation on a Nihilist encipherment, which was proposed by Geo. C. Lamb, the author of Chapter X: The key-length, to begin with, must be divisible by 3, but this is not used for writing-in. The plaintext is written into its block, not in straight order, but following a _route_ which begins in the upper left corner and goes forward for the first three letters, drops down to the second line and runs backward for the next three letters, drops to the third line to run forward for another three, and so on back and forth until the first three columns have been filled with trigrams written alternately forward and backward. It then moves over to the second three columns, beginning this time at the bottom and “snaking” upward to the top. For the third three columns it moves downward again, and so on until the square block has been filled. After this very devious primary transposition, the unit is taken off by means of the key, on the Nihilist principle of transposing both columns and rows with the same key.

Figure 48

Cipher Requiring Little Analysis

1 2 3 4 5...

T│ H│ W│ S│ E│ ──┘ │ │ │ │ S I│ O│ E│ .│ ─────┘ │ │ │ D L U│ E│ .│ ────────┘ │ │ B O T M│ .│ ───────────┘ │ ← . . .│ ──────────────┘

Plaintext: THIS WOULD SEEM TO BE...

Cryptogram: T H W S E S I O E....

We believe that the resulting cryptogram could prove puzzling to any cryptanalyst who has met the cipher for the first time. It is true that he has, in the original square, a large number of intact minor units, provided he can restore them. But these units are very tiny, and the several of them which stand on any one row are not continuous among themselves; thus his vowel-distribution, while approximately normal, would probably not satisfy his expectations. If, however, having failed to find a more satisfactory block arrangement, he attempts to match columns (it being remembered that he is accustomed to reading in all sorts of directions in order to discover plaintext fragments), he will most certainly discover the trigrams and trace their route. Afterward, however, having met and analyzed the cipher, it would probably occur to him to look for exactly this complexity whenever he discovers that he is dealing with a square whose key-length is divisible by 3. We have mentioned before the assistance which may be had from the mere knowledge that a certain method exists.

Complete-unit ciphers, of course, may be troublesome, but their complexities are necessarily confined to one small area. An irregular cipher, on the other hand, usually involves the entire text, and its complexities may be real. In this class we occasionally find ciphers in which a single cryptogram is impossible to break; and we find others in which the eventual solution of one cryptogram will not instantaneously provide the key to another enciphered exactly like it. Such ciphers are well worth analyzing, for surely, somewhere, they have their weaknesses; and most certainly any two cryptograms enciphered exactly alike should be decipherable with the same key.

The cipher shown in Fig. 49 is of the double-columnar type known in this country as the “United States Army” double transposition, and has, in fact, been authorized for use, under suitable conditions, in the military service of more than one country. As may be seen from the figure, this cipher is, in all respects, the columnar transposition of the preceding chapter accomplished twice in succession on the same text (decipherment being, as usual, the reversal of the encipherment process). The same rules apply here, as in the single columnar transposition, to the use of nulls, and to the advisability of avoiding the key-length which is a multiple of 5. It goes without saying that the block should never, under any circumstances, be allowed to work out as a square; this, in substance, would be the block unit of the Nihilist cipher. While the figure shows a primary cryptogram, taken off from the upper block, this, in practice, is never actually done. The columns of the upper block are always transferred direct to the rows of the lower one, and only the columns of the lower block are taken off as an actual cryptogram. In preparing this cryptogram, both blocks should be laid out at the same time; otherwise, there is danger that the operator may apply the first transposition and forget the second, thus sending out a simple columnar transposition which carries the key to all of his other cryptograms. This cipher, as may be seen, has its points. Yet it will have been noticed that its use for military purposes was not authorized without restrictions.

Figure 49

The "United States Army" Double Transposition

1st Encipherment

P A R A D I S E 6 1 7 2 3 5 8 4

R E G R E T C H Primary Cryptogram A N G E I N S Y S T E M S X X X (Not usually X taken off)

2d Encipherment ENT, REM, EIS, HYX, TNX, RASX, GGE, CSX. P A R A D I S E 6 1 7 2 3 5 8 4

E N T R E M E I S H Y X T N X R A S X G G E C S Final Cryptogram: X

N H S R X, G E T G I, R S M N E, E S A X T, Y X E X C.

The special hazards of military correspondence have already been mentioned: the huge volume of interceptable cryptograms; the ever-present knowledge as to probable subject-matter and more-than-probable words, including numbers and dates; the personal habits of individual operators; above all, the fact that much of the enciphering is necessarily done by operators who are not, in the first place, trained for their work, and who, very often, must perform this work rapidly under conditions which are far from conducive to clear thinking. These, however, are chiefly the hazards of the firing line. Back of the lines, where hazards are reduced, there may be a chance that a cryptogram will not be intercepted at all. It becomes possible, for many purposes, to make use of a cipher in which a single cryptogram, though probably read in the end, will resist the decryptor for the necessary length of time, several hours or several days. The double columnar transposition can be very resistant, especially when the key is long and the columns short, and can be made even more complicated by carrying it through still a third block, perhaps using a different key with each new block.

