II

:5

•

:i

I

=~-dI

-=

WABDBPARTM&NT

omcJ: U. TIIJI CBIBPBIG.... 0Il'I\3II r WASBtNGTOK I

I MILITARY CRYPTANAIXSIS

PART IV , L __

."_'+.if
Restrieted

WAR DEPARTMENT

OFFICE OF THE CHIEF SIGNAL OFFICER

WASHINGTON

MILITARY CRYPTANALYSIS

Part IV

TRANSPOSITION AND FRACTIONATING SYSTEMS

By

WILLIAM F. FRIEDMAN

Prtncipai Cryptanalyst

Slgnal Intelilgence Sermce

PREPARED UNDER THE DIRECTION OF THE

CHIEF SIGNAL OFFICER

UNITED STATES

GOVERNMENT PRINTING OFFICE

WASHINGTON 1941
The Golden Guess

Is Mormng-Star to the full round of Truth

-T,nnl/,on

J• SectionI

II

III

IVV

VI

VII

VIII

IXX

XI

MILITARY CRYPTANALYSIS, PART IV.

TRANSPOSITION AND FRACTIONATING SYSTEMS

CONTENTS

PlII'8llflIpha Pages

General _ 1-3 1-2

Bolution of Simple traasposmon clphers_______________________________________________________________ 4-11 3-17

Incompletely-filled rectangles,____ 12-16 18-36

Opportumties afforded by studymg errors and blunders made by enemy cryptographers 17-19 37-39

Special solutions for tranapoamon clphers___ __ _ _ 20-29 40-79

Prmeiples of matrix reconstrucnon 30-31 80-84

Solution of grilles• •• 32-34 85-93

Combmed subetatutaon-tesaaposition systems ._.__•• 35-36 94-96

Solution of the ADFGVX system. • • 37-43 97-143

Bolutron of bifid fractlQnatmg systems

• 44-56 144-184

Analytical key • • 57 185

Index __ 186-188

(In)
(1)

SECTION I

1 Introductory remarks concermng transpceraon CIphers -a As stated In a previous text,

transposrtaon Ciphers are roughly analogous to "JIgsaw puzzles" m that all the pieces of which

the ongmal IS composed are present but are merely disarranged The pieces into which the

picture formmg the baSIS of a JIgsaw puzzle may be drvided are usually quite Irregular in SIZe

and shape, the greater the amount of irregularity, as a rule, the greater the drlficulty In reassembling the pieces in proper order In this respect, too, transpositaon CIphers are analogous to

Jigsaw puzzles, for the greater the amount of distortion to which the plain text IS subjected m

the transposinon process, the more difficult becomes the solution

b In JIgsaw puzzles there IS usually no regularity about the SIze of the mdrvtdual pieces

mto which the ongmal picture has been cut, and this feature, of course, materially contnbutes

to the difficulty in reconstructing the picture There are, to be sure, lmuts (dictated by considerations of practacabihty) which serve to prevent the pieces being made too small, for then

they would become unmanageable, on the other hand, there are also hrmts which must be observed m respect to the upper magnitude of the pieces, for rl they are made too large the puzzle

becomes too easy to solve These features of JIgsaw puzzles also have their analogies m transposition methods In the latter, rl the textual umts to be subjected to transpositaon are made

quite large, say entire sentences, the difflculties a cryptanalyst will have m reconstructmg the

text are practically ml, on the other hand, If these textual umts me made quite small. even

smaller than single letters,1 then the reconstruction of the transpositaon text by a cryptanalyst

often becomes a very difficult matter In between these two extremes there may be various

degrees of fragmentation, hmited only by consideratrons of practicability

c It IS fortunate, however, that the cryptanalyst does not, as a rule, have to contend WIth

problems m which the SIze of the textual umts varies withm the same message, as IS the case in

