Mil Crypt III

7/28/2019 Mil Crypt III

http://slidepdf.com/reader/full/mil-crypt-iii 1/64

WAft DEPAR1'1"IEN"r

OfFICE 01' TRI (:.HJ.R, SmNAI" OrnCRB

" A S R J ~ G · J ' ( ) ! \ I I

~ I I L I ' l ~ R Y CRYP'fANALYSIS

PART I I I



Restl ictt:tl

WAR DEPARTMENT

OFFICE OF THE CHIEF SIGNAL OFFICER

WASHINGTON

MILITARY CRYPTANALYSIS

Part III

SIMPLER VARIETIES

OF APERIODIC SUBSTITUTION SYSTEMS

By

WILLIAM F. FRIEDMAN

Principal Cryptanalyst

Signal Intell igence Seroice

PREPARED UNDER THE DIRI;CTION OF THE

CHn::F SIGNAL O F F I C E l ~



MILITARY CRYPTANALYSIS. PART III. SIMPLER VARIETIES OF

APERIODIC SUBSTITUTION SYSTEMS

CONTENTSsection Paragraphs Pages

I In troductory 1-4 1-4

II Solution of systems USIng constant-length keymg umts to encipher variable-length plain-text groupings, 1____________________________________________________________________________________________ 5-9 5-7

III Solution of systems USIng constant-length keying umts to encipher varrable-length plain-text groupings, 11.__________________________________________________________________________________________ 10--13 8-13

IV Solution of systems using constant-length keying umts to encipher variable-length plain-text groupings, 111._____________________________________________________________________________ 14--16 14-18

V Solutron of systems USIng variable-length keymg units to encipher constant-length plain-text groupIngs__________________________________________________ 17-22 19-27

VI Review of auto-key systems_________________________________________________________________________________ 23 28-29VII Solution of CIpher-text auto-key systems 24--29 30--43VIII Solubion of plain-text auto-key systems __ _ 30--33 45-49IX Methods of lengthemng or extending the key __ 34--36 50-52

X General prmciples underlying solution of systems employing long or continuous keys 37-40 53-57XI The "comcidenee" or "I e test" 41-44 58-72XII The "cross-product" or "x test" 45-48 73-78

XIII Applying the cross-product or x test 49-51 79-93



SECTION I

INTRODUCTORYl'aragrapb

Prehmmary remarks __ __ 1

General remarks upon the nature of cryptographic periodicity_ _ __ 2Effects of varying the length of the plain-ten. groupIngs________ _ 3Primary and secondary periods, resultant periods __ 4

1 Prehmmary remarks -a The text immediately preceding this devoted Itself almostexclusively to polyalphabetic substrtut ion systems of the type called repeatmg-key CIphers

I t was seen how a regulanty m the employment of a lnmted number of alphabets results In the

mamfestataon of periodici ty or cyclic phenomena m the cryptogram, by means of which the

latter may be solved The difficulty In solution IS directly correlated wrth the type and number

of CIpher alphabets employed In specific examplesb Two p.ore.Iures suggest themselves Ioi consi.Iei ation when the student cryptanalyst

realizes the foregoing cucumstances and thinks ofmethods to elu.nnate the weaknesses inherent

In this cryptographic system FIrst, noting that the d.fficulties in solution increase as thelength of the key mcreasee, he may s tudy the effects of employing much longer keys to see Ifone would be warranted m placing much trust m that method of mcreesmg the security of the

messages Upon second thought, hoi ever, rei .en.Lermg i l at as a general rule the first step

m the solution consists m ascertammg the number of alphabets employed, It seems to him that

the most logical thing to do would be to use a procedure which ",ill avo.d penodicity altogether,

will thus ehmma te the cyclic phenome-ia tl.at are normally mamfested in cryptograms of a

periodic construction, and thus prevent aa enemy cryptanalyst from taking even a first step

toward solution In other WOIJS, he "'111111\ estigate the pOSSIbIlItIes of aperiodnc systems first

and If the results ar e unsatisfactory, he will then see what he can do WIth systems usmg lengthy

keysc Accordingly, the first part of tlns te ...t will Le devoted to an exammataon of certain of the

very simple vanenes of aperiodic, polyalphabeuc subsntunon systems, after this, methods of



2

at a time , prov ided only that the groupings of plain-text letters are constant m length For

example, a smgle key letter may serve to encipher two successrve piam-text letters, If t he key IS

repeunve m character and the message IS sufficient m length, penodicity willstill be mamfested

by the cryptogram and the latter can be solved by the methodsmdicated in the preceding text 1

Naturally, those methods would have to be modified in accordance WIth the specific type of

grouping Involved In this case the factoring process would disclose an apparent key length

twice that of the real length But study of the frequency distributrons would soon show that

the 1st and 2d drstnbutions were smnlar, the 3d and4th , the 5thand 6th , and soon, dependingupon the length of the key The logical step IS therefore to combine the distnbutaonsin properpairs and proceed as usual

c In all such cases of encrpharmsnt by constant-length groupings, the apparent length of

the penod (as found by applymg the factormg process to the cryptogram) 18 a mult iple of the

real length and the multrpls corresponds to the length of the groupmgs, that IS, the number ofpiam-textletters enciphered by the same key letter

d The point to be noted , however, IS that all these cases a re s ti l l periodic m character

because both the keymg units and the plain-text groupmgs are constant m length '

3 Effec ts ofvaryIng the length of the plain-textgroupings - a Bu t now consider the effects

of making one or the other ofthese two elements oaruible in l en gth Suppo se that the plain-text

groupings are made variable m length and that the keymg units are kept constant m length

Then, even t hough thekey may be cyclic m character and may repeat Itself many times m the

course of enciphermont, external penodierty IS suppressed, unless the law govermng the taruinon.

plaam-tezi groupwgs ~ s ~ t s e l f cyclw character) and the length oj the message at least two Or

more tunes that oj the cycle apphcable to th s oariable group'/,ng

b (1) For example, suppose the correspondents agree to use reversed standard crpheralphabets with the key word SIGNAL, to encipher a message, the latter being div ided up into

groups as shown below

S I G N A L S I G N A L S I G1 12 123 1234 12345 1 12 123 1234 12345 1 12 123 1234 12345C OM MAN DING GENER A LF IRS TARM YHASI S SU EDO RDER SEFFEs UW UGT KFAH UWNWJ L HN ARQ NGPU PGNVF I TR OPE RFER OCBBC

N A L S I G N A L S I G N A L1 12 123 1234 12345 1 12 123 1234 12345 1 12 123 1234 12345C TI VET WENT YFIRS T AT NOO NDIR ECTIN G TH ATT ELEP HONESL HS QHS WOFZ KDARQ N NU NMM YIDU OQZKF C NZ NUU WPWL EXYHT

S I G N A L S I1 12 123 1234 12345 1 12 123C OM MAS WITC HBOAR D SC OMMg UW UGO RFUL TZMAJ I AQ UWW

CRYPTOGRAM

QUWUG TKFAH UWNWJ LHNAR QNGPU PGNVF ITROP ERFEROCBBC LHSQH SWOFZ KDARQ NNUNM MYIDU OQZKF CNZNUUWPWL EXYHT QUWUG ORFUL TZMAJ IAQUW W

JIOUBII: 1

I In this connection, seeSeetion lIt, Mduarll CryptanalysIs, Part H;

~ - - ~ - - - - - - - - - - - -

3

(2) The CIpher text In this e xamp le (FIg 1 ) s hows a tet r ag ra plnc and a pentagraphic

repetinon The two occurrences of QUWUG (=COMMA) are separated by a n Int erva l o f 90

let ters, the two occurrences of ARQN (= IRST) by39 letters The former repeunon (QUWUG) ,It WIll be noted, IS a true periodic repetition, since the plain-text letters, their grouping, and

t he key letters are identical The interval m thi s c as e, I f c ounted In t erms o f l et te rs , IS the

product of the keymg cycle, 6, by the grouping cycle, 15 The latter repetitaon (ARQN) IS not

a true periodic repetmon in the sense that both cycles have been completed at the same POInt,

as IS the case m the former repetmon It IS true that the CIpher letters ARQN, representing

IRST both times, are produced by the same key letters, I and G, but the enciphering points Inthe grouping cycle are different in the two ca se s Repet it io ns of t il ls type may be termed

partwlly periodic repetmons, to distinguish them from those of the completely penodtc type

c When the Intervals between the two repetrtions noted above are more carefully studied,

especially from the point of VIew of the mteractmg cycles which brought them about, It WIll be

seen that countingaccording to g r o u p ~ n g s andnot accordingto singleletters, the two pentagraphs

QUNUG are separated byan in t erva l of 30g roupmgs Or, I fo ne p re fe rs to lo ok at thematter In

t he l ight of the keying cycle, the two occurrences of QUWUG are separated by 30 key letters

Since the key IS but 6 letters m length, thismeans that thekey has gone through 5 cycles Thus,

the number 30 IS the product of the number of letters in the keying cycle (6) by the number

of different-length groupings In the grouping cycle (5) The mteraction of these two cyc les

may be conceived of as paltakmg of the nature of two gears whichare in mesh, one driven byt he other One of these gears has 6 teeth , the other 5, and t he t ee th are numbered If the

two gears a re adjusted so that the "number 1 teeth" ,11e adjacent to each othe r, and the gears

a re caused to revolve , these two teeth WIll not come together again until the larger gear has

made 5 revolutions and the smallerone 6 During this tune , a total of30 meshmgs of individual

teeth WIll have occurred But since one revolution of the smaller gear (=the groupmg cycle)

represents the encipherment of 15letters, when translated in te rms of le tte rs , the 6 completerevolutions of this gear mean the encipherment of 90 l et te rs T hi s accounts for the period of

90, when stated In te rms of lettersd The two occurrences of t he other repetition, ARQN, are at an interval of 39 letters, but

In terms of the number of intervening groupmgs, the Interval IS 12, which IS obviously two

times the length of the keymg cycle In other words, t hekey hasm th'/,s case passed through 2

cyclese In a long message enciphered according to such a scheme as the foregomg there would

be many repetrtions of both types discussed above (the completely penodic and the partially

penodic) so that the cryptanalyst might encounter some difficulty In ills attempts to reach a

solution, especially If he had no information as to the baSIC system It IS t o b e noted In this

connection that If anyone of the groupings exceeds say 5, 6, or 7 letters in length, the scheme

may give Itself away rather easily, since It IS clear that wtth'/,neach group'/,ng the encuphermeni '/,s

strwtly monoalphabetic Therefore, m t he event of groupings of more than 5 or 6 letters, themonoalphabetic equiva len ts of tel l-tale words such as ATTACK, BATTALION, DIVISION,etc, would stand out The system IS most efficacious, therefore, WIth short groupmgs

j It should also be noted that there IS nothingabout the scheme whichrequires a regulanty

In the groupingcycle such as that embodied in the example A lengthy groupmg cycle such as

the one shown below may Ju st as e as il y b e emp loyed, I t b eing guide d by a k ey of I tS own , forexample, the number of dots and dashes contained m the Intemanonal Morse SIgnals for the

letters composing the phrase DECLARATION OF INDEPENDENCE might be used Thus, A ( -)ha s 2, B (_ ••• ) has 4 , and so on Hence

DEC L A RA T IO N 0 F IN D E PE N DEN C E3 1 • • 2 32 1 2 3 2 3 • 22 3 1 • 12 3 12 ' 1



4

The grouping cycle IS3+1+4+4+2 , or 60 letters in length Suppose the same phraseISu s ed as an enciphering key for determmmg the selection of cipher a lp habe ts S in ce the

phrase contams 25letters, the complete periodof the system wouldbe theleast commonmultiple

o f25 and 60o r 300 l et te rs T lu s system might appear to YIe ld a very lugh degree of crypto

graphic seounty Bu t the student will sec as he progresses that the seounty IS not so h igh /10;

he may at first glance suppose It t o b e

4 . PrImary and secondary penods , resultantpenods -a It has been noted that the lengthof the complete penod in a system such as the foregoing IS the least common multiple of the

length of the two component or interacnng penods In a way, therefore, since the componentperiods constitute the basteelement ot the scheme, they rna} be designated as the basic or p1"LmaT?j

periods These are also htdden or latent periods The apparent or patent penod, that IS, the

complete penod, may be designated as the secondary or resultant penod In certam types of

CIpher maohmes there may be more than two pnmary periods which mteract t o p rodu ce a

resultant penod, also, there are cases in ,..hich the lat ter may mterac t WIth another pnm-rry

penod to producea tertIary penod , and soon The final, or resultant, or apparent penod IS the

one wluchISusually ascertamedfirstas a result of thestudy of the mtervals between repetrnonsThia mayor maynot be broken down intoIts component primary periods

b Although a solution may often be obtamed WIthout breakrng down a resultant penod

into ItS component pnmary periods, the reading 01 many messages pertanung to a WIdespread

system of secret commumcatlOn ISmuch facilitated when the analysis IS pushed to Its lowestlevel, that IS, to the point where the finalcryptogr.lplucscheme has been reduced to Its SImplest

terms T lus may illvolve the discovery of a m,dtIphcIty of SImple elements wlnoh mteract in

sueeessrve cryptographrc strata

j

SECTION I I

SOLUTION OF SYSTEMS USING CONSTANT-LENGTH KEYING UNITS TO ENCIPHERVARIABLE-LENGTH PLAIN-TEXT GROUPINGS, I

Introductory remnrks _ _ _ _AperiodIc eneipherment producedby groupmg'! accordmg to word lengths _ __ _ _ _ _ __Solution when direct standard CIpher alphabets an employed __ _ __ _ __ _ _ _ _ _ _ _ _ __ _Solution when reversed standard cipher alphabets are employed _ • •Comments 011 fOlLg01Pg cac;ec __ _ __ _ _ _ _ _ • __ _

5. Introductory remarks -a The system described In pa.agraph 3 above IS obviously Dot

to be classified as aperiodic 11' nature, despite the IDJectIOn of a variable factor which m that

case was based upon megulautv In the leng thof one of the two clements rnvolvod ill polyalpha

betic aubstrtutaon The vanuble factor WJ,S there subject to a law wlnch In Itself was penodicIn character

b To make s uc h a system tlUly npenodie In character, by claborutmg upon the basicscheme for producn-g vuuablo-length plain-text groupings, would be possible, but unpracucal

For example, using the samemethod as IS f,Iven III paragraph 3} fOI determmmg the lengths of

the groupmgs, one might employ t he text of a Look, and If tl.p l-itter IS longer than the message

to be enciphered, the crvptogram would certainly show no periodicity as regards the intervals

between repennons, which would be plentiful However, as already indicated, such a scheme

would not be very practical forregular commurucanon between a large number of correspondents,for reasons which are no doubt apparent The book would have to besa feguarded as would a

code, enciphenng and deciphering would be quite slow, cumbersome, and subject to erroi ,and, unless the same key text were used for all messages, methods or indicators would have to

be adopted to show exactly where encipheiment begins i ll each message A SImpler method

for producing constantly cl.angmg, aperiodic piam-text groupings therefore, IS t o b e s ough t

6 AperiodIc eneipherment produced by groupings according to word lengths - a The

SImplest method for producing aperiodic plain-text groupmgs ISone which has doubtless long

ago presented Itself to the o;t ident, me , oncrpherment according to the actual word lengths of

the message to be enciphered

b Although the average number of letters composing the words of any alphabetical language

IS fall'ly constant, SUCCfSS1ve words comprismg plain text vary a great deal in this respect, and

this variat ion IS subject to 1]0 law 1 In telegraphic English, for example, t1e moan length of

words IS 52 letters, the words may c on ta in f rom 1 to 15 o r more l et te rs , but the SUC(,OSSIve

words vary illlength In an extremely Irregular manner, no matter how long the text may be

e Asa consequence , the use of word lengths for de te rmuung the number of letters t o be

enciphered by each key letter of a repetrtrve key commends Itself to the mexpenenced cryptog

rapher as soon R"! he (OID(o; to understand the way in which repeatmg-key CIphers are solvedIf there IS no penodicrty 1Il the cryptograms, how can the letters of the CIpher text, wntten ill

1 It IS true, of course, that the differences betwron two VIntcrs III respect to the lengths and characters ofthe words eontamodin their personal vocabnlanos arc ofton m-irkod and (,1n be measured ThE'sL d fIerenccsmay be subject to certam l<tVlS, but the la tter arc not ofthL t)'pp 1I1 whIChl\e ar(' lIltCIe'ltLd,bemp;p'lycho10g1cal

rather th'1n mathematICal In character SeeRIckert, E, New Methods for the Study of Lderature, UmversltyofChIcago Press, ChIcago, 1927

(5)



FIQUll1I:2

6 7

8. Solutionwhen reversed standard Cipher alphabetsare employed -I t should by thistime

hardly be necessary to indicate that the onl y change m the procedure set f or th m paragraph

7c d m the case ofreversed standard Cipher alphabets IS that the letters of the cryptogram must

be converted in to thei r plain-component (direct standard) equivalents before the completion

sequence IS applied to the message9. Comments onforegomg cases - a The foregoing cases are so simple in nature that the

detailed treatment accorded them would seem hardly to be warranted at t il ls s tage of study

However, they are necessary and valuable as an introduction to the more complicated cases to

follow

b Throughout tills text, whenever encrpherment processes are under diSCUSSIOn, the pair

of oncrphenng equations commonly referred to as charactenzmg the so-called Vigenere method

Will be unders tood, unless otherwise indicated Til ls method mvolves the pair of enciphenng

equations 81/1=(\/2, 8p /I=8C!2, that IS, the index letter, which IS usually the imtaal Ietter of the

plain component, IS set opposite the key letter on the Cipher component, the plain-text letter

to be enciphered ISsought on the p lam component and ItS equivalent IS the letter opposite It

on the Ciphercomponent 3c The soluuon ofmessages prepared accordmg to the two preceding methods IS particularly

easy,for the reason that standard Cipher alphabets are employed and these,of course, are derived

from known components The significance of tills statement should by tills nme be qur te

obVIOUS to the student Bu t what If mixed alphabets are employed, so that one or both of the

components upon which the Cipher alphabets are based are unknown sequences? The simple

procedure of completing the plain component obviously cannot be used Since the messages

are polyalphabetic m character, and since the process of factormg cannot be applied, I t would

seem that the solution of messages enciphered m different alphabets and according to word

lengthswould be a rather difficult matter However, It Will soon bemade clear that the solution

IS not nearly so difficult as first unpression might lead the student to imagine

I SeeIn

tlus eonneetion, Mdttary Cryptanaly8t8, PartII.

Section II, and Appendix 1

T R E C S Y G E T IU S F D T Z H F U JV T G E UA I G VKW U H F V B J H W L

X V I G WC K I X MY W J H X D L J Y N

Z X K lYE M K Z 0

AYLJZFNLAP

B Z M K AG O M B QC A N L B H P N C R

D B 0 MC I Q 0 D SE C P N D J R P E T

F D Q O E K S Q F U

G E R P F L T R G V

H F S Q G M U S H W

IGTRHNVTIX

J H U S lO W U J Y

K I V T J P X V K ZL J W U K Q Y W L A

M K X V L R Z X M B

N L Y W M S A Y N C

o MZ X N T B Z 0 DP N A YO U C A P E

Q 0 B Z P V D B Q FR P C A Q WE C R GS Q D B R X F D S HMdttary CryptanalY8t8,Part I, Par 20

,t:;-letter groups, be distributed mto thei r respective monoalphabets? And If this very f irst step

IS impossible, how can the cryptograms be solved?

7 Solut ionwhen di rect standard cipher alphabets are employed- a Despite the foregomg

rhetorical quesuons, the solution of thiscase IS really quite simple I t merely mvolves a modifi

cation of the method given in a previous text,2 wherein solut ion of a monoalphabetic Cipher

employmg a direct standard alphabet IS accomplished by completmg the plam-component

s equence The re , a ll the words of the entire message corne out on a single generat rix of the

completion diagram In the present case, since the mdrvtdual, separate words of a mes sage

are enciphered by different key letters, these words 'I1J11l reappear on differens generatnces oj the

dnaqrani All the cryptanalysthas t odo IS to pick them out He can do tills once he has founda good starting poi nt , by usmg a httle imagmanon and following clues afforded by the context

b An example will make the method clear The following message (note ItS brevity) hasbeen intercepted

T R E C S Y G E T I L U V W V I K M Q I R X S P J

S V A G R X U X P W V M T U C S Y X G X V H F F B L L B H G

c Subrmtting the message to routrne study, the first step IS t o use normal alphabet strapsand try o ut t he possibihty of direct standard alphabets having been used The complenondiagram for the first 10letters of the message IS shown m figure 2

d Despite the fact that the text does not all reappear on the

same generatnx, the solution IS a very simple matter because the

first three words of the message are easilyfound CAN YOU GET

Thekey letters may besought m the usual mannerand are found

to be REA One may proceed to set up the remammg letters ofthe message on shdrng norma l a lphabe ts , o r one may assume

various keywords such as READ, REAL, REAM, etc, and try tocontmue the decipherment m that way The former method IS

easier The completed solution IS as followsREA D E R S

CAN YOU GET FIRST REGIMENT BY RADIO

TRE CSY GET ILUVW VIKMQIRX SP JSVAG

DIG EST

OUR PHONE NOW OUT OF COMMISSION

RXU XPWVM TUC SYX GX VHFFBLLBHG

e Note the key m the foregoing case It IS composed of the

successive key letters of the phrase READERS DIGEST

j The only difficult part of sucha solutaon IS that ofmakingthe first s tep and getting a start on a word If the words are

short It IS rather easy to overlook good possibihues and thu s

spend some time m fruit less searching However, solut ion must

come, rl nothmg good appears at the begmnmg of the message,

search should be made m the in tenor of the cryptogram or atthe end



MESSAGE

Sl,CTION III

IDIoMORPHIC 81<QUENCES

A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z1= - 1= - 1-= 1= - - 1= - - - 1= - -- - - - - - - 1-=1= - - -

) 0 p W Z H D R I E

- - - - - - - 1- - -- - - - -- - - - - - - - - - - 1- -) R A F K N 0 T V

- - - - - - - 1- - - - - - - - - - - - - - - - i- - I-) S X D U F J P

A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z

- - - - - - - - - - - -- -i- - - - - - t - -- - - '-- f-- --

) N 0 P S T V W X Z H D R A U I E F J K- - - - - 1- - - - - - - - - - f-- - -

) R A F K N 0 T V

- 1- - 1- - - - -- - - - - - - - - - -

) S X D U F J P

FIGUR.3a

l!IGUPE 3b

(1

(2

(3

f The key word upon which the mixed component IS based ISnow not difficult to find

HYDRAULIC9 (1) To decipher the entIre message, the srmplest procedure IS to convert the cipher

letters mto their plain-component equrvalents (settmg the HYDRAULIC Z sequence agamstthe normal alphabet at any pomt of comcidence) and then completing the plain-component

sequence, as usual The wordsof the message will then reappearon differentgeneratnces The

9

e Noting that the mtorval between 0 and R II I the first and second alphabets IS the same,direct symmetry of position ISassumed In a few moments the first alphabet m the skeleton

becomes as follows

Artillery (3

Battalion (2

DIVISIOn,o'clock (1

d WIththeseassumed equrvalents a reoonstruction skeletonor diagramof cipheralphabets( Io rmmg a por ti on of a quadnculnr table) IS established, on the h) pothesis that the cipher

alphabets have been deuved from the s lidmg of a nnxed component agamst the normal se

quence FIrst It IS noted that since OIl=Rc both in the word DIVISION and 1Il the word OCLOCl{

their cipher equrvalentsmust be i n the same alphabet The reconsnucuon skeleton 18 then as

follows

(3) S E J D U U X E P'-

(4) ROHROZ

o C L 0 C K- '- ---- '" -

(3) S F J D U UX F PART IL L E R Y-...... - - . /

(2) A R V••V R K F 0 N T

'---"

(1) P WE WI WR DD I V I S ION----.7---.7

( 1)

(4)

(2) A R VV RK F 0 N T

B A T••T A L ION S' ---"IMdttary C r y p t a n a l Y 8 ~ 8 , Part I, Par 33 (J,-d, mCIUl>lVC

(8)

SOLUTION OF SYSTEl\iIS USING CONSTANT-LENGTH KEYING UNITS TO ENCIPHERVARIABLE-LENGTH PLAIN-TEXT GROUPINGS, II

ParagraphSolution" hen the ongtnal WOId lengths are retained In the cryptogram __ _ __ _ _ .______ 10Boluuon when othertypes of alphabetsale employed -______ __ __ __ 11

Isomorphism and rts ImpOl tance 1ll eryptanalyilLS - - - - __ _ __ __ __ 1lIllustratron of the apphcation of phenomena of isomorphism 1Il solvmga cryptogram _ _ _ _ _ _ 13

XIXLP EQVIB VEFHAPFVT RT XWK PWEWIWRD XMNTJCTYZL OAS XYQ ARVVRKFONT BH 2 . .L . . 4DUUXFP

OUVIG JPF ULBFZ RV DKUKW ROHROZ

10 SolutIon when the ongmal word lengths are retamed m the cryptogram -a This casewill be discussed not because It IS encountered m practical military cryptography bu t because It

affords a good mtroduction to the case in which the ongmal WOlU lengths are no longer m eVI-

dence m the cryptogram, thelatter appearing m the usual5-lettergroups

b Reference IS made at this pomt to the phenomenon called rdromorphism, and ItS value mconnection WIth the application of the prmcrples of solution by the "probable-word" method,

as explained m a previous te"{t I When the ongmal word lengths of a message are retained inthe cryptogram, there IS no difficulty 1'1 searchingfor and locanng idiomorphs and then making

eomparisons between these idiornorplne sequences m the message and special word patterns

set forth m hsts mantamed for the purpose For example, m the following message note theunderlined groups and study the letters within these groups

PWEWIWRD~ ' - - - " -R 0 H R 0 Z- " ' - - - - '

e Reference to lists of words commonly found III nuhtary text and arranged according totheir idiomorplnc patterns or formulae soon grves suggestions for these ciphergroups Thus



10

key lettersmaythen be ascertainedand the solution completed Th Z h fih d us, ror t e r s t three wordst e iagram IS as follows '

Plam_________________ ABC D E F G H I J K LMN 0 P Q R STU V WX Y ZOipher H Y D R A U L I C B E F G J K M N 0 P Q S T V W X Z

J X I

E V Z ZL PR O

CRYPTOGRAM

11

V C L LKID

V S J D ClOR

K D C F S T V I X HMP P F X UF K N A K FO R A D K 0 MPIS E C S P P H Q K C L Z K S Q

J Z WB C X H 0 Q C F F A 0 X ROY X A N 0 E MDMZ MT S

T Z F VU E A 0 R S L AU PAD D E R X P N B X AR IG H F X

11 Solut ion when other types of alphabets are employed -a The foregoing examples

Involve the use ei ther of standard CIpheralphabets or of mixed CIpheralphabets produced bythe sliding of a mixed component against the norma l s equence The re IS, however, nothmg

about the general cryptographic scheme which prevents the use of other t ypes of derrved,

mterrelated, or secondary mixed alphabets CIpher alphabets produced by the shdmg of a

mixed component against I tsel f (ei ther di rect or reversed) or by the shdmg of two dif ferent

mixed components are very commonly encountered in these casesb The solution of such cases involves only slight modifications in procedure, namely, those

connected With the reconstruction of the primary components The student should be 1Il apOSItIOn to employ to good advantage and Without difficulty what he has learned about the

pnnciples of mdirect symmetry of pOSItIOn in the solution of cases of thekmd described

c The solution of a message prepared WIthmixed alphabets derived as indicated In subparagraph b, may be a difficult matter, depending upon the length of the message In questionIt might, of course, be almost impossible If the message IS short and there IS no background forthe apphcation of the probable-word method Bu t If the message IS quite long, or, what IS

more probable Withrespect to mihtary commurucatrons, should the system be used for regular

traffic, so that there are available for study several messages enciphered by the same set ofalphabets, then the problem becomes much easier In addition to the usual steps In solution

by the probable-word method, guided by a search for and rdennfication of rdiomorphs, there IS

the help that can be obtainedfrom the use of the phenomena of isomorphssm, a study of whichforms the subject of dISCUSSIon in the next paragraph

12. IsomorphIsm and Its Importance In cryptanaly tlcs.-a The term idiomorphism IS

famihar to the student It designates the phenomena ansmg f rom the presence and positions

ofrepeated letters In plain-textwords, as a result ofwhich suchwords may be classifiedaccording

to thei r compoeuums, "patterns," or formulae The term isomorphnsm. (from the Greek "I80S"

meaning "equal" and "morphe" meaning "form") designates the phenomena ansmg from the

existence of two or more idiomorphs With identical formulae Two or more sequences whichpossess identical formulae are said to be tsomorphnc

b Isomorphism may exis t In plain text or m CIpher text For example, the three wordsWARRANT, LETTERS, and MISSION are isomorpluc If enciphered monoalphabetically, their

CIpher equivalents would also be Isomorphic In general, isomorphism IS a phenomenon of

monoalphabetacity (either plain or cipher), but there are mstances wherein It IS laten t and canbe made patent In polyalphabetic cryptograms

c In practicalcryptanalysis the phenomenaof rsomorphism afford a constantly astonishmg

source ofclues and aids Insolution The alertcryptanalyst IS always on the lookoutforsrtuations

In which he can t ake advantage of these phenomena, for they are among the most mterestingand mostImportant m cryptanalyncs

13. Illustration of t he u se of isomorphism -a Let us consider the case discussed under

paragraph 10, wherein a message was enciphered With a set of mixed CIpheralphabets denved

from shdmg the key word-mixed primary component HYDRAULIC XZ against the normal

sequence Suppose the message to be as fol lows (for s impl icity, original word lengths areretaIned)

U

TWO

XYQ

VEFHAPFVT

WKLAESLWVXLMBFTMXW

YMNCGUNYXZ NOD H V 0 Z YA 0 P E l WPAZB P Q F J X Q B AC Q R G K Y R C BDRSHLZSDC

EST I MAT E DAp=Po

E Q V I B

K T WH J

LUX I K

M V Y J LN W Z K M

o X A L NP Y B M 0

Q Z C N P

R ADO QS B E P R

T C F Q SU D G R T

V E H S UWF IT V

X G J U WYHKVXZ I L WYA J M X ZB K N Y A

C L 0 Z BDMPAC

E N Q B DFO R C E

Ap=Uo

FIGURE 4

X I X L PY H Y G S

Z I Z H T

A J A I UB K B J VC L C K WDMDLXEN E MY

Ap=So

(2) The key for the message IS f ound to be SUPREME COURT and the complete mas follows essage IS

SOLUTION

SUp REM E C 0

ENEMY FORCE ESTIMATED AS ONE DIVISION OF INFANTRY AND

XIXLP EQVIB VEFHAPFVT RT XWK PWEWIWRD XM NTJCTYZL OAS

R T SUp REMBATTALIONS OF ARTILLERY M ARCHING NORTH AT SEVEN OCLOCK

A RV VR KF ON T B H SFJDUUXFP OUVIGJPF ULBFZ RV DKUKW ROHROZ

a In case theplam component IS the reversed normalsequence, the procedure ISno differentf ~ o m the foregomg, except that m the eompletion diagram the reversed sequence IS employeda t e r t h e CIpher letters have been convertedmto their pIam-component equivalents

No doubt the student realizes from his preViOUS work that once the primary mixedcomponent has been recovered the latter becomes a knoum. sequence and that the soluuon of

subsequent messages employmg the same set of derived alphabets , even though the keys tomdrvidual messages are different, then becomes a SImplematter



12

V=C-P, CoA, LOD . KOE , lOR, D=C-X, SoON, JOB,

KW ILL

EVZZ

E

W IT H

LPRO

(HOT?)]Key STRIKE WHILE THE IRON IS

13

1 23" 6 8 7 8 9 W U " U U W U U m u z z

HYDRAU L I C B E F G J KMNO P Q S T VWXZ

(4) From rdiomorphs (2) (a) and (2) (b), the interval between Hand I IS7, It IS the samefor 0 and X. Q andH . C and M.etc From idiomorphs (3) (a) and (3) (b) the interval betweenRand NIS13, It IS the samefor 0 and A. Yand K. etc

d The message may now be solved qui te readi ly , by the usual process of converting the

Cipher-text letters into then plain-component equrvalents and then completIng the plain component sequences The solution ISas follows

S T R ICOMMUN I CA T I O N WITH FIRST ART I L L ERY

VCLLKIDVSJDCI ORKD C FS TV IX H M PP FX U

E W H I LBE THROUGH CORP S AN D COMMUN I CAT I ON

FK NAKFORA DKOMP ISE C S P P HQKCL Z K S QTHE I

S E COND ART I L L ERY THROUGH DIVISION

J ZW B C X H O Q CF FA O X R O YX AN O EMDM ZM TS

RON I SSW I T CHBOARD NO C OMMUNIC A TI ON A F TE R TEN

T Z F VU E AOR S L AU P A DD ER X PN B XA R I G HF X JXI

e (1) In the foregomg illustration the steps are particularlysimplebecause of the followmgcircumstaneee

(a) The actual word lengths are shown

(b) The words are enciphered monoalphabetically by dIfferent alphabets belongmg to aset of secondary alphabets

(c) Repetitions of plain-text words, enciphered by different alphabets, produce ISOmorphsand the lengths of the ISomorphs are definitely known as a resultof circumstance (a)

(2) Of these facts, thelast IS of most interest in the present connection Bu t what If theactual word lengths are now shown, that IS, what If the text to be solved IS mtercepted il l the

usual 5-letter-group form?

lS1H122-89--2

12 3 " 6 8 7 8 9 W U " U U U " U U m u z zE JK N PQ S V XZH DRA L I C B

(3) The sequence H D R A L I Csoon suggestsHYDRAULIC as the key word When

the mixed sequence IS then developed in full, complete corroborationWill be found from the data

of Isomorphs 2 (a) (b) and 3 (a) (b) Thus

which gives the sequence the appearance of being the latter half of a keyword-rmxed sequencerunnmg m the reversed direction, let the half-cham be reversed and extended to 26 places, asfollows

1 23" 6 8 7 8 9 W U " U " u u m u z zE K N P S V X H D A L C

(2) The data from the two partial chams (JZ Band IQ R) may now be used,and theletters mserted into theirproper posraons Thus

l ~ H M f f F ~ UHQQCEEAQX

I -- JNAKFORA

ROYXANO-, .,,-

1

(8)

(b)

Ia)

(b)3)

(2)

( l ) { ~ 2 3 "6 6 7 8 9 10 11 12 13

C S L P A N D K H X E

(2){2 3 " 5

Q R

( 3 ) { ~ 2 3

"6

Z B

!a)

(b)

(C')

(1)

(e) CPD ( f) SA (g) HE (h) QR (1 ) KX (]) LN (k) ZB

From Isomorphs (1) (a) and (1) (c)

COP . S OA , POD, HOE. QOR, K-<:>X. LON, Z-<>B,

c (1) The fact that the longest of these chams consists of exactly 13 letters and that no

addrtaons can be made from the o ther two cases of Isomorphism, leads to the assumption that a"half-cham" IS here disclosed and that thelatter represents a decnnation of the original pnmary

1 2 3 " 5 8 78 9

component at an even m te rv al Notmg the placement of the letters V S P N K ,

I The symbol ¢o IS t obe read "IS equivalent to "

(a) VCSLP (b) DKH ( c) IQ (d) JZ

From isomorphs (1) (b) and (1) (c)

b (1) Only a fewmmutes mspectiondiscloses the followmg three sets of isomorphs

V-<>C, COS , LOP , K=c-H, IoQ. D=c-K, S=C-L. JOZ.