Why, then, would it not be possible to use such a cipher for general communication? To this, there are two answers. For transposition cipher, taken as a whole, has two very serious drawbacks.

First, a transposition, in order to be a good one, must be a transposition of the whole text, and not a series of short individual transpositions. Thus, it becomes possible that an error, either in the encipherment or in the transmission, will not be confined to one small area, but will garble the whole message. In this way, we have not only the delay during which the legitimate decipherer is attempting to decrypt his own message, but, should he fail, the danger which lies in having it repeated. The decryptor who has been provided with both the correct and the incorrect version of a same cryptogram, is often able to figure out both the system and the key.

The other drawback is the danger which lies in the fact of so very many cryptograms. These, originating at many different sources, and all enciphered with the same key, will invariably include many of _identically the same length_. The nature of transposition cipher makes it inevitable that when any two texts of exactly the same length are enciphered with the same key, they will follow exactly the same route. The first letter in both messages will be transferred to exactly the same serial position in both cryptograms; the second letter in both will be transferred to another same serial position, and so on. If we are able to match correctly any two or three letters in one of the cryptograms, the two or three corresponding letters of the other cryptogram will also be correctly matched and will serve as a check. This being the case, any two or more cryptograms which are found to have the same length can be written one below another so as to place corresponding letters in the form of columns, and the problem is reduced to one of _geometric_ columnar transposition.

With ciphers of the complete-unit type, the same thing can be done having several of the major units. We have, say, a single cryptogram accomplished with a Fleissner grille, and taken off by spirals. It may be that nulls were added in the final group, or at the beginning, or the final unit may have been left incomplete (by blanking out the unwanted portion of the final grille-block). In spite of these possibilities, the unit-length, known to be a square based on an even number, can be determined — _or assumed_ — and the placing of the several units one below another provides columns made up of corresponding letters. It is even possible, at times, to apply this process, with suitable modifications, to several cryptograms whose length is only approximately the same. It has been done, for instance, with cryptograms from Sacco’s indefinite grille, mentioned in Chapter III (General Sacco himself has explained the modifications). Such a process is ordinarily referred to as multiple _anagramming_, and we have already seen, in the case of the grille, how it may be modified so as to take full advantage of any inherent weaknesses when the cipher is known.

For discussion of the general case, suppose that we have intercepted a number of cryptograms (seen, by their letter-frequencies, to be transpositions), and that among these we have been able to find five in which the length is 25 letters. Since all of these have been coming from the same two stations, and within a comparatively short period of time, it seems reasonable to suppose that at least a portion of them have been enciphered with the same key, and, upon this assumption, we have written the five cryptograms one below another so as to set up the 25 columns shown in Fig. 50. We wish now to rearrange the 25 columns in such a way as to bring out plaintext on every row, or, failing that, on some of the rows. Once the set-up has been prepared, we may arrive at our goal by any road that suits our fancy. The majority of solvers will simply cut the columns apart and start matching strips at random; and this, probably, is a good enough method, especially when columns are so short. The writer, personally, prefers to leave the set-up intact, at any rate until solution is well started, trying out in pencil the various possible column-combinations, and circling out accepted columns from the set-up in the same way in which segments were circled out of cryptograms in the preceding chapter.

Figure 50

A series of five cryptograms prepared as columns:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

C D D N C A A R T H L O I K A O E R T L S N A N O D A I T E L O C W A I U X D N T Y M I N M O E Y O B T O A T T U T O C F L I Y K X N E I O S B F Y Y T A R O T O R E I L N A O H R I O N M D S R J Y S W E K L N C H T S T S I E G E I H O O P D T N A O

For those who like this method, we repeat a suggestion which has already been made: Many columns are usually present in such a set-up which contain _more than one_ of the “clue-letters,” as here, for instance, column 14 is practically made up of them. Such a column makes a good point of beginning, since we may search the set-up, not for some single letter, but for a pattern made up of several. For column 14, specifically, we might examine the top row of letters, pausing whenever we come to one of those letters frequently preceding _K_, and examining the rest of its column to find out what letter would have to precede _H_ on the fourth row. We may fail with the first such column, but not with all.

Another particularly good method, and one which might work in the present case in spite of the very brief columns, is that of finding the particular column which contains the first letters of all the messages. Well over half of the initials used in the language will be found in the group _T A O S W C I H B D_, and with a frequency in somewhat that order. Any column made up entirely of these particular letters may be the one which begins the messages; and when this can be found, it pays to remember that a vowel is practically always present among the first three letters of each message.

As to finding the end-segment, it seems that this would be of little value except in those cases where final groups are not completed. However, the letter _E_ has a great fondness for final positions, with terminals restricted largely to the group _E S T D N R Y O_; and it is also true that many encipherers make a habit of completing their final groups with such letters as _X_ and _Q_.