JIgsaw puzzles It IS perhaps possible to devise a transpositaon system m which the text IS

divided up m such a manner that entire sentences, whole words, syllables, mdrvidual letters, and

fractions of letters form the umts for transpositaon , but It IS not difficult to imagine how rmpractacal such a scheme would be for regular communication, and It may be taken for granted that

such irregularity in SIZe of textual umts will not be encountered m practical commurucation

d The days when the simple methods of word transposition were sufficient for mihtary

purposes have long smce passed by, and It IS hardly to be expected that cryptograms of such

meffectual nature WIll be encountered in the military commumcations of even the smaller armies

of today However, m time of emergency, when a counter-espionage censorship IS exercised over

mternal commurucations, It IS possible that Isolated mstances of SImple word transpositaon may

be encountered The solution of such cases should present no difficulties, unless numerous code

names and nulls are also used in the cryptograms Mere expenmentataon With the cryptograms,

trymg varIOUS types and SIzes of rectangles, will usually disclose the secret text If code names

I Reference 18 here made to so-called fractlonatmg systems See Spectal Text No 166, AdfIGnced Mllltory

Cryptography, sec XI

Paragraph

1

2 _ __ 3

Introductory remarks concermng transpositron CIphers

BasIC mechamsm of trensposmon CIphers

Monophase and polyphase transposmon__

GENERAL
SECTION II

SOLUTION OF SIMPLE TRANSPOSITION CIPHERS

These SImple types can be solved merely by mspecnon

5. The prmeiples of solution of umhteral route-tranSpoSItIon CIphers-a The so-called

umhteral route-transpoeraon methods are next to be exammed The solution of cryptograms

enciphered by these methods IS a matter of expenmentmg WIth geometnc figures, usually rec-

(3)

B R

I D

GE

D E

S T

R 0

Y E

D

Paragraph

4

5

6

7

8

9

10

11

B S

RT

I R

D 0

G Y

E E

D D

E

RDOGY EEDDE • or

R Y D R DEE TOE

B S R T I

BIG D S

e Some examples of these SImplest types of trensposinon follow Let the message be

BRIDGE DESTROYED AT ELEVEN PM

(1) Reversmg only the words and retammg ongmal word lengths

Oipher.c, E G D I R B DEY 0 R T SED TAN EVE L E M P

(2) Reversmg only the words and regroupmg into false word lengths

CIpher__ E G D I R B DEY 0 R T SED TAN EVE L E M P

(3) Reversmg the whole text and regrouping mto fives

CIphef-.. M P N EVE LET A DEY 0 R T SED E G D I R B

(4) Reversing the whole text, regroupmg into fives, and msertmg a null in every fifth pOSItIOn

CIpher T RIM M P N E V PEL ETA A DEY R 0 R T S L

E D E G U D I R B M

(5) Wntmg the text vertically m two columns and taking the resultmg

digraphs for the CIphertext, as shown at the SIde The CIpher message becomes

4 SImple types of tra.nsposItIon ---a The SImple cases of reversed wntIng, verncal wntmg,

or raal fence wntmg hardly require senous attention, smce they may be solved almost by mspecnon These methods are mcluded bere only because they may be encountered m censorship

operataons b The low degree of cryptographic secunty afforded by these methods may be increased to

a shght degree by adding nulls or by disguismg the ongmal word lengths, and regroupmg into

false words or into groups of regular length

SImple types of transposrtion__

The prmciples of SOlutlOII of umhteral route-trauspo-rtion ciphers ----- -- -------- -- -- -- -------- - ------ --

Keyed columnar transpositron wrth completelv-filled rectangles -- - - - - - ---- ----- ----- - -

Example of solunon - ------ - - ---- -- ------ -- - ------- -- -- ----- ------------ ---------------- --------- - ------ __ oM

The probable-word method of solution - -- - ------------------- ----- ------------------------------------ ----- -----

General remarks on solution -------- ------------ --- ---------------------- ----------------------------- - - ---- - ---- ---

ReconstructIOn of literal key -- -- -- -- -- ---------- -- - ----------- ---- ----- ------------- ------ ------ ----

Column and row transposrtron - --- -- ----- -- --- -- ------- - --- ----- -- - ----- -------- - -- -- -- ------ ---

2

are used and the context grves no clue to the IdentIty of the persons or places mentioned, It may

be necessary to wait until eddrtaonal messages become available, or, lacking such a possibility,

there 18 usually sufflcient justaflcanon, under the exigencies of war, to compel the correspondents

to reveal the meanmg of these code names

e Although transpositaon CIphers, as a general rule, are much less complex m their mechamos

than are subantutaon CIphers, the cryptanalyst usually expenences a feelmg of distaste and

dismay when confronted WIth unknown CIphers of this category There are several reasons for

hISdislike for them In the first place, although transposrtron CIphersare admittedly less mtncate

than substrtution CIphers, as a general rule there are not nearly so many cryptanalytic tools and