(1) LDX (m) VP (n) CA (0) KE (p) lR (q) SN (r) JB

Notmg that the data from the three Isomorphs of this set may be combined (VCSLP and CPD

make VCSLP D, the latter and LDX make VCSLP D X), the followmg sequences are

estabhshed

from which the followmg partial sequences are constructed

from WhICh the followmg parual sequences arc constructed

from which the followmg partaal sequences are constructed

(2) WIthout stopping to refer to word-pa tt ern l is ts m au attempt to rdentify the verystnkmg idromorphs of the first set, l et t he s tudent proceed to bui ld up partial sequences of

equivalents, as though he were dea ling with a (,c1SC of indirect symmetry of posinon Thus 2

From isomorphs (1) (a) and (1) (b)



M P P F XPHQKCOYXAN

DERXP

SECTION IV

SOLU'1'ION or S Y : 1 ~ ~ ~ ~ ~ ' : ~ ~ : = ~ ~ = : g s ~ ~ T S TO ENCIPHER

General remarks __ _ _ Paragraph

Word separators.. _ - ------ - . -- -. __ _ _ 14

V ~ J a t l O n s and concludmg r e ~ ~ ; k ; ~ ~ - f ~ ; g ~ l n g ~ y ~ i f ' m s - - - --- - - --- --- -. _ • 1')

------ - --- - ._--. ------••--. -------- -- -__ 16

14. General remarks -a The cases described th fthe cryptanalyst has before hun th I us al ale pal tlculaI1yeasy to solv-e because

nuhtary cryptography this IS seldon: : ~ : ~ ~ ~ S t ~ t ieir true or ol' lgmal word lengths But In

whatmore difficult by reason of the fact that t l t c ; e ~ : : ~ o t ~ e problem IStherefore made someenClpherment by suceess rvs key le tters However th 1g to lI ld icate defil ll te ly the Imuts ofpe.runentabon In tlus case than in the pre d 'Th e so uuon merely neceSSItates more ex

repetItIons whichmay serve to "blockout"c:r ~ ; l u D l t e c:Jptanalyst must take careful noteofwill be able to fwd and IdentIfy certain h wor s, and h ope that when tlus IS done he

terns, such asthosenoted above If t h e r : ~ q ; ; m c : s f ~ V I n g fanulIaJ'IdlOmoIpmc features or pat-to permItof emp]oymg this entermg wedge en yo ext,repetition.,WlII be suffiCIent il l number

b Of course, If any sort of stereotypIC pluas 1 1or endings of the messages, the mattez of assum eoog) IS emp oyed, espcClallyat the begmnmgsand affords a quick solution For example su mg v ~ u e s for sequences ofcipher letters IS easy,found that many mess ag es be gm with t " ppos e at 8.S8. result of previous work It has beenHaving several messages for study, the n : e l : ~ ~ I ~ ~ m : : o ~ E R R I N G TO YOUR NUMBERIdlOlllOrplusm as that given by the word REFER e wluch begins with such a commonfound the word REFERRING If with a f d R1 i

GIS 8. relatIvely snnpls matter, and having

NUMBER, the solutron IS probably well u::er ~ : ; e 0 certamtyone can ndd the words TO YOUR

e (1) Take the case discussedm para a h 13 bmmcated because the message IS t r a n s m ~ e : 'thut a s s ~ m e l t h l 1 t word lengths are no longerascertammg the exact length of sequen h m

he usu 5- etter groups The process of

te d "bl ces W tc are isomorphn- or thrme, ockmg out Isomorphs" b ' , as e process 18 bnefly

rather tenuous threads of reaaoningeco;es a more dIfficult matter and must often rest upon

Wlthand let It beassumed that It was a r r a n ; : : I ~ f ~ : ~ ~ ~ ~ : u ~ ~ e illustratIve message Just dealt

VCLLK IDVS J DCIOR KDCFSUEVZZ FKNAK FORAD KOMPI TVIXH

L Z K SQ LPROJ ZWBCX HOQCF SECSP

OEMDM ZMTST ZFVUE AORSL FAOXRNBXAR IGHFX JX I AUPAD

(2) The detect IOn of I somo rphI sms n bspecial trouble il l PICkmg out the foll °tWh ecomes a more dIfficult matter There IS no

owmg I ee IsomorphIc sequences

(I) V C L L KID VS J 0 C I(g) C S P P HQ K C L Z K S Q

PAD D E R X P N B X A R(14)

lei

smce the first onehappens to be at the begmmngof the message and Its left-hand boundary, or"head," IS markedby (or rather, comcidesWIth) the begmnmg of the message By a fortunatecircumstance, the right-hand boundary, or "tall," can be fixed Just as accurately That the

repetmon extends as far as indicated above IS certam for wehave a check on the last columnI, Q, R If an additional columnwere added, the letterswould be 0, L, I Since the secondletter has previously appearedwlnle the first and thud have not, a contradictaonresults andthenew column maynot be included

If, however, none of the threeletters 0, L, I had previously appeared, so that there couldbeno means ofge ttmg a check on theu correctness, It would not be possible to block out orascertain the extentof the isomorphism in such a case All that could be said would be thatI t seems to include the first 13 letters, but m ~ g h t c o n t ~ n u e further

d (1) However, the difficulty or even the unpossibihty of blocking out the ISomorphs tot h e ~ r full extent IS not usually a senous matter Afterall, the cryptanalystuses the phenomenonnot to Identify words but to obtain cryptanalvtic data for reconstructmg cipher alphabetsFor example, how many data are lost when the illustratrve message of subparagraph 13a IS

rewntten in 5-letter groups as m subparagraph 14c (1)'" Suppose the latter form of messagebe studiedfor isomorphs

VCLLK IOVSJ OCIOR KOCFS TVIXH MPP FX U EV ZZFKNAK FO RAD KOM PI SECSP PHQKC LZKSg LPROJZWBCX HOQCF FAOXR OYXAN OEMDM ZMTST ZFVUE

AORSL AUPAD OERXP NBXAR IGHFX JXI

(2) If the underscored sequences are compared with those III the message in subparagraph

13a, Itwillbe found that only a relativelysmall amountof mformataon has beenlos t Certamlynot enough to cause any dlfhtulty have beenlost in tills Lase, for all thedata necessary for thereconstruction of tile mixed CIphercomponent came from the first set of Isomorphs, and the

latter are identical ill length in both case"! Only the head and ta il le tters of the second p8.1!

of tsomorphic sequences are not included m the underscored sequences m the 5-letter versionof the message The thud pair of isomorphic sequences shown il l paragraph 13bdoes not appca.rm the 5-letter version since there 18 only one repeated letter m tlus case In long messagesorwhen there are manyshortmessages, a study orisomorphismwilldisclosea aufflcientnumber ofpartialIsomorphs to give data usually sufflcient for purposesof alphabet reconstruction

e It should be noted that there ISnothmg about the phenomenon of isomorplusm winchrestricts Its use to cesesm which the cipher alphabets are secondary alphabets resultmg fromthe shdmg ofa mixedcomponent agamst the normal It canbe useful In all cases of Interrelatedsecondary alphabets no matter whatthe baSIS of their denvation may be

J In subsequent studies the rmportant role which the phenomenon of isomorplnsm playsIn cryptana ly t ic s wil l become more apparent When the traffic 18 stereotypic m character,even to 0. slight degree, so that isomorplnsm may extend over several words or phrases, thephenomenon becomesof highest,unportanee to the cryptanalyst and an extremelyvaluabletoolm Ins hands

15 Word seprrators --a Oneof the prcctical dtfflculues il l employmg systems In wluch the

keymg process sluft'! according to word lengths IS that in handhng such a message the decryptographIng clerk IS often not certam exactly when the termmatlon of a word has been reached,and thus tIme IS lost by hun For m<,tance, wlule decryptographmg a word such as INFORM

the clerk would not know whetherhe now has the completeword and should slnft to thenextkey letter or n ot T he word Ill1ghtbe INFORMS, INFORMED. INFORMING, INFORMAL, INFOR-



16

MATION. et c T he p as t tense of verbs, the pluralof nouns, and termmatlons of vanous sorts

capable of bemg added to word roots would gIve rIOje to difficulnea, and t he latter would beespecIally troublesome u the messages contamed a few t el egrapmc enol'S Consequentl y, a

scheme wluch IS often adopted to Circumvent thle source of trouble Is to indicate the end of aword by an mfrequent letter such as Q or X, and eneiphenng the let ta- In such usage theselet tersare called word separat01'8

11 When word separators are employed and tlns fact IS once discovered, their presence 18

of as much IUd to the cryptanalystm hrs solution as It IS to the clerks who are to decryptographthe messages Sometunes the presence of these word separators, even when enciphered, aidsor makes possible the blocking out of Isomorphs

16 VarIations and concludmg remarks on foregomg systems-a The systems t hus fa r

descnbed are all basedupon word-lengthencipherment using dIfferentcipher alphabets Words

are markedly Irregular in regard to t lus feature of theIr constructson, and thus apenodicaty 18

Wlparted to such cryptograms But V8Z'latzons m the method, aimed at making the latter

somewhat more secure, are possible Some of these vansuons will now be discussed

11 Instead of enciphenngaccording to natural word lengths, the Irregular groupings of thetext m ay b e regulated by other agreements For evample, suppose that the numeneal value

(m the normalsequence)of eaeh key letter beused to control the number of letters encipheredby the successive CIpheralphabets Depending then upon the eomposraon of thekey word orkey phrase, there would be a varymg number of letters enciphered m each alphabet If the

key word were PREPARE. lor mstance, then the first CIpher alphabet would b e u se d for 1 6

(p = 16) letters, the second CIpher alphabet, for 18 (=R) letters, and soon Monoalphabe tac8llClphermentwould therefore allowplenty of opportunityfor tell-taleword patterns to manifestthemselves In the CIpher text Once an entenng wedge IS found In tlus manner, solution wouldbe achieved rather rapIdly Of course, all types of CIpheralphabets may be employed in thisandthe somewhat smular schemesdescnbed

c H the key IS short, and the message IS long, penodicrty will be msmfested m the crypto

gram, 80 that It would be possible to ascertarn the lengthof the basic cycle (m this case the length

of the key) despzte the Irregular groupings m enoipherment The determmanon of the lengthof the cycle might, however, present dlfficultzes In some cases, since the basso or fundamentalpenod would not be clearly eVIdent because of the presence of repetaticns which are not periodicm theu- OllgID For example, suppose the word PREPARE were u sed a s a k ey , e a ch koy letter

bemg employed to enclph.er a number of let ters correspondmg to Its numerical value In the

normal sequence It ts clear that thelengthof the basic penod, m terms of letters, would herebe the sum of the numencal values of P (=16)+R (=18) + E (=1]), and so on, totalhng 79letters But because the key Itself contamsrepeated let tersand because encrphermentby eachkeyletter IS monoalphabenc there would be plenty of cases In whreh the first letter P would

enCIpher the same or part of the same word as the second letter P, producing repenuons In the

cryptogram The same would be true as regards encrphermenta by t he two R' s and the two

E' , m thIskey word Consequent ly , the baSIC penod of 79wouldbe dIstorted or masked by

apenodIc repetItIons, the mtervals between wluch would not be It functIOn of, nor bear any

reIatron to, the length of the key 'The student WIll encountermore cases of t lus lond, m whIcha. fundamental pel'lod.tCIty IS masked or obscured by the presence of cIpher-textrepetItIons notattributable to the fundamental cycle The dxpenenced cryptanalyst 18 on the lookout forphenomenaof tlns type, when he finds m a polyalphabetIcCIpherplenty of repet i tions bu t With

no factorable constancywluchleads to the dlbclosure of a short pe rI od He may conclude, then,

e1tber that the cryptogramInvolves severnl pnmary pel'lods whIch. mteract to produce a longresultant penod, or that It lllvolves a fEUrly longfundamentalcycleWltlun wluch repetItIonsof a

l•

I

17

.J . .. . .e present and o b ~ u r e the phenomenamamfestedby Npetltlonsofa penodIcnonpenowc ongID .....

ongm f 1 al habetIc enclphermsnt of v81'1abla-lengthd (1) A 10glcalextenSIon of the pnncIple 0 r ~ - t : x t groupmgs rarely exceed 4 let ters, soplam-text groUplDgs15 the case m wluch these p sb rt time thus breakmg up whatnught

that a gIven cIpher alphabet IS m play for o n l ~ : :leZer t ~ x t example,suppose the letters

otherwise appear as fall'ly long r e p e t 1 t I ~ _ order were Qet Qft mto four groups, asof the alpbabet, arranged m thm normai- requen ,

follows H F U P M Y G W V B X K Q J ZETRIN OASDLC GroupS Group4Group1 Group2

ha t one letter will be enclpha-ed, 8. letter m(2) Suppose that a letter 1D group 1 means t S ose next that a rather lengthy

group 2, that two letters will be enCIphered, o ~ d ' P ~ 'OIRECTION OF THE CHIEF

phrs.se were used as a key,for example, PREP ION COURSES Suppose, finally, that eachSIGNAL OFFICER FOR use WITH ARMY EXTENS t I ~ u l a r Clpher alphabet to be used, bu t also

letta- of thekey were used not only select ~ : ~ a r b Y the selected alphabet, o.coordmg to theto control the number of letters to e enClp b the H'lDPAULIC XZ prunary

scheme outhned above Such an e n C I p h e ~ Be = e ~ = n e n t ) would yleld the follo'WlngClpher component shdmg agamst the no P

grOUpIngs 1 1 3 1 2311321123121

Groupmg-------------------- R E P ARE DUN D :E R THE D

Key--------------------------- PR S T nIV IS I 0 NW ILL A DV A N C EAT F IVPlaID_________________________ FI T R THJ GV F X MX JNN N UW E N WAHQ \\ EW

CJ.pher------------------"---- WHB 2 3 1111211212:3 13 1

GroupIDg--- -- -- -- -- -- -- -- -- - R E C T ION 0 F THE CHI

Key--- -- -- -- -- -- -- -- -- -- -- -- -- I FT E E NA M AS SEC 0 NOD I VI SIO NPlaID__________________________ E JY Z F AO D OB RMJ B JRR P RN PCK 5

Cipher------------------------ F f the formataon of lengthy repetItions would

(3) Bere It will be seen that any t e nd :cy U l ~ ~ Shlftmg of alphabets The fust tune the

be counteracted by the short grOUpIngs ~ 3 v F X M the second tnne It OCCUNIt 18 enCIpheredword DIVISIONoccurs It IS enCIpheredas 'h red by exactly the samesequence of keyas RPRNPCKS Before DIVISIONcan be tWIce e n ~ p e between the two occurrences of theletters an mterval of at lenst \4:0 letters must 11\ ene : -140) and then the chances thatword (the sum of the values of the letters of the

f~ 7 v P e a ~ : - ; one:.n t hr ee Onl y one o f t h es e

the keylet ter P would begm the e n m p h e r m ~ ~ 0 the s a ~ e sequence of clpha- eqUlvalents the

three pOSSIble enClpherments wul yIeld exaFY Ie If the text" ere such as to place twosecond tnne as was obtamed the first time or e"{aIDt, below thell' enclpherments wouldoccurrences of the word DIVISION 1D the pOl>ltJ.ons s own ,

be as follows 3 1 1 I '1 1 2 I 1

8113211231 PREP ARED UN

PR E PAR E DU N OI VI S I ON •• •FIR S T DIV IS IO N TIl ZG T P NM .' . •

THJ GV F X M



SECTIONV

Paraga1_. .___ 17

____ _ •__ •• ._ 18_ _ __ _ __ __. _.__.___ 19

_ _ _ _ • •__ 2() .

_ _._ __ __ _ .__ _•• 21_ _ _ _ _ _ __ _.______ _ _• • 22...- . - .....-- ----.. ...--

17 Va.rlable-Iength groupmgs of the kepng sequence -The precedmg cases deal With

simple ll'ethods of chmmatang or avoiding peIlodlclty by t ' \ \ < . ' \ p h . e r m ~ vaflfl,ble-Iengthgroupings

of theplam text, n-ang conc;tttnt-length hpymg umts In p·trttgraph 2a, however, It was pointed

out that pcnodn ity can also be suppressed by 'lpplymg varzable-Iength key groupings to con

stant-length p lnm-tcv tg roups One such method conc;lsts11\ trregularly ",nte1TlJ,ptvng the keymg

seq,uen<.f:, If the latter IS of n Imnted or fiwd l e n ~ t l \ , and re(,ommI'11C'lllg It (from Its mrtial pomt)after such mterruption, c;o thJ,t the keyingsequencebecomesoqurvalent to a seriesof keys of

dIfferent l engt hs Thus, the key pln aloe BUSINESS MACHINES may be expanded to a senes of

lfregulo.r-Iength keylllg sequences, such as BUSI/BUSINE/BU/BUSINESSM/BUSlNESSMAC, etcVanous schemes or prearrangements for mdlCl1tmg or determullng the mterruptIOns may be

adopted 'I'l.ree methods will be mennoned II I the next 'Paragraph18 Met ho ds of mterruptmg a. cyclic kepng sequence -a . Tbe te a le many methods of

mterruptmg a keymg sequence wLJ.ch 18 ba.s1caUy cyc!lc, and wlnch therefore would grve rise

to penodicity Ii no t mterleredW1.th m someway These methods may, howevor, be classified

mto three categones as regards what happensafter the mten uptron occurs(1) The keymgsequence merely stops and begms agsan at the mrnsl pomt of the cycle

(2) One ormoreo f the elementsm the keying Sl"quenceml1Y be omitted from time to tune

rrregul80rly(3) The keymg sequence lrregulally alternate", 1U Its direction of progreStnon, With or

WIthoutomission of some of Its elementsb These methods may, for clarIty, be represented graplucolly as follows Suppose the

key consists 01 a cyclicsequence (f 10 element s rt>presE'uteds, mbohc81lybythe senes ofnumbers1,2,3, ,1 0 Usmgan astensk to indicate D,lllllterruptlOu, the following maythen represent

the relatlon Letween the letter number of the message and the element number of the keying

sequencesm the three types mentIonedabove

{

Letter No . 1 2 3 4. 5 6 7 8 9 10 11 12 13 14. 15 16 17 18 19 20

(I) Key element No_________ 1-2-3--4.-*-1-2-3-4-5- 6-"'- 1- 2- 3-0\<- 1 - 2 - 3 - 4 - 5 - 6- 7-*

Letter No------------------ 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35Key element No_._-_ 1 - 2 - 3 - 4 - 5- 6 - 7 - 8- 9-10-"'- 1 - 2 - 3-*- 1 - 2 - etc

{

Letter No-_____ 1 2 3 4. 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20Key element No_________ 1-2-3-*-7-8-9-10-1-2-"'- 4 - 5 - 6-*- 3 - 4 - 5- 6- 7- 8- 9-10-Letter No- 21 22 23 24 25 26 27 28 29 30 31 32 33 34 3 5

Key element No- . 1-*- 8- 9-10- 1- 2-"'- 5- 6- 7-*- 9-10- 1-*- 5- 6 - 7 - etc

(19)

Varlable-lel'gthgroupmgsof the I .e ymg s eq ue nc e, - - - - -- Methodsof mte riuptmg a c y c l l ( ~ keyingsequencc__

Interruptor IS a plam-textletter -- --

SolutiOn by s up er im po sI ti on - - - - - -- - - - -- - - -

Interruptor IS a CIpher-text letter - -

Concludmg r em ar ks -- - ••--- - -- - --- --

SOLUTION OF SYSTEMS USING VARIABLE-LENGTH KEYING UNITS TO ENCIPHEB.

CONSTANT-LENGTH PLAIN-TEXT GROUPINGS

18

Although the wordDIVIS!ON, onIts second awhere It begins on Its first appearance th ppesrence, begins but one letter beyond the place

lette1'8, the fourth, and the last letters ; h ~ ; h e r equwalents now agree only m the first two

D I V I S IO N(1) .I....H J 5J V F X M(2) IJ i Z ri T P N M

e AttentIon IS dzrected to the charactensncs f -s am ewor d Whe n they are supenm osed 0 the foregomg two oncipherments of thetwo enoipherments, then there IS a !m 1 ' first two cipher equivalentsare the samem the

l

the next cipherequivalent JS thesame n ; o ~ r v a l t ~ ~ f : ' r e the cipher equivalents are diflerentants tirtally th 1 t h ' 0'" nreeIntervalswith d I h ', ,e as oip er eqUIvalent lS tb.e sam tssirm ar crp er equiva-only to one or two letters, longer repeunons e In bO::;- cases The repennons here extendmenta yIeld only oecastonal cmnculenc68 tha can occur 0 y exceptIonally 'TIle two encipher

moreover, the d't8mb'lfi'l,on of the comcId:nce tIS, p:ces where the cipher letters are rdentical

J Tins phenomenon of ~ n t e r m ~ t t 6 n t c o ~ : ~ U l rrregular and ofan mterInlttentcharacter'

ptW'S of letters, or short sequences (rarel nees, involving cOIDCIdences of single letters

lStICS of ti lls general class of p o l Y a l P h a b ~ : ; ~ ~ : ~ ~ ~ d m g pentagraphs) ISone of the c h a r a c t e r ~mamfest what appears to be a dlsturbed or distortedtion, ;herem the cryptograms commonly

9 From a. techmcal standpomt the peno ICItysystem IS based hasmuch ment butfo ; P t ~ g r a p i l l c pnnciple upon which the foregomgto error However,If the enClphermen:: rac ICB. husage It 18 entIrely too slow and too subject

key were quite lengthy, such B.system and meohani amaed by maclunery, and If the enClphenngmd.ehmesfor accomphslnng this type ofsubstat nism becomes ofpractlCaIlmportance CIpher

ution will be treated In 0. subsequent text



Keymg element N0__ 1METHOD (2)

2 3 4 5 6 7 8 9 10etter N0______ ___ ______ 12 3 I 4 5 6 7etter N0_________________ 8

Letter N0_________________ _ 9 1- 10 11 12/- 13 14 15 16 17 18 19 20etter No_________________ 21 / _ _

22 23 24etter N0_________________ 25 26 1_27 28 29/- 30 31etter N0_________________ 32 / _ _33 34 35 etc

METHOD (3)Keymg element No__ 1 2 3 4 5 6 7 8 9 10Letter No 11 ~ 2 r i 3 r - i 4 - 5 n l ~ ~ - . 2 - . ! . . ~ LLetter No - -/7 6

Letter No, - ------------- - 8 9 10 11 12 13 14Letter No 15 ' - - / 19 18 17 16Letter No 23 24 2 5 1 - - _ 20 21Letter No 27 26 _ _ _ - / 3 0 22

Letter No 33 34 35 etc ~ ~ ~ :Obvioualy If one does not know when or ho hsectIons of k eymg e leme nt s c an no t b w t e I nt er ru pt Ion s t a ke place, t he n the SuccesSIve

d The t f e supenmposed as IndIcated aboveIn erruptIon 0 the cyclic keYing all

prearranged plan, and the three basic meth dse1uence usu y t akes p la ce according to somea short mnemomc key as an example 0 s 0 Interruption will be t aken up In turn, USIng

D J UPS

J D R 0 J

F Y X S X

o L Y R P

CRYPTOGRAM

J K X K J ~ ~ ~ ~ - - - : Y ~ I Y D PM J J V ~ B - ~ = - . , , ~ : . . . . : . . . - . . : : . . . . . ; = - . . . . : . : . . . . : : : : - = - - . : . . : K . . . . . : . : X D G D

I X X X X

P J D R 0

A F A E N

JUPS

Y

B 0 L Y RYFXUR

XGUFD

I Also called at tImes an "m1Iuence" letter because It Influences or modIfiesnormal procedure In somecaBeB no Influence or interrupter letter IS used, the mterruption or break In the keymg sequence occumng aftera preVloUBly-agreed-upon numberof letters has been enciphered

6 Suppose the correspondents agree that the Interruption In the keymg sequencewill takeplace after the occurrenceof a specIfiedletter called an tnterruptor,I which may be a letter of thep la in t ex t, o r one o f the CIphertext , as agreed upon In advance Then, SInceIn e ither casethere 18 nothing fixed about the time the mterruption will OCCUr-Itwill take place at no fixedmtervals-not only does the mterruption become quite irregular, followingno pattern, but also

the method never revertsto one havingpenodic i ty Methodsof t ins type Will now be discussedIn detail

19, Interruptor ISa plaIn-text letter - a Suppose the correspondents agree that the Inter

rupnon In the key will take place Immediately after a previously agreed-upon letter, say R,occurs In the plam text The key would then beInterruptedas shown In the following example

(usmg the mnemonic key BUSINESS MACHINES and theHYDRAULIC XZ sequence)

Key BUS I N E SSM A CH I B US B US I BUS I N E

Plam_____________ AMM U N IT IO N FOR F IR S TAR T IL L E R

Cipher----------- B 0 L Y R P J D R 0 J K X K J F Y X S X D J UPS Y

Key --____________ BU S I N E SSM A CH I N E S BUB U S IN E S· S MAC H I

Plam.____________ Y W IL L BEL 0 A D E D AFT ER A MMU N IT IO N FOR

Cipher I Y D P Y F X U R A F A E N MJ J V B 0 L Y R P J D R 0 J K X

Key BU S I B US B US I NEB U S IN

PlaIn_____________ T H I R DAR T IL L E R YClpher___________ D G D X G U F D J UPS Y I

21

b Instead of employmgan ordmary plam-text letter as the mterruptor, one might reservetheletter J for tlns purpose (and use theletter I whenever this letter appears as part ofa plam

t ex tw ord) ThIS IS a quite SImple vananon of the baSIC method The letter J acts merelyas though It were a plain-text le tte r, except that In tIns case It a lso serves as the mterruptor

The mterruptor 18 then Inserted at random, at the whim of the enciphenng clerk Thus

Key--------- BUS I NE SSM AC IBUS I NE SSM IBUS I NE SSM ACH I NE S BUS I NPlam________ TROO PS WIL L J BEHAL TED J AT R 0 ADIU NC T ION F I VE S I X

c It IS obVIOUS that repennons would be plentiful in cryptograms of tlua constructIon,regardless of whethera letter of high, medium, or lowfrequency IS selected as the SIgnalfor keymterrupnon If a letter of high frequency IS chosen, repetrnons will occur quite often, notonly because that letter will certamlybe a part of many common words, but also becauseIt willbe followed by words that are frequently repeated, and SInce the key starts again Witheachsuch mterrupnon, these frequently repeated words will be enciphered by the same sequence ofa lphabe ts TIn s IS the case In the first of the two foregoing examples It IS clear, for Instance,

that every time the word ARTILLERY appears In the cryptogram the Cipher equrvalents ofTILLERY must be the same If the mterruptor le tter were Ap instead of Rp, the repetition

29 301

9 10 /

18 19 20125 26 27 28

Keymg element No__ 1Letter N0 -____________ 1

Letter N0_________________ 5

Letter N0_________________ 11

Letter No 14

Letter N0_________________ 21Letter N0_________________ 31Letter No 34

20

( 3 ) ~ e ~ e ~ e ~ ~ t - N ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ : - : - : - 1 _ : _ * - 1 _ ~ _ * 1 _ : _ 1 6 0 11 12 13 14 15 16 17 18 19 20Letter N - 7- 8- 9-10- 1-*-10- 9- 8 - 7-*- 8K I 0 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35

ey e ement No_________ 9-10- 1 - 2 - 3-*-2- 1-10- 9- 8-* 9 10A - - - 1 - 2 - 3 etcs regards the third method, winch Involves onl I

of the keymg sequence if there t y an a t ernanon I n the dIrection o f progressIon

10-element keYIng s e q ~ e n c e for:::r:::ol In e ~ u P t I o n s In the key It would mean merely that a

sequence and the matter c o ~ l d then b e P h ~ ~ ~ dd b ~ b t r e a ~ e d as though It were an 18-element

method But 1f the PrInCIples of the seconde t ~ ~ g I t were a special form of the second

themattermay become quite complex method are combmed In one system,

c If one kno?Ls when the Interruptions t ake la hthe basic keymg cycle In the thre b P ce In eac cycle, then successrvs seenon« of

e cases may e supenmposed Thus

METHOD (1)

2 3 4 5 6 7 8 9 102 3 4 "

6 7 8

12 13/

15 16 1722 23 24

32 33135 etc



22

would include the CIpher equivalents of RTILLERY, IfIt were Tp, ILLERY, and so on On the

other hand, Jf a letter oflow frequency were selected as the mterrnptor letter, thenthe encipherment would tend to approxnnata that of normal repeatmg-key subsntunon, and repetauonswould be plentiful on that baSIS alone

d Of course, the lengths of the intervals between the repennons, m any of the foregoingcases , would be i rregular, so that penodu Ity would not be mamfested The s tu dent may

mquire , therefore , how one would proceed to solve such messages, for I t IS ObVIOUS that anattempt to allocate the letters of a single message into separate monoalphabetic distnbutionscannot be successful unless the exact locataons of the mterruptions are known-and they do

not becomeknown to the cryptanalyst until he has solved the message, or at l eas t a part ofI t

Thus It wouldappear as thoughthe would-besolver IS here confrontedWitha more orlessinsolubledilemma Tlussort ofreasonmg, however, makes more of an appeal to the novice m cryptography than to the expeneneed cryptanalyst,who speciahaes m methods of solving cryptograplucdilemmas

e (1) The problem here wil l be attacked upon the usual two hypotheses, andthe easierone wil lbe discussed f irst Suppose the system has been m use for some t ime, that an ongInal

solution has been reached by means to be discussed under the second hypothesis, and that the

CIpheralphabetsare known There remams unknown only the specific key to messages Exam

mmg whatever repennons are found, an attack IS made on the basis ofsearclung for a probable

word Thus, talong the illustrativs message in subparagraph a, suppose tl,e presence of the

word ARTILLERY 18 suspected Attempts are made to locate this word, Lasmg; the searchupon the construcnon ofan intelligiblekey Begmmng WIth the very first letter of the message,

the word ARTILLERY 18 Juxtaposed against the cipher text, and the key letters ascertained,using the known alphabets, whn h we Will assume m this case are bused upon the HYDRAULIC

XZ sequence slIdmg agamst the normal Thus

CIpher-___

___

_ B 0 L Y R P J 0 RPlam.c., --- --_____ ART I L L E R Y

"Key"------ __ -- -__ B H J Q P I B F U

(2) Smce tlns "key" IScertamly not mtelhgible text, the assumed word IS moved one letter

to the nght andthe test repeated, and soon until the followmg placeIn thetest IS reached

Cipher.L.. _ S X 0 J U PS Y I

Plam____________________ AR T I L L E R Y

Key - -- _ _ SIB U SIN E B

The sequence BUSINE suggests BUSINESS, moreover, It IS noted that the key 13 m

terrupted both tames by the l et te r Rp Now t he k ey may be applIed to the begmnmg of the

message, to see If the whole key or only a port ion ofI t has been recovered Thus

Key BU S I N E S S BUS

Ctpher B 0 L Y R P J D R 0 J

Plam A MM U NIT I U M T

(4) It ISObVIOUS that BUSINESS ISonly a paIt of the key Bu t the deCIpheredsequence

cer taInly seems to be the word AMMUNITION When thIs IS tned , the key IS extended toBUSINESS MA Enoughhas been shown to clanfy the procedure

23

f The foregoing solution ISpredicated upon the hypothesis that the CIpheralphabets areknown But what If this IS not t he eabe? What of the s teps necessary to arnve at the firstsolution, before even the presenceof an mterruptor IS suspected? The answerto this question

leads to the presentation ofa method of attack whichISone of the mostImportant and powerfulmeans the cryptanalysthas at Ius command for unravelmg many knotty problems It 18 called

s o l u t ~ o n by s u p e M m p 0 8 d ~ o n , and warrants detailed treatment

20. SolutIon by snpenmncsrnon- a Bane p M n c ~ p l e s - (1) In solvmg an ordmary

repeatmg-key CIpher the first dpp, that of ascertammg the leng-th of the period, is ofno sigmh(ance m Itself It merely paves the way for and makes possible the second step, wluch consists

in allocatmg the letters of the cryptogrammto mdrvidual monoalphabetrc distnbunons The

third stepthen consists In solving these distnbutrons Usually, the text of the message IS transcnbed into I ts penons and IS wntten out m successive lines corresponding m length With that

of the period The diagram then consists of u serres of columns ofletters and the lettersm eachcolumn belong to the samemonoalphabet Anotl lN way ofloolang at thematter i s to conceive

of the text ashaving thus been taanscnbedmto supcMmposed perwds in such case the letters Ineach columnhave undergone the same kindof treatment by the same elements (plain and cipher

components of the CIpher alphabet)(2) Suppose, however, that the repeutrve key IS very long and that the message ISshort,so

that there a re onl y a very f ewcyc le s m t he te xt T he n t he solution of the message becomesdifficult, If not impossible, because there 18 not a sufflcient number of supenznposable penods toYIeldmonoalph abetic distnbuuons which can be solved by frequency prmcrples But suppose

also that there are many short cryptograms all enciphered by the same key Then it IS clearthat If these messages are supenmposed

(a) The letters in the respective columns will all belong to mdrvidual alphabets, and(b) If there IS a sufhctent number of 'lUI h supenn-posable ll'C''l'lages ('lay 2 f i - ~ O , for F . I 1 ~ h s h ) ,

then the frequency distnbutions applicable to the suer essive columns of text can be solved

'lJJ'IJ00ut kno'/J)'/,ng the length ofthekey In other words, any difficultres that may have arisen onaccount of failure or mabihty to ascertain the length of the penod have been circumvented

The second step in normalsolutionIS thus "by-passed"

(3) Furthermore, and this IS a very important pomt, in case an extremelylong key IS employed 8J'd a senesof messages begmnmg at differentnutial pointsare enciphered by sucha key,

thismethod ofsolutionby supenmposinoncan be employed, provided the messages can be superImposed correctly, that IS, so that the letterswhichfall m one columnreallybelong to one Cipheralphabet Just how thi s can be done will be demonstrated in subsequent paragraphs, bu t a

clue has already beengiven in paragraph 1Sc At this point, however, a simpleillustration ofthe method will be given, usmg the subsntutaon system discussed m paragraph 19

b Example - (1) A set of 35 messages has been intercepted on the same day Presumably

they are all m the same key, andthe presenceof repetitIOns between rr.esc,ages corroborates tmbassumptIOn But the mtervals between repetltJOn'3 WIthm the same message do not show any

commonfactor andthemessages appear to be apeuodlcm nature The probable-word methorl

has been apphed, usmg standard alphabets, WIth no success The messages are then superImposed (FIg 5), the frequency dlstnbutlons for the first 10 columns are asshownm FIgure 6



25

b In the foregOIng example, there are nosigmficantrepentaons Such as dooccur compriseonlydigraphs, oneof which IS purely accidental But the absenceof sigmficant,longrepentaonsIS Itself purely accidental, for had the mterruptor letter been a letter other than Qo, then thephrase AMMUNITION FOR, which occurs twice, might have been enciphered identically both

(2) The 1st and 2d distnbunons are certamly monoalphabane There are very markedcrests and troughs, and thenumber ofblanks (14) IS morethan satIsfactory in bothcases (Letthe student at this point refer to Par 14and Chart 5 ofMilitary CryptanalySlS, Part I) But

the 3d,4th, and remammg distnbunons appear nolonger to bemonoalphabetac Note parncular ly the distnbunon for the 6th column From this fac t the conclusion IS drawn that somedisturbance in penodicity has been mtroduced in the cryptograms In other words, althoughthey all start out WIth the same alphabet, somesort ofmterruption takes placeso as to suppresspenodicity

(3) However, a start on solution may be made by attacking the first two distnbunons,frequency studies bemg aided by oonsiderataor-s based upon probablewords In this case, SIncethe text comprisesonly the begmnmgs of messages, assumptions for probable words are moreeaSIly made than when words are sought in the mtenors of messages Such common mtroductory words as REQUEST, REFER, ENEMY, WHAT, WHEN, IN , SEND, etc, are good onesto assume Furthermore, high-frequency digraphs used as the mmal digraphs of commonwordswill, of course, manifest themselves in the first two columns The greatest a id m thisprocess IS, asusual, a familiantyWIth the "word habits" of theenemy

(4) Let the student tr y to solve the messages In sodomghe willmore orlessqwckly findthe causeof the rapid fallmgoff in monoalphabetacity as the columnsprogress to the nght fromthe mitaal pomtof themessages

21 Interruptor IS a CIpher-textletter -a In the precedmg case a plam-text letter servesas the mterruptor But nowsuppose the correspondents agree that themterruptIon in the keywill take place immediately after a previously-agreed-upon letter, say Q, occurs In the CIphertext The key would then bemterruptedas shown In the following example

Key BUS I N E SSM A CH I N E S BUS I N E SS MPlam_________________ A M M U NIT IO N FOR FIR S TAR TIL L E

CIpher B 0 L Y R P J D R 0 J K X T P F Y X S X B P U U QKey BUS I N E SSM A C H I N BUS I N E SSM A C H B U

PlaID_________________ R Y W ILL BEL 0 A D E D AFT ERA M M U NIT I 0CIpher H R N M Y T T X H P C R F Q B E J FIE L LBO N Q 0' Q

Key BUS I N E SSM A C H BUS I N E

PlaID_________________ N FOR T H I R DAR TIL L E R Y

CIpher V E C X BOD F PAZ Q 0 N U F I C

HRNMY

C X BO DBPUUQ

!LQ QVEF Y X S X

L LBO N-

CRYPTOGRAM:

J K X T P

E J FIE

CXXXX

P J DR 0C R F Q BQ N U F I

B 0 L Y RT T XHP

F PA Z g

,I

J

~ ~ ~ ~ ~ ~ - ~ ~ ~ ~ ~ ~ ~ ~ ~3. ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

:~ ~ ~ ~ ~ABCDE FGH I J K LMNOPQRS T U VWXY Z

2. ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

~ ~ ~ ~ ~ABCDE FGH I J K LMNOPQRS T U VWXY Z

FIGUBlIlI

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~5. ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~6. ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

~ ~ ~ ~ ~ ~ ~ ~8. ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ , ~ ~ ~ ~ ~9. ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~7. ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~10 ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

24

1 ZCTPZWZPEPZQX ]9 A F E 0 J T D TIT2 WTEQMXZSYSPRC 20 KPVFQWPKTEV3 TCRWCXTBHH 21 Z A BG R T X PUQ X4 EFKCSZRIHA 22 YHEOCUHMDT5 Y ANC I H Z N UW 23 C L C P Z I K 0 T H6 VZIETIRRGX 24 AFLWWZQMDT7 HCQ I C KG UON 25 ZCWAPMBS AWL8 ZCFC LXRKQW 26 HF LMHRZNAPECE9 HWWPTEWC IM J S 27 CLZGEMKZ TO10 E P D 0 Z C L I K S J 28 TPYFKOTIZUH11 WTSSQ Z P Z I E T 29 ZCCPSNEOPHDYL12 ZCGGYFCSBG 30 C I Y G I F T S Y T L E13 CWZAOOEMHWTP 31 YTSVWVDGHPGUZ14 C I Y G I F B D T V X 32 N 0 C A I F B J B L G H Y15 E AQ DRDN SRC APD T 33 ZXXFLFEGJL16 YFWCQQBZCWC 34 Z C T M M B Z J 0 017 WTE ZQS KUHC 35 HCQ IW SYSBPHC Z V18 ZCVXQZKZYDWLK

FIGUBlIlI



27

length and were sncrphered by a vanable-length key It IS possible, however, to combine both

pnnciples and t oapp ly a variable-lengthkey to vanable-Iength groupings of the plain text

(2) Suppose the corre8pondents agree to encipher a message accordmg to word lengths, bu t

at Irregular intervals, to add at theend of a word anmteuuptor letter whichwill serve to inter-

rupt the key Notethe following, ill which the key IS BUSINESS MACHINES andthe mterruptor

letter IS X

(3) The foregomg system IS onl ya nnnor modiflcanon of tne simple case of ordmary word

length enclpherment as explained m Section II If standard CIpher alphabets are used, the

spasmodic mterruptaon and the presence of the mterruptor letter would cause no difficultywhatever, Slice the solution can be aclneved mechanically, by completmg the plam-component

sequen(,e If nuxed CIpher alphabets are used, and t he primary components are unknown,

solution may be reached by following the procedure outlined in Sections II and III, WIth such

modificataons es are SUItableto the (,11&ee It IS hardly necessary to point out that the foregoing types of aperiodic substitution are

rather unsuitable for practical military usage Enuphelment IS slow and subject to error In

some cases enopherment can be aecomphshed only by single- le tter operat ion For If the

mterruptor IS a CIpherletterthe key IS interruptedby a letterwluoh (annat beknownm advance,If the mterruptor ISa plam-text letter, while the mterruptIons can be indicated before encipher

ment ISbegun, the IrlegulantIes occasioned by the mterrupnons II I keymg cause confUSIon andquite matenaUy retard the enciphenng process In deuphermg, t he r at e of speed wou ld be

Justas s lowm 6lthermethod It IS obVIOUS that one of the pnncipal dIsadvantages il l all thesemethods IS that If an error in transmisaion IS made, If some letters are omit ted, or I f anythmg

happens to themterruptor letter, the message becomes difficult or impossible to decryptographby the ordmary code clerk Fll la lly, the degree of cryptographIc secunty attaInable by most

of these methods IS not suffiCIentfor mIhtary purposes

etc

5 BFIR S T X ART ILL E R Y etc

Z D F G JOB H DOS 5 J H I

FGJOB HDOSS JH I

CRYP rOGRAM:

U

FOR

E Q V

EQVZDDOW VT TRV

Key____ B

PlaIn_____ ___

A M M U NIT IONCIpheL______ B T T R V 0 DOW V

tunes If a short key IS employed, repeutaons may be plentiful For example, note the following, m which 50 IS the mterruptor letter

26

Key BA N D 5 BA N D S BA N D 5 BA N D 5 BAN BAN D 5 BA N D 5 B

Plum FR O MF 0 U R F I VE T 0 F 0 U R F 1FT E E N A MBA R RA G E

Cipher K T A K Z WX I I D A C B N Z WX I I D K W5 JO N K T B T l D H J

C This last example gives a clue to one method of at tacking this type of system There

will be repetinons witlnn short secticns, and the interval between tl-em wrll sometimes permitof asce, taming tl.elength(Ifthe kev In surh shr t t set tions, tl.eletters wlnch intervene between

the r e p e a t ~ d sequences may be elumnated a'! possible interrupter letters Thus, the letters

A,C,B, ano Nruay be el.mmated, m the foregomg {'Aample, asmterruptor letters By extension

of t lus principle to the letters mtervemng between other repennons, one may more or l essqUI( kIy ascertain what letter serves as the mterruptor

d On . e the mterruptor letter has been found, the next step IS to break up the messageinto "uninterrupted" sequences and then at tempt a solution by supenmposiuon The pnn-

ciples explumed in paragraph 20 neeJ only be modified In mmor respect'! In the first place 1ll

t lus case the columns of text formed by the supenmposi taon of umnterrupted sequences willbe purely r-ionoalpnabetic, whereas in the lase of the example m paragraph 20, only the very

first column IS purely monoalphabeuc, the monoalphabeticity fallmg off very rapidly WIth the

2d, 3d, columns Hence, in this case the analysis of the individual alphabets should be

an easier task But this would be counterbalanced by the fact that wl-ereas m the former case

the cryptanalyst IS dealing WIth the mrual words of messages, 1ll thi s case he IS dealing WIthmtenor poitions of tl,e text andhas nowayof know wherea word begms Thelatter remarksnaturally no not apply to the case where a whole set of messages ill this system, all in the same

key, can be subjected to simultaneous study In such a case the cryptanalystwould also have

theminal words to workupon22 Concludmg remarks -a The preceding two parag.apbs both deal with the f irst ani '

simplest of the three basic cases refer red to under paragraph 18 The second of those case..involves considerably more work II I soluuon for the reason that when the mterruption takes

place andthe keymg sequence recommences, thelatter IS not mvanably the mmal pomt of the

sequence, as m the first caseb In the second of those casee the mterruptor causes a break in the keying sequence and

a recommClllement a t a nyone of the 10 keymg elements Consequently,It IS ImpOSSIble now

merely to supernnpose sectIOnsof the text by sluftmg them so t1at theIr lmtuu letters fall Inthe same (olumn But a superunpositlOn IS nevertheless possIble provIded the InterruptIons

do not occur so frequently 2 that sectIOnsof only a very few lette:S are enCIphered by sequent

keyletters In order to accomphsh a proper supcnmposIt IOn m thIs case, a s ta t Is tical test

ISessential, and for thIs a go od many letters are reqUIred The nature of thIs test wI beexplamed II I Section XI

c The same thmg IS true of the last of the three <,ases mentIOned under paragraph 18

The solut ion ofa case of t lus sort IS adIllittedlya rather dJ1ficultmatter whIch will be taken up