Aside from the general case, each individual case carries clues of its own, and the finding of these must depend upon the detective ability (or experience) of the decryptor. Here, for instance, we find that the letter _K_ has appeared three times in only 125 letters of text. This letter, normally, has one of the lowest frequencies in the language, and often is not found at all in 125 letters of text. Finding it three times, then, rather suggests the presence of some one word, a word so important to the subject-matter that it has been used in three different messages.

When considering the letter _K_, the first combination which comes to mind is a digram _CK_ preceded by a vowel; and the letter _C_, also, is not a letter which we expect to find in confusing numbers. When an examination of the set-up shows that, for each of the _K_’s, there is a _C_ present on the same row, we are inclined to accept the hypothesis of a repeated word. In practice, we should pick out the three columns containing _K_, place beside each one a column which will set the digram _CK_ together, and _build on all three combinations simultaneously_ to the point at which the supposed word appears or is proved non-existent. Following out only one of these, let us consider column 14, where _K_ is on the top row. On this row we find that _C_ has appeared twice. Both of the _C_’s are tried with _K_, as shown in Fig. 51; we find that both combinations will provide acceptable digrams, but there is little doubt as to which we would select. Combination 1-14 is merely acceptable, while combination 5-14 provides a very accurate description of the column which would fit best on its left. There should be a vowel on the top row, to precede _CK_, and another on the bottom row, to precede _NG_. After that, perhaps another vowel should be found on the fourth row, to precede _TH_, or perhaps, in this case, an _S_, since the list of frequent trigrams includes a sequence _STH_; and, finally, something suitable to precede _TY_, which appears to be a syllable, but may belong to two different words. The five columns which will meet these requirements have been added in Fig. 52. In this figure, two combinations may be discarded, because of trigrams _KTY_ and _YTY_. The others appear acceptable. At this point, however, the sequence _XTY_ of combination 16-5-14 begins to draw attention because of its very few possibilities (SIXTY, NEXT YEAR, etc.), making it likely that one of these will quickly select or discard the entire combination. For building SIXTY, row 3 of the set-up contains two _I_’s and one _S_. The two _I_’s, columns 13 and 19, when inspected visually, are found to bring out, on the top row, the two sequences _I O C K_ and _T O C K_, while the _S_, column 21, brings out, on the top row, another _S_, which would extend these, respectively, to read _S I O C K_ and _S T O C K_, the latter surely the more acceptable. The results of these additions, with subsequent development, can be examined in Fig. 53. The completion of the word SIXTY has brought out also: STOCK, _MITED_, SMITH, DOING. The presence of the word STOCK suggests extending the sequence _MITED_ to read LIMITED, and the addition of two more columns on the left brings out another CK, suggesting another appearance of the word STOCK. The chances are that we have already been building on this other word STOCK, but if not, we may build it now to the point shown in the figure, where the top row suggests RAILROAD STOCK, the third row, FIFTY TO SIXTY, and the second may or may not suggest MEXICO. Thus we are well on our way to solution, and have not once had recourse to a long prepared list of probable words: _division_, _regiment_, _battalion_, _attack_, _advance_, _report_, _forward_, _artillery_, _ammunition_, _communication_, _enemy_, _signal_, _retreat_, _troops_, and so on.

Figure 51

1-14 5-14

C K C K D D E D B Y T Y T H T H W G N G

Figure 52

12-5-14 13-5-14 15-5-14 16-5-14 25-5-14 O C K I C K A C K O C K O C K U E D X E D N E D T E D O E D L T Y I T Y K T Y X T Y Y T Y A T H O T H R T H I T H S T H I N G E N G E N G I N G O N G

Figure 53

11 8 25 6 3 21 19 16 5 14 L R O A D S T O C K I C O L I M I T E D F T Y T O S I X T Y N E S O R S M I T H S T O C K D O I N G

Naturally, there are times when the matching of the columns, for one reason or another, proves troublesome. We are thrown off by errors, by the presence of nulls, initials, abbreviations, etc., or by the encipherer’s use of cover-up devices, such as the writing of _YH_ instead of _TH_. Or we find that the handling of many paper strips, caused by message length, is awkward and confusing. But if, in the eyes of the decryptor, there is any good reason for finding out the contents of such messages, he can always succeed, even with only two letters per column.