"tncks" to be used m the solution of the former as there are in the latter, and therefore the

mental stunulus and satisfaction which the cryptanalyst usually denves and regards as part of the

reward for his hard labor m solvmg a CIpherIS often nnssmg m the case of transposmon CIphers

In the second place, despite their lack of complexity, the solution of transposition CIphers often

mvolves a tremendous amount of time and labor most of which commonly turns out to be

frurtless expenmentation Thirdly, m modern military communication, transpositron methods

are usually not employed alone but m conjunction WIth substrtution methods-and then the

problems may become difficult mdeed, for usually before the substatutaon can be attacked It IS

necessary first to uncover the transpositaon Fmally, m workmg WIth transposition CIphers a

much higher degree of accuracy m mere mechamcal operataons IS required than m workmg WIth

substrtunon CIphers, because the accidental OmISSIon or addinon of a smgle letter will usually

necessitate rewntIng the work sheets applymg to entire messages and starting afresh Thus,

this sort of work calls for a constant state of concentrated attention, WIth ItS resulting state of

psychological tension, which takes ItS toll m mental wear and tear

2 BaSIC mechamsm of transpOSItIon CIphers---a Basrcally.all transpositaon CIphersmvolve

at least two processes (1) WntIng the plain-text umts (usually smgle letters) within a specific

regular or irregular two-drmensional design called a "matnx," "cage," "frame," "rectangle,"

etc, m such a prearranged manner that the said units are distributed regularly or Irregularly

throughout the various cells or subsecnons of that design, (2) removmg the plain-text umts

from the design m such a prearranged manner as to change the ongmsl sequence m which they

followed one another m the plain text, thus producmg CIphertext Since the first process oonsists

of mscnbmg the text within the design, It IS techmcally referred to as the process of 'tnscnptwfl"

and since the second process consists of transcnbmg the text from the design, It IS techmcally

referred to as tbat of transcnptwfl, EIther or both processes may be repetitive, by prearrangement of course, m which case the intermediate steps may be referred to as processes of rescnpt'l.On,

or rescnptwe processes

b It IS hardly necessary at this pomt to give the student any mdications as to how to

dIfferentIate a transpoeitron from a substrtutaon CIpher If a review IS necessary, however, he

IS referred to Section IV of Military Oryptanalysis, Part I

3. Ko,ophase and polyphase transposmon ---a As may be mferred from the foregomg

defimtaons, when a transposrtion system mvolves but a single process of insonptaon, followed by

a single process of transonption, the system may be referred to as monophase transpos'ttWfl"

commonly called s'tngle transpo8'ttwfl, When one or more rescnptive processes mtervene between

the ongmal msenpuon and the final transcnptaon the system may be referred to as polyphase

transposUwfl, As a general rule, the solutron of the latter type IS much more difficult than the

former, especially when the sueeessrve transpositions are theoretically correct ill pnneiple

b Any system which IS suited for monophase transposinon IS also usually swted for polyphase

transpOSItIon, the processes of lDScnptlOn, rescnptIon and transcnptlOn bemg accomph~hed

WIth the same or WIth dIfferent keys
4

angles, of various dimensions suggested by the total number of letters in the message, then

nspectmg these rectangles, searching for whole words or the fragments of words by reading

honzontally, diagonally, vertically, SPirally, and so on 1 (See Special Text No 165, Elementary

Mil'IJary Cryptography, 1935, pars 20,21)

b The amount of expenmentanon that must be performed m the solution of Ciphers of this

type may be matenally shortened by means of formulae and tables constructed for the purpose

But because Ciphers of thlS type are of mfrequent occurrence today, these formulae and tables

are only occasionally useful and hence they have not been mcluded m this text 2

6 Keyed columnar transposItIon With completely-:fIlled rectangles -a In practical cryptography, the dnnensions of the transposinon rectangle, as a general rule, cannot vary between

large hmrts, that is, It can be assumed in practice that rectangles based upon lmes of wntmg

contammg less than 5 letters or more than 25 letters will not commonly be encountered If the