II I Its proper place later

d (1) In the cases thusfar studIed, eIther the piam-text groupmgs were vanable Inlength

and were enCIphered by a constant -length key, or the plam-te"{t groupmgs were constant m

2 When no mterruptor or "mflucnce letter" used, the InterruptIOn or breakIn the keymg sequence occursafter the eUClphLrment of a definIte number of le tters Once thIs number has bE-en J.scertamcd '30lutlOn ofsubsequent messages IS very Simple '





31

FIGUBlI:7

b If as a. result of the analySIS of several messages (as descnbed m pa r 25), mixedpnmary ~ o m p o n e n t s have been reconstructed, the solution of subsequent messages may r e a ~ ybe accomplished by followmg the procedure outlined in a above, since In that case the eap er

alphabetshave become known alphabets b25 Gener al pnnerplea under lyIng solut ion of Cipher- text auto-keyed cryptograms '1f r e q u e ~ c y analysIs -a FIrst o f a ll , I t I S to be noted In connectionWithCipher-text auto-keymg

that repetitions will no t be nearly as plentiful In the Cipher text as they are m the plam t ~ t ,because m tlus system before a repetinon can appear two thmga must happen SImultaneousy

FIrst of course the plam-text sequence must be repeated, and second, one or more Cipher-text

lette;s ( d e p e n ~ g upon the length of the Introductory key)Immediatelybefore the second appear

ance of the pIron-text repetition must beIdenticalWIthoneor more eapher-textletters unmedIate

IY

before the first appearance of the group ThIs can happen only as the result of chance n

the followmg example the mtroductory key ISa single letter, X, and direct standard components

are used In the usual Vigenere manner

A V H X T X N H O

BWIYUYOIP

CXJZVZPJQ

D Y K A W A Q K R

EZLBXBRLS

F A M C Y C S M T

G B N D Z D T N U

H C 0 E A E U 0 VIDPFBFVPW

J ~ GCGWQXK F R H D H X R Y

LGSIEIYSZ

MHTJFJZU

N I U K G K A U B

OJVLHLBVC

P K W M I M C W D

Q L X N J N D X E

R M Y O K O E Y F

S N Z P L P F Z ET O A Q M . . . Q G A H

U P B R N R H B I

V Q C S 0 SIC J

W R D T P T J D K

X S E U Q U K E L

Y T F V R V L F M

Z U G W S W M G N

K D K S J M D H N V H L Y

THIRD R E G I M E N T

K D K S J M D H N V H L Y R

Key X C K B T M D H N V H L Y

Plam_________________ FIR S T R E G I M E N T

Cipher C K B T M D H N V H L Y R

(80)

CRYPTOGRAM:

P8lllll'llphSolution of cipher-textauto-keyedcryptogramswhen known alphabetsare employed_____________________________ 24General prmeiples underlying solution of cipher-textauto-keyed cryptograms by frequency analysls__________ 25Frequency distnbutrone required for solution --------------------__________________________________________________________ 26

Example ofsolution by frequency analyslll________________________________________________________________________________ 27Example ofsolution by analysrs of Isomorphisms -- ----____________________________________________________________________ 28Bpeclalcase of solution of cipher-textautO-keyed cryptograms ._____ 29

24 SolutIon of cIpher-textauto-keyed cryptogramswhen known alphabetsare employed _

a (1) Flrst of all It IS t o be noted that If the cryptanalyst knows the CIpher alphabets whichwere employed in encipherment, the solunon presents hardly any problem at all It IS only

necessary to decipher the message beyond thekey letteror key-word pornon and themraal part

of the plain text enciphered by t lu s key l e tt er o r key word can be filled In from the context

An example, using standard Cipher alphabets, follows hereWIth

SOLUTION OF CIPHER-TEXT AUTO-KEY SYSTEMS

SECTION VII

W S G Q V O H V M Q W E Q U H A A L N B N Z Z M P E S K D

(2) Wntmg the Cipher text as keyletters (displaced one interval to theright)and declphenngby direct standard alphabets yields the followmg

Key -------------- W S G Q V 0 H V M Q WE Q U H A A L N B N Z Z M P E S KCIpher___________ W S G Q V 0 H V M Q W E Q U H A A L N B N Z Z M P E S K D

Plam_____________ WOK F T T O R E G I M E N T A L CO M M A N D P 0 S T

(3) 1'11alof the word REPORT as the imtral word of the message YIelds an mtelhgible wordas the mmal key FORCE, so that the message reads

Key_____________________ F O R C E V 0 H V M Q

Clpher__________________ WS G Q V 0 H V M Q

Plam____________________ R E P 0 R T T O R E •

(4) A sermautomanr, method of solvmg such a message IS to use sliding normal alphabets

and align theatnps so that, as one progressesfrom left to right, each Cipher letter IS set oppositethe letter A on the preceding s tr ip Takmg t he l et te rs VMQWEQUHA in the foregomg example,

note In Figure 7 the senes of placements of the successive stnps Then note how the SUCCesSIve

plam-text letters of the word REGIMENT r eappea r t o t he l ef t of the successive CIpher lettersMQWEQUHA



32

The repeated plain-text word, REGIMENT, has only 8 letters but the repeated CIpher-text group

con ta in s 9 , of which only t he l as t 8 letters actually represent the plam-text repention In

order that the word REGIMENT be enci phered by D H N V H L Y R the s ec ond t ime thi s

word appeared in the text It was necessary that the key letter for Its first letter, R, be Mboth

times, no otherkey letter will produce the same CIphersequence for the word REGIMENT in tills

case Each different key le tt e r for enciphermg the first letter of REGIMENT WIll produce a

differentencipherment for the word, so that the chances I for a repetrtaon in tills case are roughly

about 1 in 26 ThIS IS the principal cause for the reduction in repetrtrons in tills system If

an mtroductory key of two letters were used, It would be necessary that the two Cipher letters

immediately before the second appearance of the repeated word REGIMENT be rdentrcal With

the two CIpher letters immediately before the first appearance of the word In general, then,

an n-letter repetition in the CIphertext, m tills case, representsan (n-k)-letter repetiuonm the

plain text, wheren IS the length of the CIpher-textre petttion and k IS the length of theintroductorykey

b There IS a second phenomenon of mterest in connection WIth the Cipher-text auto-key

method Let the letter opposite which thekey letter IS placed (when using slrdmg components

for encipherment) be termed, for convenience in reference, "the base letter" Normally the

base letter IS the miual Iet t er of the plain component, but It has been seen in precedmg textsthat this IS only a convent io n Now when the introductory key IS a single letter, If the base

letter occurs as a plain-text letter ItS CIpher equivalent IS Identical WIth the irnrnedtately pre

cedmg Cipher letter, that IS, there IS produced a double letter m the CIphertext, no matter what

the CIpher component IS and no matter whatthe key letter happensto befor that encipherment

For example, using the H Y D R A U L I C X Z sequence for both pr imary com

ponents, WIth H, the mitral letter of the plain component as the base letter , and using theintroductory key letter X, the following encipherment IS produced

Key X J 0 I I FLY U T T D K K Y C X G

Plam______________________ MAN H AT T AN H I G H J INK SCIpher J 0 I I FLY U T T D K K Y C X G L

Note the doublets II , TT, KK Each time such a doublet occursIt means that the second letter

represents Hl , which IS the base letter in this case (rmtial Ietter of plum component) Now If

the base letter happens to be a high-frequency letter m normal p lam text , for example the letter

E, or T , then the CIpher text WIll show a large number ofdouble ts ,I f I t happens to be a low-f re

quency l e tt e r the CIpher text will show very few doublets In fact, the number of doublets

will be directly proportional to the frequency of the base letter m normal p lain text Thus,

If the cryptogram contains 1,000 letters there should be about 72 occurrences of doublets If

the base letter IS A,since m 1,000 letters ofplain text there should be about 72A's Conversely,

If a cryptogram of 1,000 letters shows about 72 doublets, the base letter IS l ik ely to b eA , If It

shows about 90, It IS l ike ly to beT, and soon Furthermorewhena clue to the Identity of the

base letter has been obtamedm thismanner, I t IS possible Immediately to insert the corresponding

plain-text l e tt e r throughout the text of the message The drstribuuon of tills letter may not

only s er ve as a che ck (If no inconsistencies develop) but also may l ea d to the assumption ofvaluesfor other CIpher letters

c When the mtroductory key IS 2 letters, then this same phenomenon will produce groups

of the formula ABA, where A and Bmay be any letters, but the first and third must be IdentIcalThe occurrenceof patterns of tills type III tIns case mdlcates the enCIphermentof the base letter

1 If all the CIpher letters appeared WIth equal frequency the chances would be exactly1 In 26 But certam

letters appearWIth greater frequency because some plam-text le tters are much more frequent than others

33

d The phenomena noted above can be used to considerable advantage in the solution ofcryptograms of this type For instance, If It IS known that the ordinary Vigenere method of

oncipherment IS used (8k /2=81 / 1 '

81>11=8. /2 ) , t hen t he imnal Ietter of the plain component ISthe base letter If, further, It IS known that the plain component IS the normal direct sequence,

then the base letter IS A and a wor d s u ch a s BATTALION WIll be enciphered by a group havingthe formula AABCCDEFG If the plain component IS a mixed sequence and happens to start

WIth the lett;;- E ~ h e n a word such as ENEMY would be enciphered by a sequence having the

formula AABBCD 2 Sequences such as these are, of course, rdiomorphic and If words yieldingsuch idiomorphisms are frequent II I the text there Will be produced m the latter several or many

cases of Isomorplusm When these are ana lyzed by the princrples of mdirect symmetry of

posttion, a quick solution may followe A final principle underlying the solution of CIpher-text auto-keyed cryptograms remains

to be discussed It concerns the nature of the frequency distrIbutIOns required for the analysis

of such cryptograms Til lspr incipleWIll be set forth m the next paragraph26 Frequency distrIbutIOns required for solution -a Consider the message given in

paragraph 23c (1) It happens that theletter R. occurs twice II I tills short message and, because

of the nature of the Cipher-text auto-keymg method, this let ter must also appear twice m the

key Now It IS ObVIOUS that all plain-text letters snctphered by key letter Rk WIll be m the same

Cipher alphabet m other words If the key text IS "offset" one letter to the right of the Ciphertext then every ' c ~ p h e r letter w h ~ ~ h ~ m m e d w t e l y follow8 an R. the cryptogram unll belong t \ the

8 a m ~ cipher alphabet and tills alphabet may be designated convemently as the RCipher alpha et

Now If there were suf ficien t text , so that there were, say , 30 to 40R. 's in It, then a frequency

distribution of the le tt e rs Immediately following the R.'s wil l oxhibrt monoalphabeucityWhat has been said of the letters following the Rc'sapphes equallywell to the letters following

h tl A ' B' C' nd soon In short If26 distnbutionsall the other letters of the Clp er text, .ne c S, e S, c S, a , da re made one f or e ach letter of the alphabet, showing the Cipher letter immediately succee mg

each different letter of the Ciphertext, then the text of the cryptogram can be allocated mto 26unihteral, monoalphabetic frequency distnbutions WhICh can be solved by frequency analysis,

providing there are sufficient data for tlus purposeb The foregoing pnnciple has beendescnbed as pertammg to the case when the introductory

key IS a single letter, that IS,when thekey text IS "offset" or displaced but one interval t o t henght of the CIpher text But It applies equallyto cases wherem the key text IS offset more than

one interval provided the frequency drstributions are based upon the proper interval, as deter

mmed by the displacement due to the length of t he i nt roduct or y key Fo r metance, suppose

the introductory key consists of two le tte rs , as in the following example

Key t ex t X ZI M R H F H G F N Q R X 0 M R M6: E E

Plain text R ELI A B LEI N FOR MAT IE'CIpher text M R H F H G F N Q R X 0 M R MV W E

The keytext III this case IS offset two mtervals to the right of the Cipher text and, therefore,

quency distribunons made by takmg the CIpher letters one interval to the right ofa givenCt edletter each time that letter occurs, will not be monoalphabeuc because some letter not re ate

at all to the given Cipher letter IS the key letter for snoiphenng the letter one I l l t e r v ~ h t o fith enzht of the latter For example, note the three Re's III the foregomg IllustratIOn e r s t

Rto IS followed by H representmg the enCIpherment of L, by M , the second R. IS followed hy x.,

c C, L. d R f 11 d b M representmg t e en-representmg the enCIpherment of F l by Qk' the tlllr • IS 0 owe Y c, I ltd d dcipherment of All by M

kThe three CIpherletters H,X, and Mare here entIrey unre a e an 0

2 SIX letters are shown because the IdlOmorphlsm m thlil case extends over that many letters



34

not belongto the same cipher alphabetbecause they represent encipherments by three differentkey le tte rs On the other hand, the cipher letters two intervals to the r ight of the Ro's, VIZ,F, 0, and V, are in the same Cipher alphabet because these Cipherletters are the results of enciphenng plain-text letters I, 0, and T, respectively, by the same key let ter , R It IS ObVIOUS,

then, that when the mtroductory key consists of two letters and t he key text IS displaced two

mtervalsto the right of the CIphertext, the properfrequency dtstnbutrons for monoalphabsneujwill be based upon the letter at the second interval to the right of each CIpherletter Likewise,

rl the mtroductory key consists of three letters and the key text IS displaced three mtervals tothe right of the CIpher text, the distributions must bebased upon the third mterval, and so on,

m each case the interval used corresponding to the amount of displacement between key textand Cipher text

c Conversely, in solving a problem of thIs type, when the length of the mtroductory keyand therefore the amount of displacement are not known, the appearance of the frequency dIStnbutions based upon vanous mtervals after each different Cipher letter will disclose this un

known factor, since only one set of drstributions will exhibrt monoaiphabeticity andthe interval

corresponding to that set will be the correct mterval

d Apphcation of these prmciplos willnow be made, using a specificexample

27. Example ofsolution byfrequency analysis -a It WIll be assumed that previous studieshave disclosed that the enemy IS using the CIpher-text auto-key system descnbed It will befurther assumed that these studies have also disclosed that (1) the mtroductory key IS usually asingle letter, (2) the usual VIgenere method of employmg sliding primary components IS used,

(3) the plain component IS usually the normal direct sequence, the Cipher component a mixed

sequence which changes dally. The followmg cryptograms, all of the same date, have beenmtercepted

35

I A AB DJ U AWL

L Y Z K C

M X G S S

o V U Y EKMXXX

N B T J GC Z M J EG B 0 I WR 0 V D IK B J H QA J I E F

o NDueSET WWSU A 0 X

F K K M E

L V WT TS PBS F

TUX N J

Q P U X M

N K A Z C

D H 0 0 VI I V U UP PD Q ZMLAC ZE S JoeI B B 0 Z

N T ToeD I X CEE K A Q I

R X A L Xo V M R G

M X DID

VH ID IU U N M GFO B H V

T Z 0 I DMMVYM

L M W K YM T F H Z

N N D G IJ WK I EB Q X X X

E C A Q ZF D IP PH X M 0 Z

MESSAGE V

MESSAGE VI

MESSAGE VII

MESSAGE IV

Q A A Z T

C J J G JG G BOX

A R Y Y P

M M T T F

M W 0 H C

W Z H S TF K I R H

WMEHH

U Q Z H Z

o B ee X

Y 0 0 V U

J L N Q M

L T Z K XG R J P F

C S L G X

T B J P AB D A Q YC E C Z M

G IS U HX C T B S

HAG I E

P S F A JWP V I BMU Z E L

FO R S A

X J J P M

T U T e V

SU M U J

T B J P AS F T Q TXUKTX

FXXXXb A distnbution table of the type descnbed m paragraph 25e IS compiled and 18 shown as

F 8 below In making these distnbutions It IS SImpleto insert a tal ly m the appropriatec : I T ~ the pertment honzontalhne of the table, to indicate the Cipher letter w h 1 ~ h n n m e t ~ a ~ l ~follows each occurrence of the letter to which that l ine applies Obviously, the est me 0 0

m i hng the data ISto handle the text digraphically, taking the first and second letters, the

second and third, the third and fourth, and soon, and distnbutmg the final letters of the digraphsin a quadncular table The distnbution merely takes the form of tallymarks, the fifth being a

diagonal strokeso as to totalize the occurrences visibly

D I WP PG T e Z M

J J Q Q YF K SET

J X W K AGXXXX

J C C X UC S UHF

Z E Y G CR R Q H Q

B Z ELM

I B R X D

U K N M VD I V E YS G TAR

G Y F K R

K MK I X

D GET X

R M X A NY Y Z J U

U E Q E VD G T T Z

G G K X X

JeD D YW V G R K

MESSAGE I

C N Q E TN N J J IG 0 I E QF Y TeDR Q G G NY s c o I

WP C K KN L M WKPUR R S

T e E T P

L B weD

Z 0 K V U

C H 0 L M

T Q Y U X

MESSAGE II

MESSAGE III

E E C D AH I F E L

R V CU R

M G LOY

K M L T U

T Z J 0 Q

Z W K X GA K 0 B LQ B ML TB WN Y SBUY N K

LTC J MH Q V G X

K I R 0 Z

I J X WXQ Z S X 0

E H H L M

CAR P H

T 0 I Q K

o K N T B

G R V R M

R T N J U

F H I J AF F N F l

A 0 0 X D

R W K A 0MWT Q 0

L A Q Y U



FIGURE 8

36

SECOND LETTER

ABCDEFGH I JKLMNO PQRSTVVWXYZ

ZM LAC

MLAC

Z

Z M T F H

M T F H ZV I C

V V NMGA

Assumed FrequencyAlpha Approxrbet matron

e. e. Expected Actual

M T V Low 2 Fair

T F I High 2 Fair

F U L Medium 1 GoodU N B Low 1 Good

N M L Medium 2 Fair

M G E HIgh 3 Fair

Message VI, hne 2 B D A Q Y MM T T F

A A

The assumption cannot be discarded Just yet Let the values derivable from the assumption

be inser ted in their proper places m a cipher component, and, usmg the latter in conjunction

Witha normal direct sequence as the plain component, let an attempt be made to find corroboration for these values The followmg placements may be made

Plam_________________ ABC D E F G H I J K L MN 0 P Q R S T V V WX Y Z

Cipher M F G V N T

Thelet ter Me appears tWICe in the cipher sequence and when this partrally reconstructed cipher

component IS tested It IS found that the value Lp(Nt)=Me IS corroborated Having the le tt e rs

M, F, G, V, N, and T tentatively placed in the cipher component, It IS possible to msort certain

plam-text values ill the text For example, in the Malphabet, Fe==Dl, Ge=Ep, Ve=OIl' Ne=Pp,

Te=V l In the F alphabet, Ge=B l , Ve=Ll , Ne=M , TC=SIl' Mc=Xp The other letters yieldadditional values ill the appropriate alphabets The plam-text values t hu s obt amab le a re

mserted m the CIpher text No moonsistencres appear and, moreover, certam "good" digraphsare brought to light For instance, note what happens here

Key V Q Z H Z MT F H Z MLAC ZMessage V, hne 4 Cipher V Q Z H Z M T F H Z M LAC Z

Plam___________ V I

Now If the letter H can be placed in the CIphercomponent, several valuesmight be added to thi spartial decipherment Notmg that F and G are sequent m the CIpher component, suppose Hfollows G therem Then the followmg IS obtamed

Key____________ V Q Z HMessage V, hne 4 Cipher V Q Z H Z

Plam _

sequence represents BATTALION does not appear to be warranted Similar attempts are made

at other points in t he text , With t he same or other probabl e words Some of t he se attempts

may have to be carr ied to the point where the placement of \ alues in the tentative CIpher com

ponent leads to serIOUS mconsistencies Finally, attention IS fixed upon the following sequence

37

MMTTFVVNMGThe word AVAILABLE IS assumed The appropriate frequency drstubuuons are consulted

to see how wel l the actual mdrvrdual frequencies correspond to the expected ones

III I II I III I I I 1111 iHll III I II- - - - - - - -- - - - - - - - - - - - - - - - - -I III I III I I 1111 I I II III I II I- - - - - - - -- - - - - - - - - - - - - - - -I II iHI III III I II III I II I I I III 111I- - - - - - - -- - - - - - - - - - - - - - - -I I II I iHI II iHIHI I I - -I II II- - - - - - - - - - - - - - - - - - - - - - - - - -1I1 I I III II I III II II iHI I I II- - - - - - - -- - -- - - - - - -

I I 1111 II I I 1111 I I II- - -

I I I- - - - - - --- - - - -- - - - - - - - - -I I / I III III I I II I I III I III I II I- - - - - - - - - - - - - - - - - - - - -I I II III II I II -

III I I I I II- - - - - - - - - - - - - - - -I 1111 iHI iHI I I II I I II II

-I II III II- - - - - - - - - - - - - - - - - - - - -- -111I I I I II 111I I III III 11I1 I - - -

III I II- - - - - - - -- - - - - - - - - - - - - -111 I I - - - -iHI III I 11I1 II I II I I I II II- - - - - - - -- - - - - - - - - - - - - -I I I I - - - -iHI III 1111 I II II- - - - - - - -- - - - - - - - - - - - - -II III III I I I - - - -11I 1111 II II II II II iHll III II- - - - - - - - - - - - - - - - - - -I I I 1111 III I II II- - - -

II I I- - - - - - - -- - - - - - - - - - - - - -II I II II I - - - -II III I I iHI II III- - - - - - - -- - - - - - -II I I III I I

- - - - - - - - - - -III I I II II- - - - - - - -- - - - - - - - - - - - -I I II I I I I - - - -II I I I I I I iHI 1111- - - - - - -- - - - - - - - - - - - - - -II I II I II II I II II II I II I II I

I I I- - - - - - - - - - - - - - -- -I 1111 I I I I I II iHI I- - - - - - - - - - - - - - - - - - - -1111 iHl l I II - - - -I I II III I iHI 1111 I II 1111- - - - - - -- - - - - - -- - - - - -II III I II III III I

- - - - -I I 1111 I II II II I- - - - - - - - -- - - - - - - - - - - - - - - - - -I I III I I I II I 1111 I I I- - - - - - - -- - - - - - - - - - - - - - - - - -iHl l I I I I 1111 I II I I II I- - - - - - - -- - - - - - - - - - - - - - - -I III 1111 II I 1111 I II 111I II II II

- - - - - - - - -- - - - - - - - - - - -I - - - - - -II II II I I II II I II I II- - - - - - - -- - - - - - -I I 111I - - - - - - - - - -II II II iHll I II I II I

A

B

C

D

E

F

GH

I

J

P::K

L

tlM

0P::PQ

R

S

T

V

V

W

X

YZ

c The mdrvidual frequency distnbunons give every appearance of being monoalphabeticwhich checks the assumption that t he enemy ISstill employing the same system The total

number of letters of text (excludmg the final X's) IS 680 If the base letter ISA then there should

be approximately 680X7 2%=49 cases of double letters m the text There are actually 52such cases, which checks quite well With expectancy The letter A IS substituted throughoutthe text for the second letter of each doublet

d The following sequence ISnoted

Message V, lme L GIS V H WZ H S T T Z 0 I D D H 0 0 V N B T J G

A A A

Assume that the sequence DDHOOVNBT represents BATTALION Then the frequency of He in the

Dcipher alphabet should be high, since He=Tp The H has only 2 occurrences LIkeWIse the

f requency ofO , i n t he H alphabet (=Tp) should be hrgh, I t If> also only 2 The frequency'of Vill the 0 alphabet should be medium or l ow , smce I t would equal Lp, It IS 5, which IS too high

The rest of the letters of the assumed word are similarly checked against the appropriate frequency distnbuuons, With the result that, on the whole, the assurnpuon that the DDHOOVNBT



38

Suppose the VIC IS the begmmng of VICINITY Tills assumption pemuts the placement of

A,C,L, and Z In the CIphercomponent,as follows

Plam_________________ ABC D E F G H I J K L MN 0 P Q R STU VWXY ZCIpher M A F G H L Z U N T C

These addmonal values check In very mcely and present ly the entire cipher component ISreconstructed It IS found to be as follows

Plam_________________ ABC D E F GH I J K L MN 0 P QR STU VWXY ZCIpher MA B F G H J K L Q S V X Z U N D E R W0 T Y P IC

The key phrase IS obviously UNDERWOOD TYPEWRITER COMPANY All the messages now may

be deciphered WIth ea se The fol lowmg gives the letter-for-Ietter decipherment of the firstthree groups of each message

I (Introduotory key K)

QVVJLA P G R S

P V F Z N

S C A A T

IXDMTYKIPH

NK

NS F B aD I X G Z

Y G S I J

S J T B V

N Q I C HDMLEGo A E 0 T

E 0 V ACR S J Y L

F D B B Y

Y

MHCTY

YYBVKI Q 0 V J

o Z E T Z

D Q G S U

Q L Z I X

F Q F N N

XROC SDEWRRY J J L K

BMMLB

1

MLEXR KVDBDT X X B W ENAXML K Z E K U R C N IEKKLR V R F R FN D seD M P B B VJ L X T C V A 0 V EP L Q G W UPVKUWT H C Z R

2

H 0 U Z 0 LLZNA

o T G U Q Q F J 0 CB 0 E P L Q I G NRHOT J 0 C R I I X

3

MHCVB YUHAOYBHAL ZOFHMXLXGZ J P WU Io 0 SE A ATKPB

GRXLG

KVBWKKVKRORPEEW

T R X D I

MAMMaN E V V J

X D D Q Q

Z R L F D

o U P ITU V E V YXLODL

JRRVMRFRFXMCUNXI T M L J

HAL 0 ZKZEKUXAGXDBJNNB

U S Y P W

BEKVBPM Y U CT C V N I

E F A A G

AT N N B

NXQWHTNKKU

B I I B F

X R SeTK T T C F

JOEYM

39

c Frequency distnbunons are made, based upon the 2dlettersof pairs, as In the precedingexample The result IS shown m the table m figure 9 Thedata in each distnbution are rela

tIvely scanty and It would appear that the solution IS going to be a rather dIfficult matter

e In the foregomg example the plam component was the normal direct sequence, so thatWIth the V I g e n ~ r e method of encipherment the base le tte r IS A If the plaan component IS a

mixed sequence, the base letter may no longer be A, but m accordance WIth the principle setforth m paragraph 25b, the frequency of doublets in the c ipher text WII1 correspond WIth the

frequency of the base le t ter as a le tte rof normal plain text If a goodclue as to the identityof tills letter IS afforded by the frequency of doublets in the cipher text, the insert ion of the

correspondmg base letter In the plam text will lead to further clues The solution from there

on can be handled along thehnes indicated above27 Example of solunon by analysIs of rsomerpbisms -a It was stated In paragraph 25d

that m cipher-text auto-keymg the production of ISomorphs IS a frequent phenomenon and

that analysis of these ISomorphsmay YIeld a quick solution An example of this sort will now

be studiedb Suppose the following cryptograms have been mtercepted

MZDKVZ D K V U

N DRED

A C N C QC N Q E T

Y QUI E

G WP C KWP C K KP E C I A

X E C A Q

E C A Q Z

F I C I E

T T Z 0 IT Z 0 I DASH E S

TRXALRXALXXUPHE

P VHIDVHID IaU T S I

X E E C DE E C D A

F A I R L

o LTC JLTC J M

ONE H U

MZWKXZWKXGN G 0 F S

HWZHSWZ H S T

o U S F L

AARYYA R Y Y P

ARE A B

M L T Z K

LTZKXINS U F

AQAAZQAAZTI SAM I

Key KI I J X WCIpher T J X WX

Plam______________________ RIG H T

Key EI G R V RCIpher G R V R M

Plam______________________ NOT H I

Key HI R WK ACIpher____________________ R W K A 0

Plam______________________ ABO U TIV (Introductory key J)

III (Introduotorykey R)

VI (Int roductorykey B)

VII(Introduotory key B)

II (Introduotorykey E)

Key X J J P

CIpher X J J P M

Plam______________________ G U A R D

V (Introductory key E)

Key G IS UCIpher G IS U H

Plam______________________ NUMER

Key ----___________________ m B J P

CIpher____________________ T B J P A

Plam______________________ THE R E

Key mT B J P

CIpher T B J P A

Plam______________________ THE R E



FIGURE 9

40

OBOOQG§UN§FBOBEK

NEVVJLKZEKURCNIF

T N K K U X .b 0 D .b W T H C Z R I end of messageC R I I X 0 E T N K I end of messageCQV V J L K Z E K UR F R F X

Y.T.

Plam______________ ABC D E F G H I J K L M N 0 P Q R STU V W X Y ZCIpher H Y 0 R A U LIe B E F G J K M N 0 P Q S T V W X Z

These few letters are sufficient to indicate that the plain component IS probably the normal

d ir ec t s equence Afewmmutes testmg proves this to be true The two components are there-

fore

With these two components at hand, the decipherment of the messagesnow becomes a relatively

SImple matter Assummg a single-letter mtroductory key, and t rymg the first five groupa of

message 1 the results are as follows

41

The sequence IS obviously based on the keyword HYDRAULIC, andthe complete primary CIpher

component 18 now available The plain componentIS then t o be r econs tr uc ted A wordmust

be assumed m the textf A good probable word to assume for the lO-letterrepetition found m messages 1 and 3

18 ARTILLERY Tlus single assumption 18 sufflcient to place 7 letters in the p lsm componentThus

1 28 ' a 8 7 89m u u M U U W n ~ ~ ~ ~TVWXZ •• OR ULI BE FG J K NO QS

1 2 8 4 a 8 7 8 9 10 U 12 18 M 15 18 17 18 19 n

1 2 8 4 a 8 7 89m u u M U U W n

TEZKR. IVF. Q WG. NUS B X J DO L

The only missing letters are A, C, H, M, P, and Y By use of the nearly complete sequence on the

text It will bepossibleto place these 6 lettersm their posinons in the CIphercomponent Or, If akeyword-mixed sequence IS suspected, then the sequencewhichwasreconstructedmay be merely

a decimataon of the ongmal pnmary sequence By testIng the partial sequence for vanous

intervals, when the seventh ISselected the following result 18 obtained

Key V V J L K Z E K U RPlam_______________ ART IL L E R Y

Clpher • • V V J L K Z E K U R

Key '/ U S Y P W T R X 0 I M LE X R K V 0 BOO Q G S

Cipher U S Y P W T R SDIM LE X R K V D B D 0 Q G S U

Plam_______________ '/ P H R FYI V E FIR E 0 F L I G H TAR TIL

Asfor the endof the isomorphism, thefact that Isomorphs (2) and (5) are the samefor 10lettersseems to indicate that that IS the length of the isomorphism The fact that message 2 ends 2

letters after the last "tie-in" letter, Z, eorroborates this assumption It IS at least certain thatthe isomorphism does not extend beyond 11 letters because the recurrence of R in Isomorph (5)

ISnot matched by the recurrenceof Rm Isomorph (2), nor by the recurrence of T in Isomorph (3)

Hence I t may be assumed that the isomorplnesequenceISprobably 10letters in length, possibly11 Bu t to beon safeground It ISbest to proceed on the 10-letter basis

e Applymg the pnnciples of mdirect symmetry to the superimposed Isomorphs, partial

chams of equivalents may be constructed and It happensin

this case that practically the entirepnmary component may be established Let the student confirm the fact that the following

sequencemay be denved from the data given

11 I I /I /I /I /I I 11 II- - - - - - - - - - - - - - - - 1-

/I I I I I /I I /I 1/1/ /II /I 11

I I I /I I I I /I I 11 I I

f--/I /I I /I I 11 1 I /I I

I I I 1/1/ I /I I I'-

/I /I I /I

I /I I I I I I I /I

1-

/I Il- I-I /I /I /I I I I /II

- - - - - - - - - - - - - - - - - - - II - - - - -11 11 I I /I- - - - - - - - - - - -- - - - - - - - - - - - - - -

I /I I I I I I I /1 fH

I 1/1/ I 1/1/ I I II -

II

I II II I I I II-

I 1111 II/I II

I I 1 I I I III I III II I I II III

I II 11I1 III I I I /I I II- - - - - - - - - - - - - - - - -t:

III I I /1 II 11 I I /I I

I 1/ 11 I 11 I I I I 111 II 11 II

II I I I I 1/ I /I 1/1- -

I II 1/ II I I II I I

I 111 1/ I I I II I II III 1/ III- - - - - - - - - - - - - - - 1-

III I I I II I I I I

I /il I I II III I II II -

I II I I

I I I I II II I II I II -

I I

II III II 11 I III /11 I I I II I

I I- - - - - - - -

II I I II II- - - - - - - -- - - - - - - - - - - - - - -I I fH 1/ 11 I I I III I II I- - - - - -

/I I I I I I 11 I II I- - - - - - - - - - - - - - - - - - - - - -

III I II 11 II I II

SECOND LETTER

ABC 0 E F G H I J K L M N 0 P Q R S TU V W X Y Z

A AB BC Co 0E E

F FG GH H

I IJ J

K K

L LM M

..:: N8 N

0 0P PQ QR RS ST TU UV VW W

X XY YZ Z

ABC 0 E F G H I J K L M N 0 P Q R S TU V W X Y Z

First, It IS necessary to delimit the length of the isomorphv Isomorph (2) shows that the 1"'0

morplnsm begms With the doubled letters For there 13 an E before the VV il l that ease and also

an E witlun the I'lOmOIph, Ifthe phenomenonincluded the E,then the letter immediately beforethe DD in the case ofIsomorph (1)would have to bean N, to match Its homolog, E, In Isomorph(2), which It IS not Corroboratmg data are grven by Isomorphs (3), (4), and (5) m thi s respect

Hence, we may take It as estabhshed that the isomorphism begins With the doubled letters

d However, before beconung discouraged too quickly, a search IS made throughout the

text to see If any Isomorphs are present Fortunately there appear to be s ev er al of them

Note t he followmg

Message L

(3)

Message 2 (4)

Message 3 (5)



42

It 18 obvious that an mtroductorykey ofmore than one letter was used, since the firstfew letters

YIeld unmtelhgible text, bu t I t also appears that the last cipher letter of the mtroductory key

was used as the mtroductory key letter for eneiphenng the subsequent auto-keyed portion oft he t ext (see par 23c(3» However, assummg that the lYE before the word FIRE 18 the endingof the first wordof the plain text, and that this word IS INTENSIVE, the mtroductorykey word

ISfound to be WICKER Thus

Key W I C K E RI T R X D IM L EX R K V D B D D Q G S •

Plam__________ I N TEN S I V E FIR E 0 F L I G H TA R TIL •

Cipher U S Y P WT R X D IM L EX R K V D B D D Q G S U •

The begmrungs of the other two messages are recoverable m the same way and are f ound t o be

as follows

Key PRO M IS EI R X L G H 0 U Z 0

Plam_________________ R E QU E S T V I G 0 R 0 U SCipher B I I B F G R X L G H 0 U Z 0

Key C H A R G E DI R R V M M H C V B

Plam_________________ SEC 0 N DB A T TAL IO N •Cipher HAL 0 Z J R R V M MH C V B

9 The example solved m the foregomg subparagraphs offers an Important lesson to the

student, insofaras It teaches him that he should not '/,mmedw,tely jeel dtscouraged when confrontedwtth a problem presenttngonlya small quantttyoj text and therefore aJlordtng what seems at firstglance tobean tnsujfic1,ent quantttyoj datajor solutwn For in this example,wlule It 18 true that

there are msufflcient data for analysie by Simple pnncrples of frequency, It tu rned out that

solution was achieved wtthout any recourse to the prtnctples oj freg:uency oj occurrence Here,

then, 18 one of t hose mterestmg cases of substrtutaon ciphers of rather complex constructionwhich are solvable Without any study whatsoever of frequency distnbutrons Indeed, It WJ.11

be f ound to be true that m more than a few instances the solution of quite complicated cipher

systems may be accomplished n ot b y t he apphcation of the pnneiples of frequency, bu t by

recourse to mductrve and deductive reasomng based upon other considerataons, even though

the latter may often appear to be vpry tenuous and to rest upon quite fhmsy supports29 SpecIal case ofsolutionof Cipher-text auto-keyed cryptograms - a Two messagesWith

idenucal plam texts enciphered accordmg to the method of paragraph 23 c (3) by mitral key

words of different lengths and composinons can be solved very rapidly by reconstructmg the

pnmary components The cryptographtc textsoj suchmessages wtll be'/,somorphw afterthe'/,ntttalkey-word pottums Note the two followmg supenmposed messages, In which isomorphism be

tween the two cryptograms ISobVIOUS after thei r 6 th let ters

I I I I I ....-.... I1 T S B J S K B N L 0 C FH A Z LWJAM BNFN S MVJRE

2 BKKMJ X Y C X B H R P V 0 XMUVI Y C R eG I K U T DI I I I I ' - ' I

• ....-.... ..-1 HFPRX C P C R R EHFMU HRAXC NFDUB ATFQR

2 PRETN HEHTT D P R I W PTVNH CRSWY V J R F T' - ' .......,

43

StartIngWIth any pall' of superimposed letters (begmmng WItht he 7 th pair), chams of equiva

lents are constructed

1 sa, & 8 7 8 9 W n " u u1_________________ Z 0 B Y

2_________________ L X N C H P E D S G

3_________________ Q F R T J UWM I

4_________________ A V K

By Interpolation, these partial sequences may be united into the key-word sequence

HYDRAUL I CBE FG JKMNOPQS TVWXZ

b The mitaal key words a nd t he plain texts may now be ascer tamed quite easily by

deciphenng the messages,using tlus pnmary componentslid agamst rtself It will befound thatthe mraal key wordfor the 1st message IS PENCE, that for the 2d 18 LATERAL The reason that

the cryptograpluc texts are isomorphic beyond the mrtial key word portionsIS,of course, that

since thetex t beyond thekeyword ISenciphered auto-keyfashion by the preceding CIpher letter

the letters before thelast letter of thekey have no effect upon the encrphennent at all Hence

twomessages ofIdentical textcannotbe otherthan isomorphic afterthemrtial key-word portions

c The foregomg solunon affords a clue to the solut ion of cases m which the texts of two

or moremessages are not completely Identical but a re m part Identical because they happen to

have sunilar begmmngs or endings, or contam nearly similar mformation or mstructions The

progressm such cases 18 not so rapid as m the case ofmessagesWIthwhollyidenncal texts becausemuch care must be exercised in blocking out t he isomorphic sequences upon which the recon

structIonof thepnmary components will be basedd (1) In the foregoing cases, the pnmary components used to encipher the illustrative

messages were identrcsl mixed sequences If nomdenncal components are employed, the

cryptograms present an mterestmg case for the apphcat ion of a principle pomted out m a

preceding text t(2) Suppose that the three messages of paragraph 27b had been enciphered by usi ng a

plam component different from the mixed component The enoipherments of the word

ARTILLERY would still YIeldisomorphic sequences, from which, as has been noted, the recon

strucnon of the Cipher component can be accomplished(3) Having reconstructed the Cipher component (or an equivalent) t he l at te r m ay be

applied to the Cipher text and a "deCipherment"obtained In this process any sequence of 26letters may be used as the plain component and even the normal sequence A Z may beemployed for tms purpose The word decipherment in the next to thelast sentence 18 enclosed

by quotanon marks because the letters thus obtained would not YIeldplain text, smce the realor an equivalent plain component has no t yet been found Such "deci pher ed" t ex t may be

termed sPUrtOUS plain text But the '/,mportant th'/,ng tonotess that th'/,s text '/,8 nowmonoalphabet'/,cand may be80lved by the Stmple procedure usually employed '/,n solmng a monoalphabetw ctpherproduced by a mngle m'LXed alphabet Thus, a polyalphabeno Ciphermay be converted to monoalphabene terms and the problem much simphfied In other words, here 18 another example

of the srtuationsm wluch the principle of conversionmto monoalphabenc termsmay be applied

WIth g r a t 1 f ~ success It 18 also an example of the dictum that the use of two drl ferent ly

mixed pnmary components does not reallygivemuch more secuntythan does a mixed componentshdmg agamst Itself or &gamst the normal sequence

, MiluM1/ Cr1/ptaool1/A',Part II, par 4fifl



44

e (1) If the auto-keymethod shownIn paragraph 23c (2) had beenemployed In enciphenngthe two Identical texts above, the solution would, of course, have been a bit more difficult Toillustrate such a case, let the two texts be enc iphered by key words of the same lengths butdifferent composmons PENCE and LATER Thus