So far, nothing has been said about helping ourselves to the serial numbers of the columns, which, during the rearrangement of letters, are automatically forming in a certain sequence across the top of the set-up. Regardless of the cipher, it can do no harm to examine these, and find out what information, if any, they are able to give. In some cases, they will provide us with both the system and its key, enabling us to throw away the strips and start deciphering. Suppose, for instance, we have correctly matched sixteen columns, and find their numbers in the following order: 31-10-24-37-17-3-32-11-25-38-18-4-33-12-26-39. A careful examination shows that the numbers are running in sets of six. After the first six are passed, the next six have repeated them with an increase of 1, and another six appear to be forming up which will repeat them with an increase of 2. We may verify this by finding the columns which have numbers 19-5-34-13, etc., and, if the set-up continues to show plaintext, we know that we are dealing with a simple columnar transposition. Notice that if the above series were marked into segments of six numbers each, and the segments placed one below another, we should have _six columns_, each one made up of numbers which are consecutive. Thus, we may sometimes learn from a series of numbers: (1) the system, which is straight columnar transposition; (2) the key-length, which is 6; and (3) the key itself, which, taking the six numbers according to size, is 5-2-4-6-3-1, possibly with the wrong numbers coming first, though it happens that in this case they do not. This is our old friend SCOTIA, used on forty numbers, in case the student cares to verify it.

The trail of the columns is not so plain where a second transposition has done something to the first. But it is still present; the most complex of ciphers has method of some kind, provided we can find it. Consider, for instance, the series of numbers, 11-8-25-6-3-21-19-16-5-14, which has been forming in Fig. 53. Examination here shows pairs of consecutive numbers, 11-8, 6-3, and 19-16, all having the same numerical difference of 3; that is, the plan of our present encipherment, whatever it is, has, on three separate occasions, caused some plaintext digram to appear in the cryptogram reversed, and with its letters three positions apart. Irrespective of the type of transposition, this constant numerical difference of 3 might be found again; perhaps we can set some two columns together correctly simply by _reproducing this numerical difference_ in the two column-numbers. A glance ahead at the next figure will show that we actually could, by setting together columns 12-9 or columns 20-17. Where we cannot discover a repeated numerical difference, perhaps we can discover a progressing difference, or some other signs of regularity.

Now, returning to the particular case, let us pass on to Fig. 54, in which the matching of the 25 columns has finally been completed, and make a careful comparison between the two numerical series 12-9-10-15 and 20-17-18-23. What can these represent but the _fragments of four columns_, belonging to a _first encipherment block_, which have been laid down along the _rows_ of a _second encipherment block_, and taken out in slices? And since the lineal distance apart of any pair of numbers, as 12 and 20, is seen from the figure to be six positions, it would be possible, by writing the series of numbers in lines of six numbers each, to place each pair of corresponding numbers in a same column. The trail, usually, is not so wide, but there is little doubt here that we have been dealing with a case of double columnar transposition in which the key-length of the original block was 6. We shall come back to this in a moment.

Suppose, now, we give our attention to the various series of numbers which appear in Fig. 54, and make sure that we understand what they are. The numbers running across the tops of the columns were, originally, the _serial numbers of cryptogram letters_ (or columns). When we restored these letters to their plaintext order, we disarranged their serial numbers, causing these to come out in the order 1-7-24-22-12-9, etc. This series, then, is made up of _cryptogram serial numbers_. But it is also a _key_, since it shows us exactly the order in which we might _take off a plaintext_ in order to form a cryptogram. It is a key of the Myszkowsky type, according to which every letter in the text has its individual key-number, as we saw in Fig. 46 (imagine that encipherment accomplished twice in succession). We do not desire, however, to take off plaintext. And, to use this same key on a cryptogram, we should have to use it in the _writing-in_ manner; that is, first lay out the series of key-numbers, and then, taking the cryptogram letters in their 1-2-3 order, place them, one by one, below their key-numbers. But once the plaintext has been restored, the _plaintext letters_ (or columns) _may also have serial numbers_, and these new serial numbers, in the figure, have been added at the bottoms of the columns. Should we now restore these columns to the order in which we found them, that is, to their cryptogram order, each column taking with it its new serial number, we should find, running across the bottom of the set-up, another mixed series of numbers in the order 1-10-20-9-24, etc., which is a different order from that of the cryptogram numbers, and this new series is made up of _plaintext serial numbers_. This is the other key, having the same relationship to the first as that explained in connection with the short Nihilist key. Applied to the plaintext, it would have to be used in the _writing-in_ manner; used on the cryptogram, it serves for _taking-off_. Thus we are able to recover from our reconstructed plaintext two long keys, either one of which will serve to decipher additional cryptograms, _but only on condition that these new cryptograms contain exactly 25 letters_.

Figure 54

The Columns of Figure 50, After Solution by Multiple Anagramming:

1 7 24 22 12 9 10 15 4 2 20 17 18 23 13 11 8 25 6 3 21 19 16 5 14

C A N N O T H A N D L E R A I L R O A D S T O C K D O Y O U W A N T A N Y M E X I C O L I M I T E D B U Y B L O C K A T O N E F I F T Y T O S I X T Y T R Y R A I L R O A D O N J O N E S O R S M I T H W H A T I S T E L E P H O N E S T O C K D O I N G

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 (Plaintext serial numbers, added at bottoms of columns)

(Appearance of the plaintext serial numbers, if the above columns should be restored to their cryptogram order) 1 10 20 9 24 19 2 17 6 7 16 5 15 25 8 23 12 13 22 11 21 4 14 3 18

If, then, we hope to decipher cryptograms of other lengths, which originally were enciphered with exactly the same key as our present five, it is still necessary that we take one or the other of these long Myszkowsky-type keys and reduce it to the short columnar form. The theory on which this is done should not be at all difficult to understand if it be kept in mind that both of our long keys are actually the serial numbers of letters, and that each individual serial number accompanied its letter throughout the encipherment process. This will explain any references which are made to FIRST and SECOND encipherment blocks, with their respective columns and rows. Whichever of the long keys we decide to reduce, our first objective, always, is that of determining the _length_ of the shorter key; after that we restore its _order_.