WIdth, that is, the number of columns, lSdetermmed by a key, then the number of rows becomes

a function of the length of the message to be enciphered If the latter lS very long, longer than

can be conveniently handled WIthOUt too many errors, It lS a common practace to break up a

message mto two or more parts and treat each part as though It were a separate commumcation

Such parts are commonly termed sectWnB

b When the last row of a transposition rectangle lS completely filled, the solution of the

resultmg cryptogram lS considerably more simple than when this IS not the case 8 Consequently, thlS wJ.11 the constitute first case to be studied

I It ISmterestmg to observe that Damel, of Bibheal fame, wa" apparently the first cryptanalyst In hIstory

(as well as one of the earliest Interpreters of dreams), for he solved the cryptogram m the "handwrrang on the

wall," obtammg as his decipherment words WhICh he mterpreted as predrctmg the downfall of Belshazzar and

hia dynastv (Daniel V 1-28) The followmg partIal account of the episode IS not as enhghtemng as one might

Wish, but It ISprobably the best explanatron avsalable It IS taken from Dr Max Sehgsohn's article on the subJect m The JetJnsh Encyclopedia, vol s, pp 490-491 (1925) "MENE, MENE, TEKEL, UPHARSIN <1'C'1n "pn laD laD)

Words wrrtten by a mystenous hand on the walls of Bel'!hazYar's palace, and mterpreted by Damel as predietmg

the doom of the Kmg and hIS dynasty The meident IS desenbed as follows Once when Kmg Belshasaar was

banquetmg WIth hISlords and dnnkmg WIne from the golden vessel'! of the temple of YH WH, a man's hand was

seen wntmg on the wall certaIn mvstenous words Frightened bv the apparrtion, the Kmg ordered hIS astrologers to explam the mscnption, but they were unable to read It Damel was then summoned to the Royal

Palace, and the KIng promised him costly presents If he could decipher the mscnption Darnel read It "Mene,

mene, tekpl, upharsm," and explained It to mean that God had "numbered" the KIngdom of Belshaasar and

brought It to an end, that the KIng had been weighed and found wantmg, and that hIS Kmgdom was divided

and given to the Medes and Peraians

The first question whieh presents Itself to the entre, namely, why could the mscnption be deciphered by

Damel onlv--engaged the attention of the Talmudists, who advanced various answers Certam of them

concluded that the Hebrew wrrting had been changed In the time of Ezra, so that even the Jews that were

found In the royal court could not read an msenption wntten In arehare characters But those who followed

R SImeon In mamtaimng that thp wntmg had not changed found other solutions for the problem, e q It was

wrItten In the crvptographie combmation IIr.1 nlC, each letter of each pair being substituted bv ItS companion

e g tiD" 2'1 1'K ntl' ntl', or the words were written thus ""0 'DpD aVlDD, one above the other, having to be

read vertIcally, or 'III"lD'2 np" 1:1. 1:I2IC, each word backward, or again, 1'0"1111 "np acm ICDJ the first two letters of

each word beIng transpobed (Sanh 228) It IS eVIdent that the author of the Book of Damel meant that the

InSCnptIOn was wrItten In characters famIlIar to the KIng and WIse men of Babylon, but that, as often happens

With anCIent InscrIptIons, the transpOSItIOn of certam letters baffled every attempt to deCIpher them "

I See Lohr, Lenox Rand Fnedman, WillIam F , Formulae/or the solutIOn 0/ transposdfon CIphers RIverbank

PublIcatIOn No 19, Geneva, illInOIS, 1918

• See SpeCIal Text No 165, Elementary Mddary Cryptography, 1935, Sec V In thIS text the term "transpOSItIon rectangle" WIll be Ull8d to deSIgnate the matrIx, frame, cage, or deSIgn regardless of whether the latter

IS completely filled or not

I

I

I

j

1

t

L

5

c In solvmg a cryptogram of this type the first step taken by the cryptanalyst IS to ascerfam

the dunensions of the rectangle Clues for this are usually afforded by findmg the factors of

the total number of letters m the cryptogram Suppose the cryptogram contams 152 letters

The dimensions of the transposition rectangle may be 4X38 or 8X19, by which IS meant that

four hypotheses may be made with respect to ItS dimensrons The rectangle may consist of