No 1

Key ________ PEN C E T S B J S MMNRU L P U I H J B T X F INN R MPlam_______ R E QUE S TIN F o R MAT IO N 0 F SIT U A T IO N I

Cipher_____ T S B J S MMNRU L P U I H J B T X F IN N R M D W I Q VKey ________ D W I Q V P C K A 0 D PAZ 0 B C M R I A F N W 0 G L I H TPlain_______ N F I F T EENTH I N FAN TRY S E C TOR A TO N C ECipher_____ P C K A 0 D PAZ 0 B C M R I A F N W 0 G L I H T I WWC U

No 2

Key________ L ATE R BKKMJ R BTU X S G E B Q YRHHA T E T U CPlam_______ REQUE S TIN F o R MAT IO N 0 F SIT U A T IO N ICipher_____ B K K M J R BTU X S G E B Q YRHHA T E T U C N 0 G T MKey ________ N 0 G T M L D Q L E N G BYE W D S U H PUT Z E HHGDKPlain_______ N F I F T EENTH I N FAN TRYSE C TOR A TO N C ECIpher_____ L D Q L E N G BYE WD S U H PUT Z E HHGDK T 0 D E X

(2) Now let the two cryptograms be superimposed and Isomorphisms besought Tbeyare

shown underhned below1_____________

T S B J S MMNRU L P U I H J B T X F IN N R M D WI Q V2_____________

BKKMJ R B TUX S g E B Q YRHHA T E T U C NQgTM1_____________

P C K A 0 D PAZ 0 B C M R I A F N W 0 G L I H T I WW C U2_____________ L ~ Q L J 1 : i N g B Y ~ W ~ S Y H P U I Z ~ HHgDK TQDEX

It will be noted that the mtervals betweenIsomorphic supenmposed pairsshow a constantfactor of 5,indicating a 5-letter mtial key word

(3) A reeonstrucnon diagram for the pairs beyondthe first fiveletters IS estabhshed, basedupon thisinterval of5, and IS as follows

ABC D E F G H I J K L M N 0 P Q R S TU V WX Y Z

P W N H T Y D S R L I 0 F G- - - - - - - - - I- - - - - - - - - - I- - - - - - l-X R D U H B E G W 0 P- - - - - - - - - - - - - - - - - - - - - - - - - I-B K I N 0 G Q S T W X C H E D R- - - - - - - - - - - - - - - - - - - - - - - - - J-

L F E A D B N C P S T U W Z H Y- - - - - - - - - - - - - - - - - - - - - - - - - I-W D T A U Q H I C B E F G K X M N 0

The equivalent sequence AW N B D T K I H Q G U X 0 E R V M C Y S J L Z P F IS

estabhshed by indirec t symmetry, from this, by dec imanon on the eleventh Interval, theHYDRAULIC XZ component IS recovered

(4) I t will benoted that the foregoingcase, 10 which the mrnalkey words for the two cryptograms are of the same length, IS only a special apphcataon of the method set forth m paragraph44ofMihtary Cryptanalysis, Part II Bu t If the keywordswere ofdifferentlengths, the methodset forth in pard-graph 45 of the text referred to would be applicable No example IS deemednecessary, since no new pnnciplesare involved

SECTION VIII

SOLUTION OF PLAIN-TEXT AUTO-KEY SYSTEMSPlII'8gI'8ph

Prehmmary remarks on plain-textauto-keymg.i, _ ---______ 30

Solution of plain-textauto-keyed cryptogramswhen the mtroductory key IS a single letter, _ _ 31Exampleof solution by the probable-word method __ _ -_ 32Concluding remarks on the solunon of auto-key systems --- --______ 33

30 Prehmmaryrema.rks onplam-textauto-keymg- a If thecipher alphabetsare unknown

sequences, plam-text auto-keymg gives me to cryptograms of more mtnoate character thandoes CIpher-text auto-keying, as has already been stated As a cryptographic pnnciple It ISvery commonly encountered as a new and remarkable "invention" of tyrosm the cryptographicart I t appa.rently gives me to the type of reasonmg to which attention has been directedonce before and which was thenshown to be a popular delusion of the ummnated The noviceto whom the auto-keyprinciple comesas a bnlhant flashof theimagmanonsees only the apparentimpossibihty of penetrating a secret which enfolds another secret II1sreasonmg runs about88 follows "I n order to read the cryptogram, the would-be solver must, of course, first knowthe key, bu t the keydoes not become known to the would-be solveruntil hehas read the cryptogram and has thus found the pla in text SInce tlns IS reasonmgaround a Circle, the system IS

mdecipherable " How unwarranted such reasonmg really IS m tlns case, and how readi ly the

problem IS solved, will be demonstrated m the next fewparagraphsb A eonsideranon of the mechamcs of the plain-text auto-key method discloses that a

repetition of n letters m the plain text will produce a repetition of (n-k) letters in the Cipher

text, where n represents the length of the repetition and k the length of the mtroductory keyTherefore, when the mtroductory key CODSlSts ofa smgle letter there will beas many repetitionsin the Cipher text as there are in the plain text, except for true digrsplno repennons, which ofcourse disappear Bu t on the other hand some "accidental" digraphic repetitions are to befaIrly expected, since It can happen that two dIfferent plam-text pairs, enciphered by differentkey letters, will produce Identical Ciphereqtuvalents Such accidental repetmons will happenless frequently, of course, m the case of longer polygraphs, so that when repennons of4 or moreletters are found in the Ciphertext they may be taken to be true or causa l repetat ions I t IS

obVIOUS that m studying repetitions in a cryptogram of thia type, when the mtroductory keyIS a singleletter, a 5-letterrepetition m the Ciphertext, for example, represents a 6-letter word,or sequence repeated m the p lam t ex t When the mtroductory key IS k letters in length then

an n-letter repetitionrepresents an (n+k)-letter repetition in the plamtextc The diSCUSSIon will, as usual , be divided into two pnneipa l cases (1) when the Cipher

alphabets are known and (2) whenthey are unknown Under eachcase there may bean mtroductory key consistmg of a smgle let ter , a word, or a short phrase The SIngle-letter imtaal

key will be treatedfirst31. SolutIon of plam-text auto-keyed oryptograms when the mtroductory key ISa smgle

letter - a Note the followingplam-text auto-keyedenoiphermentof suchcommonlyencountered

plam-text words as COMMANDING. BATTALION. and DIVISION. usmg two identical pnmary

components,m thiscasedirectstandardalphabets

1311922-39---6 (45)



47

b (1) There aremany repetitions, their mtervals show no common factor, and a umhteral

frequency distnbunon does not appear to be monoalphabetic Plam-text auto-keying IS SUB-

pected The Simplest assumption to make at the start IS that smgle-Ietter mtrodurtory keys

are bemgused, With the normal V I g e n ~ r e method ofencipherment, and that the plam component

IS the normal sequence Attempts to solve any of the messages on the assumption that theCipher component 18 also the normal sequence bemg unsuccessful, It 18 next assumed that the

Cipher component IS a mixed sequence The 13 -lette r r ep eti tio n J D R U WN G R Y S

K B L a n d the IO-Ietter re pe ti ti on P D G 0 V V V K WU are studied intensively If a

VVVKWN N E Z V

Q V U X NR B H A K

F N R A K

R F K B V

J WV P KC D Z C Y

X K C Q F

B H M V JF F Y U E

K C I F GF V H A V

Y C P Z H

S U B R J

R F J P DK C M P D

E Q 0 Y

I B F E JQ H H F 0R H W U N

N P P K P

V P D G 0

U A K V DY S K B L

L L P R V

G P S V S

X T W F M

B L

K Q M V B

D N C U J

o E Q Z V

A P O E P

E Q Z B UC F N R A

A P U F Z

VRQIJ

I V Z 0 ZR Z V Q R

U W N G R

P P K G SX A P Q Y

D K C W V

G R Y S K

I V Z 0 ZW F M R F

N D B D DD R H W U

A L U P Z

R H V G P

Y Q C Y HP E A M P

D S W J AR P Z V X

G J WZ HT B S K C

MESSAGE II

MESSAGE II I

o C Q J JR Z V X T

K W U H EE N D B D

o C Q J JU Q H U M

A Y J D RS V K Z P

Y U E Z QU V C C P

D R U W N

F K D E N

RHWUM

F Z P Q PV C C E J

W K C V GQ Y G P A

P D K C 0

K M Y H S

T H O F H

J U F I IS P K T S

G 0 V V VG 0 V Z S

H U F I IU E W H U

G J P G H

PH D P R

WUAVW

C I F G ZR 0 Q 0 J

F J U H F

E U B D D

R H U J U

T V H N S

U N M H H

Z Q X A P

Z U V C CX M H F F

U H C B M

d If reversed standard Cipher alphabets are used, the word BATTALIONWIll be enciphered by the sequence______________________________ BHATPDUB,

whichalso presentsidiomorphic charaetenstaceleading to the easyrecogmtion of the word

e All the foregomg phenomena are based upon standard alphabets, but when mixed Cipher

components are used and these have been reconstructed, snmlar observations may be recorded

and the results employed m the solution of addrnonal messages enciphered by the same com

ponents32 Examp le of s ol ut io n by the probable-word method.--a The solutaon of messages

enciphered by unknown mixed components will now be discussed by example When the pn mary components are unknown, the observanons notedunder the preceding subparagraphs are,

ofcourse, not appheable,neverthelesssolutionISnot dif ficult Given the following three erypto

grams, all mtercepted on the same day, and therefore suspected of bemgrelated

MESSAGE I

46

jKey text___________ B A T T A L I O N Key text___________ D I V I S I 0 Nj

(1) Plamtext B A T T A L IO N Plaintext D I V I S IO N (2)

Clpher______________ B T M T L T W B Clpher______________ L D D A A WB

jKey text ___________ COM MAN D I N G Key text___________ C A P T A I N

(3) Plain text__________ COM MAN D I N G Plam text__________ C A P T A I NClpher • Q A Y MN Q L V T CIpher______________ C PIT I V

These charactenetacsmay be noted 1

(1) The c iphe r equ ival en t o f Ap IS the plain-text letter which immediately precedes Ap(See the two A's in BATTALION, m example 1 above)

(2) A plain-textsequenceof the generalformulaABA yieldsa doubletas the cipherequrvalentof the final two letters (See IV I or lS I in DIVISION, example 2 above)

(3) Every plain-text tngraph havmg Ap as Its central letter Yieldsa cipher eqwvalent the

last two letters of which are idenncal With the mmal and final letters of the plam-text tngraph(See MAN in COMMANDING, example 3 above)

(4) Every plam-text tetragraph havmg Ap as the nntaal and the final letter Yieldsa Cipher

equivalent the second and fourth letters ofwhich are identical With the second and thirdletters

of the plam-text tetragraph, respect Ively (See APTA in CAPTAIN, example 4 above, also ATTAin BATTALION, example 1 )

b (1) From the foregomg charaetensnca and the fact that a repeti t ion of a sequence of n

plam-text letters will Yield,m the caseof a I-letter mtroductory key , a repetmon of a sequence

of n-l Cipher letters, It 18 obVIOUS that the SImplest method of solvmg thIs type of CIpher ISthat of the probabl eword Indeed, I f the system were used for regular traffic It would not be

long before the solution would COIlSlSt merely in refernng to hats of CIpher eqwvalents of com

monly used words (as found from previous messages) and searchmg through the messages forthese Cipher eqwvalents

(2) Note how easily the followmg message can be solvedBECJI B T M T L T W B P Q A Y M N Q H V N E T W A A L C

I "'- ' ' '- '"' ISeemg the sequence BTMTLTWB, which 18 on the hat of equrvalents in a above (see example 1),tho wordBATTALION IS inserted in proper position Thus

BECJI B T M T L T W B P Q

B A T T A L I O N

With t ln s a s a star t, the deciphermentmay proceedforward or backward With ease Thus

B E C J I B T M T L TWBPQ AYMNQ H V N E T W A A L C

E A C H B A T T A L I O N C O MMAND E R W IL L P L A C

e The foregomg example 18 based upon the so-called VIgen&e method of eneipherment

(9J.:12=9 1 h 9p/l=9012 If m encipherment the plain-text letter 18 sought in the Cipher component,Its eqwvalenttaken m the plsm component (9J.:12=9

1h 9p/2=ge/l), the steps in solutionare identical, except that t he l is t of Cipher equivalents of probable words must be modifiedaccordmgly For instance, BATTALION WIll now be encipheredby the sequence ZTAHLXGZ

1 The student IS cautioned that the charactenstIcs noted apply only to the case where two rdentieal components are used, WIththe base letter A



48

smgle-Iettermtroduotory key 18 bemg used, then these repetitions mvolve 14-letter and ll-letter

plsm-text sequences or words, If the normal VIgenm-e method of encipherment 18 m eff ec t

(911:12=9'ih 9 p l 1=9 012) , then the base letter 18 A If the latter 18 t rue then a good word wluchwould fit the 13-letter repention 18

Key R E CO N N A ISS A NeE

PI81n text R E CO N N A I A NeE •

CIpher_______________ J D R U \Vl.! G R ~ K B L

and a good word which would fit the IO-Ietter repetrtion 18

Key 0 B S E R V A TIO N

Plmn text...__________ 0 B S E Rl!.A T IO N •CIpher_________________ P D G 0 -V l! V K W U •

(2) I nser tmg, m a mixed component, the values given by these two essumpnons Yields

thefollowmg

Plmn ABC D E F G H I J K L II N 0 P Q R STU V WX y Z

CIpher {: S TIN G B C K LO p V W Y

(3) It 18 a SImple matter to combme these two part Ial cipher components mto a single

sequence, and the two components are as follows

Plmn___________ ABC D E F G H I J K L II N 0 P Q R STU V WX y ZCIpher REA D JU S TIN G B C F H K L II 0 P Q V W X y Z

(4) With the pnmary components at hand,solunon of the messages 18 now an easy matter

c The foregomg example uses an unknown mixed CIpher component shdmg &g&lDSt what

was f irst assumed (and later proved) to be the normaldrrectsequence Whenbothpnmarycom

ponents are unknown mixed sequences bu t are idenneal, solutaon 18 more drlficult, naturally,

because the resultsof assummg valuesfor repeated sequencescannot be proved.and

estabhshedso quickly as m the foregomg example Nevertheless, the general method indicated, and the

appheataon of the principles of indirect symmetry will leadto solution, If there 18 a faar amount

of text evaileble for study When an mtroductory key of several letters 18 used, repetitions

are muchreduced andthe problembecomes snll more difficult butby no meansinsurmountable

Space forbids a detailed treatment of the method of solvmg these oases bu t It 18 beheved that

thestudent 18 m a posi tion to develop these methods and to expenmentWith them at his leisure33. Concludmg remarks on the solution of auto-key systems - a The type of solution

elucidated m the preceding paragraph 18 based uponthe successful epphcanon of the probable

word method Bu t sometnnes the latter method faJ1s because the commonly expected wordsmay no t be p re se nt a ft er all H en ce , other pnneiples and methods may be useful Some ofthese methods, useful in special cases, are almost mechemeal m theIr nature ExtenSIOnof the

baSIC pnnciplesmvolved may leadto rather far-reachmg eomplentIes However, because these

methods are applicable only to somewhat special sr tuanons, and because they are somewhat

mvolved they will be omit ted from the text proper and p laced m Appendi x I The student

who 18 especially mterested m these cases may consult that appendix at his leisure

b. It 18 thought that suffiCIent attention hes been devoted to the solution of both Cipher-textand plain-text auto-key systems to have demonstrated to the student that these cryptographic

methods have senousweaknesses which exclude them from practaeal usagem militarycryptography Besides being comparatIvelyslow and subject to error, they are rather easJ1y solvable,

evenwhen unknown CIpheralphabets are employed

c In both systems there are charaetenst ics which permi t of Ident Ifymg a cryptogram as

belonging to t lus class of substrtutaon Both cases wJ11 show repetrtions in the Cipher text In

Cipher-text a u t o - k e ~ therewillbe farfewerrepetitIOns than m the ongmal plam text, especiallywhen mtroductorykeysof more than t-letter m length are employed In plam-textauto-keymg

there wil l be near ly as many repetitions 10 the Cipher text as m the ongma l p la in text unless

long mtroductory keys are used In either system the repeutions Will show no constancy asregards mterval& ~ them, 8II1d a umhteral frequency distnbutaonwill showsuch messages

to be polyalphabetlc in nature Cipher-text auto-keymg may be distmguished from plum-text

auto-keymg by the appearance of the frequency distnbunon of the second member of sets oftwo lettersseparated by thelength of the mtroductorykey (seepar 25h) In the case ofciphertext auto-keymg these frequency distnbutions will be monoalphabetie m nature, m plain-text

auto-keYIDg such frequency dlstnbutlons wJ11 not show monoalphebenc charactenstaoa



SEOTJON IX

METHODS OF LENGTHENING OR EXTENDING THE KEY

51

transposnaon method of lengthemng the keymg sequence and at the same tune mtroduomg an

irregulanty, such as aperiodic mterruptlon has already been descnbed (see par 18)

c Anothermethod ofdevelopmga longkey from 8 shortmnemonicone ISthat shown below.Given the keyword CHRISTMAS, a numerical sequence IS first denvedand then one wntes down

successrve sections of tIns numencal key, these sections termmatmg With the successive num-

bers 1, 2, 3, of t he n umen ca l k ey Thu s

Mnemonic key __. __ ._ C H R 1ST MASNumencalkey 2-3-6-4-7-9-5-1-8

Extendedkey C H R I S T Mil IC IC H R IC H R 1ST : IC H IC H R I H R 1ST MA H R I s il

Thus the originalkey ofonly 9lettels IS expandedto one of45letters (1+2+3+ +9=45)

The lODger key 18 also an mterrupted key of the type noted under paragraph 17, bu t If the mes

sage 18 long enoughto requireseveral repeunons of the expanded key the encipherment becomes

penodic and can.be handled by the usual methods employed In solving repeatmg-key CiphersIf the basickey IS f8.U'ly long, so that the expanded key becomes a quite lengthy sequence, thenthe message or messages may be handled in the manner cxplamed In paragraph 20

d Another method ofproducinga rather long sequenceof digrte for keymgpurposesfrom a

smgle keynumber 18 to select a number whose reciprocalwhen converted by actual drvisionInto

Its eqUlvalent decimal Yields a long series of digits For example the reciprocal of 49, or 1/49,YI el ds a se qu en ce of 42 digit e b egmnmg 02040815 Such a n umbe r, co up le dW ith akey word hke CHRISTMAS, could be used for interrupted kevmg, the successive CIpheralphab ets

bemgused for eneaphenng as many letters asare indicated by the successive digits In the case

of the example Cited, the first dIgit IS 0, hence the C alphabet would not be used The nextdJglt 18 2, the H alphabet would be used for enciphenng the first and second letters The thIrd

dlglt 18 &gam0, the R alphabet would not be used The fourth digrt IS the I alphabet wouldbe usedfor eneiphenng the third, fourth, fifth, and sJ.Xth letters, and soon

36. Other systems employmg lengthy keymg sequences -a The 8o-caUed "run1l/ ng Jcey"81/stem -T o be mentIoned in connection With tins subject of extensive or lengthy keys IS the

CIphersystemknown as the runmng-key, contmuous-key, or nonrepeatmg-keysystem, In wluch

the key consists of a sequenceof elements whichnever repeatsno matter howlong the messageto be encipheredhappens to be The most common and most practicalsource of such a key 18

that In whieh the plain text of a previously agreed-upon book serves as the source for suecessive

keyletters for encrpherment I The solutionof this type of CIpher,an accomphshmentwhichwas

once thought impossible,presentssome mterestmgphasesand will be consideredshortly At thlS

pomt It IS merely desired to indicate that according to the runmng-key system the key for an

mdmdual message mo.ybe as long as the message and never repeat, but If a l arge g roup of

correspondents employ the samekey sequence, It may happen that therewill be several messagesIn the same key andthey will all begin With the samemitral key letter or, there willbe severalwhich will "overlap" one anotherwith respect to the key, that ie, they begin at drlferent untralpointsm the keying sequence but onemessage soon overtakes the other, so that from that pomt

forward all subsequent letters In both messages are enciphered by the same sequence of key

letters

I Sec IX, AdllancedMddary Cryptography Beealso footnote8, page71 oftlustext.

PrebDlInary r em ar ks • •__•__• • ._.__• • •__._•• _

Extended and nonrepeatmgkeys, the so-es ll ed " runmng -key sy stem"_ _ - - ••- -- -- -- -- -- -- -Other systems emp10ymglengthykeyingsequences_. • •••• • :::::::::::::::::::::::::::::.::::::::::

Parag!aph

343536

34 Prehmmary remarks -I n paragraph Ih o f thIS text I t was stated that two proceduressuggest themselves for ehmmatmg the weaknesses Introduced by penodlClty of t he t ype p ro

duced by simple, repeatmg-key methods The first of these, when studied, embraced some ofthevery SImplemethodsof suppressing or destroYIng penodierty, by suchdevices asmterruptmg

t he k ey and usmg vanable-Iengthgroupings of plain text It was demonstrated that subter

fuges of thIs SImplenature are Inadequate to ehmmate the weaknesses referred to, and must bedrscarded in any system Intended to afford real s ec un ty T he other alternatIve suggested In

paragraph lb therefore remains now to be mvesngated, VIZ, that of lengthenmg the keys t o a

pomt where there would seem to be an InsuffiCIent amount of text to enable the cryptanalyst to

solve the traffic Attempts toward thisend usuallyconsist m extendIng the key tosucha lengththat the enemy cryptanalysts will have only a very hmited number of penods to work WIth

The key may,mdeed, be lengthened to a pomt whereIt becomes as long as, or longer than, thetext to beenCiphered, so that the key ISused onlyonce

35 Extendedand nonrepeatmg keys -a I t IS ObVIOUS that one of the SImplestmethods oflengthemng the key to a message IS to use a long phrase or even a complete sentence, providedIt IS not too long to remember In addrtion to the d1fficultIes that would be encountered In

practical military cryptographym selectIng long mnemonic phrases and sentences wluchwould

have to beImparted to many clerks, there IS the fact that the probable-word method of solutions tIl l remams as a powerful too l m the hands of e nemy c ryptan alys ts And If only a word o r

two of t hekey can bereconstructed as a result of a fortunate assumpnon, It IS obVIOUS that the

enemy cryptanalysts couldreadIly guess the entira key from a fragment thereof, SInceany longphrase or sentence which IS selected because It can easl1ybe remembered IS l Ikely to be wellknown to many people

b There are, however, more or lesssimple methodsof employmg a short mnemomc key Inorder to produce a much longer key BasIcally, any methodof transposrtionapplied to a smglealphabetiCsequencerepeatedseveraltImeswill YIelda faIrly long key, which, moreover, has theadvantage of bemg umntelligIble and thus approachIng a random selection of letters For

example, a numerical keymay bedroned f roma wordo ra shortphrase, this numencalkey may

then be apphed as a columnar-transpOSltIOnkey for a rectangle withmwluch the normal alphabet

has been repeateda preVIously agreedupon number of tImes m a. normal (left to nght) or pre

arranged mann er T he letters when transcnbed from the transposrtronrectangle then becomethe succesSIve letters for enciphermg t he plam text, USIng any desired type of pnmary com

ponents Or, If a smgle transpoSItIon IS not thought to be suffiCIently secure, a. double trans

positron willYIelda still moremixed up sequenceof key letters Other types of transposmon

may be employed for the purpose, meludmg vanous kinds of geometnc f igu re s A ls o, a non-(50)



52

b The 80-Ca&d progr688'tve-alphabet ByBletn - In the so-called progressrve-elphabet systemthe baSIC pnnciple IS quite su np le Two or mor e primary elements are arranged or provided

for according to a key which may be vaned from tune to tune, themteractIon of the pnmary

elements results in makIng avaalable for cryptographIc purposes a set of cipher alphabets, a llthe latter are employed in a fixed sequence or progression, hence the designataon progresares,alphabet system If the number of alphabets avaIlable for such use IS rather small, and If thetext to be enciphered IS much longer than the sequence of alphabets, then the system reduces

to a p en od ic method Bu t If the number of alphabets ISlarge, so that the sequence ISnotrepeated, then of course, the cryptographic text will exlnbitno penodic phenomena

c The senes of CIpheralphabets in such a systemconst Itutes a keymgsequence Once setup, often the onlyremammg elementm the key for a speeificmessage ISthe startmgpomtm the

sequence, that IS, the mmal CIpher alphabet employed m enciphering a given message If this

keymg sequence must be employed by a large group of correspondents, and If all messages

employ the same startmgpointm the keymg sequence, obviously the cryptogramsmay SImply

be supenmposed WIthout any prehmmary testIngto aseertamproper pomts for supenmposraon

The student has alreadybeen shown howcasesof tlns sortmay besolved However, I fmessagesare enciphered WIth varymg startmg points, the matter of supenmposmg them properly takeson a dIf te rent a spec t Thi s WIll soon be treated m detai l

d The respectIve CIpher alphabets eonstrtutmg the entIre complement of alphabets may

be employed in a SImpleprogression, that IS,consecutIvely from a preselectedmmal pomt ort hey may be employed aceordmg to other types of progression For example, If the systen:comprises100alphabetsonemight use them in the sequence 1 3 5 7 or 1 4 7 10or Irregular types of skippingmay be employed ' , , , " '" ,

e In addmon to the foregoing, there are, of course, a great many mechamcel methods ofproducing a long key, such as those employed m mechanical or electncal CIphermaclunes In

most cases these methods depend upon themterecnon of two or more short, pnmary keys which

Jomt ly produce a smgle, much longer, secondary or resultant key (See par 4) Only bnef

reference can be made at tlns pomt m the cryptanalytIcstudies to casesof this k in d Ade ta il edtreatment of complex examples would require much tune and space so that It will be reservedfor subsequent texts

J FInally, there must be mentIoned certa in devices m WhICh, as in encipherment by the

auto-key method, the text Itself serves to produce the vanataon in CIpherequivale nts, by con

trolling the seleenon ofsecondary alphabets, or by influencing or detemumngthe sequence WIth

which they will beemployed Nat ur al ly , in such cases thekey IS automancally extended to apomt where It comcides m length WIth that of the text .An excellentexample of sucha device

IS that known as the Wheatstone, the solution of which WIll be descnbed m I ts p rope r p lace 'Some wnters clasSIfy and treat thISmethod as wellas auto-keymethodsas forms of the runningkey system bu t the present author prefers to consider the lat ter as bemg radically dIfferent inpnnciplefrom the formertypes, because in thetrue runnmg-keysystem the key IS wholly external

to and mdependent of text bemg enc iphe red ThI s IShardly true of aut o- key sys tems or o fsystems such as the Wheatstone mentIoned herem

I SeeSeo XII, Ad"ancea MUNaTf/ Cr,lptogra,h1l

SECTION X

GENERAL PRINCIPLES UNDERLYING SOLUTION OF SYSTEMS EMPLOYING LONG

OR CONTINUOUS KEYSParagraph

Solution when the prImary components are known sequences •• 37

Solution of a runnmg-key cipherwhen an unknown but mtelhgiblekey sequenceIS used andthe primarycomponents are know n______________________________________________ _________________ 38

Solution ofa progreesrve-alphabet cipher when the primary components are known_______ 39

General solutionfor CIphersmvolvmga longkeymg sequenoe offixed length and composraon, 40

37 SolutIonwhen thepnmary componentsare known sequences -- a Asusual, the solution

of cases mvolvmg long or continuous keys will be treated under two headings FIrs t, when the

pnmary components are known sequences, second, when these elements are wholly unknown

or partially unknownb Smce the essential purpose in USIng long keys ISto prevent the formatIon of repennve

cycles within the t ex t, I t I SObVIOUS that m the case of very long keymgsequences the crypt

analyst IS not gomg to be able to t ak e t he t ex t and break I t up mto a number of small cycles

which WIll penmt the estabhshment of monoalphabetrc frequency distnbunons that can readily

be solved, an end which he can attain all the more readily If to begm WIthhe knows the pnmary

sequences But, therenearlyalways remains the cryptanalyst's last resort the probable-word

met ho d I na smuc h as t hi s method ISapplicable to most of these cases , even to that of the

runnmg-key system, which perhaps represents the furthest extension of the pnneiple of long

keymg sequences, an example USIng a cryptogramof the latter type will be studied

38 Solu tI on of a r unmng-key mpher when an unknown but mtelligIble key sequenceIS u sed and the pnmary components are known -a In paragraph 36a mention was made ofthe so-called runmng-key, contInuous-key, or nonrepeatIng-key system, m wluch the p lam text

ofa previously agreed-upon book serves as the source for successrvekey lettersfor eneipherment

Smoe the runnmg-key system IS entirely apenodic, and the CIpher t ext can therefore not be

arranged In supenmposed short cycles, as in the case of the repeatIng-key system, It wouldappear on f irst consideration to be "mdecipherable" WIthout t he k ey 1 Bu t If the student

WIll bear In mind that one of the pracncal methods of solvmga repeatIng-key CIpher18 that ofthe probable word,2 he n ll immediately see that the latter method can a lso be app li ed m

solving t lns type of nonrepeatmg-key system The essence of the matter IS thIs The

cryptanalyst may assume the presence of a probable word in t he t ext of the message, I f he

knows the pnmary componentsmvolved, and If the assumed word actually eXISts m the message,

he ean l ocat e It by checking agamst the key, 8 ' t n c ~ the latter u tnlelltgtble text Or, he may

assume the pre senceo f a p robabl e word or even of a phr as e such as "to t he , " "of t he , " etc,

m t he k ey t ext and check hIs assumptIon agaInst the tex t of the message Once h e has forced

I At one tIme,mdeed, thIs VIewwas current among certam cryptographers, who thought that the pnncIple

of factonng the mtervals between repetItIons m the ease of the repeatmg-key CIpher formed the baslB for the

only pOSSIble method of solvmg t he l a t t er t ype of system Smea, aooordmg to thIs erroneous Idea, factonng

cannot beapplIed In the case of the runmng-key system (USlDg a booka s the key), thereforesolutIonwas conSIdered to be ImpOSSIble How far tws Idea ISfrom thetruth WIll presently be seen In tlus same connectIon

see also footnote8, page 71I See MdstaTfl CryptanalytnB, Part II, par 25

(S3)



54

such an en tenng wedge into either the message o r t he key, h emay build upon this foundation

by extending Ius asaumpnons for text alternately in t h ek ey and m the message, thus gradu

ally reconstructmg both For example, grven a cryptogram contammg the sequenceHVGGLOWBESLTR , supposehe assumes the presence of the phraseTHAT THE in thekey text

and finds a place In the plam text where this YIeldsMMUNITI Thus, usmg reversed standard

cipher alphabets

Assumed key texL_ __ _ T HA T THE

Cipher text_______________ H V G G LOW B E S L T R

Resultant plain text_________________ M M U N IT I

This suggests the word AMMUNITION The ON in the cipher text then YIelds PR as the beginnmg of the word after THE m t he k e y t ex t T hu s

Assumed key text_________________ __ T HAT THE P RCipher teCL__________________________ H V G G LOW B E S L T RResultant plain text_________________ M M U N IT ION

PRmust be followed by a vowel, with 0 the most hkely canchdate He finds that 0 YIelds VI

m the plain text, which suggests the word WILL The latter then YIelds OTEC in the key,makmg the latter read THAT THE PROTEC Thus

Assumed key text____________________ T HAT T HE P RO T E CCipher text____________________________ H V G G LOW B E S L T RResultant plam text_________________ M M U N IT IO N W IL L

Thia suggests the words PROTECTION, PROTECTIVE, PROTECTING, etc Thus extendmg one

text a f ew letters servesto "coerce"a few more letters out of the other, somewhat as in the case

of two boys who are runningapproxunately abreast in a race, 88 BOon as one boy gets a bit ahead

the spirit of competrnon causes the other to overtakeand pass the first one,then the latter puts

forth a little more effort, overtakes and passes the second boy Thus the boys alternate movertaking and passmg each other unt i l the race IS run The only pomt m wluch the smnle

faJ.1s 18 that while the boys usually run forward all the time, that lS, m a smgle direct ion, the

cryptanalyst lS f ree to work m two chrectIons-forward and backward from an mternal point

in the message He may, m the case of the example Cited above, continue hIS building-up

process by adding Ato the front of MMUNITI as wel l as ON to therear If he reaches theend of

Ius resources on one end, t he re r emams the o th er end for espenmentanon He lS certam1y

unlucky If both ends temunate m complete words both for the message and for the key, leavmg

rom Withouta singleclue to the next word in either, an d forcmg him to a more mtensi ve useof Ius imagination,guided only by the context

b In the foregoing illustranon the cryptanalyst lS assumed to have only one message

available for hIS expenmentanon Bu t 1fh eh a s two or more messages wluch either begin at

idenncalmmal points with reference to the key, or overlap one anotherWlth respect to the key,

the reconstrucnon process descnbed above lS, of course, much eaaier and ISaecomphahedmuch

more quickly For if themessage8 have been correctly s'lJ/pmmposed vnth reference tothekey tezl,the add'l1wn of oneor two letters tothekey yulds 8 ' U { J g e s t ~ o n s for the aBB'Umptwn of words 8everalmessages The latter lead to the addition of several letters to the key, and so on, m an everwidemng circle of Ideas for further assumpnona, since as the process eontmues the context

affords more and more of a basia for the work

55

c Of course, 1fsufficient of the key text lS reconstructed, the cryptanalyst might IdentIfy

the book that 18 beIng used for the key, and 1favailable, hISsubsequent labors are very much

snnphfied

d All the foregomg IS, however, dependent not only upon the use of an mtelhgible text 8.S

the keymg text bu t also upon having a knowledgeof the pnmary components or Cipher alpha

bets employed in the enoipherment Even 1f the pnmary components are chfferently mixed

sequences, 80 long as t hey a re known sequences, the procedure lS quite obvious m view of

the foregomg explanation The t rammg the s tu dent h as already had lS beheved sufficient, to

indicate to him the procedurehe ma y follow m that solutaon, and no further details will here be

given il l respect to suchcases Bu t what 1f the pnmary components are not known sequences?ThIS contmgencywill be treated presently

39. Solution of a progressive-alphabet Cipherwhen the Cipheralphabets are known-a

TakIng a very su rpie case, suppose the mteractmg elements referred to m paragraph 36b consist

merely of two pnmary cipher components which slide agamst each other to produce a set of26

secondary Cipher alphabets, and suppose that the simplest type of progression lS used, mz, theCipher alphabets are employed one a ft er t he o th er consecutIvely Begmnmg a t a n imn al

juxtapositaon, producingsay, alphabet 1, the subsequent secondaryalphabets are m the sequence

2, 3, 26, 1, 2, 3, , and so on If a different nutaaljuxtaposrtaonISused, say alphabet 10lS the firstone, the sequence lS exactly the same as before, only begmmng at a chfferent point

b Suppose the two pnmary components are based upon the keyword HYDRAULIC Amessage 18 to be enciphered, begmnmg With alphabet 1 Thus

Plam component .H Y D R A U L I C B E F G J K M N 0 P QS T V WX Z H Y D

Cipher component H Y D R A U L I C B E F G J K M N 0 P Q S T V WX Z

Letter No 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

Alphabet No 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

Plam text___________________ ENE M Y HAS P LAC E D H E A V YINCipher text_________________ E 0 G P U U E Y H M K Q V M K Z S J Q H E

Letter No 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39

Alphabet No 22 23 24 25 26 1 2 3 4 5 6 7 8 9 10 11 12 13

Plam text___________________ T E R D I C T ION FIR E U P 0 NCipher text_________________ N L H H L C V B S S N J E P K D D 0

Letter No 40 41 42 43 44 45 46 47 48 49 50 51 52 53

Alphabet No 14 15 16 17 18 19 20 21 22 23 24 25 26 1

Plain text___________________ ZAN E S V ILL E R 0 A D

Cipher text_________________ G P UHF K H H Y L H M R D

e ThIS method reduces to a penodie system mvolvmg 26 secondary cipher alphabets and

thelat ter are used m Simpleprogression It ISobvious therefore that the 1st,27th, 53d,letters are in the 1stalphabet,the 2d, 28th, 54th, lettersare m the 2d alphabet, and soon

d To solve such a cryptogram, knowing the two primary components, IShardly a problem

at all The onlyelementlacking 18 a knowledge of the star t ing pomt But this lS not necessary , for merely by completmg the plain-component sequences and exammmg the diagonals ofthe diagram, the plain text becomes evident For example, given the followmg HID CT

E HUXI Completmg the plain-component sequencesmrnated by the successive Cipherlette rs, the



:PIGn.. lO

H IDCTEHUXLYCRBV FYLZ IDBAEWGDIHC

REUFX JRCYBAFLGZKA DE

UG I JH I I ERFL JCKYNLFAGI K BYDO I GU JCMENRPC J LKBNFOAQBK IM

EOGPUSEMCN

F P J Q LT FNBOGQKS IVGOEP

plam text, EN E MY MAC H I ISseen to come out m SUCCeBS1Ve stepsupward in Figure

10 Had the cipher component been shifted m the OPPOSlte direcnon m enerpherment, the stepswould have been downwardinsteadof upward If the shdmgstrips had been set up accordmgtothe sequence of cipher letters bu t on a diagonal, then, of course, the plam-text letters wouldhave reappeared on one generatnx

e The student will understand what simple modJ.ficatlons mprocedure would be required In case the two prImary components

were d11ferent mixed sequences Bu t what J.f the prImary components are not known sequences? How does the cryptanalyst

proceed m that case?