The first process, summed up in Fig. 55, was originally published, so far as the writer knows, by M. E. Ohaver, and makes use of the cryptogram numbers which were the first series obtained. The discovery of the shorter key-length is made by searching the set-up for some numerical difference (between any two numbers whatever) which is repeated by corresponding pairs of numbers at some regular interval. For convenience in making the search, Ohaver suggests that the mixed cryptogram numbers be written, with uniform spacing, on two strips of paper, in one case repeated. One strip can then be moved along beside the other so as to place pairs of numbers in actual contact. It is immaterial what numerical difference is used; the difference 1 pointed out in the figure seemed a little more visible than others. This difference 1 has been noted between the numbers 9 and 10, and the next difference 1 has been found _six positions away_ between the numbers 17 and 18, but is not found again between the numbers 25 and 6, which stand at the next interval of six positions. This may be a clue, but it is not what we had hoped to find. The clue is strengthened, however, by the observation that a difference of 5 occurs just at the right of the original difference 1, and is also repeated at the lineal interval 6.

Figure 55

Finding the Original Short Key from the CRYPTOGRAM Serial Numbers - M.E.OHAVER

Finding the key-length:

1 7 24 22 12 9 10 15 4 2 20 17 18 23 13 11 8 25 6 3 21 19 16 5 14. 1 7 24 22 12 9 10 15 4 2 20 17 18 23 13 11 8 25 6 3 21 19 16 5 14 1 7 x . . . . . x (Repeat series)

A difference of 1 occurs again at the interval 6. The two series 9-17 and 10-18 are fragments of columns from the first encipherment block. The key-length necessary for placing either pair in a same column is 6.

Replacing cryptogram numbers in first encipherment block:

(As PLAINTEXT)... 1 7 24 22 12 9 10 15 4 2 20 17 18 23 13 11 8 25 6 3 21 19 16 5 14

COLUMNS of the FIRST encipherment block are converted to ROWS of the SECOND:

(a) (b) (c) 1 10 18 6 14 1 10 18 6 14 22 1 - 3 - 5 - 2 - 4 - 6 22 2 11 19/ 7 15 23 3 2 11 19 7 15 23 12 20 8 16 3 12 20 8 16 24 1 10 6 24 4 13 21/ 9 17 25 5 4 13 21 9 17 25 2 . 7 5 3 8 4 9 5 At (a) the columns of the first block are (C O S M O S) arranged so as to make the cryptogram numbers At (c) the order is run consecutively in each of the new columns. shown in which the columns At (b) this block has been adjusted, so as of (b) would be taken off. to form six columns. This order is the KEY.

To find a good clear example, using the strips as they stand, let us go back toward the left, and look for a difference 2. We find it first between the numbers 24 and 22; exactly six positions away, we find it again between the numbers 4 and 2; another six positions, and we find it between the numbers 13 and 11; still another six positions, and we find it for the fourth time between the numbers 21 and 19. Thus we have two series of numbers, 24-4-13-21 and 22-2-11-19, which run parallel to each other with their numbers always separated by interval 6. Sequences of this kind came from the _columns of a first encipherment block_, and can all be placed back in these columns by re-writing the mixed cryptogram numbers in lines of _six numbers each_. Sometimes we find such columns broken to bits, as would be the case should we continue moving the strip until we have completely exhausted the possibilities for difference 1; and we never find them complete, since these columns of the first encipherment block were taken out in irregular order and written continuously upon the rows of a _second encipherment block_, and after that were sliced through in the taking out of columns from the second block. We found traces of them once before, where a difference of 8 was found throughout four consecutive pairs of numbers 12-20, 9-17, 10-18, 15-23, always at an interval of 6 positions.

The key-length, then, is 6, and the cryptogram numbers (in their plaintext order) if written into a block of that width, will reproduce the first encipherment block. From this, we wish to carry the numbers, column by column, into their second encipherment block, from which they may then be taken out, again by columns, in such a way as to bring them back to their cryptogram order 1-2-3. If this is to happen, the numbers must run consecutively in the new columns, and the number 1 must be on the top line. We select, then, from the restored plaintext block, the column which contains the number 1, then the column containing the number 2, and so on, writing these columns horizontally on the rows of the new block, in such an order as to make the numbers consecutive in every column. This may or may not require the adjustments indicated in the figure at (a) and (b). When block (b) is completely adjusted, the order in which it would be necessary to take its columns so as to produce the cryptogram numbers in their original 1-2-3 sequence, is the order of the original short key. Our key-word COSMOS, incidentally, could have been better chosen.