(1) 4 columns With 38 rows, or

(2) 38 columns With 4 rows, or

(3) 8 columns With 19 lOW"!, Of

t4) 19 columns With 8 rows

In practical work It IS rather unlikely to encounter a rectangle that conforms to hypothesis (1)

or (2), and for the present these may be discarded As to choosing between hypotheses (3) and

(4), a rather SImple test to be described presently WIll disclose which IS the more probable

d It IS ObVIOUS that If the cryptogram IS transcribed withm a rectangle ofthe correct dimenS10ns the letters m each row WIll be the ones which actually were m those rows in the origmal , ,

transpoeition rectangle and formed good plain text therein In jact, the rows oj letters tn the

correctly-dtmennoned rectanglewould read platn text were 1t not for the transposttwn whwh they have

undergone 'lmthtn the rows Therefore, the rows of a oorrectly-dimensioned rectangle are more

hkely to manifest the expected vowel-consonant proporbions of normal plain text than are the

rows of an mcorrectly-dunensioned rectangle, because m the latter case there are brought Into

some of the lOWS letters which belong to other rows and which are hkely to disturb the normal

vowel-consonant proportions of plain text That IS, In an moorrectly-drmensioned rectangle

some of the rows Will have too many consonants and not enough vowels, in other rows tills

relationship will be reversed, whereas m a correctly-dimensioned rectangle each row will have the

proper number of vowels and consonants Hence In solvmg an unknown cryptogram of this

type, rl a count 1"1 made of the vowels and consonants In the rows of rectangles of various probable

dimensions, that rectangle m,which the rows show the best proportions of vowels and consonants

lSmost hkely to be correct, and the one that should be tned first

e Having ascertained the correct dunensrons of the rectangle by the foregomg procedure,

the next step IS to experiment with the columns of the rectangle, trymg to bring together several

columns which wJ.11 then show "good" digraphs, tngraphs, or polygraphs m the rows formed by

juxtaposmg the columns ThIS process of combmmg or matohmg columns m order to build up

these fragments of plain text will herein be referred to as anagrammtng 4

j The procedure IS to select a column which has a good assortment of high-frequency letters

and find another column which may be placed before or after the selected column to build up

high-frequency digraphs m the rows, when such a pair of columns has been found, attempt IS

made to add another column before or after this pair to build up high-frequency tngraphs, and

so on, gradually building up longer and longer polygraphs until entire words begin to appear In the

respective rows of the rectangle In this process of anagrammmg, advantage may be taken

of Simplemathematical considerations such as adding the normal plam-textfrequency values ofthe

dIgraphs m the rows to aSSIst m discardmg combmatlOns whIch are on the borderhne of chOICe

However, It must be noted that the totals obtamed by slIDpleadditIOn of the frequency values of

4 The Standard DIctIOnary defines the \\ord anagram as follows "(noun) 1 Thc letters of a Vlordor phrase so

transposed a<;; to make a dIfferent \\ord or phra'!e, as, 'tIme' and 'mIte' are anagrams of 'emIt' 2 <\tran'!positIOn,

Interchange" As a verb, It 11> defined as "to anagrammatlze, to make an ana/l;ram of, make anagrams" (The

construction of anagrams was a very \'I-Idespread pastIme m preVIOU'l centurIes See Wheatley's 0/ Anagrams,

London, 1862) A strIct InterpretatIOn of the Vlordwould therefore confine It to cases wherem the letters to be

rearranged already form bonafide words or IntelhgIble phrases Howevcr, thIS Vlould hardlv be broad enough for

cryptanalytIC purposes As used In cryptanalYSISthe word IScommonly employed as a verb to referto the process of rearrangmg the dIsordered letters of CIphertext so as to reconstruct the orIginal plam te'\t
6

the digraphs should be considered only as rough approxrmatrons or guides in weighing probabilitres In favor of one hypothesrs as against another, for theoretically the probabihty of the SImultaneous occurrence of two or more independent events IS the product, and not the sum, of their

respective probabilitres In most rases the caloulation of products involves an amount of labor

unwarranted by the results to be expected, so that simple addition of probabrhtres I~ usually

sufficrent However, If tables of the logarithms of the probabihtres are readily available, the

addition of these loganthms becomes a SImplematter and affords a more accurate guide in seleotion of combmstrona produced In the anagrammmg process 5 Once a set of four or five columns