40. General solut ion for Ciphers mvolvmg a long-keyIngsequence of fixed length and composition -- a It 18 obvious, asstated at a previouspomt, that no matter how the keymgsequenceIS denved, if allthecorrespondentsemploythesame key, or'ifth'Ul key 'IJl

'USed many nmes by a s ~ n g l e office, and if alwaysbegltns at thesamep o ~ n t , thetarw'US messagesmay s ~ m p l y be 8'Upe1"tmposed Thus,therr

respectlve 1st, 2d, 3r d, let ter s WIll all fall Wlthm columnswhich have been enciphered by the 1st, 2d, 3rd, key l ettersIf there 18 a suffiClent number of messages, solution then becomespossibleby frequencyanalysisof the successrvecolumns-nomatter

howlong the keymg sequencemay be, and regardless of whether the keymgsequenceconstltutesmtelhgible text or IS a purely randomsequenceofletters ThISmethodofsolutionby supenmposinon has already been outlined in paragraph 20 and no further reference to It needhere bemade

b Bu t now suppose that the keymgsequence does no t always begm at the same pomt for

a ll messages Suppose the several correspondents are able to select at will any porot m the

keymgsequence as the pomt ofdeparture m encipherment Thus, sucha keymgsequence, If regarded as partaking of the nature of a CIrcle, will afford as many possible sta.rtmgpomts as there

are lettersor characters in that sequence Now J.f there areno externalmd1catlons or tndol.cator,·m the cryptogramspertammg to sucha system, such as would afford enemy cryptanalysts directand definite mformanon WIthregard to the mmal keymg element for each cryptogram, then Itwould seem as though the supenmposmon of messages (to bnng letters enciphered by the same

Cipher alphabets withm the same columns) would be difficult or unposeible, and therefore thatattempts at solution are blocked at their verybegmnmg ThIS, however, 18 not the end of thestory For suppose two of the messages have m commononly one polygraph, say of 5 letters,

these two messages may be Juxtaposed so as to bnng these repetmons mto snpenmposmonThus, the possession of this long polygraph in common serves to "tie" these two messages together or to "interlock" them Then, suppose a shorterpolygraph, say of4 letters, 18 possessed

m common by one of these two messages and a third message, this will serve to tie m the latter

WIth the f irst two Extension of t lna process, mcludmg the da ta from shorter repetltlons oftngraphs and digraphs, will serve to assemble a whole set of such messages m proper super

ImpoSltlon Therefore, the first step 18 to examme all the messages for repetitions

J Indicators playan Important rOlem pract ical cryptography An indIcator J8 a symbol ( C O D 8 I S ~ l n g of aletter, group of letters, a figure 01' a group of figures) wluoh indicates the &peOlfio key used under the generaloryptographlc system, orIt may mdreate whJ.ch oneof a Dumberofgeneral systemshas been used, or It may mdioate both

51

e Whensuchrepetltlons are found, and J.f there are plenty of them so that assumptaons forprobable words are easy to make, It 18 clear that the correct assumptaons will enable the crypt

analyst to set up plain-cipher equrvalencies which WIll make It possible to reconstruct the primary components Dependmg upon t he t yp e used, the pnnciples of direc t or indirec t symmetry of posinon will be veryuseful m tlna process

d Bu t J.f It happens that there are no polygraphs by means of which two or more messagesmay be ned together and properl y supemmposed, the snnplemethodsmentioned m subparagraphs

tJ-C cannot here be applied However, although the road towarda solutionseems to be blocked

rather effectlvely, there 18 a detour which presents rather mterestmg VIstas The latter are

really of suchImportance in cryptanalysis as to warrant detailed treatment



SECTION XI

THE "COINCIDENCE" OR ",," TESTPamamph

The baeie theoryof the eomeidence or /C (kappa) test 41

Generalprocedure to befollowedm making the /C test_________ _ 42Exampleof apphcetionof the /C test 43Subsequent steps 44

41. The baSIC theory of the eomcidenee or IC (kappa) test -a In AppendIX2 of the pre

ceding text 1 certain SImple apphcations of the theory of probabihty were presented for the

student's consideration, by way ofpomtmg out t o h im the impor tant role wInch certain phases

of that branch of mathemancs play m cryptanalys i s Reference was theremade to the subjectof c o ~ n c u l e n c e 8 and Its sigmflcance in connection With the study of repetrnons in cryptogramsIn this section themat terwill be pursued a few stepsfurther

b In the appendix referred to, It wasshown that the probabilityof monographiccoincidence(1) m random text employmg a 26-letteralphabet 18 0385, (2) in Enghsh telegraphic plain text,

0667 These two par amet er s wer e r ep re sent ed by the symbols ICr and ICp, respectively The

Important role which these valuesplay In a certam cryptanalytao test will now be explainedc One of the most Important techniques in cryptanalytlcs 18 that known as appl'g't1t{J the

c o ~ n c u l e n c e or "kappa te8t " Th18 test 18 useful for several cryptanalytic purposes and one ofthe most Important of them 18 to ascertain when two or more sequencesof letters are correctlysupenmposed By the word "correct" m t lus cas e 18 merely meant that the sequences are so

arranged relative to one another as to faoihtate or make possible a solunon The t est h as for

Its theoretical baSIS the followmg CIrcumstances(1) H any two rather lengthy sequences of characters are supenmposed, It will be found,

on exammmg both members of the successive pall'Sofletters broughtmto vertical juxtaposraon,that a c e r t a ~ n numberof case8 the twosupenmp08ed letter8 will c o ~ n c u l e

(2) H both sequences of letters constitute random text (of a 26-letter alphabet), there willbe about 38 or 39 such cases of coincidence per thousand pall'Sexamined ThIS, of course, IS

because ICr= 0385(3) H both sequencesof letters constitute plain text, there will be about 66or 67such cases

of comcidence per thousand PaIl'S examined ThIS 18 because ICp18 0667(4) H the superunposed sequences are wholly monoalphabeue encipherments of plain

text by the same CIpheralphabet, there will still be about 66 or 67 cases of comcidence in each

1,000 cases exammed, because m monoalphabetic subsntutaon there 18 a f ixed or unvaryingrelanon between plain-test letters and cipher letters so that for stansncal purposes monoalpha

betic Cipher text behavesJust the sameas 1fIt were normal plain text

(5) Even 1f the two supenmposed sequences are not monoalphabetically enciphered texts,but are polyalphabetrc In character, there WIll still be about 66or 67cases o f identity betweensuperimposed letters per thousand cases examined, provuled thetwo sequence8 really belong tothesame cryptographte SY8tem and are 8t£penmp08ed at the proper p o ~ n t W'/,th respect to the ke'g'tng

sequence The reasons for tluswill be set forth in the succeeding subparagraphs

I M,Zdarll CrllptanaZ1I8t.B, Part II It IS recommended that the student refresh hISmemory by reviewingthat appendIX

(58)

59

(6) Conmder the two messages below They have been enciphered polyalphabetrcally by

the sametwo pnmary componentsshdmg agamst each other The two messages use the same

keymg sequence, begmmng at the same mitaal pomt m that sequence Consequently, the two

messages are Identicallyenciphered, letter forletter, and the only differences between them are

those occasioned by drlferences m plain text

jAlPhabets .___ 18 21 13 II 8 • 17 19 21 21 2 8 3 8 13 18 1 7 12 8

No 1 Plamtext W H E N I N T H E C 0 U R S E L O N G M

CIpher________________ E 9....-!i B T E Y R C X X L Q J N Z 0 YAW

jAlphabets-___________ 16 2 1 18 6 8 • 17 1 9 21 2 1 2 8 3 8 13 13 1 7 12 6

No 2 Plain text____________ TH E G ENE R A LA B SOL U T E L Y

CIpher________________ P 9....-!i T U E B W 0 J L Q H Y Z P T M Q I

Note, now, that (a) m every case m which two supenmposed CIpher le tters are the same, the

plam-text letters are idenncal and (b) m every case m wluch two supenmposed. Cipherlettersare d1fterent, the plam-text letters are different In such a sys tem, even t hough the Cipher

alphabet changes from letter to letter, the number of cases of identity or coincidence in the two

membersof a parrof supenmposed Cipherletters will still be about 66or 67 per thousand cases

examined, became the twomember« of each pal1' of 8t£penmpobed leuer« are the same C?,pher

alphabet and tt has been Been (4) that monoalphabmc C?,pher text " '1.8 the 8ame as for p l a ~ ntm,.mz, 0667 The two messages may here be said to be supenmposed "correctly," that 18,

brought mto proper juxtaposmon Withrespect to the keymg sequence(7) Bu t now suppose the sametwo messages are superimposed "mcorrectly," that IS, they

areno longerm properjuxtaposraonWithrespectto the keymg sequence Thus

j

AlPh abets__________ 18 21 18 I 8 • 17 1 9 21 21 2 8 3 I 13 13 7 12

No 1 Plam text._________ W HEN I N T H E C 0 U R S E LON G

CIpher______________ E Q N B I F Y R C X X b....Q J N 0 Y A

jAlPh abets__________ 18 21 18 I 8 • 17 1 9 21 21 2 8 3 6 18 18 1 7

No 2 Plein text_________ THE G ENE R A LAB SOL UTE

Clpher______________ P Q N I U F B W 0 J b....Q H Y P T M

It 18 evident that the two members of every P8Jl'of superunposed letters are no longer m the

same Clpher alphabet, and therefore, If two superimposed CIpher letters are Identical thia ISmerely an "accident," for now there 18 no basic or general causefor the snmlanty, such as 18true m the case of a correct supenmpositaon The SlIDllanty, If present, 18, as already stated,

due to chance and thenumber of such cases of SlIDuanty should be about the same as thoughthe two Clpherletters were drawn at random f rom random text , In which ICr = 0385 It 18 nolonger true that (a) m every case m which two supenmposed CIpher le tters are the same, the

plam-textletters are Identical or (b) m every case m which two supenmposed Cipherletters aredrlferent, the plam-textletters d1fterent Note,for example, that the supenmposed To'srepre

sent two drlferentplam-textletters and that the Spof the word COURSE m the first message givesJ. while the S of the word ABSOLUTELY m the second message gives H. Thus, I t becomes clearthat m an mcorrectsupenmposmon two c:hfferent plam-textletters enciphered by two dIfferent

alphabets may "by chance" produce Identical CIpherletters, wluch on supenmposinon yield a

I Thefact that In thIs case each monoalphabet eontama but twolettersdoes not affect the theoreticalvalueof /c, and whether the actualnumber of COInCIdences agrees closely WIththe expectednumber based upon /C =

0667 depends upon the lengths of the two supenmposed sequencea



60

comcidence havmgno externalmdications as to dissnmlanty in plain-text equrvalents Hence,J.f there are no other factors which enter mto the matter and which might operate to distortthe results to beexpected from the operationof the baSIC factor, the expected numberof casesofidenacalcipher letters brought together by an mcorrectsupenmposition will be determmed bythevalue K= 0385

(8) But nownote also that m the foregoingmcorrectsupenmposmon thereare two Zo's and

that they represent the same plain-text letter L Tills 18 occasioned by the fa.ct that the plaintext messages happened to have L's in Just those two places and that the cipheralphabet hap-

pened to bethe sameboth tames Hence, It becomesclear that the same cipheralphabet brought

intoplay twice may "by chance" happento encipher the same plain-text letter both times, thusproducmg idenncal cipher letters In some systems tlns source of identity in superimposedCIpher letters 18 of httle Importance, in othersystems, It may materially affectthe actualnumberof comcidences For instance, J.f a system IS such that It produces along secondarykeymg cyclecomposed of repeunons of short pnmary keymg cycles, an mcorrect supenmposrnon of twocryptograms may bnngmto JuxtapoSItIon many of these short cycles, WIththe result that theactual number of cases of identical supenmposed CIpher letters 18 much greater than the expected number based upon Kr= 0385 Thus, tillqsource for the producnon ofidenncal CIpherletters m an mcorrectsupenmpositaon operates to mcrease the number of cases to be expectedfrom the fundamental constant K= 0385

(9) In some systems, where nonrelated CIpher alphabets are employed, It may happenthat two identical plain-textletters may be enciphered by two different CIpher alphabets which,"by chance," have the same eqmvalent for the plam-text letterconcerned Tills 18, however,a functIon of the particular cryptographic system and can be taken mto account when thenature of the system 18 known

(10) In general, then, It may be said that in the case of a correct supenmpositaon theprobability of identity or coincidence m superimposed upher letters IS 0667, m the case ofanmcorrect aupenmposmon, the probability IS at least 0385 and may be somewhat greater, de

pendmg upon speeral CIrcumstances The foregomg situation and facts make possible whathas been refer red to as the "comcidence test" Sm-e til ls test uses the constant K, It 18 alsocalled the "kappa test "

d The way m which the comcidence test may be applied will now be explained The

statement that Kp= 0667 means that in 1,000 cases where two letters are drawn at randomfrom a large volume of plam text, there will be about 66 or 67cases m which the two letterscoincide, that IS, are identacal Nothmg IS specified as to what the two letters shall be, theymay be two Z's or t he y may be two E's 'I' lns constant, 0667, really denotes a percentageIf many campa-mOM of singlelettersare made, the letters being drawn at random from amongthose eonsntutmg a large volume of plam text, 667 percent of these compansons made willyIeld comcidences So, If 2,000 such comparisons are made, the theory mdioates that thereshould be about 0667X2,000=133 comcidences, J.f there IS sufficient text to permit of making20,000compa.nsons,there should be about 1,334comeidenees, and so on

e Another way of handling the matter 18 to f ind the rano of the observed number of comcidences to the totalnumber ofcases in which the event in questionnught possibly occur, 1 e ,the total number of compansons of supenmposed letters When til ls ratio IS closer to 0667than It 18 to 0385 the correct supenmpoeinon has been ascer tained Tills IS true because mthe case of a correctsupenmpositaonboth members of each pair of supenmposed letters actually

belong to the same monoalphabet and therefore the probability of their comcidmg 18 0667,whereas m the case of an mcorrect supenmpoSltIon the members of each patrof supenmposed

61

letters belong, as a general rule, to dIfferent monoalphabets 8, and therefore the probability of

theIr ccineidmg 18 nearer 0385 than 0667J. From the foregomg, It becomes clear that the kappa test mvolves ascert8.1nmg the total

number ofeompansons that canbe madem a givencase,as wellas ascertammgthe actualnumberof comcidences m the case under considerataon When only two messages are supenmposed,th1B 18 easy The total number of comparisons that can be made 18 thesame as thenumber ofsupenmposed p8.11'S of letters But when more than two messages are supenmposed in a trUper'&mpomtm d'UJ,(J1'Q,m It 18 necessary to make a simple calculanon, based upon the fact that 71,

71,(71,-1l et te rs y Ield 2 p8.11'S or comparisons, where 71 18 the numberof letters in the column' For

3X2example, m the caseof a column of3 letters, there are - 2 -=3 compansons ThIs can be

checked by notIng that the 1stle t term the column may be comparedWIththe 2d, the 2d WIththe 3d, and the 1st WIththe 3d, making 3 compansonsm all The numberof compansonspercolumn tImes the number of columns in the supenmpositaon diagram of letters grvea the totalnumber of comparisons The extension of thls reasonmg to the case where a supenmpoeraondiagramhas columns ofvanous lengths 18 quite obVIOUS one merely adds together the numberofcompansona for columns of dif ferent lengths to obtain a grand total For convemence, the

followmgbnef table 18given

Number of Nnmber ofNumberof Numbprof

Namberof Number ofletter. 1U lettu. ''1 lettpr. 11column

eompanvms column wlllpar son" columneompansons

2 1 11 55 21 210

3 '1 12 66 22 2H

4 6 1& 78 2& 253

5 10 14 91 24 276

6 15 15 105 25 JOO

7 21 16 120 26 32;;I 8 28 17 13b 27 J51

9 36 18 153 28 &78

10 45 19 171 29 4Gb

20 190 30 435

9 In ascertammg the number of comcidences in the Laseof a column containmg several71,(71,-1)

letters, It IS agam necessary to use the formula 2 ,only m tlna case 71, 18 the number ot

IdentIcal letters in the column The reasoning, of course, 18 the same as before The total

I The qualIfymg phrase "as a general rule" 18 Intended to cover any distortionIn results oceasioned by the

presenceof an unusual numberof those cases ofeomeidence described under subpar c (8) and (9)t Tlushas alreadybeen encountered (footnote3, AppendIX2,Mddary C r y p f . a n a l Y 8 ~ 8 , Part 11) It 18merelya

specw case under the general formula for ascertammg the number of combmatlons that may b e made of n

C n'ifferent thmgs taken r at a tune, wluch 18 - = - ' (' In studymg comeidences by the methodmdieated,nr r n -r

n'smce only two letters are compared at a time, r 18 always 2, hence the expression rl(n-r)I' wluch 18 the same as

n ( n ~ ~ ~ ~ ) I 2 ) 1 ,becomes by eaneellanon of (n-2)', reduced to n(n;-I)





FlOURS 110

123

65

X /'Il!11

1/1/

-- - -x x 11

- -- -- -x x x

1

2

3

&s being members of the same fauuly, so to speak, then the two let ters formmg the successive

parrs of letters broughtmto supenmpoaitaon by an mcorrect placement of one message relative

to another are total strangers to each other, brought together by pure chance Tln s happens

nme and again, as one message IS slid against the other-untll the correct supenmposmon IS

reached whereuponm etery rase the twosupenmposed lettersbelong to the same faml1y There

may be'many different famihes (CIpher alphabets) but the fact that in everycase two membersof the same fauuly are present causes the marked Jump in number of coincidences

e In slnftmg; one message against another, the cryptanalyst may move to the nght con

stantly,or he may move to theleft constantly, or he may move alternately to the left and nght

from a selected imtaal pomt Perhaps the latter IS the bestplanf (1) Having properly supenmposed messages 1 and 2, message 3 IS next to be studied

Now It IS of course possible to test the latter message against the combmation of the former,

WIthout further ado That IS, escertarnmg merely the totalnumberof comcidencesg iven by the

supenmposnaon of the 3 messages might be thought sufficient But for reasons which w111

soon become apparent It IS better, even thoughmuch more work IS mvolved,first to testmessage3 against message 1 alone and agamstmessage2 alone This will really not Involve much addi

taonal work after all, since the two tests can be conducted simultaneously, because the proper

supenmpositaon of messages 1 and 2 IS already known I f the tests agamst messages 1 and 2separately at a given supenmposmongive good results, then message 3 can be tested, at that

supenmposraon, agamst messages 1 and 2 combmed That IS, all 3 messages are tested as a

single set Smce, according to the schemeoutlmed,a set of threecloselyrelatedtests ISmvolved,

one might as well systematise the work soa s to save tune and effort, If possible With tills InVIew a diagram such as that shown 10 FIgure ll a IS made and m I t the co.ncidences are recorded

m the appropriate cells,to show separately the comcidences between messages 1 and 2, 1 and 3,2 and 3 for e ach supenmpositaon tested The number of tallies 10 the cell 1-218 the same at

the begmmngof all the tests, I t hasa lreadybeen found to be9 Therefore ,9 tal lies are Inserted

Ince ll 1-2to begm WIth A columnwhich shows Ident ical let ters Inmessages 1 and 3 Yie lds a.

singletally for ce111-3, a column wluch shows identicalletterem messages 2 and 3 Yieldsa singletal lyfor cel l2-3 Only when a supenmposinon yie lds 3 idennca lIe t te rs 10 8 column, 18 a ta llyto be recordedsrmultaneously 10 cells1-3 and 2-3,SIncethepresence of3 idenncal lettera In the

column Yields 3 COIncidences

The total number of eompansons IS now 98, so that the expected numberof coincidences 18 98X

0667=65366, or still about 7 The 2d and 3d supenmpositaons are defimtely mcorrect, as tothe 1st and 4 th , the lat t er gives almost 30 percent more comcidences than the former Agam

considering the relatively small number of compansons, tills 30 percent drlference In favor ofthe 4th supenmpoaraon asagainst the 1st 18 impor tant Further detailed explanation18 unnecessary, and the s tudent may now be told that It happens that t he 4 th supenmposinon IS reallycorrect, u the messages were longer, all doubt would be dispelled The relatrvely large numberof cornctdences found at the 1st supenmposraon IS purely accidental in tills case

d The phenomenon noted above, wherem the observed number of comcrdences shows a

sudden Increase in movingfrom an incorrect to a correct supenmpositaon IS no t at all unusual,nor should It be unexpected, because there IS only one correct supenmposinon, while aU other

supenmpositions are entIrelyincorrect In other words, a supenmposinon 18 either 100percent

correc t or 100 percent wrong-and there are no grada tions between these two extremesTheoretIcally, therefore, the difference between th e correct supenmposrtaon and anyone of the

many mcorrect supenmpoeraons should be very marked, since It follows from what has beennoted above, that onecannot expect that the diacrepancybetween the actual and the theoretIcal

number of eomcadences should get smaller and smaller as one approaches closer and closer to

the correct supenmposrnon 7 For u letters belonging to the same CIpheralphabet are regarded

64

70 80 8Ii 90 93 100

No L_____ J P I V J W V A U 12 BAH M I H K 0 BML T F Y Z L g S 0 G K

No 2_______ C D KY O 0 B V D 12 XeD 0 G R G IBM r c s H S G goP Y A 0 Y X

of eomcideaces uught Jus t be "one of those accidents" Therefore message 2 18 slnfted onespace to thenght, placing Its 1stletter beneath the 2d letter of message 1 Agam the number

of comcideneea18 noted and this time It 18 found tobe only4 Thetotal number ofcompansons

18 now 100, the expectednumber 18 still about 7 Here the observed number of comeidenees 18considerably less than the expected number, and when the relatIvely small number of com

pansons 18 borne In mind, the discrepancy between the theoretical and actual results 18 all the

more s tn lo ng T he h as ty cryptanalyst might therefore Jump to the conelusion that t he 1st

supenmpositaon 18 actually the correct one But only two tnals have been made thus far and

a few more are sti ll advisable , for In this scheme of supenmposmg a senes of messages It ISabsolutely essentaal that the veryfirst suponmposinons rest upona perfectlysound foundatIon

otherwisesubsequent work w111 be very difhcult, u not entirely fruitless AdditIonal tnals willtherefore be made

e Message 2 18 shifted one more space to the nght and the number of comcidenees IS nowfound to be only 3 Once a gai nmessage 2 IS shifted, to t he positaon shown below, and theobserved number of comcidences Jumps suddenly to 9

40 40 so 55 80 115 70

No L H Y E I U Y N BO N N F D M WZ L U K Q A QA H Z M G CDS LE A G C

No 2_______ Z T LAW R D F G D D E Z D LBO T F U Z N A S R H H J N G U Z K P R

s 10 15 20 20 3D 36

No L_____ P G LPN HU F R K SAy Q Q A Q ! U 0 Z A K G A E 0 Q C N P R K Q VNo 2_______ C WH P K K X F L y M K U R ! X CO P H W N J U W K W I H L Q K

7 The lDlportance of tlus remarkWIll be appreclatt>d when the student comes to study longer examples, mwhich statIstical expectations have a better opportunity to matenahre



FIGUIl.Jl116

66

(2) Let message3 be placed beneath messages 1 and 2 combined, so that the 1st let ter of

m811ths&gt

8 t3h falls under the 1st letter of message1 (It IS adviseble to fasten the latter In placeso a ey cannot eaBIly be chsturbed) Thus

Total numNumber ofeomeidenees

CombmatlOD bero'

D18OItlP

comparlSODB Expected ObserVldal lq

PmItlC

MeB8&ges 1 and 3_ • • -_____ 99 About 7 10 +43

MeB8&ges 2 and 3 _ _•_____ 97 About 6 6 0

Messages 1, 2, and 3 - __ 293 About 20 25 +25

1 2 3

1 x '11

2 x x "f

3 x x X

FIGl1BJl ue

67

76 M 8lI 95 101

No 1.______ J P I V J W V A U Q BA H M I H K 0RML T F X Z L g S 0 G K

No 2_______ C 0 KY O 0 V D Q x c o 0 G R G I BM I Q MH S G Q 0 PYA 0 Y X

No 3. K V Y Z WX K 0 Q 0 AZ QNOT N A L T Q HX E H T s c r

6 10 1& 20 25 30 3&

No L_____ P G LPN HU F R K SAY QQ A Q! U 0 Z AK G A E Q Q C N P R K Q VNo 2.______ C WHP K K X F L y MKUR ! X CO P H WN J U W K W I H L Q. KNo 3_______ WF WTO N H T G MR A A Z G P J D S QA U P F R Q X J R 0 !:! R Z W

(3) The reason for the separate tabulanon of eomcidencea between messages 1 and 3,2 and 3,and 1,2, and 3shouldnowbeapparent Whereasthe observednumberof comcidencesIS 57 percent belowthe expected number of coincidencesIn the caseof messages 1 and 3 alone,and 50percent.belowIn the caseofmessages2 and3 alone, the discrepancybetweenthe expectedand observed numbers IS not quite so marked (-21 percent) when all three messages are considered together, because the relatIvely high number of comcrdences between messages1 and 2,which are correctly superimposed, serves to counterbalance the low numbers o.f comcidencesbet .ween 1 and 3,and 2 and 3 Th1L8, a correct supenmposuwnjor oneojthe three comb'maCrons

may yteld 8'UCh good results asto maskthebadre81dts forthe other two c o m b ~ n a t w n s(4) Message 3 IS thenslufted one space to the l'lght, and the sameprocedure IS followed as

before The results are shown below

4& m &II • 65 70

No L_____ H Y E I U Y N BO N N F 0 MWZ I:! UKg A Q AH Z MG C Q S I:! E AGe

No 2 Z T LA W R 0 F GO D E Z 0 LB O T F U N A S R H H J N G U Z K P RNo 3__ .____ C Z S R TEE E V P X 0 A T 0 Q I:! 0 0 Q. HAW N X T H Q X I:! H Y I G

X. 11

111/1/~ - -x x 11

x x x

f'omblDatlOn Total numberNumber of colnPldpnpeq

or tomparl<on< --- D<erell

Exppctpd O h ~ p r v e d &DPY

--Mes8&ges 1 a nd 1 91) About

Percent

Messages 2 and 3- - 7 3 - ')7

Messages 1,2 , and 3- 96 About 6 3 -5 0

291 About 19 15 -2 1

1

2

3

1 2 3 4 6 6 7 8 9 1 0 1 1 1 2 1 3 U 15 1 6 1 7 1 8 1 9 2 0 2 1 2 2 2 3 2 4 25 2 6 'P

L_________ P G L PN H U F R K SAY Q Q A Q Y U 0 Z A K G A E 02___________ C WH P K K X FLy M K U R XX COP H W N J U

3___________ WF WTON H T GMR A A Z G P J 0 S Q A U P FRO X

2 3 ~ O O ~ ~ ~ M ~ u ~ ~ ~ ~ ~ n ~ " " " ~ ~ ~ m ~ ~L_________ Q C N P R K Q V H Y E I U Y N BON N F D MWZ L ;

2___________ WK W I H L Q K T LAW R 0 F G D D E Z D L V 0 T F3.__________ J R 0 H R Z WC S R TEE E V P X 0 A T Q L 0 0 Q

u H m M ~ . M ~ M " P H ~ H M r o n ~ n U U U " ~ N M M~ - - - - - - - - - - Q A Q A H Z MG CDS L EA G C J P I V J W V A U D B----------- U Z N A S R H !:! J N G U Z K PR e 0 KYO 0 B V 0 DX

3___________ Z HAW N X T 1:1 D X L H Y I G K V Y Z W X B K 0 Q '0 A

1 ~ U ~ u M ~ M M ~ m ~ n M " ~ ~ ~ ~ ~ m ~ ~ ~_._----.--- A H M I H K 0 RML T F Y Z L G S 0 G K

2___________ CO O G R G I RM r c s H S G GOP Y A 0 Y X3. • Z Q NOT N A L T C N Y E H T seT

123

The sucoessrve c olumns are n ow e d d honly e omordenees b t xamme an t e c omcidences are r ecorded, r ememben ng that

lated In the dra e w e ~ h m e s s a g e s 1 and 3,and between messages2 and 3 are now to betabu-position YIelds ( ' o m ~ : : ~ ~ ~ : s : : : w ~ ~ : test are shown In FIgure lI b Tlus supenmmessages 2 and 3 Th tt l b ssages 1 and 3, and the same number betweenIS drawn up e 0 anum ers of comparisons are then noted and the following table



Total numNumber of COIDCldeDCIS

ComblDatlOD her ofl' .t'I'ep

eompansonsan("'\o

Expected Observed

Peru"t

Messages 1 and 4 _________ 96 About 6 3 -5 0

Messages 2 and 4 _________ 96 About 6 3 -5 0

Messages 3 and 4__ - 96 About 6 1 -8 3

Messages I, 2 ,3 and 4 - 582 About 39 33 -1 8

x '!lit ' I!J/1/

-- - - -X X ny 'II

t- - - - -X X X I

I- - - - -X X X X

69

J'IGVU 11.

II 10 n 20 2Ii 30 "

No L •• P G L P N H U F R K S A U Q Q A Q Y Y 0 Z A K G A E 0 Q C N P R K 0 V

No 2_______ C WH P K K X F L U M K U R Y X C O P H W N J U W K W I H L 0 K

No 3_______ WF WT D N H T G MR A A Z G P J D S Q A U P F R O X J R 0 H R Z W

No 4_______ T U L D H N Q E Z Z U T Y G D U E D U P S D L I 0 L N N B O N Y- - -40 411 liO 5' 60 611 70

No L_____ H Y E I U Y NBO N N F D M WZ L U K Q A Q A H Z M G C D S L E A G C

No 2_______ Z T LAW R D F G D D E Z D L B O T F U Z N A S R H H J N G U Z K P R

No 3_______ C Z S R T E E E V P X 0 A T D Q L D 0 Q Z H AW N X T H D X L H Y I G

No 4 L QQ V Q G C D U T U B Q X S 0 S K N 0 X U V K C Y J X C N J K S A N

1

2

3

4

75 80 85 90 95 101

No L J P ! V J WV A U DB A H M I H K 0 R M L T F Y Z L G S 0 G K

No 2 C D KY O 0 B V D D X C DOG R G I R M I C N H S G G O P Y A 0 Y X

No 3_______ K V Y Z WXB K 0 Q 0 A Z Q N D T N A L T C N Y EH T S e TNo 4 G U I F TOW 0 M S N B Q D BA I V I K N W G V S HIE P- - - -

123 4

(6) It 18 beheved that the procedure has beenexplainedWIth sufficientdetailto make furtherexamplesunnecessary The student should bear m mmd always that as he adds messages tothe snpenmposraon diagram It 18 necessary that he recalculate the number of compansons sothat the correct expected or theoretical number of comcidenceswillbe beforehun to compareWIth the observed number In adding messageshe should see that the results of the separatetests are consistent, as wellas those for the combined tests, otherwise he may be led astray at

times by the overbalancmgeffectof the large numberof comeadences for the already ascertained,correct aupenmposraons

44 Subsequentsteps - a In paragraph43a four messageswere given of a seriessupposedlyenciphered by a long keymg sequence, and the succeeding paragraphs were devoted to an explanation of the preparatory steps m the solution The messages have now been properlysupenmposed, so that the text has been reduced to monoalphabenc columnar form, and thematter 18 nowto bepursued toIts ultimate stages

To tal numNumber of coIDCldeDCI'S

( ombmatron ber ofD,.crpp

ccmpensonsExpected Observed

HDLy

Messages 1 and 4Perce"t

96 About 6 7 +16

Messages 2 and 4 _ - -- 95 About 6 7 +1 6Messages 3 and 4 ----- 96 About 6 5 -1 6

Messages 1,2, 3, and 4 ___ 581 About 39 43 +10

X '!lit ' I !J 'ffI- -

X X lH! fHJIf--,

- -X X X

lH!I- - - -X X X X

No L _No 2 _

No 3 _No 4 _

68

1

2

3

4

1 2 3 4

J'IGVU lid

II 10 15 20 2Ii 30 3'

P G L P N H U F R K S A Y Q Q A Q X U O Z A K G A E O Q C N P R K O VC W H P K K X F L Y M K U R X X C O ~ H W N J i j W K W I H L O KW F W T R N H T G M R A A Z g P J D S Q A U P F R O X J R O H R Z W

T U L R H N Q E Z Z Y T Y G D U E D U P S D L I O L N N B O N Y L- - --0 411 lIS ftO 611 70

No L_____ H Y E I U Y N BO N N F D M WZ U K g A Q A H Z M G C D S L E A G C

No 2 Z T LA W R R F G D D E Z D LB O T F U Z N AS R H H J NG UZ KP R

No 3_______ C Z S R T E E E V P X 0 A T D Q D Qg H AW N X T H Ii X L H Y I G

No 4_______ Q Q V Q G C R U T U B Q X S 0 S K N Q X U V K C Y J X QHJ K S ! N g75 80 85 90 911 101

No L_____ J P I V J ! V A U R!! ! H M I H K 0 R M L T F Y Z L G S 0 G K

No 2_______ C D K Y Q 0 !! V D R X C R 0 G RG ! RM Q N Ii S G goP Y A 0 Y X

No 3_______ K V Y Z WX !! K 0 Q 0 ! Z Q N D T N A L T C N Y E H T S C T

No 4 - U I F T Q ! 0 M S N !! Q R B A I V ! K N WGVSHIE P

Note howwellthe observed and expectednumbers of eomeidenees agree in all three combinetlOlliS Indeed, the results of tins test are sogood that the cryptanalystmight well hesitate tomake any more tests

(5) Having ascertamed the relative positions of 3 messages, the fourth message IS nowstudied Here are the results tor the correct supenmpositaon

The results foran incorrect supenmposraon (Ist letter ofmessage4 under 4th letterof message1)arealso shown for comparison



70

b The four messages employed in the demonstrataon of the pnneiples of the IC t e st h av e

served their purpose The mformation that t hey are messages enciphered by an mtelhgiblerunmng key, by reversed standard cipher alphabets, was WIthheld from the student, for peda

gog ical r ea sons Were t he k ey a random sequence of letters instead of mtelhgible text , the

explanatron of the coincidence test would have been unchanged m the shghtest partaculsr, sofar as concerns the mechamcs of t he t ext Itself Were the CIpher alphabets unknown, mixed

alphabets, the explanatIon of the IC test would also have been unchanged m the shghtest par

tacular But, as stated before, the four messages actually represent encrpherments by means ofan mtelhgible runmng key, by reversed standard alphabets, they will now be used to illustrate

the solutaon of cases of tlns sortc Assummgnow that the cryptanalyst 18 fully aware that the enemy 18 using the runmng

key system WIthreversed standard alphabets (obsolete U S Army CIpher disk), the method of

solutaon outlmed in paragraph 38 will be illustrated, employing the :first of the four messagesreferred to above, that begmnmg PGLPN HUFRK SAUQQ The word DIVISION will be taken as

a probable word and tested agamst the key, begmnmgWIth the very:first letter of the messageThus

CIpher text_________________________ P G LPN H U F R K S A U Q Q

Assumed plain text______________ D I V I S IO N

Resultant key text_______________ S 0 G X F

Theresu ltant keytex t ISumntelhgible andthe word DIVISION 18 shiftedone letter to the right


Assumed plam text______________ D I V I S IO N

Resultant key text J T K

Agam the resu l tan t key tex t IS unmtelhgible and the hypothencal word DIVISION 18 shifted

once more Connnuanon of this process to theend of the message proves that the word 18 not

present Another probable word 18 assumed REGIMENT When the point shown below IS

reached, note the results


Assumed plam text______________ • REG I MEN TResultant key text_______________ • E LAN D 0 F T

It certamly looks as though mtelhgible text were bemg obtained as key text The wordsLAND OF T suggest that THE be tned The key letters HEgive NO, makmg the plam text

read REGIMENT NO The four spaces precedmg REGIMENT suggest such words

as HAVE, SEND, MOVE, THIS, etc A clue may be found by assurmng that the E before LAND

m t he k ey IS part of the word THE Testmg It on the CIpher text gives IS for the plain text,

which certamly mdicates that the message begme WIth the word THIS The lat ter yields INfor the :first two key letters And soon, the process of checking one tex tagamst theother con

tmumg until the entire message andthe key texthave been reconstructed

d Thus far the demonstranon has employed bu t one of the four messages available forsolution When the reconstrucnon process ISapplied to all four SImultaneously It naturally

goes much faster, WIthreduced necessityfor assummg words after an mrtaal entermg wedge has

71

been dnveninto one message For example, note what happens in this case Just essoon as the

word REGIMENT IS tned in the proper place

Key text_____________________1

I I ElL AIN D °I F TI I

No1 {CIPher text__________________ P G L P N H U F R K S A U Q Q

Plam text____________________ R E G I M E N T

No2 {CIPher text__________________ C WH P K K X F L UM K

Plaintext____________________

I E L D T R A I

No3 {CIPher text__________________ WF WT D N H T G M R A A Z

Plam text____________________ L I N G K I T C

No4 {CIpher text__________________ T U L D H N Q E Z Z U T Y

Plam text____________________ T I T A NK G U

It IS obVIOUS that No 2 beg ins WI th FIELD TRAIN, No 3, WIth ROLLING KITCHEN, No 4WIth ANTITANK GUN These words yIeld addrtaonal key letters, the lat ter suggest addrtaonsl

plam text, and thus the process goes on until the solutaonIScompletede Bu t now suppose that the key text that has been actually employed m encipherment IS

not mtelhgible text The process 18 stall somewhat the same, only in thiscase one musthave at

least two messages in the same key For instead ofcheckmg a hypothetical word (assumed tobe present in one message) agamst the key, the same hOO of a check t8 made a g a ~ n s t the othermessage ormessages Assume, for instance, that in the case Justdescnbed the key text, instead

of beingmtelhgible text, were a senes of letters produced by applyinga rather complex transpo

sition to an ongmally mtelhgible key text Then If the word REGIMENT were assumed to bepresentm the proper place in message No 1 theresultant key letterswould yIeld an unintelligible

sequence Bu t these key letters when applied to message No 2 would never thel es s y ie ldIELDTRAI,whenapplied to message No 3,LINGKITC, and soon In short, the textof onemes-sage t8 checked a g a ~ n s t the of another message or messages, 1f the ongmally assumed word 18

correct, then plain text will befound m theothermessages S

I Perhaps tbJs18asgooda placeas any to makesome obeervanonswhichare of general Interest 18 eonneetionWlth the running-key pnneiple, and whieh have no doubt been the subject of speeulatron on t hepar t of somestudents Suppose a besie, umntelhgible,random sequence of keying characterswhich 18 not denved from the

mteract10n of two or more shorter keys and whteh MII6T repeat8 18 employed but once a s a k ey for enciphermontCan a cryptogramenciphered Insuch a systembe solved? The answer to this question mustunquali fiedly bethiS even If the CIpher alphabets are known sequences, eryptanalytic science ISoertamly powerless to attack

sucha cryptogram Furthermore,sofaras can now be discerned, nomethodof attaok IS hkely ever to be devisedShort of methods based upon the alleged phenomena of telepathy-the very objeetrve existence of which 1'1

dented by most "sane" mvestigatora today-It 18 nnpossible for the present author to conceive of any way ofattackIng such a cryptogram

Tws IS a ease (and perhaps the only case) In which the impossibrlrty of cryptanalYSIS IS mathematieallvdemonstrable Two thmgs are Involved m a complete solution In mathematiCS not only must a sat18factory(logteal) answer to the problem be offered, but also It must be demonstrated that the answer offered ISumqUi',

that IS, the only possi bl eone (The mis take 18 often made that the lat ter phase of what constrtutes a v ahdsolutron IS overlooked-and tlus IS the basicerror which numerousalleged Baoon-Shakespeare"cr yptographers"commrs ) To attempt to solve a cryptogrameneiphered 1D the manner mdieated IS analogous to an attempt tofind a unique solution for a single equat ion eontammg two unknowns, WIthabsolutely no data available forsolutacn other than those given by that equation Itself It IS obVIOUS that no unique solutron ISpossible In sucha oase,SInceanyone quanhty whatsoell6T may bechosen for one of the unknowns andthe other will followas aaonseauenee Therefore an mfimte numberof cWferentanswers, all equally vahd, 18 posaible In the ease 01a



72

J All the foregomg work IS, of course, based upon a Imowledge of the CIpher alphabetsemployed m the encipherment What If thelat terare unImown sequences? It may be stated

at once that not much could be done With but four messages, even after they had been superImposed correctly, for the most that one would have m the way of data for the solution of the

mdividual columns of text would be four let ters per alphabet--whIch IS not nearly enough

Data for solution by mdirect symmetry by the detection of Isomorphs cannot be expected, forno Isomorphs are produced In this system Solution can be reached only If there IS sufficienttext to permit of the analysis of the columns of the supenmpositaon diagram When there IS

this amount of text there are also repetmons which afford bases for the essumpnon of probable

words Only then, and after the values of a fewCIpherletters havebeen estabhshedcan indirectsymmetry be apphed to facihtate the reconstruenon of the pnmary components-If used

g Even when the volume of text IS great enoughso that each column contams say 15 to 20letters, the problem IS still not an easyone But frequency distnbutaona With 15 to 20 letterscan usually be studied stansucally, so that If two distnbuuons present snmlar charactensncs,the latter may be used a"l a basis for combmmg drstnbutions which pertam to the same CIpheralphabet The next sectaon will be devoted to a detailed treatment of the nnplicanons of the

last statement

oryptogram enciphered m the manner mdicated, there IS the equrvalent of an equation WIth two unknowns,the key 18 oneof the unknowns, the plain text 18 the other One may CODJure upan mfimte number of differentplain texts and offer anyone of them as a "solutIOn" One may even perform the perfeotly meanmgless labor

of reeonstruetmg the"key" forthiSselected "solutIon",bu t smce there 18 nowayof provmgfrom the cryptogramItself, or from the reoonstructed key (which ISunmtelhgible) whether the "soluaon" SO selected 18 thB aotual

plain text. all of the mfinlte number of "SOIUtlOns" are equally vahd Now SInceIt 18 mherent ID the very Ideaofcryptographyas a pracncel art that there mustand can beonly one actual solunon (orplain text), and smoenone of thiS mfimte number ofdifferent solutions can be proved to be theoneand only correct solution, therefore,our common sense reJects them one and all, and It may be said that a oryptogramenciphered In the manner

mcbcated 18 absolutely nnpcssible to solveIt ISperhaps unnecessary to pomtout that the foregOlDg statement ISno longer true when the running key

constitutesurtelhgible text, orIfIt IS used to encipher more than one message, or If It IS the secondary resultant ofthe mteraeuon of two or me-re'!hort primary keys whioh go through cycles themselves For II I these cases there

IS addrticnalmformationavailablefor the dehmrtation of ODe of the parr of unknowns. and hence a unique solution becomes possible