In Ohaver’s process, we have taken the _cryptogram numbers_ and _enciphered_ them. By the process of General Givierge, summed up in Fig. 56, we do the opposite: we take the _plaintext numbers_, in their cryptogram order, and _decipher_ them, so as to bring them back to their correct plaintext order 1-2-3. For learning the key-length, General Givierge endeavors to find that number which, when added or subtracted throughout the series of numbers, will most often cause one of its segments to repeat another. The portions which repeat are the columns, or partial columns, not from a first encipherment block, but from a _second_, since the process here is to follow out a decipherment. In the figure, the left-hand block (not strictly necessary) represents the plaintext, written as a cryptogram, and the one on the right represents it in what is known to have been its first encipherment block. To develop the second block: either take columns from the right-hand block and lay them on the rows of the central one in such an order that its columns can be taken out to form the cryptogram; or, write the cryptogram arrangement into the columns of the central block in such an order that its _rows_ will show the columns of the plaintext block on the right. The order in which columns must be taken from the right-hand block to form the central one (or that in which columns must be taken from the central block to reproduce the cryptogram arrangement) is the order of the original short key. The condensed presentation here is also drawn from the writings of M. E. Ohaver. General Givierge, who seems first to have published the method, was chiefly concerned with exposing the possibilities of _analysis_, as applied to numbers generally, and explains to us the reason of the increase 6 which betrays the key-length in the plaintext series of numbers. The width of the original block being 6, each number is larger by 6 than the one just above it, making every one of the columns an arithmetical progression in which the constant difference is 6. These columns, still retaining their regular increase of 6, are laid down on the rows of a second block, and, for at least a portion of their length, some two or more of them always continue parallel, with progressions of 6 running side by side. Thus the taking out of columns from the second block will, at times, select _one each_ from two or more different progressions of 6, and the new columns, throughout some portion of their length, will differ from one another by exactly 6, the original key-length.

Figure 56

Finding the Original Short Key from the PLAINTEXT Serial tumbers - GIVIERGE

To find the key-length: Try adding (or subtracting) possible key-lengths (4, 5, 6, 7, etc.) to the whole series until some one of these added numbers causes portions of the series to repeat.

1 10 20 9 24 19 2 17 6 7 16 5 15 25 8 23 12 13 22 11 21 4 14 3 18 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6

7 16 26 15 30 25 8 23 12 13 22 11 21 31 14 29 18 19 28 17 27 10 20 9 24

The portions which repeat when the correct key-length, 6, is added, are columns, or part-columns, from the SECOND encipherment block.

Plaintext Serial Numbers S E C O N D F I R S T In CRYPTOGRAM Order: Encipherment Block Enoipherment Block / 1 10 20 9 1 7 13 19 25 4 1 2 3 4 5 6 24/19 2 17 10 16 22 2 8 14 7 8 9 10 11 12 6/ 7 16 5 20 5 11 17 23 3 13 14 15 16 17 18 15/25 8 23 9 15 21 6 12 18 19 20 21 22 23 24 12/13 22 11 24 25 21/ 4 14 3 18

The ROWS of the CRYPTOGRAM BLOCK, (approximately of column-length), must be written back into the COLUMNS of the SECOND ENCIPHERMENT BLOCK in such an order that the ROWS of this SECOND encipherment block could have been taken off as a primary cryptogram from the COLUMNS of the FIRST ENCIPHERMENT BLOCK, extreme right, known to be the original order of the numbers.

The original short KEY can then be found by observing (in the central block) the order in which columns have been taken from the right-hand block. That is, find the small numbers which were on the top row; these are standing in the order 1, 4, 2, 5, 3, 6 (a writing-in key), and the columns which are headed by these receive key-numbers in the order 1-3-5-2-4-6.

* * *

We have seen, then, the general case in which the “enemy” decryptor, having several cryptograms of the same length, enciphered with the same key, is able to use a purely mechanical method in order to restore the plaintext, and afterward, by observing traces of a known cipher, to extract their key. For the solution of single cryptograms enciphered in complicated systems, the writer knows of no other method than straight anagramming, in which the single letters, accompanied by their serial numbers, are written on individual cardboard squares (or imagined to be so), and the attempt made to match them up. Attention has already been called to some possibilities which may lie in the serial numbers whenever the sequences or probable words are thought to be correctly matched. But with absolutely nothing known or suspected as to source or subject matter, and with nothing discoverable from serial numbers or possible routes (and taking it for granted that any accumulation of letters represented in about the normal frequency-proportions can be made to yield dozens of different solutions), it would hardly seem that the decryptor, even should he find the correct solution, would have a means of distinguishing it from any other.