has been correctly assembled It I~ usually the case that the process may be completed very quickly,

for With the placement of each column the number of remaining columns possible for selection

dummshes, toward the close of the process, when only two or three columns remain, their placement IS almost automatic

g It IS desirable, as a final step, to try to reconstruct, If possible, the literal key from which

the numerical transposition key was denved

7 Example of solutIon -a Given the followmg cryptogram, the steps in solution will be

set forth in detail

b The cryptogram contains 126 letters (factors of 126 2, 3, 6,7,9,14,18,21), suggestmg

rectangles of 7X 18 or 9X 14 If the former dimensions are taken, the rectangle may have 7

columns and 18 lOWS or 18 columns and 7 rows, If the latter dimensions are taken, It may have 9

columns and 14 lOWS or 14 columns and 9 rows The factors of 126 do not, of course, preclude

the possibihty that the rectangle may be 6X21, that IS, WIth21 columns and 6 rows or 6 columns

and 21 rows If no good results were obtained by testing rectangles of the dimensions mdioated

(7X18 or 9XI4), then one would proceed to test rectangles 6X21 In the event that all tests on

the baSIS of a completely-filled rectangle failed, then It would be assumed that the rectangle mav

be incompletely filled In making the vowel-consonant test described m paragraph 6d, It IS

advisable to base the count on the columns as well as on the rows of a rectangle, since It IS possible

that the cryptogram was prepared by mscnbmg the plain text m rows and transcnbmg the text

from the columns, or vu:e oere« After exammmg a rectangle both honzontally and vertically,

It IS often possible to discard VarIOUS arrangements WIthout further tests For example, at A

in figure 1 there IS shown a rectangle of 7 columns and 18 rows Now m a row of 7 letters there

should be (7X40 percent=2 8) either 2 or 3 vowels, but rows 12 and 15 contain no vowels at all

and rows 8 and 9 contam 5 vowels, row 16, 6 vowels It IS concluded at once that this arrangement 18 hIghly Improbable Ifthe plam text had been msenbed vertically m tlns same rectangle,

and then the rows had been transposed in formmg the cipher text, then III each column (18letters)

there should be (18X40 percent= 7 2) about 7 vowels, but column 2 contains 11 vowels and column 6 only 4 Tills likewise mdicates that It IS highly Improbable that the message was mscnbed

vertically and the cryptogram formed by transposing the rows But when the arrangement at

I A suggestion for which the author IS mdebted to Mr <\ W Small, [umor crvptanalv ..t in this office The

prmetple makes practieable the lise of tabulatmg machmery for the purpose of speeding lip and faeihtatmg tl>e

matchIng of columns m the anagrammmg process

7

B In figure liS studied, It IS not so easy to say at once that It IS improbable For m 18 letters

there should be about 7 vowels and none of the rows of this arrangement shows too great flo

departure from tlns expected number 'I'his possibihty will have to be explored further and It

IS for the moment put aside If It be assumed that the message was msenbed vertically m the

rectangle 18X7 and the rows subjected to transposition, there should be (7X40 percent=2 8)

2 or 3 vowels 10 each column But since several of the columns show rather considerable departures from this expected number, It may be concluded that a vertical inscnption and honzontal

transcriptIOn IS not probable and tIDE> assumpnon may be ehmmated Then the arrangements

at C and D m figure 1 are studied In the same manner, With the result that at the end of the study

the srtuation as regards the vanous essumptaons IS summarised as follows

o EFT R

R R I I A

o N A J I

Y E C F X

E E EEl

CAP D T

o 0 FDA

S A FAT

o N S 0 0

E D F 0 Y

V R A U 0

M N D M A

CRYPTOGMM (126 letters)

U D H T S

T L BFA

T UTe U

F RAN F

TIE 0 E

T N N V U

RNRWE

S 0 M T N

A

I L H H D

RHNEA

R I V N L

U POL R

R T GET
8

.2

1 8

1.2

8

.. sll

,g§

l'll'l

.8'i

l!lll

"p,

~"