Now although the runmng-key system descnbed m the first peragreph represents the ultimate goal oferyptographie security and ISthe idesl toward wluch cryptographloexperts have stnven for a longtime, there ISa WIde abyss to be bridged between the reeognrtion of a theorelllcally perfeot system and Its establIBhment as apractical means of secret mtereommumeatron For the mere meohanloal detaJls Involved In the production,reproduction, and distnbutron ofsuch keys present ddficultleswhich are sofonmdableas to destroy the effeotlveness of the method as a systemof secret IDteroommumoatlon SUitablefor groups of correspondents engagedIn avolummous exohange of messages

SECTION XII

THE "CROSS-PRODUCT SUM" OR "x TEST"1

ParacraphPreIImmary remarks 45

Thenature of the "Orose-productsum" o r"X (Cln) test" m cryptanalys18___ __ _ 46Denvation of the x test _ __ _ _ __ 47Applying the X test In matehrng distnbutrons .____ 48

45. Prehmmary remarks.-a The realpurposeof making the oomoidenoetest in cases such

as that studied In the precedmgsection 18 to pemnt the cryptanalyst to arrange hISdata soa s tocircumvent the obstacle which the enemy, by adopting a complicated polyalphabetIc scheme ofeneipherment, places In theway of solution The essence of the matter IS that by dealingmdi

vidually With the respective columns of the supenmposraon diagram the cryptanalyst hasarranged the polyalphabeac text so that It can be handled as though It were monoalphabencUsually, the solutionof the latter 18 a relativelyeasy matter, especially If there 18 auffieient text

In the columns, or If the letters wrthm certam columns can be combined mto SInglefreq uencydistnbunons, or If some cryptographIc relationship can be estabhshed between the columns

b It 18 obvious that merely ascert&mlng the correct relative posmons of the separate messages of a senesof messages In a supenmposiaon dragram 18 only a means to an end, and not anend in Itself The purpose IS, as already stated, to reduce the complex, heterogeneous, polyalphabetic text to SImple,homogeneous, monoalphabetic text Bu t thelatter can besolved onlywhen there are suffiCIent data for the purpose-sand that depends oftenupon the type of CIpheralphabetsmvolved The latter may be the secondaryalphabets resulting from the sliding of the

normal sequence agamstIts reverse, or a mixed componentagamst the normal, and soon Thestudent has enoughmformatIon concermng the vanous cryptanalytic procedures whIch may beapphed, dependmg upon the CIrcumstances, m reconstructing dIfferent types of pnmary components and no more need besaad on thIS score at thIS POint

c The student should, however, realize one pomt which has thus far not been broughtspeeiflcally to hISattention Although the eupenmpositaon diegram referred to In the precedingsubparagraph may be composed ofmany columns, there IS oftenonly a relatively smallnumberof d'd!erenl CIpheralphabets mvolved For example, m the case of two pnmary components of26letters each there 18 a maxnnum of 26secondary CIpheralphabets Consequently, It followsthat m sucha case If a supenmpoaraondiagram 18 composed of say 100columns, certainof thosecolumns must represent SImIlar secondary alphabets There may, and probably will be, noregu1anty of recurrence of these repeated secondanes, for they are used m a manner dIrec tlygoverned by the letters composmg the words of the key text or the elements composmg the

keymg sequenced Bu t the latter statement offersan excellent clue It 18 clear that thenumber ofnmee a

given secondaryalphabet18 employed In sucha supenmposinondiagramdepends upon the com-

I The X test, presentedm thiSsection, aswellas the ill test, presented in Bection XIV, were first describedm an Important paper, Stat"tlcal Methods " Cr1lpta"al1lBIB, 1935, bySolomonKullback, Ph D , ASSOCiate Crypt

analyst, Srgnal Intelligence ServJce I take pleasure m acknowledgmg my Jndebtedness to Dr Kullback'spaper for the basICmaterJal used m my own expoBltloDoft hese tests, as well as for hJshelpful cntlCI8DIII thereofwlule m manusoript

(73)



I MddaT1/ Cryptanal1llnB, Part II, AppendIx 2

75

d It IS advisableto pomt out, however, that the student must not expec t t oo much of amathematical methodof companng distnbutions, becausethere arelnmts to the size of distnbut ions to be matched below which these methods will not be effective If two drstnbutions

contamsome smnlar charactenstacs the mathematical method will merely afford a quantitative

measureof the degree of smnlanty Two distnbuuons may actually pertam to the same cipheralphabet but, as occesionally happens, they may not present any external evidences of thisrelanonship, m which case no mathematical method can mdicate thefact that the two distnbu

nons are really snmlar and belong to the same alphabet47. DerIvation of the x test - a Consider the followmgplam-text distnbunon of 50 letters

0067NJ- 0667N

2I)

c Iakewise, If jA. represents the number of occurrences of Am the foregomg distnbutaon,

then the number of comoidences for the letter A may be indicated symbohcally b y j A ( j ~ - I )And smnlarly, the number of comeidenees for the letter B may be indicated by j B ~ - I ) , and

soon down to jz(fz-l) The total number of actual comeideneea found in the distnbutaon IS,

2

of course, the sum of j.4.«'2-1)-t!B<t;-I)+ jz(j;-I) I f the symbolje IS used to mmcate

any of the letters A, B, Z, and the symbol IS used to mmcate that t he qum of al l t he

--~ , ~ ~ ~ ~ ~ ~ ~ ~ ~ ~A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

In a previous text 1I I t was shown that the chance of drawmg two identical letters in normal

Enghsh telegraphic plain text lS the sum of the squares of the relative probabilities of occurrenceof the 26lettersm suchtext,which IS 0667 That is , the probability ofmonographic comcidencein Enghsh telegraphic plsm text lS Kp= 0667 In the message to which the foregomg distnbu

tionof 50 lettersapphes, the number of possible pamngs (comparisons) that can bemade between50X49

SIngle lettersIS 2 t:::::l,225 Accordmg to the theoryof comcidences thereshould, therefore

be 1,225X 0667=81 7065 or approximately 82 comcidences of single letters ExaIDllllDg the

distnbunon It IS found that there are 83 eomcidenees, as shown below

-~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

3+0+0+ 1+21+0+0+I+3+0+0+0+1+10+15+0+0+1+10+15+ I+0+1+0+0+0-83

The actual number of eomcidencea agrees very closely With the theorencal number, which IS

of course to be expected, smce the text to which the distnbution applied has been indicated as

bemg normal plam text

b In the foregoing; simple demonstratIon, let the numberof compansons that can bemadeN(N - l )

in the distnbutaonbe mdieated symbolIcally by 2 ' where N=the total numberof letters

m the distnbution Then theexpectednumberofcomeidencesmay bewntten as 0067 -1),

which may then be rewntten as

74

posmon of the key text Smce m the caseof a runnmg-key system using a book as a key the

key text constatutes mtelhgible text, It follows that the varwus 8econdary alphabet8 wUl be employed '/J)'/,th jrequencu8whtch are dtrectly related tothe re8pectwe jrequencu8oj OCcurrence oj leuer«tn normalplatn te:Bt Thus, the alphabet correspondmg to key letter E should be the mostfrequentlyused, the alphabetcorrespondingto key letter Tshouldbe next in frequency, and soonFrom this It follows that insteadof bemg confrontedWitha probleminvolving asmany differentsecondary CIpher alphabets as there are columns in the supenmpositaon wagram, the cryp t

analyst will usually have not over 26suchalphabets to deal With, and allowmg for the extremelyImprobable repetraveuse of alphabets eorrespondmgto key letters J, K,Q,X, and Z,It IS hkely

that the cryptanalyst will have to handleonly about 19 or 20 secondary alphabetse Moreover, since the E secondary alphabet will be used mostfrequently and soon, I t ISpossible for the cryptanalyst to study the various distnbutaons for the columns of the superunposrnondiagramWitha VIew to assemblmg those distnbunonswhich belong to the same Cipheralphabet, thus makmg the actual determmanon of values much easier m the combmed distn

bunons than would otherwise be the case

j However, If the keymg sequence does not Itself constitute mtelhgible text, even If It lS

a random sequence, the case lS by no means hopeless of solunon-c-provided there lS sufflcienttext within columns so thatthe columnar frequency distnbunonsmay afford mdications enabling

the cryptanalyst to amalgamate a large number of small distnbutions mto a smaller number oflarger distnbutions

9 In thIS process of assembling or eombmmgmdrvidual frequency distnbunons which belong to the same CIpheralphabet,recourse may be had to a proceduremerely alluded to m connection Withprevious problems, and designated as that of "matchmg" distnbunons The nextfewparagraphs will dealWiththIS Importantsubject

46 The nature of the IlCross-product sum" or "x (Chi) test" m cryptanalySIS-a The

student has already been confronted With cases in which It was necessary or deairable to reducea large number of frequency distnbunons to a smaller number by Identlfymg and amalgamatIng

distnbunons which belong to the same CIpheral phabet Thus, for example, m a case in whichthere are,say, 15 diatnbunons bu t only, say, 5 separate CIpheralphabets, the <hfficultym solvinga message can be reduced to a considerabledegree provided that of the 15 distnbuuons thosewhich belongtogether can beidentified and allocatedto the respectIve CIpheralphabets to whichthey apply

b ThIs process of Identlfymg distnbutiona which belong to the same Cipheralphabet in -

volves a careful exammanon and companson of the vanous members of the entire set of distnbunons to ascertam which of them present suffiCIentlysimilar' charactensnce to warrant theirbemg combinedmto a smgle distnbution applicable to one of the Cipheralphabets mvolved mthe p robl em Now when the mdrvidual distnbutiona are faIrly large, say contammg over 50or 60 letters, the matter lS relativelyeasy for the expenenced cryptanalyst andcan be made bythe eye, but when the distnbunona are small, each contammg a rather small number ofletters,ocular comparisonand idennfieataon of twoor more distnbutions as belongmg to the samealphabet become qurte difficult and often mconclusrve In any event, the tame required for the successful reduction of a mulnphortyof mdrvidualsmall distnbunons to a few larger wstnbutIons

IS, m such cases,a verymatenal factorm determmmgwhether the solutIOnwillbe accomphshedm tIme to beof actual valueor merely ofhIstoncal mterest

c However, a certam statIstIcal test, called the "cross-product sum" or "x test", has been

deVIsed, whIch can be broughtto

bear upon thIs question and, by methods of mathematicalcompanson, ehmmate to a largedegree the uncertamtIes of the ocularmethodof matchIng andcombmmg frequency wstnbutIons, thus m many cases matenally reducmg the tIme reqUlredfor solutIonof a complex problem

I II



(VIII)

2 ~ f 9 d E l J = 0667(2NlNa), or

~ f 9 d 9 1 = 0667NINI

9 The kut eq:uatwn th'U8 perrrl/l.t8 of e 8 t a b 1 M h ~ n g an expected value for the 8umof the prOductBof the c o r r e 8 p o n d ~ n g frequencu8 of the two dutMbut'Wn8 b e ~ n g conmdered for amalgamat'Wn ThecroBB-product BUm or X teetfor m a t c h ~ n g two d u m b u t ~ o n 8 u based upon equat'Wn (VIII)

48 Applymg the x test In matching distrIbutIons -- a Suppose the followmg two distnbutlons are to be matched

1 3 ~ 9 2 2 - 3 9 - 6

77

Let the frequenCIes be Juxtaposed, for convenience m findmg the sum of the cross productsThus'

fal-··---------------- 1 4 0 3 0 1 0 0 1 0 0 1 0 0 1 0 0 3 2 2 1 0 1 3 0 2 --_..N l=26A BCD E FG H I J K L MNO PQR S TU VWXY Z

f9l------------------- 0 2 0 0 0 3 0 0 1 0 1 0 0 1 1 0 0 3 1 1 0 0 0 0 1 2 - - _ . _ N ~ = 1 7fal faa- ------------- 0 8 0 0 0 3 0 0 1 0 0 0 0 0 1 0 0 9 2 2 0 0 0 0 0 4

In tms case ~ j a d E l J = 8 + 3 + 1 + 1 + 9 + 2 + 2 + 4 = 3 0

NINa= 26X 17=442

Reducing to simplest terms by cancelhng ou t smular expressions

fl-------------- ABC DE F G H I J K L M N 0 P QRSTU V WXy Z

f2-------------- ABC D E FG H I J K L M N 0 P QRSTU V WX YZ

b The fact that the quotient (0711) agrees very closely WIth the expected value (0667)means that the two distnbunons veryprobablybelong together or are properly matched Notethe quahfymg phrase "very probably" It imphes that there IS no certamtyabout tlns businessof matching distnbunons by mathematicalmethods The mathematicsserve only as measunngdevices, so to speak,which can be employed to measure the degree of smulanty that exists

c Instead of dividing ~ f 9 d E l J by N IN2and seeinghow closely the quotientapproximates thevalue 0667 or 0385, one may set up an expected value for ~ f 9 d E l J and compare It WIththe observedvalue Thus, in the foregomg example 0667 (NlNa)= 0667X422=28 15, the observedvalue of ~ f 9 d 9 s IS 30and therefore the agreementbetween the expected and the observedvaluesIS quite close,mdicatmg that the two diatnbunons are probably properly matched

d There are other mathematical or statasucal tests for matchmg, m addition to the x test

Moreover, It IS possible to gofurther Withthe x test and finda measure of the reliance thatmay

be placed upon the value obtamed, bu t these pomts WIll be left for future discussion m subsequent texts

0667N2 - 0667N

2

elements that follow this sign IS to be found, then thesum of the actual eomcidences noted m

the distnbunon may be mdieated thus ~ i a ( f ~ - l ) , whichmay be rewritten as

~ 1 9 l l = 0667N12 + 9333Nl and

~ f 9 s 2 = 0667Nl+ 9333N2,

d Now although denved from chfferent sources, the two expreasiona labeled (I) and (II)

above are equal, or should be equal, m normalplain text Therefore, one may write

(VI)

(II)

0667N12 + 9 3 3 3 N l + 2 ~ f 9 d E l J + 0667N:l+ 9333N2=0667(N1 2 + 2NlNa+Nl)+ 9333Nl+ 9333N2

76

Expanding the terms of this equation

(VII) ~ l a l l + 2 ~ f 9 d 9 s + ~ f e I 2 = 0667(N1 2 + 2NlNI+ N22)+ 9333Nl+ 9333NI

But from equation (V)

Sunphfymg this equanon

(III) ~ l a l - ~ f a = 0667N2- 0667Ne N o w ~ f a = N

Therefore, expression (III) may be wntten as

(IV) ~ l a l - N = 0667N2- 0667N,

which on reduction becomes

(V) ~ l a l = 0667N2+ 9333N

Thia equationmay bereadas "the sum of the squares ofthe absolute frequencies of a distribution

IS equal to 0667 tames the square of the total number of let ters m the distnbunon, plus 9333times thetotal number ofletters m the distnbution " Theletter 81 18 often used to replace thesymbol ~ l a 21 Suppose two monoalphabetic distnbuaons a re thought t o per ta in to the same Cipher

a lphabe t Now If thev a ctua ll y do belong to the same a lphabe t, and Jf they are correct lyacombined mto a single distnbunon, the lattermust stJ.11 be monoelphabenc in character That

IS, agam representmg the mdividual letter frequencies m oneof these distnbunons bv the generalsymbol fal themdrvidual letterfrequenciesm theother distnbuuon by191' and the total frequencyin the first distnbunon by Nit that in the second distnbuncn by N I , then

3 By "correctly" IS meant that the two dIStrIbutIOns are slid relative to each otherto theirpropersuperImposrtion

80 that equation (VII)may be rewritten thus



and

78

e One mo re pomt will, however, here be added m connectIon With the x test Supposethe verysame two chBtnbutIonsm subparagraph a are agam Juxtaposed, bu t With fa. sluftedone

mterval to the leftof the posmon shown m the subparagraph of reference Thus

{I 4 0 3 0 1 0 0 1 0 0 1 0 0 1 0 0 3 2 2 1 0 1 3 0 2 ------N=26

fOl--- ------------- ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

{B C D E F G H I J K L M N 0 P Q R STU V W X Y Z A ------N2= 17

f9l---- ------------ 2 0 0 0 3 0 0 1 0 1 0 0 1 1 0 0 3 1 1 0 0 0 0 1 2 0

'1-f

o

do

! = 10 = 0226N1"N; 442

The observed ratio (0226) ISsomuch smaller than the expected ( 0667) that It can besaad that Ifthe two distnbunonapertain to the same pnmary components theyare not properlysuperimposed

In other 'lJ)()rd8, thex testmay also beapplud'l.n case8 where tlJ)() ormorefreg:uency d'l.8trtlrutwns m'U8t

be shifted relatwely 'I.n order tofind thetr correct 8'Upertmposmon The theory underlymgthia apph-

cation of the x test ia, of course, the sameas before two monoalphabenc distnbunonawhenprop

erlycombined willyield a smgle distnbutaon which should still be monoalphabene m character

In applyIng the x test m such cases I t may be necessary to smft two 26-element distnbunons to

varioussupenmposmons, makethe x test for each supenmposmon, and take as correct that onewmch yIelds the best value for the test

f The nature of the problemwill, of course, determmewhether the frequency distnbutaonawhich are tobe matched shouldbe compared(1) by directsupenmposraon, that IS, settIng the A

to Z ta.lhes ofone distnbuuon directlyopposite the correspondmgtalliesof the otherdistnbunon,

as m subparagraph a, or (2) by slufted supenmpoeraon, that is, keepmg the A to Z ta.lhesof the

first distnbunon fixed and shdmg the whole sequence of ta.lhes of the second distnbunon tovanous supenmposraens agamst the first

SECTION XIII

APPLYING THE CROSS·PRODUCT OR X TEST

ParagraphStudyof a situanon In which the x test may be apphed_______________ __.___________________________ 49

Solutionof a piogreesrve-alphabetsystem bv means ofthe x test______________________________________________________ 50Alternativemethod ofsolution __ __ _ _ ._______________ 51

49 Studyof a Sltuatlon in wluch the x test may be apphed -a A SImpledemonstration

of how the x-test lS apphed m matchmg frequency distnbutacns may now be set before the

s tu de nt T he problem mvolved lS the solution of cryptograms enciphered according to the

progressrve-alphabet system (par 36b), With secondary alphabets denved from the mteracnon

of two identical JIUXed primary components It willbe assumed that the enemy has beenusmg

a sys temof thIs kmd and that the pnmary components are changed dBJ.1y

b Before attacking an actual problem of thlS type, suppose a few mmutes bedevot ed to a

general analYSlS of ItS elements It lS here assumed that the primary components are based

upon the HYDRAULIC Z sequence and that the CIpher componentISshifted toward the

nght one step at a t ime Consider a CIpher square such as that shown in FIgure 12, which IS

applicableto the typeofproblem understudy It has been arranged in the form ofa deciphenngsquare In t lna square, the hortzontal sequence8 arealltdenncalbut merely shifted relattvely, theletters tMule the square areplatn-text letters

(79)

•



80

ALPHABJ!,T No

1 2 3 < 5 6 7 8 9 10 11 12 13 1<1 15 16 17 18 19 20 21 22 23 2;l 25 26

A A U L I C B E F G J K MN 0 P Q S T V WX Z H Y D RB B E F G J K MN 0 P Q S T V WX Z H Y DR A U L I CC C B E F GJ KMN 0 P Q S T VWX Z H Y D R A U L ID D R A U L I C B E F G J K M N O P Q S T V W X Z H Y

E E F GJ K MN 0 P Q S T V WX Z H X DR A U L I C BF F G J K MN 0 P Q S T V WX Z H Y DR A U L I C B EG G J K MN 0 P Q S T V WX Z H Y DR A U L I C B E F

H H YD R AU L I C B E F G J K MN 0 P Q S T V WX ZI I C B E F GJ K MN 0 P Q S T V WX Z H Y D R A U LJ J KMN 0 P Q S T V WX Z H Y DR A U L I C B E F GK K M N O P Q S T V W X Z H Y D R A U L I C B E F G J

L L I C B E F G J K M N O P Q S T V W X Z H Y D R A Upi

M M N O P Q S T V W X Z H Y D R A U L I C B E F G J K

N N O P Q S T V W X Z H Y D R A U L I C B E F G J K M

I 0 O P Q S T V W X Z H Y D R A U L I C B E F G J K M NI looo P P Q S T V W X Z H Y D R A U L I C B E F G J K M N O

Q Q S T V W X Z H Y D R A U L I C B E F G J K M N O P

R R AU L I C B E F G J K MN 0 P Q S T V WX Z H Y DSST V W X Z H Y D R A U L I C B E F G J K M N 0 P QT T V WX Z HY DR AU L I C B E F G J K MN 0 P Q SU U L I C B E F G J K MN 0 P Q S T V WX Z H Y D R AV V WX Z H YD R AU L I C B E F G J K MN 0 P Q S TW WX Z H YD R AU L I C B E F G J K MN 0 P Q S T VX X Z HY DR AU L I C B E F G J K MN 0 P Q S T V WY Y D RA UL I C B E F G J K MN 0 P Q S T V WX Z HZ Z H Y DR AU L I C B E F G J K MN 0 P Q S T V WX

[Plamtext lettersarewlthm thesquare proper]

FIGUIllI: 12

•c If, for mere purposes of demonstration, instead of letters withm the cells of the square

there are placed tallies correspondmg m number With the normal frequencies of the letters

occupymg the respectrve cells, the cipher square becomes as fol lows (showing only t he 1 st

three rows of the square)

ALPHABET No

1 2 3 <I 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 2;l 25 26

:::::::: ::: i!'i ::: :::-

::::: :::A - :

i!'i ::: i!'i ::: i!'i ::: ::: - i!'i - i!i i!'i ::: § i!'i- ::: ::: - - :::--- - - - - - - -- - - - - - - -- - - -- - -- - - --:::i!'i ::: -

B: - ::: ::: -:: :

i!'i ::: ::: ::: i !' i i !' i 2:: 2:::

?:: -- Z. ::::- -- - ::::: ::::: " ---- - - - - - - - -- - - - - - - -- - -- - - -- - - -- -:::

::::

:::: ::::C

:::

-: :::::

::: - i!'i ::: : ::: i!'i ::: i!i i!'i - - ::: ::: § i!i :: : : ::

FIGURE 1311

81

d It ISObVIOUS that here IS a case wheremIf two drstnbutions pertammg to thesquare are

Isolated from the square, the x test (matching dismbutions) can beapphed to ascer ta in how the

distnbuuons should be shiftedrelatrve to each other so that they(an be supenmposed and made

to Yielda monoalphabenecomposite There is obviously one correct supenmposiuon out of25

pos-abihties In this case, the Brow oftalhesmust be displaced 5mtervals to the nght 1Il order

to match It and amalgamate It WIth the Arow of talhes TIm,>

:::::

::: i!i :::-::

:-- -:: -- -A i!'i :; "'- it. 2;: :g. :; '12:E if - - z.'" .

15, 4 5 6 7 10 11 l' 14 16 17 18 -lq )0 .<1 22 21 '::4 J; 26

----

- -- - - - - -

--- - - - -

--- - - - - - -

--

- -:::-:: :::: i!'i .".

--- -

B 2;: ::: i!'i :::.:::- :.?' ::: ::::: ::::.. ;?

.J ", J5 26 "1 2 5 6 7 8 J 10 11 12 n 14 15 16 17 19 .0 '<1

FlrURE 13b

e Note that the amount of displacement, that IS, the number of intervals the B sequence

must beshrfted to make It matchthe Asequencem FIgure 13b, correspondsexactlyto the dietance

between the letters A and B m the pr imary CIpher component, which IS 5 mtervals Thus0123<15

A U L I C B Thefact that theprimary plain component 1"1m thi« case identical

With theprimaryCIpher component hasnothmg todo with the mat ter The d'/,splacement '/,nterval

'/,s be'/,ng measured on the c'/,phel component It IS Important that the student see t lus pomt very

clearly He can , If he hke , p ro" e the pomt by expenmentmg With two different primary com

ponents

f Assummg that a message 1Il such a system I> to be solved, thetex t IS transcnbed m rows

of 26 letters A umhteral frequency distnbution ISmade for each column of the transcnbed

text, the 26 separate distnbunons bemg compiled withm a smgle square such as that shown m

FIgure 14 Such a squaremay be termed afrequencyd'/,stnbutwnsqoore

9 Now the verticalcolumnsof talheswithin such a distnbution square constitute frequency

diatnbunons of the usual t yp e They show the distnbunon of the various CIpher letters m each

CIpher alphabet If there were many lmesof text, all arrangedm penods of26 letters, then each

column of the frequency square could be solved m the usual manner, by the apphcatron of the

SImple pnnciples of monoalphabetic frequency Bu t what do the horizontal rows of talheswithm the square r ep re sent ? Is I t not clear that the first such row, the A row, merelyshows thedistnbuuon ofA. throughoutthe SUCCeSSIVE CIpher alphabets? And doesnot th'/,s graph'/,c puture

of thed'/,stnbutwnofA. correspondtothe sequence of letters compos'/,ng thepnmary pla'/,n oomponentr

Furthermore, ISIt not clear that what has been said of the Arow of tallies applies equally to the

B. C. D. Z rows? Finally, IS It not clear that the graphicpictures ofall the distnbunons

correspond to the same sequence of letters, except that the sequence beginsWitha different letterIII each row? In other words, all the horizontal rows of tallies within the distnbution square

apply to the same sequence of plain-textletters, the sequencesm one row merely begmnmg WIth

a different letter from that With which another row begms The sequences of letters to wluchthe talhes apply II I the varIOUS rows are merely displacedrelative to one another Now If there

are sufficient data for statistical purposes In the varIOUS horizontalsequences of tallies within the

distnbunon square, these sequences, bemg approxrmately smnlai, can be studied by means of

the x test to find the'/,r rplat'/,t'p d ' / , ~ p l a c e m e n t ~ And m findmg the latter a method IS plOVIdN]

wherE'by the prImary CIpher component may be rE'constrlletE'd,smce the correct absembhng of

the dIsplacement datawIllyw]d the sequenee of letters l'Onstitutmg the prlmaryCIphercomponentIf the plam eomponent 1"1 IdpntICltlWith the elpher component, tIl(> e;oluhon I> ImmE'dlc1tely III

82 83



hand, Ifthey are dIfferent, the solunon IS but one step removed Thus, there has been elabo- b The message IS transcnbed mimes of26 letters, since that IS the totalnumber ofsecondaryrated a method ofsolvmg tlus type ofcipher system vnthout mahng any aB8Umptwns oj values alphabets in the system The transcnbed text IS shown belowfor mpher letters

1 8 4 S 8 7 8 9 ro II " D U ro u ro ro m • H • •60 Solution of a progressive-alphabet system by means of the X test - a The followmg

1 W G J J M M M J XED G C 0 C F T R P B M I I I K Zryptogram has been enciphered according to the method indicated, by progressive, SImple,2 RYNNBUFRWWWWYO IH F J KOKHTTAZnmterrupted slnftmg of a primary Cipher component against an Identical pnmary plain3 C L J E P P FRWCKOO F F FG E PQ R Y Y IW Xomponent

4 MXUD I P F E XM L LWFKGYPBBXCHB FYRYPTOGRAM

lET X H FBI V DIP N X I V R P W T M G IM P TW G J J M M M J X E D G C 0 C F T R P B M I I I K ZRYNN6 EC J BOKVBUQGVG FF FK L Y YCKB IWXB U F R W W W W Y 0 I H F J K

oK H T T A Z C L J

E P P F R 7 MXUD I P F FU YN V S S I H RMH Y ZH AUQWW C K 0 0 F F F G E P Q R Y Y I W X M X U DIP F E X M L L8 G K T I U X Y J J A 0 W Z 0 C F T R P P 0 Q U S G YW F K G Y P B B X C H B FYI E T X H F B I V D I P N X I V9 C X V C X U C J L M L L Y E K F F Z V Q J Q S I Y SR P W T M G IM P T E C J B 0 K V B U Q G V G F F F K L Y Y10 PDSBB J U AHYNWLOCXSDQVCYVS I LC K B I W XMXUD I P F F U Y N V S S I H R M H Y Z H A U11 I W N J OOMAQ S LWY JG T V PQ K P K T L H SQ W G K T IUXYJ J A 0 W Z o C F T R P P 0 Q U S G Y C X12 ROON IC FEVMNVWNBNEHAMRCROVSV C X U C J L M L L Y E K F F Z V Q J Q SlY S P D S B B J13 T X EN H P V B TWKUQ I O C A VWBRQN F J VUAHYN W L 0 C X S D Q V C Y V S I L I W N J 0 o M A Q S14 NRVDOPUQRLKQNFFFZPHURVWLXGLWYJG T V P Q K P K T L H S ROO N I C F E V M N V W N15 SHQWHP JBCNN JQSOQORCBMRRAONBNEHA M R C R 0 V S T X E NHPVB T W K U Q I 0 C A V16 RKWUHYYC IWDGS JCTGPGRM IQMPSWBRQN F J V N R V D 0 P U Q R L K Q N F F F Z PHURV17 GCTNMFG JXEDGCOPTGPWQQVQ IWXW L X G S H Q W H P J B C N N J Q S 0 Q o R C B M R R A 0 N18 T T TCO J V A A A BWMX I H OWHDEQU A I NRKWUH Y Y C I W D G S J C T G P G R M I Q M P S G C T N19 FK FWHP J AH Z I TWZK FEXSRUYQ I O VM F G J X E D G C 0 P T G P W Q Q V Q I W X T T T C 0 J V A20 R ERD J V D KH I R QWEDG EB Y BM L A B J VAABWM X I HOW H D E Q U A I N F K F WHP J A H ZIT21 T G F FG X Y I VGRJ YEK FBEPB J OUAHCW Z K F E XSRUY Q I 0 V R E R D J V D K H I R Q WED G22 UG Z L X I A J KWD V T Y B F R U C C C U Z Z I NEBYBM LAB J V T G F F G X Y I V G R J Y E K F B E P B23 ND FR J FMBHQ L XHMHQ YY YMWQVC L IJ 0 U A H C U G Z L X I A J K W D V T Y B F R U C C C U Z Z 24 P TWT J YQBYR L I T UOUSRCDCVWDG IIN N D F R J F M B HQLXH MHQYY

YMWQV C LIP T 25 GGUBH J V V PWABU J K N F P F YWVQ ZQ FWTJYQ B Y R L I T U 0 U S R CDC V W D G IG G U B H J26 LHTWJPDRXZOWUSSGAMHNCWHSWWV V P W A B U J K N F P F Y W V Q Z Q F L H T W J P D R X Z27 L R YQQU S ZVDN X AN VN KH FUC V V S S So W U S S GAMHN C W H S W W L R Y Q Q U S Z V DNXAN28 P L Q U P C V V V W D G S JOG T C H D E V Q S I JVNKH F U C V V S SSP L Q U P C V V V W D G S JOG T C29 PHQ J AW FR I Z DWXXHC X YC TMGU SE SHDEVQ S I J P H QJAWF R I Z D W X X H C X Y C T M G30 NDSBBKR L VWRVZEEPPPA TO I A N EEUSE S N D S B B K RLVWR V Z E E P P PAT 0 I A NEE31 EEJNRCZBTBLXPJJKAPPMJEGIKREE JNR C Z B T B L X P J J K A PPM J E G I K R T G F F32 TG F FHPVVVYK J E FHQSX JQDYV ZGRHPVVV Y K J E F HQSX J Q D Y V Z GRRHZ QLYXK33 RHZQ LYXKXAZOWRRXYKYGMGZBYNX A Z 0 W RRXYK Y G M G Z BYNVH Q B R V F E F Q L L34 VHQ BR V F E FQ L LW ZE Y L J E ROQ SOQ KWZEYL J E R 0 Q S 0 Q K 0 M W lO G MBKFF LX D X T35 OMW IOGMBKFFLXDXTLW I L PQSEDYL W I L P Q SED Y I 0 E M 0 I B J M L NNSYK X J Z J M36 I O E M O I B J M L N N S Y K X J Z J M L C Z BM SL C Z B M S D J W Q X T J V L FIR N R XHYBD B J U F I37 DJWQXTJVLFIRNRXHYBDBJUFIRJR J I C T UUUSK KWDVM F W T T J K C K C G C V SA G38 I C T U U U S K KWDVMFW TT J K C KCGC VSQ B C J M E B Y N V S S J K S D C B D Y F P P V F D W Z M T 39 AGQ BC JME B YN V S S J K SD C BD Y F P P VB P V T T C G B V T Z K H Q D o R M E Z o 040 FDW ZMTB P V T TCG BV T Z KHQDDRME Z41 o 0



84

Nw=52

~ f v l w = 1 2 2

Nv=53

r 1 0 2 0 0 2 6 4 8 0 0 7 0 0 2 '1 1 1 1 1 0 6 4 0 2 4 Nv=53

IVl 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

IW{ :5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 1 2 3

0 1 0 0 2 8 1 7 6 0 1 0 0 2 3 0 2 1 2 0 4 2 1 1 5 Nw=52

Ivl." 3 0 2 0 0 4 48 4 56 0 0 7 0 0 4 3 0 2 1 2 o 24 8 0 2 20 ~ / v l w = 1 9 0

{

I 0 2 0 0 2 6 4 8 0 0 7 0 0 2 1 1 1 1 1 0 6 4 0 2 4Iv 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 1 6 17 18 19 2 0 21 22 2 3 24 25 2 6

{18 19 2 0 2 1 22 2 3 2 4 25 26 1 2 3 4 5 6 6 8 9 10 11 12 13 14 15 16 17

I." 2 3 0 2 1 2 0 4 2 1 1 5 3 0 1 0 0 2 8 1 7 6 0 1 0 0

Ivl." 2 0 0 0 0 4 0 16 16 0 0 35 0 0 2 0 0 2 8 1 0 36 0 0 0 0

~ v l . " = 122= 044NvNw 2756

TH IRD TEST

F IRST TEST

Ir{ 0 2 0 0 2 6 4 8 0 0 7 0 0 2 1 1 1 1 1 0 6 4 0 2 4 Nv=53

2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

I {24 2526 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23." 0 4 2 1 1 5 3 0 1 0 0 2 8 1 7 6 0 1 0 0 2 3 0 2 1 2 Nw=52

Ivlw 0 0 4 0 o 1018 0 8 0 o 14 0 01 4 6 0 1 0 0 o 18 0 0 2 8 ~ / v l w = 1 0 3~ f v l w = 103= 037NvN w 2756

SECOND TEST

~ / v l w = 190 = 069NvNw 275b

e Smcethelastof the three foregoing tests grves a value somewhat betterthan the expected0661, It looksas thoughthe correctpOSItIOn of the Wdistnbution WIthreference to the Vdiatnbu-taon has been found In practice, several more teats would be made to Insure that other closeapproximataons to 0667 will not be found, but these WIll herebe omi tt ed The test indicates

1 2 3 i

that the primary CIpher component has the letters Vand WIn these positrons V W, SIncethe correctsupenmpositaon requrres that the4th cell of the Wdistnbutionmust be placed underthe 1st cellof theV distribution (seethe last supenrnposition above)

f The next best distnbutaonWIth which to proceed IS theF distnbution, WIth 51occurrencesParalleling the procedure outhned In paragraph 43, and for the same reasons, the F sequenceIS matched agamst the Wand Vsequences separately and then against both Wand Vsequences

85

d The:t test will nowbe applied to the honzontalrowsof tallies In the distribunonsquare,In accordance WIththe theory set forth in paragraph 49g Since this test IS purely statIstIcalIn character and becomesmcreasmgly reliable as the srzeof the distnbutions Increases, It IS bestto start by workmg WIththe two distnbutions having the greatest total numbers of talliesThese are the Vand Wdistnbunons, WIth 53 and 52 occurrences, respectively The results ofthree relatIve displacements of these two distributions are shown below, labeled "J:41rst test,"

"Second test," and "Third test"

46

25

43

88

a1

45

52

44

45

34

39

39

35

43

33

37

31

39

37

N

Fmuftl '14

I I I I-I [ - I ~ I - I ~ I - I I-I I I I -[ 1 ~ 1 ~ 1 - 1I j 1 ~ 1 ~ 1 1 ~ 1 ~ 1 - 1 - 1 - 1 - 1 1 - 1 ~ 1 1 - 1 ~ 1 - 1 ~ 1 1 1 - 1 ~ 1 1

~ 1 ~ C 1 ~ 1 - 1 ~ 1 - / - I - I - 1 I - I ~ I i ~ I ~ 1 l - l g l ~ ~ I § 1 1-

li§! I I I ~ I ~ I I 1-'-' ' - I ~ I ~ I - I '-'-II I 1-' I I I%I I I I I-I I I I I 1-I I 1-I 1I r-

I ~ I ~ I I ~ I ~ ' - I - I ~ I - I I I ~ I ~ I ~ I ~ I I , I ~ I - I - I -~ I ~ I I 1-1-/-/ I 1 - 1 - 1 ~ 1 ~ 1 I - I ~ I ~ I 1-1-1 I ~ I ~ I I ~ I ~

I I I I I 1-' 1 ~ 1 ~ 1 I ~ I ~ I I I ~ I ~ I I ~ I -I I ~ ' ~ ' ~ I ' ~ I ~ I - I ~ I - I I - ' ~ I I I I-I I 1 ~ 1 ~ 1 ~ 1 ~ 1 ~

1 - 1 § 1 ~ 1 ~ 1 ~ 1 ~ 1 ~ 1 - 1 I 1 ~ 1 ~ 1 I - I ~ I ~ I I I I ~ I ~I I 1 ~ 1 ~ 1 I I 1 ~ 1 ~ 1 ~ 1 ~ 1 ~ 1 - 1 ~ 1 ~ 1 I 1 ~ 1 -

~ I ~ I 1-1-' I 1 - 1 ~ 1 ~ 1 ~ 1 % 1 - 1 I I I ~ l - I 1-'-1-' I ~ I < I -~ I - I [ l ~ l - I ~ I : I - I ~ I ] I ~ l - I I I '-I I ~ I ~ I I 1 ~ I - r

\ \ I I I I1=1-1 \-1

I [ I I I I I-I Il-I-I-r-

~ I ~ I - I I ~ l - l 1I I 1 ~ 1 ~ 1 - 1 ~ 1 ~ 1 I I - I ~ I - I I ~ I ~ II J ] ~ I ~ I r-'-I I 1-1-1 1 - 1 - 1 - 1 ~ 1 ~ 1 - I ~ j I I' 14-

I I ~ I ~ J - I j - I - I - I ~ I I ~ ) ~ ) j I ) ~ I ~ I - I ~ I ~ 1~ I ~ I - I - I ~ I 1 - 1 ~ 1 - 1 - - 1 ~ 1 - 1 I ~ I - I - I ~ I ~ I I ~ I % I - I ~ I IT-, I I I I-I I I ~ I ~ I - I I-I I I I ~ I ~ I - r ~~ I ~ I ~ I ] I I - I ~ I - I - I - I ~ I I I ~ I ~ I I I I ~ I - I:I ] ~ I ~ I : I ~ I ~ I ] ~ [ I I - I ~ I - I I-I '-I 1 ~ 1 - 1 ~ 1 ~ 1 - I ' 1-, I I ~ I ~ I ~ I : I I I I ~ I - I - I - I - I - I I ~ I ~ I l ~ l ~

- 1 - 1 ~ 1 ~ 1 I-I I 1 ~ 1 ~ 1 - - 1 ~ 1 ~ 1 \-1 I I ~ I ~ I I ~ I - I ~ I I ~ I ~I - I ~ l ~ l - I I 1 ~ 1 ~ I ~ j ~ j ~ I - I ~ 1 I I-I I I I - I ~

1-1-1 I l ~ j ~ 1 I - I ~ I I I ~ I ~ I I - I ~ I ~ I ~ I ~ I I ~ I - I / ~ I ~I 1 ~ 1 - 1 I 1-1-' 1 ~ 1 - 1 1 ~ 1 ~ 1 I I I-I I ~ l ~ !