Figure 57

A Single Cryptogram in Double Columnar Transposition:

L H D L A O D D H L H E E U I X D F P I U T A E R O I T Q A E T E R L N I E N A U D K L I E E H Y N M S J L C N H P B O A D G R N.

The Solution, Enciphered by a Method Mentioned in Chapter III:

M T Q P I N A I E N E I T H R G E K D U U D L L I R I H F R T E C L O L N J L A S H A A U Y D O E E L N E N D H P D H D E A B O.

For the student who may care to struggle with a case of single anagramming, we have appended a problem in Fig. 57, together with a means for finding out the solution and perhaps even the key-word. It has come from the Philadelphia headquarters of a band of revolutionists, and our stool-pigeon tells us that the leaders of this movement are to be called together for consultation during the coming summer.

* * *

The finding of a _key-word_, after recovery of the numerical key, is not, of course, necessary to the decipherment of further cryptograms. However, this recovery will afford us the same convenience which it gave to the encipherer; that is, a simple mnemonic device for reproducing the numbers at will. And to recover the actual original key-word may, at times, provide some insight into the habits or mental make-up of the person who selected it, and who may select others like it, or might, conceivably, make use of this same key-word in some other kind of encipherment. If the key is short, it is practically always possible to recover more than one word; but with long keys, we seldom, if ever, recover more than the one word on which the numbers were actually based. In this connection, however, it must be remembered that key-words are not necessarily taken from any one language; thus, their recovery becomes largely a matter of combined information, intuition, guesses, trials, and determination, so that an exact method for accomplishing it is hard to give. But, presuming that key-numbers have been derived in the usual way, those which are small are, in general, likely to have derived from the earlier portion of the alphabet, which contains _A_, _E_, _I_. So long as they increase toward the right, they may continue to represent a same letter, and when they do, this letter is usually a vowel, When an increase occurs on the left, the new number has certainly derived from a new letter, coming later in the alphabet. Whatever the language, then, it is very easy to determine the two extreme alphabetical limits outside of which no one of the letters can possibly be found.

This can be seen at (a) of Fig. 58. The numbers 1, 2, 3, might all have derived from _A_, but the number 4 cannot have derived from a letter coming earlier in the alphabet than _B_. Similarly, the numbers 4, 5, might, by possibility alone, have derived from _B_; the numbers 6, 7, 8, might all have derived from _C_, the numbers 9, 10, from _D_, and, finally, the number 11, from no letter earlier than _E_. When these earliest possible limits have been established for every key-number, and it is seen that the range is five letters, then the last five letters of the alphabet, _V_, _W_, _X_, _Y_, _Z_, may be used to establish the limits at the other end of the alphabet. It is seen now, that the key-number 6, must have derived from some letter between _C_ and _X_, inclusive, and similarly with the others. But when we come to the particular case, it becomes necessary to make assumptions; for instance, were these numbers derived from a common English word or from a Russian proper name? The person who selected it, so far as we know, is accustomed to speaking English, and in all of his past cryptograms we have been able to recover common English words rather than proper names. Assuming, then, as at (b) of the same figure, that we are to recover his usual common English word, we set down _A_ as a possible letter for the key-numbers 1 and 2. But when we arrive at the number 3, we see that we cannot assign here a third _A_, since common English words of this length do not contain a doubled _A_. The earliest letter possible, then, is _B_, and, upon noting the consecutive letters _AB_ at this particular point, we think at once of the common English terminal sequence -_ABLE_.

Figure 58

(a) Limits: (b) Assumption of English word:

6 9 1 4 11 7 10 2 3 8 5 6 9 1 4 11 7 10 2 3 8 5 C D A B E C D A A C B A A B L E X Y V W Z X Y V V X W (FL (MY A C (NZ (FL (MY A B L E D E (New limits)

To find whether this is possible, we make sure that the new letters, _L E_, alphabetically considered, do not run contrary to their supposed numbers, 8 5. Then, having accepted these four letters as entirely possible and likely, we work back to the missing number, 4, and find, now, that it has new limits; it must have derived from _E_, _D_, or _C_, and from nothing else, and of these, we are inclined to discard _E_, which would give a sequence _AE_. We then work back to other missing numbers, 6 and 7, and find that these, too, have acquired new limits; they must be found somewhere between _F_ and _L_, inclusive. All numbers which follow 8 have attained a new limit in the earlier portion of the alphabet, but not in the latter portion. These are all shown in (b). At this point, any knowledge at all of English prefixes will suggest what the first two letters are and will narrow the limits still further. The student, perhaps, has already guessed the word.

Of the keys which follow, (a) and (b) were derived from English words, one of which has been used in the present chapter. The remaining four are derived from proper names, respectively (c) German, (d) Italian, (e) Spanish, and (f) French.