A

1 2

1 8

1.2

I ESE T T B Y R N T A APT MF X

L 0 0 ERN F elL U U 0 0 N N A R

HEN ERN A A I R TON L F D T T

H U S I H V EPA NCO A R R MY G

D D 0 0 N U D D R R U 0 J S A A E E

THO E E T F T I WV FlO N seT

I T E F A LOR V E R DUM F A F A

FIGURE Ie

Total devrationeeS 2

Average deviation-e t 2

Rectangle 9 X 14

9

Rectangle 7 X 18

9 columns and 14 rows

(5) HOrizontal inscnpuon, columnar transcnption. _ Possible

(6) Vertacal mscnption, horizontal transcnption.. _ -__ Improbable

14 columns and 9 rows

(7) HOrizontal mscnpnon, columnar tranacnption _ Improbable

(8) VertICal mscnption, horizontal transcnpuon.,.. _ --- Very improbable

c Discarding all assumptions except (3) and (5), the latter are subjected to further scrutmy

Suppose the average amount of deviation from the expected number of vowels in each row IS

calculated by finding the difference between the actual and expected numbers m each row,

adding these differences (neglecting SIgnS), and dividing by the total number of rows For assumptions (3) and (5) the results are as follows .,

'"i3

18 X 7

123 4 5 6 7 8 91011 U U U U M "g i

6

9

6

7

9

6

8

7 columns and 18 rows

(1) Horizontal msenption, columnar transcription Very Improbable

(2) Vertical mscnption, horizontal transcnpnon.. _ Very Improbable

18 columns and 7 rows

(3) HOrizontal mscrrption, columnar transcnpnon Possible

(4) Vertical mscnption, horizontal transcnption.. __ _ Improbable

6

3

3

7

4

4

10

6

8

553152

D

4 2

18 X 7

8 9 W II U U U U M " g

14 X 9

I 2 3 4 5 6 7 8 9 10 11 12 13 U

1 lEO F NET N T 0 U N M C

2 L U 0 T N D R L C F P F A F

3 H D E R V F R R U D 0 R S X

4 H HER U 0 I N V A L A A R

5 D T E H T Y I R R 0 R N F T

6 T SEN LeA WAN S FAG

7 I 0 I E BAR E U A 0 MT E

8 E N 0 A F PIT 0 J MN Y T

90S ETA D V U 0 lTD E A

I 2 1 4 5 6

2 4 4 6 2 I 3 241 2 5 521 232

B

I ESE T T B Y R N T A APT MF X

L 0 0 ERN F elL U U 0 0 N N A R

HEN ERN A A I R TON L F D T T

H U S I H V EPA NCO A R R MY G

DDOONUDDRRUOJSAAEE

THO E E T F T I WV FlO N seT

I T E F A LOR V E R DUM F A F A

Number Of} vowels 4 3 9 2 2 4

FIGURB 1

Number Of} vowels ---

o

~~

S~::l~

7 8 9

10 4 7

9 X 14

o 5 7 7 3 5

C

1ST B R TAT F 2

LOR FlU 0 N A 5

H N R A I T N F T 2

H SHE A CAR Y 4

DON D R U J A E 4

TOE F I V INC 4

I E A 0 V R U F F 5

E E T Y NAP MX 4

o ENe L U 0 N R 4

E E N A R 0 L D T 4

U I V P NOR MG 3

D 0 U D R 0 S A E 5

H E T T WF 0 S T 2

T F L RED MA A 3

7 X 18

I 2 3 4

ION T TUM

LON Rep A

H E V R U 0 S

HEUIVLA

DETIRRF

TELAASA

I I B R U 0 T

E 0 FlO MY

o E A V 0 T E

E FEN 0 N C

U T D L F F F

D R F R D R X

H RON A A R

THY RON T

S New N F G

o E A E A ME

NAP T J N T

S T D U I D A

1

2

3

4

5

6

7

8

9

10

11

12

13

14

I 2 J 4 5 6

o

Z

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

Number Of} 6 10 J vowels -

A

Number of} 7 II 6 6 vowels --
FIGURE If

Total deviatIOn=12 6

Average deviationee 9

A T I A T S A T T A T F

o N L o N 0 o N R o N A

N F H N F N N F R N F T

ARH A R S ARH A R Y

J A D J A 0 JAN J A E

I N T I N 0 I N E INC

U F I U F E U F A U F F

P ME P ME P MT P MX

o N 0 ONE o N N o N R

L D E L D E L D N L D T

RMU R M I RMV RMG

SAD SAO S A U S A E

o S H o S E o S T o S T

MAT MA F MAL MA A

FIGURII:3

11

( The frequenCIes shown are as given ill table 6, appendix to Mthtary CryptanalY8t8, Part I)