1 2 3 4 5 6 7 8 9 10 1 1 1 2 1 3 1 4 1 5 1 6 1 7 1 8 1 9 2 0 2 1 2 2 2 3 2 4 2 6 26 1

Q

R

S

T

U

V

W

X

Y

Z

A

B

C

D

E

F

G

H

I

J

K

L

M

N

o

p

c A frequency distnbunon square IS then complied, each column of the text formmg aseparate distnbunon ill columnarformm the square The latter IS shown ill figure 14

I ? 3 4 ft 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

8687I ",



123 4 6 G 7 8 9 W II U W M n M z

V A L WN 0 X F B P Y R C Q Z IG S E H T D J U MK

at their correct supenrnposmon The following shows the correctrelatrve posrnonsof the threedistnbunons

1 2 4 5 6 7 8 9 10 11 12 14 15 16 17 18 19 20 21 22 24 25 26

1 WG J J MMMJ XED G C 0 C F T R P BMI I I K ZWIT H THE IM P R 0 V E MEN T S IN THE A I

2 RY NNB U F RWWWWY 0 I H F J K 0 K H T T A ZR P LAN E AND TH E MEA N S 0 F COM MUN I

3 CLJEPPFRWCKOOFFFGEPQRYYIWX

CA T IO N AND WIT H TH E V A S T S I Z E 0 F

4 MX UD IP F E X ML L WF K GY P B B X C H B F YMOD ERN ARM I E SST RA T E G I C SUR P R

5 lE T X H FB I VD IP N X I V R P WT M G IM P TI SEW ILL B E COM E H A R D ER A N D H A R D

6 E C J B 0 K V B UQ G VG F F F K L Y Y C KB I WXE R T 0 A T T A I N X I NTH E P RE S EN CEO F

7 MX UD IP F F U Y NV S S I H R MH YZ H A UQW

MOD ERN A V I A T IO N AND F A S T M0 V I N8 G K T I U X Y J J A 0 WZ 0 C F T R P P 0 Q U S G Y

GME C HAN I ZED E L E MEN T S G REA T E R

9 C X V C XU C J L ML LY E K F F Z V Q J QS lY SCOM P LEX I T IE S M0 RES U BTL E DE C E

10 P D S B B J U AH Y NWL 0 C X S D QV C YV S I LP T IO N SST RA T E GEM SAN D F E I N T S W

11 I WN J 0 0 M A QS L WY J G T V P Q K P K T L H SILL H A VET 0 BE E MP LOY E DX I NMOD E

12 ROO N I C F E V MN V WN B N E HAM R C R 0 V SR NWAR FAR E I T IS S T IL L P 0 S S IB L E

13 T X E N H P V B T WK U Q I 0 C A VWB R Q N F J VTOG A I N T AC T I CA L SUR P R I S E B Y MA

14 N R V D 0 P U Q R L K QN F F F Z P H U R VW L X GN YMEA N S XWH I LET HEM E A NS 0 FO B S

15 S H QWHPJ B C N NJ Q S 0 Q 0 R C B MR R A 0 NS E R V I N G AND T RAN S MIT TIN GIN F 0

t Of course, I t IS probable that m pract ical work the process of matching distrrbutions

would be interrupted soon after the pOSItIOns ofonly a fewlet ters in the primary component had

been ascertained For by trymg partially reconstructed sequences on the CIpher text the skele-

tonsof some words would begin to show By fillmg in these skeletons With the words suggested

by them, the process of reconstructmg the components IS much facilitated and hastened

J The components having been reconstructed, only a moment or two IS necessary to as-certain their mitral pOSItIOn m enciphering the message It 18 only necessary to Juxtapose the

two componentsso as togrve "good" valuesfor anyone of the vertical distnbunons ofFIgure 14

This then gives the juxtapositionof the components for that column, and the rest follows very

easilyfor the plain text may now be obtamed by di rectuse of the components The plain text

of the message IS as follows

N,=51

I.fv/F=212

Nv=53{I 0 2 0 0 2 6 4 8 0 0 7 0 0 2 1 1 1 1 1 0 6 4 0 2 4

Iv 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

I {8 9 10 11 1 2 13 14 15 16 17 18 19 20 21 22 23 24 25 26 1 2 3 4 5 6 7., 1 1 2 100 6 3 9 3 0 2 0 0 0 2 1 1 1 2 0 4 2 0 3 7

Ivl., 1 0 4 0 0 0 36 12 72 0 0 14 0 0 0 2 1 1 1 2 0 24 8 0 6 28

I.lvl., = 212 = 078NvN, 2,703

{I 1 5 3 0 1 0 0 2 8 1 7 6 0 1 0 0 2 3 0 2 1 2 0 4 2 Nw=52

Iw 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 1 7 18 1 9 20 21 22 23 2 4 25 2 6

{5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 1 2 3 4

I., 0 3 7 1 1 2 1 0 0 6 3 9 3 0 2 0 0 0 2 1 1 1 2 0 4 2 N.,=51

Iwl., 0 3 35 3 0 2 0 0 0 48 3 63 18 0 2 0 0 0 6 0 2 1 4 0 16 4 'Zlwl.,=21O

'Zlw/F == 210 = 078NwN, 2,703

Smce I t was stated that the problem mvolves identical primary components, both components

are now at hand

g The process IS continued in the foregoing manner unt i l the entire primary CIphercom-

ponent has been reconstructed It IS ObVIOUS that as the work progresses the cryptanalyst IS

forced to employ smaller and smaller distributions, so that statastacally the results are apt to

become less and less certam But to counterbalance this there ISthe fact that the number of

possible supenmposiuons becomes progressively smaller as the work progresses For example,

at the commencement of operations the number of possible pomts for superimposing a second

sequence agamst the first IS 25, af ter the relative pOSItIOns of 5 drstnbutions have been ascer-tamed and a 6th distnbunon If, t o bep l aced m the primary sequence beingreconstructed, there

are 21 possible pOSItIOns, after the relative pOSItIOns of 20 drstnbutions have been ascertaaned,there are only 6 possible pOSItIOns for the 21st distnbunon, and soon

h In the foregoing case the completely reconstructed pnmary CIpher component IS asfollows

{4 0 3 0 0 4 14 5 15 6 0 8 0 0 4 4 1 3 2 3 0 10 6 1 3 9 NH W= 105

I(v+w) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

f {8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 1 2 3 4 5 6 7

, 1 1 2 1 0 0 6 3 9 3 0 2 0 0 0 2 1 1 1 2 0 4 2 0 3 7 N.,=51

l(v+w)/F40 6 0 0 0 84 15 35 18 0 16 0 0 0 8 1 3 2 6 0 40 12 0 9 63 I.ICV+Wl!Jr=422

I.1(v+wJ.,= 422 = 079N(V+WlN., 5,355

1 28 4 a G 7 8The test YIelds the sequence V W F

88 89



1 2 3 4 Ii 6 7 8 9 10 11 12 13 14 Iii 16 17 18 19 20 21 22 21 24 2Ii 26

16 R K WU HY YC I WD GS J C T G P G R MI Q MP SR MAT IO N 0 F T RO O P M 0 V E MEN T S AR E

17 G C T N MF G J XE D G CO P T G P WQ Q v Q I WXG RE A T L Y IM P R 0 V E D0 V E R TH O S E 0 F

18 T T T C 0 J V AA AB WMX I HOW H D E QUA I NTHE PAS T TH E ME C HA N I CA L MEA N S 0

19 F K F WH P J A H Z I T WZ K F E X S R U Y Q I 0 VF M0 V I N GT ROO P S AR E L IK E WI S E F A

20 R E R D J V D KH I R Q WED G E B Y B MLA B J VR S P E E D I E R XA L S 0 F A L S E I N FOR MA

21 T G F F G XY I V GR J Y E K F B E P B J 0 U AH CT I O N CAN B E FA R M0 R E E A S I L Y AND Q

22 U GZ L X I A J K WD VT Y B F R UC C C UZ Z I NU I C KL Y D I S T R IB UTE D X THE L E S S 0

23 N D F R J F M B H Q L X H MH Q Y Y YMWQ v C L IN T 0 BEL EA R NE D FR O MTH E 0 PE N I N G

24 P T WT J Y QB YR L I T U 0 U S R CD C VWDG IP HA S E 0 F AL L E N B Y S BA T T LE O F MEG

25 G GU BH J V VP WAB U J K NF P F YWv Q Z Q FG I D 0 1 S T HA T SU R P R I S E I S P 0 S S I B

LHTWJPDRXZOWUSSGAMHNCWHSWWL E E V E N I N M O D E R N W A R F A R E B U T O N

L R Y Q Q U S Z V D N X A N V N K H F U C V V S S S

L Y B Y PER F E C T D I S C I P L I N EO N TH E

28 P L QU P C v v vWDGS JO G T C H DE V QS I JPAR T 0 F TH E T RO O P SA N D AL M0 S T S U

29 P H Q JA W F R I Z D WX X HC X Y C T MGU S E SP E R H U M A N F O R E T H O U G H T A N D A T T E

30 N DS B B K R L V WR V Z E E P P PA T 0 I A NE EN T IO N T 0 D ET A I LO N T HE P AR T 0 F T H

31 E E J NR C Z B T B L XP J J K A PP M J E G I K RE S T A F F B A CKE D U P B YRES 0 L UTE A C

23 T G F F H P V VV YK J E F H Q S X J Q DY VZ G RT IO N I NT H E A I R XTOM A I N T A I N S E C

33 R H Z Q L Y X KX A Z 0 WR R X Y KY G MG Z B Y NR E C Y M0 V E MEN T S MUS T B E U N D E R C 0

34 V HQ BR V F E F Q L L WZ E Y L J E R 0 Q S 0 Q KV E R 0 FD A R K N E S SA N D C 0 V ER E D B I V

3 5 0 M WI 0 GMB K F F L X DX T L WI L P Q SED Y

o U A CA R E A S MUS T B E 0 C CU P I E D DU R

1 2 3 4 Ii 6 7 8 9 10 11 12 11 14 n 16 17 18 19 20 21 22 23 24 Al 26

36 I 0 E M0 I B J ML N NS Y KX J Z J ML C Z BMSI N G DA Y L I G H TH O U R S X UNO B S E R V E

37 D J WQX T J V L F I R N R XH Y B DB J U F I R JD D A Y L I G H T M O V E M E N T S W I L L R E Q U

38 I C T UU US K KWDVM F WT T J K C K CG C V SI R E TH E RES T R IC T IO N 0 F H 0 S T I L E

39 A GQ B CJ ME B Y NV S S J K S D CB D YF P P VA I RO B S E R V A T IO N B Y AN T I A I R C R A

40 F D WZ MT B P V T T C G B V T Z K H Q D DR ME ZF TA R T I L L E R Y AN D COM BA T A V I A T I

41 0 0o N

WITH THE IMPROVEMENTS IN THE AIRPLANE AND THE MEANS OF COMMUNICATION AND WITHTHE V AS T SIZE OF MODERN ARMIES STRATEGIC SURPRISE WILL BECOME HARDER AND

HARDER TO ATTAIN XIN THE PRESENCE OF MODERN AVIATION AND FAST MOVING MECHANIZEDELEMENTS GREATER COMPLEXITIES MORE SUBTLE DECEPTIONS STRATEGEMS AND FEINTSWILL HAVE TO BE EMPLOYED X IN MODERN WARFARE IT IS STILL POSSIBLE TO GAINTACTICAL SURPRISE BY MANY MEANS XWHILE THE MEANS OF OBSERVING AND TRANSMITTING

INFORMATION OF TROOP MOVEMENTS ARE GREATLY IMPROVED OVER THOSE OF THE PAST THEMECHANICAL MEANS OF MOV ING TROOPS ARE LIKEWISE FAR SPEEDIER X ALSO FALSE

INFORMATION CAN BE FAR MORE EASILY AND QUICKLY DISTRIBUTED X THE LESSON TO BELEARNED FROM THE OPENING PHASE OF ALLENBYS BATTLE OF MEGGIDO IS THAT SURPRISE ISPOSSIBLE EVEN INMODERN WARFARE BUT ONLY BY PERFECT DISCIPLINE ON THE PART OF THE

TROOPS AND ALMOST SUPERHUMAN FORETHOUGHT AND ATTENTION TO DETAIL ON THE PART OF

THE STAFF BACKED UP BY RESOLUTE ACTION IN THE AIR X TO MAINTAIN SECRECY MOVE-MENTS MUST BE UNDER COVER OF DARKNESS AND COVERED BIVOUAC AREAS MUST BE OCCUPIED

DURINGDAYLIGHTHOURS XUNOBSERVED DAYLIGHT MOVEMENTSWILL REQUIRE THE RESTRIC-TION OF HOSTILE AIR OBSERVATION BY ANTIAIRCRAFT ARTILLERY AND COMBAT AVIATION

k The student should clearly understand the real nature of the matchmg process employedto such good advantage 10 tills problem ln pracncally all the previous cases frequency distn-

bunons were made of c ~ p h e r letters occurnng 10 a cryptogram, and the tallies 10 those distnbu-

nons represented the actual occurrences of CIpherletters Furthermore, when these distnbu-

nons were compared or matched, what were being compared were actually Cipher alphabetsThat IS, thetextwasarranged 10 acertainway,so that lettersbelongingto thesame Cipheralphabetactually fell withm the same column and the frequency distnbunon for a specificCipher alphabet

was made by tabulatmg the letters 10 that column Then If any distnbunona were to be com-pared, usually the entire distnbunon applicable to one Cipheralphabet was compared With the

entare distnbuuon applymg to another Cipher alphabet Bu t 10 the problem Just completed,what were compared 10 reality were not frequency distnbutions applying to the columns of the

CIphertext astranscribedonp 83, but graphicrepresentationsof the vananons 10 the frequenciesof platn-text letters j a U ~ n g u1entwal sequences, the ulennne« oj these p l a ~ n - t e x t letters b e ~ n gunknown jor the moment Only after the reconstruction has been completed do their Identitiesbecome known, when the plain text ofthe cryptogram IS established

90 91



COMPONENTS

MESSAGE

D U F F T

Y NUN L etc, etc

V WP X W

A Z VI SWL PN M

CA D U VL ID 0 LX GAM X

I K MK IF N I I G

1 2 3 4 5 6 7 8 U 10 II U 14 W n z

Assumed plain text C OM MAN D IN G G ENE R A L FIR S TAR M YCipher I K M K I L ID 0 L W LPN M V W P X W D U F F T F

12345 6 7 8 9 10 II U 14

TON

Y . Y Y

•

Reference to the plain component will show that the plain-text letters represented by the three

Y's appearm the orderNOT , that 1.3, reversed Withrespectto their order in the plain text

Bu t the intervals between these letters IS cor rect Aga in a consi de ra ti on o f the mechamcs ofthe enciphering system shows why this ISso s ince the CIpher component ISdisplaced one step

With each encrpherment, two identical letters n intervals apart in the CIpher text must representplain-text letters which are n intervals apart m the p lam component In the present case the

di rect ion m which these letters run in the plain component ISopposite to that in which the

CIpher component IS displaced That IS, If the CIpher component IS displaced toward the left,

the values obtained f rom a study of repeated plain-text letters give letters which coincide in

sequence (interval and direction) With the same letters m the CIpher component, the values

obtained f rom a study of repeated CIpher-text letters give letters the order of which must be

reversed m order to make these letters comcide in sequence (interval and direction) With the

same lettersm the plain component If the CIpher component IS displaced towardthe r ight , th i s

relationshrp ISmerely reversed the values obtained f rom a study of the repeated plam-text

lettersmust be reversed m theirorderwhen placing them m the CIpher component, those Yieldedby a study of the repeated CIpher-text letters are insertedin the plain componentm their ongmal

order

e Of course, I f the primary components are identical sequences t he d a ta from the two

sources referred to in subparagraphs c and d need not be kept separate bu t can be combined

and made to Yield thepnmary component very quicklyj WIth the foregoing pnnciples as background, and given the followmg message, which IS

assumedto begmWith COMMANDING GENERAL FIRST ARMY (probable-wordmethod of attack),

thedata yielded by this assumed text are shown in FIgure 15

MESSAGE

d Now consider the repeated CIpher letters m the example under b There happens to be

onlytwo cases ofrepetition, both involving Y's Thus

(1 )(2)

(3)

(4)

(5 )

(6)

FIR S T B AT T AL IO N

128 4 5 6 7 8 U 10 II U 14

I II K

T T TX P Y

A AS T

Plam _

Cipher _-------------laIn _CIpher _

- - - - - - - - - - - - -lam _

CIpher _

Plam_________________ H Y D R A U L I C B E F G J K M N 0 P Q S T V W X ZCipher F B P Y R C Q Z IG S E H T D J U M K V A L W N 0 X

1234567891011121314

Plain FIR S T B AT T AL IO N

Cipher E I C N X D S PY T U K Y Y

c Certa in le tt e rs are repeated m both plam text and CIpher text Consider the formerThere a re two I 's, three T's, and two A's Their encipherments are Isolated below, for con

vemence in study

61 Alternative method of solution -a The foregoing method of solution IS, of course,

almost entirely statastical in nature There IS, however, another method of attack whichshould

be brought to notice because m some cases the statist ical method, mvolvmg the study of rela

trvely large distnbutions, may not be feasiblefor lack of sufficient text Yet in these cases theremay be sufficient data in the respective alphabets to permit of some assumptaons of values of

CIpher letters, or there may be good grounds for applying the probable-word method The

present paragraph will therefore dealWith a method of solving progreasrve CIpher "ystems whichIS based upon the apphcanonof the pnnciples of mdirect symmetry to certain phenomena ansmg

from the mechanics of the progressive encipherment method Itselfb Take the two sequences below and encipher the phrase FIRST BATTALION by the pro

gressrve method, slidmg the CIpher component to the leftone interval after each encipherment

The two I' s in l ine (1) are 10 letters apart, reference to the CIpher componentWill show that the

interval between the CIpher equivalent of the first I p (which happens t obe Ie ) and the secondI p(wluchISKe) 18 10 Conai de ra ti on of the mechamcs of the enciphering system soon shows why

this IS so: since the CIpher component ISdisplaced one step With each encipherment, two identicalletters n intervals apart in the plain text must Yield CIpher equivalents which are n mtervals

apart m the Cipher component Exammanon of the data in l ines (3) and (4), (5) and (6) will

confi rm thisf inding Consequently, I t would appear that m such a system the successful apphcation of the probable-word method of attack, coupled withm indirect symmetry, can quickly

lead to the reconstruction of the Cipher component

92 93



FIGUREH

128 4 5 6 7 8 D m 11 d

CIpher______________ N I I G XGAM X CADPlaIn________________ I LEO R

The word after ARMY 18 probably WILL TIus leads to the msertion of the letterW n the plam

component and Gm the ciphercomponent In a shorttune both components can be completely

estabhshed9 In passmg, It may be wel l to note that in the illustrstrve message m paragraph 50a the

very frequent occurrence of tnpled letters (MMM, WWW, FFF, etc) mdrcatee the pre sence o f a

frequentlyused shortword, a frequently used ending,or the hke, the letters of which are sequentm the plam component An astute cryptanalyst who has noted the frequency of occurrence

of such tnplets could assume the value THE for them, go through the entlre text replacmg all

tnplets by THE, and then, by applymg the principles of md1rect symmetry, build up the plain

componentm a short tune WIth that much as a start, solunon of the entlre message wouldbe

constderably sunphfied.h The pnncrples eluCldated m this paragraph may, of course, also be applied to cases of

progressrve systems in wluch the progression 18 by mtervals greater than 1, and, WIth necessarymochficatlons, to cases in which the progression 18 not regular bu t follows a speCIfic pattern, such

as 1-2-3, 1-2-3, , or 2-5-7-3-1, 2-5-7-3-1, and 80 The latter types of progres&lOnare encountered m certam mechanical cryptographs, the study of wluch will be reserved for

future texts

letters m the message, gaps bemgfilled m from the context For example, the first few letters

after ARMY decipher as followsI _I--- - - - - - - - - - - - - - - - - - - - - - -K

I-- - - - - - - - - - - - - - - - - - - - - - - - - -M

>-- - - - - - - - - - - - - - - - - - - - - - - - - -K

f--- - - - - - - - - - - - - - - - - - - - - - - - - -I

I-- - - - - - - - - - - - - - - - - - - - - - - - - -L

- - - - - - - - - - - - - - - - - - - - - - - - - I-I

- - - - - - - - - - - - - - - - - - - - - - - - - -DI-- - - - - - - - - - - - - - - - - - - - - - - - - -

0>-- - - - - - - - - - - - - - - - - - - - - - - - - -

L>-- - - - - - - - - - - - - - - - - - - - - - - - - 1-

WI-- - - - - - - - - - - - - - - - - - - - - - - - - -

L>-- - - - - - - - - - - - - - - - - - - - - - - - - 1-

P- - - - - - - - - - - - - - - - - - - - - - - - - -

N'- - - - - - - - - - - - - - - - - - - - - - - - - - -

f- -M

- - - - - - - - - - - - - - - - - - - - - - - - -V

I-- - - - - - - - - - - - - - - - - - - - - - - - - -W

I-- - - - - - - - - - - - - - - - - - - - - - - - - -P

f- - - - - ---- - - - - - - - - - - - - - - - - - - - I-X

I-- - - - - - - - - - - - - - - - - - - - - - - - - -W

I-- - - - - - - - - - - - - - - - - - - - - - - - - 1-

- D- - - - - - - - - - - - - - - - - - - - >-- - - - ,--- '

-U

- - - - - - - - - - - - - - - - - - - - - - - - -F

f-- - - - - - - - - - - - - - - - - - - - - - - - - I-F

f-- - - - - - - - - -1- - - - - - - - =1= - -- - - -T

- -- I-F

ABC D E F G H I J K L M N 0 P Q R STU V WX Y Z

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

1 2 'J 4 5 6 7 8 9 10 11 12 18 14 15 16 17 18 19 20 21 22 23 24 25 26

Plam ________________ AL I C E F G M N 0 S YDR

CIpher_______________{D MKV L WN 0 F P I T

• X

Analys18 of the data afforded by FIgure 15, in conjunction with the principles of indirect sym

metry, YIelds the followmg partial components

Settmg the two partial components mto juxtaposinon so t hat Cp=I . (first encipherment) the

8th value, Ip=De• gives the posrtion of DIn the ciphercomponent and permits the addmon of X

to I t, these being two letters which until now could not be placed into posiuon m the ciphercomponent WIth these two partasl sequencesIt becomes possiblenow to deciphermany other



+f z( z - l )

XN(N- l) ,

2 ", 2 or

(X) Expected value offA(jA-l)+fB(jB-l)+ +Jz( fz- l)=",N(N-l)

If for the left-hand side ofequataons (IX) and (X) the symbolE IS used, then theseequations

become

where E(4)) means the average or expected value of the expression m the parenthesis, IC" and

", are the probabihties of monographic comcidenoe ill plmn and in random text, respectivelyd Now il l normal English plam text It has been found that IC,,= 0667 For random text

of a 26-1etteralphabet IC,=

038 The re fo re , e quat ions (XI ) and(XII) may

now bewntten

thus(XIII) For normalEnglish plain text E ( ~ , , ) = 0667 N(N- l )

(XIV) For random text (26-1etter alphabet) E(4),)= 0385 N(N- l )

e By employmgequations (XIII) and (XIV) It becomes possible, therefore, to test & p lNe

of text for monoalphabetacityor for "randomness" That IS, by USIng these eqnauons ooe canmathematlcally test a very short cryptogram to ascertain whether It 18 .. monoolphabMlcallyenciphered substrtutaon or involves several alphabets so that for a ll practical purposes It IS

equrvalent to random text ThIS test has been telmed the 4> test

64 Applying the 4> test - a GIven the following short piece of text, IS It likely that It IS

normal EnglIsh plain text enciphered moncalphabencally"

N=25

E(4),,)=IC,,N(N-l)

E(4),)=IC,N(N-l),

FOI plain text

For random text

ABCDE FGH I J KLMNOPQR STUVWXYZ~ ~ ~ ~ ~

(XI)

(XII)

For this case the observed value of ep IS

(1XO)+ (1XO)+ (2Xl)+ (3X2)+(4X3)+ (2X 1) + (1XO)+ (4X3)+ (2X 1) + (1XO)+ (1XO)+

(3X2)=2+6+12+2+12+2+6=40

If t1us text were monoalphabenoally enciphered English plain text the expected value of 4> IS

E(4),,)=K,,N(N-l)= 0667X25X24=40 0

If thetext were random text, the expected value of 4> IS

E(4),)=K,N(N-l)= OJ85X25X24=23 1

The conclusion IS warranted, therefore, that the cryptogram ISprobably monoalphabetic subsntunon, smce the observed value of ep(40) more closely approximates the expected value for

English plain text (400) than It does the expectedvalue for random text (23 1) (As a matter

of fact, the cryptogram was enciphered monoalphabetically )b Here IS another examp le G iven the followmg series of l et te rs , does I t r ep re sent a

selection of EnglIsh text enciphered monoalphabetacally o r does I t more nea rly rep re sent a

random selection of letters?

YOU I J ZMMZZ MRNQC XIYTW RGKLH

ParagraphPurpose of the • t es t __ _ 52

Derivation of the • test_______________________________________ _ • 5:1

69. Purpose of Ule (pm) test - a Thestudenthas noted that the X test IS basedupon thegeneral theory of comcidences and employs the probability constants ICp and ICr There ISonemore test of a. related nature which may be useful for hun to understand and Its explanationwUl be given il l the succeeding paragraphs

it In paragraph 48e I t was stated that two monoalphabeuo distnbuuons when correctlyoombmed will yie ld a smgle distnbunon which should sWI be monoalphabenc ill characterThIS question anses, therefore, ill the student's mmd I s t he re a test whereby he can ascertam

mathematlcally whether a diatnbution IS monoalphubeno or not, especially ill the case of onewhich has1'elatlvely few data? Such a test has been devised and IS termed the "4> (phi) test"

68. Dennt1oJ1 of the 4> test.-a Consider a monographicor umhteral frequency distnbutaon

which IS monoalphabetac m eomposmon If there IS a total of N letters il l the distnbutaon,N(N - l )

ill a system il l which there are n possible elements, then there ISa possible total of --2--pairs ofletters (for compansonpurposes)

b Let the symbolfA represent thenumber ofoccurrences of A,fB the number of occurrences

of B, and so on tofz WIthregard to the letter A then, there are fA if;-1 ) comcidences (Agam

the cornbmanons of fA thmgs taken two at a time ) WIth r egard to the letter B, there are

f B ( f ~ - I ) comcidences, and soonup tofz(fz

2-

1)coincidences for the letter Z Now It has been

N(N- l )seen that accordmg to the " test , ill 2 compansons of letters formmgthe two members

IC N(N- l )of pears of letters in normal Enghsh plain text, there shouldbe P .2 comoidences, where

""IS the probabihty of monographic coincidence for the language III question

C Now the expected value o ffA(f;-I) + f B ( f ~ - I ) + + f z ( f ~ - I ) ISequal to the theoret-N(N- l )

ical number of comcideneea to be expected in 2 c ompa nsons of two l et ter s, which for

N (N - l) N (N - l)normal plam text IS"" times 2 and for random text IS IC, nmes 2 That IS, for

plam text

Expectedvalue o ffA(fA-l)+fB(a- 1)+ + fz(fz-l) xN (N - l )2 2 2 IC" 2' or

(IX) Expected value of fA ( jA- l )+fB( jB- l )+ +f z(f z - l)=KpN(N-l), and forrandomtext

Expected value of fA(fA-l) -ti-B(f B- l ) +2 2(94)

SECTION XIV

THE "MONOALPHABETICITY" OR "4> TEST"

96



The distnbunon and caloulation are as follows

ABCD E F GH I J K LMNO P QR S T UVWXYZ- - - ~ - ~ - ~ - - -- - - ~ ~j ( j - l ) . . 0 0 0 2 0 0 0 6 0 0 0 2 0 0 0 0 2 6

' ] ; j ( l - I)= 18 (That 18, observed valueof cI>= 18)

E(cI>p)= 0667X25X24=40 0 (That 18, expected value of cI>p=40 0)

The conclusion 18 that the series ofletters does not represent a selection of English text monoalphabetically enciphered Whether or not I t represents a random selectaon of letters cannot

be told, but It may be saad that If the letters actually do constitute a cryptogram, the latter IS

probably polyalphabetically enciphered (As a matter of fact, the latter statement 18 true, forthe message was enciphered by 25 alphabets used m sequence)

c The cI> test is, of course, closely related to the X test and denves from the same general

theory as the latter, which IS that of coincidence When two monoalphabetic distnbutaonshave been combmed intoa single distnbunon, the x testmay beappl iedto the latter as a checkuponthe til test. I t 18 also useful m testing thecolumns ofa supenmposinon diagram, to ascer

tam whetheror not the columnsare monoalphabetic

SECTION XV

CONCLUDING REMARKS

Paragraph

Ooneludmg remarks on apenodre substrtutrcn systems --------_.----------- 55SynoptIc table • • ••------------- 06

55. Concludmg remarks on apenodie subsntunon systems.--a The various systems

described m the foregomg pages represent some of the more common and well-known methodsof mtroducmg complexities in the general scheme of cryptographic substrtunonWith the viewto avoiding or suppressmg periodicity There are, of course, other methods for accomphshmgthis purpose, which, while perhaps a bit more complex from a practical pomt of VIew, yield moredesirable results from a cryptograpluc point of VIew That IS, these methods godeeper into the

heart of the problem of cryptographic secuntyand thus make t he task of the enemy crypt

analyst much harder But studies based on these more advanced methods will have to be

postponed at this time, and reserved for a later textb Thus far in these studies, aside from a few remarks ofa verygeneral nature,no attention

has beenpaidto that other large and Important class of CIphers, VIZ, transposraon It 18 desir

able, before gomg further With subsntunon methods, that the student gam some understandmgof how to solve certain of the more SImple vanenes of transposition CIphers Consequently,

m t he text to succeed the present text, the student WIll temporanly lay aside the vanous usefulmethods and tools that he has been given for the solution of substatution CIphersand will turn

hISthoughts toward the methods of breakingdown transposition CIphers56. SynOptIC table.-Contammg the plan mstituted in preVIOUS texts, of summanzmg the

textual material m the form of a very condensed chart called An Analyncel Key for MihtaryCryptanalysis, the outlmefor the studies covered by Part II I IS shown on p 119

(97)



b The peculiar nature of the phenomenon Just observed,mz, a completiondiagram With the

vert ical sequences in adjacent columns progressing m opposite directions, those in alternate

columns m the same drrectIOn, calls for an sxplanataon Although the matter seems rather

mysterious, It WIll not be hard to understand First, It IS not hard to see why the l e tters mcolumn 1 of FIgure1 should form the descending sequence QPO for these letters are merely

will nowbe shown Talongthe two Ciphergroups under considerataon,let them be "decrphered"

WIthmrnal key letterA

CIpherm m __mmn n mn --- mn - mm QVGLBTPJ'l'FDeciphered With keyletter A ·. QFBKRCNWXI

The deciphered text IS certamly not "plain text" But If one completes the sequences imtiated

by these letters, using the direct standard sequence for the even columns, the reversed standard

for the odd columns, the plain text sequence IS seen to reappearon onegeneratnx I t ISHOSTILEFOR( eE) From this It appears that mstead of going through the labor of making 26 successive

trials, which would consume considerable time, all that IS necessary IS to h av e a set of strips

bearing the normal direct sequence and another set bearing the reversed normal sequence, and

to align the strips, alternately direct and reversed, to the first "deCipherment" The plam text

will now reappear on one generatnx of the compl enon dIagr am (SeeFig . 1 )

APPENDIX 1

ADDITIONAL NOTES ON METHODS FOR SOLVING PLAIN-TEXT AUTO-KEYED CIPHERS

ParagraphIntroductory remarks __ 1

~ m p l e "mechanical" solution 2

Another "mechanical' solution.c, __ 3Solution of plain-text auto-keyed cryptograms when the Introductory key IS a.word or phraae.,., 4Subsequent steps after determmmg the length of the mtroductory key __ _ 5Conversion of foregoing apenodrocipher into periodic form, _ 6Ooneludmg remarks on auto-key systems _ 7

1. Introdu<nory remarks.-a In paragraph 33of t he text proper It was indicated that the

method elucidated in paragraph 32 for solving plain-text auto-keyed ciphers IS l ikely to be sue

cessful only If the cryptanalyst has been fortunatem hIS selecnon of a "probableword" Or, to

pu t It another way, If the "probable words" which hIS imagmataon leads him t o a ssume to be

present m the text are really not present , then he IS unfortunate, for solution will escape him

Hence, It 13 desirable to point outother prmciples and methodswhich are not sosubjectto chanceBut because most of these methods are applicable only in special cases and because m generalIt

IS true that auto-key systemsare no longercommonlyencounteredin practical militarycryptog

raphy, It '\\88 thought best to exclude the exposition of these prmcrples and methods from the

text proper and to add them In an appendrx, for the study of such students as find them ofparticular mterest

b A complete dISCUSSIOn of the solution of plam-text auto-key systems, With examples,

would requirea volume in I tsel f Onlyone or two methods wil lbe descnbed, therefore , leaving

the developmentof addmonal principles and methods to themgenmty of thestudent who Wishes

t o go more deepl y i nt o the subject The discussion herem Will be presented under separate

headings , dependent upon the types of primary components employed

c As usual, the types ofprimary componentsmay be classified as follows

(1) Primary components arc identrcal

(0.) Both components progress m the same drrection

(b) Both components progress in opposite directions(2) Pnmary components are different

2. SImple "mechanical" solution - a (1) Taking up the cas e whe re in the two identical

primary components progress m the same drrection, assume the following additional factors tobeknownby the cryptanalyst

(a) The primary components are both normal sequences

(b) The encipherment IS by plain-text auto-keying

(c) The encrphenng equauons are 8k /2=81 /1 ,8p / I=8C !2

(2) A message begmnmg QVGLB TPJTF IS intercepted, the only unknown factor IStheimnalkey let ter Of course, one could try to decipher the message using each keyletter m

turn, beginning With A and contmumg until the correct key letter IS tried, whereupon plain text

will be obtained But It seems logical to tlunk that all the 26 possible "decipherments" might

be derived from the first one, so that the process might be much simplified, and tills IS t rue, as

(98)

Initialkeyletter

AB

eD

EF

G

HI

J

K

L

M

N

oP

QR

S

T

U

VW

X

Y

Z

Q V G L B T P J T FQ F B K R C N WX IPGALQDMXWJo H Z M PEL Y V K

N I Y N 0 F K Z ULMJXONGJATM

L K WPM H I B S NK L V Q L I HeR 0J MURK J G D Q PI N T S J K F E P QH 0 S T IL E FO R *G P R U H M D G NSF Q Q V GN e HMTE R P WFO B I L U

D SOX EPA J K Ve T N Y D Q Z K J WBUM Z e R YL I XAVLABSXMHYZ WK BAT WNGZY X J e Z U V0 F AX Y I D YV UP E BWZ HEX WT Q D eV A G F WX S ReDU B F G V Y R S B ETeE A U Z Q T A FS D D I TAP U Z G

R E e J S B 0 V YHFIGURE 1

100 101



,. ,

the ones resultmg from the successrve "decipherment" of Qc by the successive key letters A,B,C, Now since t he "decipherment " o btained f rom t he 1st cipher letter in any row mFigure 1 becomes the key letter for "deciphering" the 2d cipher letter in the same row, It IS

apparent that as the letters m the 1st column progress m a reversed normal (descending) order,the letters m the 2d column must progress m a direct normal (ascendmg) order The matter

may perhaps become more clear If encipherment IS regarded as a process of addmon and decipherment as a process of subtraction. Instead of primary components or a Vigenere square,one may use simple anthmetic, assignmg numericalvalues to the letters of the alphabet, beginnmg WithA=0 and ending With Z=25 Thus on the basis of the pair ofenciphermg equations

~ ( 2 = 8 1 ( 1 J 8p(I=8c 2 the letter H, enciphered by key letter Mk With direct primary componentsYieldsTc Bu t using the followingnumerical values

ABCD E F GH I J K LMNO P QR S T UVWXYZo 1 23 4 6 6 7 8 9 ro II U H W M U W

the same result may be obtamed thus f!pCMk)=7+12=19=Tc Every nme the number 25 IS

exceeded m the addrtion,one subtracts 26fromIt and finds the letter equivalentfor theremainder In decipherment, the process IS one of subtraction 1 For example Tc(Mk=19-12=7=Hp , Dc(Rt)=3-17=[(26+3)-17]=29-17=12=Mp Using this anthmencal equivalent ofnormal shdmg-stnp encipherment, the phenomenon Just noted can bebetdown m the form ofadiegram (FIg 2) which will perhaps make the matter clear

1 It WIll be noted that If the le tters of the alphabet a re numbe red f rom1 to 26, In the usualmanner, theantbmencal method must be modified Ina minor particular Inorderto obtain the same results as are given byemploying the normal VIgeneresquare ThIS modificatron eonsists merely In subtractmg 1from the numericalvalueof the key l et te r T hu s

ABCDE FGH I JKLMNOPQRS TUVWXYZ1 23 4 6 6 7 8 0 W II U H UM U W

H,,(Mk)=8 + (13-1) =8 + 12=20=T.T.(Mk) =20- (13-1) =20-12=8=H"

For an mterestmg extension of the bssic Idea Involved In anthmetic cryptography, seeHill, LesterS Cryptography an A l g e b r a ~ c Alphabet American Mathematical Monthly, Vol XXXVI,

No 6,1929

Ibid Concermng c e r t a ~ n bnear transformatton apparatusof cryptography American Mathematrcal Monthly,

Vol XXXVIII, No 3,1931

Q V G L B T P J etc

Qc(AlIJ=16- O = 1 6 = Q - - ~ Q F B K R

V ( ) =21-16= 5=F : T 111Gc(Ft)= 6- 5= 1=B ---'

Le( Bk)=ll- 1=10=K :Bc(Kk)= 1-10=17=R : i,, ,

* * * * * * * * * * * * * * * * * * * * * *

,oo

* * * * * * * * * * * * * * * * * * * * * *

Qc(Cc)=16- 2=14=0-----.0 H Z M P

Vc(Ok)=21-14= 7=H : r 111GC(Hk)= 6- 7=25=Z . :

L (Z )=11-25=12=M : : :c t I I , I

Bc(Mk)= 1-12=15=P : : : :

FIGVRE2

Note how homologous letters of the threerows (joined by verticaldotted lines) form alternatelydescending and ascendmg normal sequences

c When the method ofencipherment based uponenciphenngequations ~ 1 2 = 8 1 / 1 ' 8p(2=80 /1

IS used instead of the one based upon enciphenng equations ~ ( 2 = 8 1 / 1 J 8p /1= 8cflh the processindicated above 18 simplified by the fact that no alternation m the direction of the sequences

In the completion diagram IS required For example

CIpher Y H E B PDT B J D

Deciphered A=A________ Y F J K Z C V W F I

ZGKLADWXGJ

AHLMBEXYHK

B I MN CF Y Z I LC J NO D G Z A J MDKOPEHABKN

E L P Q FIB C L 0F M QR G J C D M PGNRSHKDENQ

*H 0 S TIL E FORFIGvaz3

d (1) In the foregoing example the primary components were normal sequences, but the

case of Identical mixed components may behandled m a similar manner Note thefollowingexample, based upon the followmg primary component (which IS assumed to have been reconstructed from previous work)

F BPYRCQZ I G S EHTD JUMKVALWNOX

Message____________ U SIN L Y Q E 0 P •• • etc

100102



MESSAGE

X T WZ L X H Z R X

FIGURE 6

V D D NeT S EPAZ V C I Y UQ L V X

I A Q G R MZ WAFG L Z S C KIN L BS WI E Q V G 0 WPENG H Z A S X N YH 0 S T IL E F 0 R*T XED G WH B X CD F H J S N T P F QJ BT U E 0 D Y B ZU P D MH X J R P IMY J K T F U C Y GK R U V D B MQ R SV CMA J P K Z C EA QK L U Y V I Q HL Z V WMRAG Z TWI A N K CLS I DN G L 0 V Q WE G J

o S WX A Z N H S UX E NF L lO T E MF HOB WG X D H KB T X P NSF J T VPDF Y 0 E BUD AYJBRXHPMJLR U P eFT Y K U WCM Y Q B D R V M NQ K R Z P J C A K 0Z V C I Y UQ L V X

IWvu. .