(a) 1-9-2-4-11-3-7-8-6-10-5. (b) 2-7-8-3-4-1-6-5-9-10. (c) 2-5-11-3-9-13-6-12-8-1-4-7-10. (d) 9-1-10-6-5-2-8-7-4-3. (e) 2-11-3-6-7-9-1-5-8-4-10. (f) 5-1-4-6-2-3-9-8-7.

36. By TITOGI.

(a) U O Y M E E T E N A W H T I M C I C T I J I U S O G N H Y F. (b) Y T M I L L E M L E W U A A J T W O N F O R T A H L H T G I. (c) R O P U L E A E E B A H F T K O D T S C I L T T M R Y T I H. (d) U M H T S E U O K S I H W T R A N C I O W A O H T Y O S S Y. (e) E C E R L T A D A R M R E A O G P O Y M E E A A T N I B S A. (f) R E U O T K N A E H E H H L Y W D E L E E E E O M N W S L L. (g) I H L P U H T T G I Y T T A S N E R T E O R Y T A H N J D S. (h) E S E F K A C A P E E O L S A M E J N S T E O M S L E O T I. (i) T E N E W O H S K I I N S G T M O O H T A A T H U E U T O B. (j) H T P R A H L E R E E R E T A T L E E H S T T T E H B N B S.

37. By EFSEE.

(a) I U E G N M O W H X T A N O I P D I L S F P I A R - (b) F N E E T X I E T O N O T S M G R T R Y V G P A C - (c) S F U F N I C E Q E S C U N R I L T M Y I O I P T - (d) B T E E S N B I H I E T L N X O E S N R E I E G T.

38. By SIR ORM. (This has a keyword!)

T A S H L E C P W E T C I H A O T N R A O O H L W D O Y I L E O H R L E V A T E A O M N L E V N W I W I E I H S M H E T H N W O I O L S V I I F S S O W A S O T F I L E H N M G O F I E R A L O C G N N.

39. By DAMONOMAD. (And he calls this a "Nihilist" !)

A H H S E S T I H D I S O M E A T H I O O H D I O U T T I K M I E S O F G S N E R W U G T S G Y I S L A T I T T A A N H O G E N Y L A W E A L E R T M I W T O E D.

40. By FRA-GRANT. (A military message sent by General Calamity to Major Catastrophe).

T E H A N E M G S L L I W S N E T T A C K Y E I A A E B P S O U R P E M O C E E T U N R I S T E R S A F O E T O R T D A E R T E F D I N C A S E R E T T U O P W A R U R E F F O Y A E E D F O R D R C R.

No. 40 can be decrypted by the multiple-anagramming of its units. Afterward, if you are unable to reconstruct the system, No. 41 will tell you all.

41. By PICCOLA. (Single block - completed unit - with columns transposed. The key to this transposition may amuse you, provided you can reconstruct it in letters!)

A O U U P D M C A N I O G T R S A A Y N K N C A B M N A O A T L E C H Q S D O R E E W W D N C K E E S T S H N I E T E U H K N I F D I T Y F U X G I V L T A I P H R C S N R R E H S B M E E A R M T A I U T E W O P I R S M H O O E V R W F N X S D A H I E T S S U F C N N E E S N F S E O O L T U A E A O F T V L T E E O E C.

42. By TITOGI and PICCOLA. (General information - nothing more).

(a) I H S E W D O X H D H T S E O E H R N E C T O O A G A R S A N O E A O S O H U W R T C A U R E N T T O M S O C N Y N P G S H A P P N F S N E R T E H E P M A W S M E G I A E A P O R Y D T A A S S A F M I H S R C H E C W N E I T A T R X E I S O A C F A T I C E N I R T E U Y H T E R T S R S E L S T E G P A H R W. (b) S R H J I A X E C A N E Y P K A N D A T S D L I L A S L N T G E A D Y E B L Y T S C C I D T C S G A M C E E N W A T I E A E N H L A B D Y A G H C H E G I H O I L P O N P A S E D N T T W E S Y E F I M L A R E R H N E D I O T E L R O S I T D S S R I S N I R R F S S P E C T R E I F B G O M R X S E N A H A R N L. (c) A E G Y B A T Y N S R I D T O O S D N E Y E E E O G N I U U T W S N L H E I I S C G H H W D R R U W E A H E T K C T W V O E H H I.

43. By TITOGI. (Keerful, Si! All is not gold that glitters).

C T I H N A I E S O R M F Y E E C T H U W I S L A E D K R L B E R N M J I T S D A N D O O H T V A T H T E R Y G A U N O T S A P E M O E S U R I L T E D I E O N E N R C A F I N P O L H O E A G R B X S.

44. By ALII KIONA. (Nou hooda thawt it uvvim?)

E N W N O T N S E N Y U H O I K H N O E W A O T I U S S A L B W S F R M I E I D I H R W N T F N D S E E O T U E Y B N O T W E W Z E E D I B A E R Y I P L R N P Z R S M U T A S O I S U S D T D T R N H N O A S A F E Z.