XTWZLXHZRXC J NOD G Z AJ M

D K 0 P E H A B K NE L P Q F IB C L 0F MQ R G J eD MPG N R S H K DEN QH 0 S T IL E F 0 R*I P T U J MF G P SJQUVKNGHQTK R VWL 0 H I R ULSWXMP I J SVMTXYNQJKTWNUYZORKLUX

o V ZAP S L M V YP WA B Q T MNWZQ X B C RU N 0 X ARye D S V 0 P Y BS Z D E T WP Q Z C

T A E F U X Q R A DU B F G V Y R S B EV C G H WZ S T C FWD H I X A T U D GXE I J YBUVEH

Y F J K Z C V WF IZ G K LAD WX G JAHLMBEXYHKB I MN C F Y Z I L

U S IN L Y QE 0 PWDAY K E LUI AN T L P V S WJ G Vo H WBAG N D S KX E NFL lO T E MF SO X WZ X H H UB G X 0 N Q F E T JP IE N 0 CBS D DY Z B WX R P G J TR Q P L F Y Y I U HC C Y A B P R Z M EQ R R V P B C Q K SZ Y C K Y F Q C V GI P Q MR X Z R A IG B Z U CO l Y L ZS F I J Q N G P WQE X G D Z WS B N CH 0 S T IL E F 0 R*

TNEHGAHXXYD WH E S V T 0 F PJ L T S E K D N B PU A D G H M J WP FMV'JI1 'UULYX}{KUZbJMARO

VMM Q I D K V C NAUK CUT V K Q WLJVRMHAMZL

1 I 1 I 1 I 1 I 1 I

V X U D JF U Y L

V D DNeT S EPA

Plam component.c.r... F B P Y R C Q Z IG S E H T D J U M K V A L W N 0 XCIpher component.L,, X 0 N W L A V KMU J D THE S G I Z Q CRY P B F

Note here that the primary mixed sequence ISused for the completion sequence and that the

plain text , HOSTILE FOR(CE), comes out on one generatnx I t IS immaterial whether the

direct or reversed mixed component IS used for the complet ion sequence, so long as all the

sequences m the diagram progress in thesame d ir ec ti on (See FIg 6)

j (1) There remains now to be considered only the c as e m which the two components

are different mixed sequences Let the two primary components be as follows

Plam_________________ AB C D E F G H I J K L MN 0 P Q R ST U V WX Y ZCipher F B P Y R C Q Z IG S E H T D J U MK V A L W N 0 X

and the message

(2) The procedure in this case IS exactly the same ah before, except that It IS not necessary

to have any nlternataon m direction of the completion sequences, WhICh may be either that of

the plam component or the CIpher c ompo ne nt Not e t he solution in FIgure 5 Let the s tudent

ascertain whv the alternation m direcuon of the completion sequences 18 not necessary in this

case(3) In the foregomg case the alphabets were reversed standard, produced by the shding

of the normal sequence against ItSreverse Bu t the underlying prinoiple of solution 18 thesame

even If a mixed sequence were used instead of the normal, so longas the sequence ISknown, the

procedure to befollowed IS exactly the same as demonstrated in subparagraphs (1) and (2) hereof

Note the following solutron

(2) FIrs t, the message 16 "deciphered" wrth the mrtial key-letter A, and then a completion

diagram IS established, usmg shdmg s tr ip s beanng t he mixed primary component, alternate

stnps bearm-; the reversed sequence Note FIgure 4, m WhICh the piam text, HOSTILEFOR( CE}, reappears on a single genere.trrx Note also that whereasm FIgure 1 the odd columns

contain the P!unary sequence m thr- rover-sed order, and t he even columns contam the sequence

in the direct order, II I FIgure 4 the situation IS reversed t he odd columns contam the pnmary

sequence m tl.o direct order, and t he even columns con tam the sequence m the reversed order

ThIS point IS brought to notice to show that It IS immaterial whether the direct order IS used

for odd colurrns or for even columns, t1><, aliernaium. tn direciurn. IS all that IS required m this

type of solution

e (1) Thrre IS next to be con'lldE'H',lthe case m which the two prnnary components progress

m OPPOSltp du ocnons [par I c (1 ) (b)] Here IS a message, known to have been onoiphored by

reversed standard alphabets, plum-text auto-keymg having been followed

104105

(4) When the plain component IS also a mixed sequence (and dif ferent f rom the CIpher



Now prepare a stnp bearing the ciphercomponent reversed, and set It below the plain component

so that Fp=L o, a s et ti ng g rven by the 1st two l et te rs o f the spunous "plam text" recovered

Thus'

Plam____________ A B C D E F G H I J K L MN 0 P Q R S T U V WX Y Z

CIpher__________ F X 0 N W L A V K M U J D T H E S G I Z Q C R Y P B

(3) Now OPPOSIte each letter of the completion sequence in column 1, write I ts plam

component equivalent, as given by the Juxtaposed sequences above This grves what IS shown

m FIgur e 7b Then reset the two sequences (reversed cipher component and the plain component) so that Qp=Fo (to correspond WIth the 2d and 3d l et te rs o f the spunous plam text),

wnte down the plain-component equivalents of the l et te rs m col umn 2 , f ormmg col umn 3Contmuethis process, scannmg the generatrices from tune to trme, resettmg the two componentsand f indmg equrvalents f rom column to column, unti l I t becomes evident on what generatnx

the plain text IS reappearing In FIgure 7c It IS seen that the plain text generatnx IS the one

begmnmg HOST, and f rom this point on the solution may be obtamed direct ly, by usmg thetwo primary components

D Q X J Dessage_________ B B V Z U

B B V Z U D Q X J DV Y R I Y Z E F O R

I Q N J

G E Y G

X V W Z

L L K 0

*H 0 S T

Y K BA H H

J M V

Z D X

M J G

N G J

F B E

o I ZR T L

P U IE R 0

Q S A

D N eS P Pe e FT F QK A UU Z M

WX D

Plam., W B V I G X L H Y A J Z M N F O R P E Q D S e T K U

CIpher .______ F B P Y R e Q ZIG S E H T D J U M K V A L W N 0 X

FIGURE S.

CIpher B B V Z U D Q X J D

"Plain" (8k=X)

V Y R I Y Z E F O R

To solve the message, "decipher" t he t ex t WIth any arbitrarily selected nutial keyletter and

proceed exactly as m subparagraphs (2) and (3) above Thus

Note the completion diagram in FIgure 8 which shows the word HOST very soon m the

process From this pomt on the solution may be obtained directly, by using the two primary

components

component), the procedure IS identacal WIth that outlmed m subparagraphs (1)- (3) above.The fact that the plain component in the preceding case IS the normalsequence IS ofno particular

significance in thesolution,forIt actsas a mixed sequencewould act under SImilar circumstances

To demonstrate, suppose the two fol lowing components were used in encipherment of the

message below

FIGUBII t«IGURE 76lGt7BE 7a

(2) FIrst "decipher" the message WIth any arbrtranly selected mrnal key letter, say A,and complete the plamcomponentsequence in the first column (FIg 7a)

Cipher e F U Y L V X U D J e F U Y L V X U D J e F U Y L V X U D J

Plam________ L F Q X W X A W S F L F Q X W X A W S ELF Q X W X A W S E

M M J M J B e

N N1D N Dey'-'

o o e oeLI

P P Y P Y N G

Q QU Q U A J

R RW R W U N

S SQ S Q K L

T T N T N T Q

U U K U K Y A

V VH V H E S

W WE W E F D

X X B X B P B

Y YX Y X R Z

Z Z T Z T D P

A AG A E H R

B B Z B Z J O

e e v e V X E

D DM D M Z W

E E P E P O F

F F A F A W H

G GR G R M M

H H 0 *H 0 S T

I IS ISG

J JL JLV

K KI KII

106

3. Another "mechanical" solution -a Another "mechanical" solution for the foregoing

107

d The s tudent h as probably already noted that the phenomena observed m this sub



cases will now be descr ibed because It presents rather mterestmg cryptanalytic sidelights

Takethe message

b NO\\ suppose the message has been intercepted and IS to be solved The only unknown

factor wil lbe assumed to be the nuual key l et te r L et t he message be "deciphered" by means

of any nutral key letter," say A, and then note the underscored repetmons m the spurious plain

text

paragraph are the same as those observed m subparagraph 2b In the latter subparagraph It

was seen that the drrectaon of the sequences in alternate columns had t o be r ever sed m order

to bnng out the plain text on one generatnx If this reversal IS not done, then obviously the

plain text would appear on two generatnces, which IS equivalent to having the plain text reducedto two monoalphabets

e When reciprocalcomponentsare employed, the spunous plain text obtained by "decipherment" with a key settmg other than the actual one will be monoalphabetac t hroughou t Not e

the following encipherment (with uutral key scttang Ap=Ge , using a reversed standard sequenceshdmg agamst the direct standard) and It" "decipherment" by sett ing these two components

Ap=A.Plain text,.. R EF E RE N C E HIS PRE FE R E N C ECipher P N Z B N N R L Y X Z Q D Y N Z B N N R L Y

Spurious plain text., L Y Z Y L Y H WY B C M J L Y Z Y L Y H W Y

Here the spurious plain text IS wholly monoalphabettcj The reason for the exceptaon noted m footnote 2 on page 106 now becomes clear For

If the actual imtaal key letter (G)were used, of course the decipherment yields the correct plaintext, If a letter 13intervalsremoved from G IS used as the key letter, the CIpheralphabet selected

for the first "decipherment" IS the reciprocal of the real rmtial CIpher alphabet and thereafter

all alternate CIpher alphabets are reciprocal Hence the SpurIOUS text obt ai ned fr om such a"decipherment" must be monoalphabetic

g In the foregoing case the prImary components were identical normal sequences progressmgin the same direction If they were mixed sequences the phenomena observed above would

still hold true, and solong as the sequencesare known, the indicated method of solution may beapplied

h When the two primary components ale known but differently mrxed sequences, tillsmethod of solut ion IS too involved to be practical I t IS more practicable to try successive

imnal key letters, notmg the plain text each t ime and resettmg the strips until the correctsettmg has beenascertamed, as will be evidenced by obtammg mtelhgible plain text

4 Solut ion of plain- text auto-keyed cryptograms when the Introductory key IS a word or

phrase -a In the foregoing discussion of plain-text auto-keymg, the introductory key was

assumed to consist of a single letter, so that the subsequent key letters are displaced one letter

to the r igh t With respect to t he t ex t of the message Itself Bu t somet imes a word or phrasemay serve tills function, in which case the subsequent key IS displaced as many letters to the

right of themiual plain-text letter of the message as there are letter" in the imtial key Tills

will not, as a rule, interfere in any way With the apphcation of the pnnciples of solution set

forth m paragraph 28 to that part of the cryptogram subsequent to the introductory key, and

a solution by the probable-word method and the study of repetitaons can be r eached However ,

It may happen that tnal of this method 1<; not successful in certain cryptograms because of the

paucity ofrepetitaons,or because offailureto find a probableword in thetex t When the Cipher

alphabets are known there IS another point of attack which IS useful and mterestmg The

method consists in finding the length of the introductory key and then solving by frequencyprmcrples Just how tills IS accomplished WIll now be explained

b Suppose that the introductory key word ISHORSECHESTNUT, that the plain-textmessage18 as below, and that identical primary components progressing in the same direction are used

1-2E FK Z

E R

K LE N

K H

C EI Y

C H

I B

AR

G S

T SS T

11011....

1- 2 1-2E F R E

K Z X Y

ER N C

K L T WENE BK H K V

C EO 0I Y U I

INK So H Q M

R EA NXY GH

FED RL Y J L

1-2

R E

X Y

F E

L YR E

X Y

N CT W

E H

K B

I So M

P R

V L

REFERENCEIS PRE FER E NC E I NR EF E RE N C E C H AR T S

CIpher __ m X V J J V V R P G L P A H G V J J V V B P G M V E LU"Plain text" X Y L Y X Y T W K B 0 M V L K Z K L K H I Y 0 H X Y L Y

Cipher V V R P G FPC Y C S N Q U V J J V V R P G G J H Y K L

"Plum text" X Y T W K V U I Q M G H J L K Z K L K H I Y I B G SST

The ongmal four 8-letter repetations now turn out to be two

different sets of 9-letter repetttions TIllS calls for an explana

tion Let the SpUriOUS piam text , With I ts leal plam text be

transcribed as though one were dealmg WIth a per iodic CIpher

mvolving two alphabets , as shown m FIgure 9 It wil l here be

seen that the letters in column1 are monoalphabetic, and so aret hose m col umn 2 In other words, an auto-key CIpher, which

IS commonly regarded as a polyalphabetic, apenodic CIpher, has

been converted into a 2-alphaLet, periodic CIpher, the individualalphabets ofwhich are now monoalphabetic m nature The tworepetmons of X Y L Y X Y T WK represent encipherments of

the word REFERENCE, m alphabets 1-2-1-2-1-2-1-2-1, the two

repetrtaons of L K Z K L K H I Ylikewise represent encipherments ofthe sameword but in alphabets2-1-2-1-2-1-2-1-2

c Later onI t wil lbe seen how t il ls method of oonvertmgan

auto-key CIpher mto a penodic CIphermay be app li ed t o the

case where an introductory key word IS used as theuutial keying

element insteadof a single letter, as in the present case

, Except the actual key letter or a letter 13intervalsfrom It See subparagraph (7) below

and encipher It by plain-text auto-key, with normal dn ect primary components, mitral key

settmg All=GC Then not e t he underscored repetitions

R EF E RE N C E HIS P RE F ER E N C E I N REF EX V J J V V R P G L P A H G V J J V V R P G M V E V J J

R E N C E BO O K SA N D REF ER E N C E C H AR T SV V R P G FPC Y C S N Q U V J J V V R P G G J H Y K L

R EF ER E N C EBO O K SAN D

109

6 7 8 9 io 11 12 13

T

:I 3 4 51 2 3 4 5 6 7 8 9 1 0 11 12 13 1

(1) Key H 0 R SEC H EST NUT

108

to encipher the message, by enciphenng equation 81;12=8, /1 ' 8 p/1=8 c/2 Let the components

be the normal sequence The encipherment ISas follows



EX

•

1 2 3 4 5 6 7 8 9 10 11 12 13

T Mew J V M PSG X C L

D eN I NO N Y GU O I N

P T Q G ! R X F J IMC E X U J ! WDYXA ZR K G V A MX K F 0 D WNG L KE B H P F WQ Z R HX S KENMI A J C F G KPYX I Y MP R X E 0 P QWWRVCWJ SEW F Z MC LO P I U GWA X WU G

VMF Y X J X ! Z F E VE U R Z R H H GUT Q B G

FIGURJ: 10

1 2 3 4 5 6 7 8 9 10 11 12

T M WJ VMpsg X CL D N I NON Y guoI N PET X Q G T R X F

JIM C E E X U J T W D

Y X A Z R KG VAMXK

E 0 D WN G L K F B H PEWQ Z R H X S K F N MI A J C F G K PYX I Y

MP R X 0 P QWWR VC W J S W F Z M eL 0P I U G WA X WU GyMF Y X J X WZ F WEyE

U R Z R H H GUT Q B G

1311922-39-8

•

(2) Plam___________ T(3) C Ipher _

1 28 4 5 6 7 8 9(1) Key E

(2) PlaIn___________ T •

(3) CIpheL._______ X

Here It Willbe noted that Ep m hne (2) has a Tp on either SIdeof It, at a distance o f 13mtervals,

the first enerpherment (Ep by TI<) Yields the same equrvalent (X.) as the second encipherment

(Tp b y ~ ) Two Cipher letters are here idenncal, at an interval equal to the length of the mtro

ductory key Bu t the converseIS nottrue, that IS,not every pair of identtcal letters in the CIphertext represen ts a case of tlus type For in this system Identi ty m two Cipher letters may be

the result of the following three conditions each having a statrstically ascertamable probabilityof occurrence

(1) A g iv en plain-text letter ISenciphered by t hesame key letter two different times, at an

interval which IS purely accidental, the CIpher equrvalents are identical bu t could not be used

to g ive any mformation aboutthe length of the mtroductory key

(2) Two different plain-text letters are enciphered by two different key le tt e rs , the Cipher

equrvelents are forturtously identical

(3) Ag iv en plam-text letter ISenciphered by a g iven key letter and later on t hesame plain

textletter serves to encipher another plain-text letter which IS identical WIth the first key letter,

the CIpher equivalents are causally rdentical

It can be proved that the probability for rdentiues of the third type IS greater than that for

identrtaes of either o r b ot h 1 st a nd 2d types jor that uiteroal w h ~ c h corresponds unih. the length

ojthe ~ n t r o d u c t o r y key, that IS,Ifa tabulation IS made of the intervals between identical letters in

such a system as the one being studied, theintervalwhichoccurs most frequently should comcide

With the length of the mtroductory key The demonstration of the mathematical basis for thisfact IS beyond the scopeof the present text, bu t a practical demonstrationWill be convincing

d Le t the illustrative message be transcribed in lines of say 11, 12, and 13 letters, as mFIgure 10

1 2 3 4 6 6 7 8 9 10 11

T MeW J V M PSG X

C L DeN I NON Y G

U 0 I N PET X Q G TR X F JIM C E E X U

J T WD Y X A Z R K gV A MX K F 0 D WN gL K F B H P F WQ Z RH XS K F N MI A J CF G KEY X I Y M P R

X E 0 E QWWR VC WJ S E F Z MeL 0 P

lU G A X W U G V M

F Y X J XWZ F WE VE U R Z R H HG U T Q

B G

123 4 G 6 7 8 9 ro II U U H W n ro

Key -__________________ H 0 R SEC H EST NUT M Y L EFT F LAN K I S

Plam_________________ M Y L EFT F LA N K I S R E c s r V I N G H E A V

Clpher_______________ T Mew J V M PSG X C L DeN I NON Y GU O I N

Key R E c s r V I N G H E A V Y ART ILL E R Y FIRPlain Y ART IL L E R Y FIR E ENE M Y IS M ASS I

Cipher PET X Q G T R X F JIM C E E X U J T W D Y X A Z

Key E ENE M Y IS M ASS I N G T RO O PST 0 L E F

Plam_________________ N G T ROO PST 0 L E FT FRO N TAN D CON CCipher R K G V A M X K F 0 D W N G L K F B H P F W Q Z R H

Key T FRO N TAN D CON C E N T RAT I N GAR T I

Plam_________________ E N T RAT I N GAR TI L L E R Y T HE R EX W ICipher X S K F N M I A J C F G K PYX I Y M P R X E 0 P Q

Key L L E R Y T HE R EX W ILL NEE D CON SID E

Plam_________________ L L NEE D CO N SID ERA B L ERE I N FOR CCIpher W WR V C W J SEW F Z M eL 0 P lU G WA X WU G

Key R A B L ERE I N FOR C E MEN T S TO M A I N T

PlaIn_________________ E MEN T S TOM A I N T A I N M Y P 0 SIT IO N

Clpher.._____ V M F Y X J X W Z F WEVE U R Z R H H GUT Q B G

It will now be noted that since the introductory key contains 13 letters the 14th letter of the

message ISenciphered bythe 1st letterof the plam text, the 15th bythe 2d, and so o n Li kewi se ,

the 27 th letter 18 enciphered b y t he 14th, the 28th by the 15th, and s oon Hence, If t he 1 st

cipher letter 18 deciphered, this will give the key for deciphenng the 14th, the lat ter Willgive

the key for the 27th, and so on An important step m the solutaon of a message of this kindwould therefore involve ascertammg the length of the mtroductory key This step will now

be explained

c Since the plain text Itself constrtutes the key lettersm this system (after the mtroductory

key), these key letters Willoccur with theirnormal frequencies, and this means that there willbe many occurrences of E, T, 0, A, N, I, R,S, enciphered by EI<, there will be many occurrences

of these same high-frequency letters enciphered by TI<' by 01<, by AI<, and so on In fact, the

number of tunes each of these eombmations will occur may be calculated statrstacelly WIth

the enciphenng condinons set forth under b above, Ep enciphered by TI<, for example, will Yieldthe same CIpher equivalent as Tp enciphered by m other words two encrpherments of any

parr of letters of whicheither may serveas the key for enciphering theother must Yield the same

cipher resultant 8 It IS the cryptographic effec t of these two phenomena working together

which permits of ascertammg the length of the mtroductory key m such a c as e For every

time a given letter, 8p , occursm the plain text It Willoccur n letters later as a key letter, 81<, and

n m thIs caseequals the length of the mtroductory key Note the followmg illustranon

I It 18 important to note that the two components must be identrcal sequences and progress in the samedirection If thIs 18 no t the case, the entire reasomng 18 mapphcable

110111

b Inspection of the result'! of these three t r ia ls soon shows that the entire senes of 26In each transcnptaon, every pair of superimposed letters IS noted and the number of rdentitaes

IS mdicated by ringing the letters involved, as shown above The number of identit.es for nn

II

II II'I

II



I'IOUIII: 11

(a) Flrqt column of 1< l l l u r ~ 10 (c)• d,cI\,hrred Ib) nrbt column of F I ~ u r c ,0 (r) 'du1\lhucd'I ,) 1< Irbtcolumn of FlJlure 10(,) d,clphcleuwilli IDltldi O.=A wrth III1t1slO.-B With O.-C

c It will be noted that the vertical sequences m adjacent columns proceed m oppos ite

directions, whereas those in alternate columns proceed ill the same direction The explunation

for t lus alternation ill progression IS the same as m the

previous case wherein tlns phenomenon was encountered

(par 2b), a nd t he s equenc es m FIgur e 12 may now be

completed very quickly The diagram becomes as shown

m Figure 13

d One of the horizontal hnes or generatnces of figure

13IS the correct one, that IS, I t contams the ac tua l plain

text equivalents of the 1s t, 14 th , 27th, letters of the

message The correct generatnx can be selected by mere

ocular examina tion , a s IS here possible (see generatnx

marked by asterisk m Fig 13), or It mav be selected by a

frequency test, assignmg weights to each letter accordmg

to Its normal plam- text f re quency (See pa r 14} of

M u ~ t a r y G r y p t a n a l Y 8 ~ 8 , Part II )

FIGUBB13

FIGURE12

CIpher letters of Col I , Fig 1L T D P C R G X P W C V E

A_________ T K F X U ML E S K L T

B_________ S LE Y T N K F R L K UKeyletters C R M D Z S 0 J G QM J V

~ _ ~ ~ ~ ~ ~ - ~ ~III 1III 1III 1

tr ials need not be made, for the results can be obtained from the very first tnal This may be

shown graphioally by supenmposmg merely the r esu lts of the first three tnals hOTlzontallyThus

e Identicalp ro cedu re I S fo llowed With r e sp ec t to c olumns 2, 3 ,4 , o f F I gu re 10c,WIth

the result that the mitaal key word HORSECHESTNUT ISreconstructed and the whole message

may be now decipheredquite

readily

T D P C R G X P WC V E

TKFXUMLESKLT

SLEYTNKFRLKU

R MD Z S 0 J G QMJ VQ N CAR P I H P N I W

P 0 B B Q QH I 0 0 H Xo PAC P K G J N P G Y

N Q Z DOS F K M Q F Z

M RYE N TE L L R E A*

L S X FMUDMKSDB

K T W G L V C N J T C C

J U V HK WB 0 I U B DI V U I J X A P H V A E

HWT J I Y Z QGWZ FGXSKHZYRFXYG

FYRLGAXSEYXH

E Z QMF BWT D ZW ID A P N E C V U C A V JC BO O D D U V B B U K

B C N P C E TWA C T L

ADMQBFSX ZDSM

ZELRAGRYYERN

YFKSZHQZXFQO

X G J T YIP A W G P P

W H I U X JO B V H 0 Q

VIHVWKNCUINR

U J GWV LM D T JM S

1 2 1 4 R 7 l! 0 10 1 1 12 II

TMCWJVMPSGXCL

R

D

M

P

D

C

Z

R

SGoXJP

G

W

QCM

V

JE

V

, 2 , 4 f> 7 II 0 10 1 1 12 13-MCWJVMPSGXCL

S

D

L

P

E

CY

R

TGN

XK

P

FWR

CL

VK

EU

1 2 3 4 R 7 l! 'I 10 II 12 l>

TMCWJVMPSGXCL

T

D

K

P

F

C

XR

UGM

XL

P

E

W

S

CK

V

LE

T

assumed mtroductory-key length 13 IS9, a s agamst 3 for the assumption of a key o f 11 letters,

and [) for the assumptionof a key o f 12 letters

e Once having found the length of the introductory key, two hne s o f attack are pos-able

the compositaon of the key may be studied, wlnch "Il l yield sufficient plam te"{t to get a st ,11t

toward solution, or, the message may berodured to penodic te rms and solved asa repeatmz-kev

CIpher The first hne of attack will be discussed hrst, I t being constantly borne m mmd In tln.,

paragraph that the entrre dISCUSSIon ISbased upon the assumption that the CIpher alphaLets

are known alphabets The illustratrve message of b above "i l l be used6 Subsequent steps afterdetermmmg the length of the mtroductory key -a Assume that

the first letter of the introductory key IS A and decipher the 1st CIpher letter Tc (WIth direc tstandard alphabets) Thrs yields Til andthe lat ter oecomcs the key letter for the 14th letter of

the message The 14th letter 1"1 deciphered D. (Tt)=KII , the latter becomes the keylet ter for

the 27th letter and soon , down the entire first column of the message ns transcribed ill lines of

13 letters The same procedure IS followed usmgB as themmal key letter, then C, and s oon

The message asIt appearsfor the first three tnals (assuming A,B, then C as the Iwt1l11 keyletter)

IS s hown m FIgur e 11

112

6 Conversion of foregomg apenodio eipher into periodic form -a In paragraph 4 I t was

stated that an aperiodic CIpher of the foregoing type may be reduced to penodic terms and

113

Now wnte down the real plain text of the message m hnes of26 letters Thus



solved as though It were a repeatmg-key CIpher, provided the primary components are known

sequences The baSIS of the method l iesm the phenomena noted m paragraph 2b An examplewil l be g iven

b Let the Cipher text of the message of paragraph 4b be se t down again, as in FIgure 10c

2 3 • 6 6 7 8 0 10 11 12 13

T M C W J V M P S G X C LD C N I N 0 N Y G U 0 I NP E T X Q G T R X F J I M

C E E X U J T W D Y X A ZR K G V A M X K F 0 D W NG L K F B H P F W Q z R HX S K F N M I A J C F G KP Y X I Y M P R X E 0 p QW W R V C W J S E W F Z MC L 0 P I U G W A X W U GV M F Y X J X W Z F W E VE U R Z R H H G U T Q B G

FIGVBB IOC

Using direct standard alphabets (Vigenere method), "decipher" the second line by means of

the first hoe, that IS, taking the letters of the second hoe as Cipher text, those of the first lme

as key letters Then use the thus-found "plain text" as "key letters" and "decipher" the thud

lme of F Igure lOc, as shown in Figure 14 Thus

"Key" T M C W J V M PSG X C LCIpher D C N I NON Y GUO I N

"Plam" K Q L MET Z J 0 0 R G C

"Key" K Q L MET Z J 0 0 R G C

Cipher PET X Q G T R X F JIM

"Plam" F 0 I L M NUl J R S C K

FIGVBB 14.

Continue this operation for a ll the remammg hnes of FIgure 10c and wnte down the resul ts in

lmes of 26 letters Thus

1 2 3 t 6 6 7 8 9 W 11 U 13 HUM tl 13 ill

T M C !! J Y. M PSG X .Q L K g L MET f! 0 0 R G C

F 0 I L MNUl J R S .Q K X g !! M I W f! Q UHF Y .eU U K J S Q Y W L H Y Y Y M R A W J B R ~ L J ~ T JL B K J E V R R Y TEN B E X N Z U R Y A Z L K C P- - - - -- -S Z E ! ! I F L § F L Y . X X K M K T A P V E V M ~ X J~ A V F X U C § E T y ' H M T U ! ! U Y N F Q Q A V U U

FIGVBB16

1 2 3 4 6 6 7 8 0 W 11 U 13 HUM tl 13 ill ~ ~ ~ ~ ~MYLEFTFLANKISBECEIVlliGHEAV

YARTILLERYFIREEliEMYI§MASSI

N G T ROO PS T 0 L EFT FRO N TAN D CON C

ENTRATINGARTILLERYTHEREXWI

LLNEEDCONSIDERABLEREINFORC

E MEN T S TOM A i N T A N M Y P 0 SIT iON- - - - - - -

FIGVBB16

c When the underhned repetatrons m FIgures 15 and 16are compared, they are found to beidentacalm the respectrve columns, and If the columnsof FIgure 15are tested, they will be found

t o b e monoalphabetic The Cipher message now grves every mdicanon of being a repeatmg-key

Cipher It IS not difficult to explam this phenomenon in the light of the demonstration given in

paragraph 3g FIrst, let thekey word HORSECHESTNUTbe enciphered by the following alphabet

ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

A Z Y X W V U T S R Q P 0 N M L K J I H G FED C B

"Plam" H 0 R SEC H EST NUT

"CIpher" T M J I WY T W I H N G H

Then l e t t he message MY LEFT FLANK, etc , be enciphered by direct standard alphabets as

before, but for t he k ey a dd t he monoalphabetic equivalents of HORSECHESTNUT TMJIW to

thekey Itself, that IS,use the 26-letter key HORSECHESTNUTTMJIWYTWIHNGH m a repeatmg-key

manner Thus (Fig 17)

123 • 6 6 7 8 9 W 11 U 13 HUM tl 13 ill ~ ~ ~ ~ ~ ~ ~Key H 0 R SEC H EST NUT T M J I W Y T W I H N G H

Plam_________________ M Y L EFT F LAN K I S R E C E I V I N G H E A VCipher T M C WJ V M PSG X C L K Q L MET Z J 0 0 R G C

Plain Y ART IL L E R Y FIR E ENE M Y IS M ASS I

Cipher F 0 I L MNUl J R S C K X Q WM I W Z 0 UHF Y P

Plam_________________ N G T ROO PS T 0 L EFT FRO N TAN D CON CCipher U U K J S Q Y WL H Y Y Y M RAW J R R J L J B T J

Plam_________________ E N T RAT I N GAR TIL L E R Y T HE R EX W ICipher L B K J E V R R Y TEN B E X N Z U R Y A Z L K C P

Plam_________________ L L NEE D CON SID ERA B L ERE I N FOR CCipher S Z E W I F L S F L V X X K M K TAP V E V M B X J

Plam_________________ E MEN T S TOM A I N T A I N M Y P 0 SIT IO N

Cipher L A V F X U C SET V H M T U W U U N F 0 Q A V U U

FiGtTBB 17

The Cipher resultants of this process of e n c ~ p h e n n g a messagecomcideexactly Withthose obtainedfrom the "deevpheruu;" operation that gaverise to FIgure15 How does thishappen?



116

(4) Now note that the sequenceslomed by arrows m FIgure 186 and care idenneel and smceIt IS certam that FIgure 18c IS penodicm form becauseIt was enciphered by the repeatmg-key



INDEX

Identity or comeidence, - - - __________________ 58Idiomorplnsm , - - - __________________________ 8

Indlcators_________________________________ 56

Influence letter 21

Inltl&lkey ============================- 2 ~ 3 2nterlocking messagesby r epe tr ti ona__________ 56Intermittent cOInCldences____________________ 18

Interruptmg a cyche keying s eq ue nc e_ __ __ __ __ 1 9

Interruptingthe key, three basic methods of.__ 19Interruptions, key Ing________________ _____ 19

InternIptor________________________________ 21Cipher-text letter a'l - - - ___ ________ 25Plain-test letter as 21

Disadvantages of._ -_ -- -___ ____ 27Introductorykey 28,32

Consistingof more than one letter____ 32, 45, 107Irregular mterruptions In keying s eq ue nc e_ __ __ 19Isomorphie sequences_______________________ 11

IsomorphismDetection of - - - -- - - -________ ____ 11

Hlustration of the use o f 11,39

Phenomena of._ -_______________________ 11

Isomorphs, blockmgout o f. __________________ 14

56

58

631

4

5

19

50

50

Page

8

81

2,19

16

5

General solution for Ciphers mvolvmg a longkeying scquence _

Groupmgs

Constant-length plain-text _Irregular _

Variable-length, plain-text _

Kappa test _

AppheatIOn of. _Keymg, fixed _

Keying cycles, mteraetron of _

KeyIng umtsConstant length _Variable length _

Keys, extended,nonrepeatmg, runnmg _7550 Lengthemngkeys _

(117)

112

112

7358100

1

1

Page1 Formulae, idiomorphie _

Frequencydrstnbution square _

1811922-39--9

ApenodIc systems _

ArIthmetIcal equivalent of normal shdmg-stnpenCipherment_________________ ________ 100

Auto-key eneipherment, two baSIC methods of- _ 28

Auto-key systemsSolutionof 28,98

Oharectenstres of- ______________________ 31

Concluding remarks on_ ____ 48

Auto keyingCipher text 28,30

Plam text 28, 45, 98

AVOIdIng periodrcrty, methods of-_____ _______ _ 1

Base letter-- - - 32, 36

BaSIC period masked by apenodic repetationa.;, 16Blocking out lsomorphs______________________ 14

Blocking out words_________________________ 14Book as key 5,50,51,53,74

Enclphenng equations _

Enclpherment by wordlengths _Extendedkeys _

Chi test; _ 73,89

ApplyIng the 77,79

Derivanon 0'-__________________________ 75

Example of appheation 0'-_______________ 79

In matchmg shifted distnbutro na, ________ 77Nature of- __________ _______ _____ 74

Oomeidenee test_ _________________ ____ 58

ApplIcatIOn o f____ _________ ____ 63B&81c theory of______ ________ 58

Oomeidence,mtermrttent, , __ _______ ______ 18

Oombmmg mdividual frequency distnbutiona,_ 74Companaons for cOIncidence_________________ 60

Constant-length, plam-text groupmgs_________ 2,19Contmuous-key system 50,51

Conversion of an apenodie CIpher Into periodicform _

Convertingauto-key text to penodie terms _Cross-product or x test _

Cryptanalytic comeidenee test _CryptographiC anthmetie _

CryptographIC penodicity, nature of _Cychc phenomena _

OrlillnalOlpherta t Onglnalcipher te n Repeatingkey encipher

BUdconvertedtext ment

TUESDAYINFORMA

LHZEMOY LHZEMOY LHZEMOYPFRBMVM PFRBMVM T IONFRO

AMQFYJK AMQFYJKHRKCXRN _- - -0 HRKCXRN MRELIAB

HDAHVAX HDAHVAXBNMXOJZ BNMXOJZ LESOURCIQMEJ JW IQMEJJW

HMKBRJA HMKBRJA E SIN D I CPCWFASW 0-------- PCWFASW

EZEVKBY EZEVKBY ATESTHE

TBAAKTU TBAAKTU

• b

FIOURE18

'l. The foregomg procedures mdicate a SImplemethod of solvmg Ciphers of the foregomg

types, when the pnmary components or the secondary Cipheralphabets are known It consistsin assummg mtroductory keys of vanous lengths, convertmg the Cipher text mto repeatmg-keyform, andthen exammmg the resultmg diagrams for repetitions When a correct key length IS

assumed, repetitionswill be as numerous as should be expected in Ciphers of the repeatmg-key

class, incorrect assumptions forkey lengthwillnot show somany repetitions3 All the foregoing presupposes a knowledge of the CIpheralphabets mvolved When these

are unknown, recoursemust be had to first prmeiples and the measages must be solved purely

upon the basis of probable words, and repetinons, as outlmed m paragraphs 27-28

method, It follows that Figure 18b IS now also m periodicform, and il l that form the message

could be solved as thoughIt were a repeatmg-keycipherII. (1) In case of pnmary components COnsISting of a directnormal sequence shdmg agarnst

a reversed normal (U S Army disk), the process of convertmg the auto-key text to penodieterms IS accomplished by using two direct normalsequences and "deeaphenng" each lme of thetext (as transcnbed m periods) by the lme above It For example, here ISa message auto

enciphered by the aforementioned disk, With the lnltlal key word TUESDAY

TUESDA YI I NFOR MAT ION FRO MRELI ABLE SOU RCESIN DI C

INFORMATIONFROMRELIABLESOURCESINDICATESTHELHZEMOYPFRBMVMHRKCXRNBNMXOJZHMKBRJAEZEVKBY

(2) The Cipher text IS traascnbed in penods equal to the l ength of the minel key word

(7 letters) and the 2d lme IS "deCIphered" With key letters of t he 1st lme, usmg enciphenngequations ~ f J = 8 1 / l ' 8p /1=8CJ 'lhe resultantletters are then used as keylettersto "decipher"the 3dlmeof text and soon '1he results are as seen in FIgure 19b Now le t the originalmessage be e'M'/,phered m repeatmg-key manner by the disk, With the key word TUESDAY, and the

result IS FIgure 19c Note that the odd or a l te rna te lmes of Figure 19b and e are Identical,

showing that the auto-key to'\.thas been convertedmto repeatmg-key text

118



Page

52

14

515

19195

46

Vanable-IengthGroupings of keymg sequence _Key eneiphermg _

Plain-text groupmgs _

Vigenere method _

Wheatstone cryptograph _

9 Word habits of the enemy, farmharrty with _Word-length eneipherment, solution of , _

3 Word separators _

RepetItIons-ContmuedNonper!odIc____________________________ 3

Partially penodlc_______________________ 3Slgnlficant_____________________________ 25

62 Resultant key 4,52

73 Runnmg-key cipher, solution of 53,56,63,7194 Runmng-key system; _____ 51

58Secondarykey 4,52

50 Separators, word____________________________ 15

Sequences, umnterrupted____________________ 2651 Solution by supenmpositron 23,53,583 Spunous plain text 43,104

Statistical test____ _ ________________ 26

Stereotypie phraseology_____ 14

8 Supenmposable penods______________________ 23

8 Superimposed sequences and the comeideneetest_____________________________________ 58

4 Supenmpo&tIon____________________________ 5316 BaSIC pnnciples of- ______________ ____ 53

Correct and mcorrect____________________ 58Solution by __ _________ _ 53

Dlagram_______________________________ 61Synoptic table 97, 119

Symmetry of posrtion, direet., __ ___________ 9

1,50

52

Makmg th e IC test, general procedure _Matclung of frequency distributaons _MonoalphabetIclty or ~ test , _Monographic comcidenee, probabilrty of _

Lengthy keysSystems usmg _

Mechamcal methods of producing _

Nonrepeatmg key system _

Overlap _

Partial penodierty _

PatternsIdIomorpluc _

~ o r d _

Period, apparent, basic, complete, hidden,

latent , patent , pnmary, resultant, secondary;Penodieity, masked _

PeriodsComponent____________________________ 4Bupenmpcsed, _ ____________________ 23

Plu test___________________________________ 94

Applylng______________________________ 95Denvatron of-_____ _ __ ___________ 93Purpose of._ __ ______ ___________ 93

Related to X test_______________________ 96

Probabihty, theory of-______________________ 58

Probabilrty of monographic comcldence________ 58

Progressive-alphabet cipher, solution of- 52,55,82Progressive alphabet system 52, 55

Reconstruction skeleton _

RepetitionsCompletely penodie _



506-AperlOdlc systems(1-54)

"I '

I

71'"

616-Systems using lengthykeys (34-54)

I Ir i g ' , ! ..,~ R u n I 1't6-ProgresDing ke y sy s I

s lv e a l ph abe ttems (35, 36a, systems (36b, 39-37-38, 40-54) 40,41-54)

I I816-Introduc 816-Introduc-

t ory k ey IS a tory key IS a

smgle letter (23- word or phrase(23, 2M, 26, 30-26,27-29)33)

616-Auto key systems(23-33)

I I716-Clpher 716 -P l a l n

text au tokeytext au to key

mg (27-33, Apmg (23-26)pendix 1)

I I

o

714-Interrupto r IS a Ciphe rtext letter (2122)

614-Varlable l engt h k eymgumts encipher constant lengthplaintext groupings (17-22)

713-Interruptor IS a plamtex t l et te r (Ill20)

[Numbers In parentheses refer to Paragraph Numbers In this text)

Analytical Key for MIlitary Cryptanalysis, Part III

613-Constan t length keyingUOltS encipher vari able lengthplaintext groupings (2-16)

I I711-Varlable-

length p la i n 712 -Wordtext groupings l en g th p la inother than word text groupingslengths (2, 3, (6,10-13)16)

I II

I I813-0rlgmal 814-0rlglnal

plain text group- plain text group

ings are retained mgs are not re

m the c r y ~ totamed m the

grams (10-13 c ryptograms(14-15)

Documents

Mil Crypt III