• Followmg the steps taken ill subpar d, frequency weIghts may be given the varIOUS trigraphs ill fig 3 and

the sums obtained taken as mdieatrons of the relative probability of each of the four trials These steps are here

omitted, for they are ObVIOUS

e Each of these eornbmations shows at least one "ImpossIble" tngraph and several "poor"

ones 6 After more or less work along these hnes, the cryptanalyst begms to get the feelmg that

"something IS wrong," for, as a rule, once a correct start has been made m cases of this kind,

solutIOn comes rather quickly Hence, the cryptanalyst decides here that possibly hIS first

Combination (3) grves the highest frequency value for the digraphs and an attempt IS made to

add a column to It Here are some of the combmations tried

781 782 783 789

(1) (2) (3) (4)

t- t- p, t- " ~~ ~~ §'" I'l",

gO! i: ".9 0<" ~~g~ "'~ ,,~

Ii: 7 6 7 8 ... 7 9 ... 7 2

"" "" "" A S ________ 41 A T__________ 47 A T_________ 47 A F__________ 4

0 0__________ 6 0 U__________ 37 0 K - - 77 0 A__________ 7

N N__________ 8 N T________ 82 N F___ - - 9 N T__________ 82

A S________ 41 A C__________ 14 A R_______ ,

44 A Y_--------- 12

J o_________ 2 J U__________ 2 J A____ 1 J E__________ 2

, I 0_________ 41 I V_____ ____ 25 I N 75 I C__________ 22

U E__________ 11 U R__________ 31 U F_____ I U F__________ 1

P E__________ 23 P A__________ 14 P M _______ 4 P X__________ 0

0 E__________ 3 0 U__________ 37 0 N_ -- - 77 0 R__________ 64

L E__________ 37 L 0__________ 13 L 0 -- - -- 9 L T__________ 8

R I __________ 30 R 0__________ 28 R M._________ 9 R G__________ 7

S o_________ 15 S 0__________ 15 S A_________ 24 S E__________ 49

0 E__________ 3 0 F__________ 25 0 S_________ 14 0 T_________ 19

MF__________ 1 MD__________ 1 MA__________ 36 MA_________ 36

TotaL__ 262 TotaL_____ 371 TotaL___ 427 TotaL___ 313

FIGURE 2

1 6

1 4

1 6

4

4

4

1 4

4

4

4

6

1 4

1 6

6

9X14

10

I

"0

123 4 5 678 9 J

1 I S T B R TAT F 2

2 LOR F I U 0 N A 5

3 H N R A I T N F T 2

4 H SHE A CAR y 4

5 DON D R U J A E 4

6 TOE F I V INC 4

7 I E A 0 V R U F F 5

8 E E T Y NAP MX 4

9 0 E N C L U 0 N R 4

10 E E N A R 0 L D T 4

11 U I V P NOR M G 3

12 0 0 U 0 R 0 S A E 5

13 H E T T WF 0 S T 2

14 T F L RED MA A 3

The average amount of deviation for assumption (5) IS only 09 as against 12 for assumption

(3), therefore the former assumption IS considered to be somewhat better than the latter and It will

be tried first

d The columns of the rectangle shown in figure ljare now to be cut apart and the procedure

of anagrammmg apphed (For this It IS best to have the cryptogram written on cross-sectaon

paper preferably with ~'-mch squares for ease in handlmg ) Consider column 7, with the letter

J in row 5, tills letter, If It IS a part of a word, must be followed by a vowel, which eliminates

columns 1, 3, 4, and 5 as possibihues for placement on the right of column 7 Here are the

digraphs formed by combining column 7 with columns 2, 6, 8, and 9, respectively, and the totals

obtained by adding the frequency values of the digraphs formed in the rows
12

f It IS beheved that the procedure has been set forth WIth suffleient detaal so as to make

further demonstration unnecessary The rectangle can be completed very quickly and 18 found

to be as shown m figure 5

g It will be mterestmg to see If a calculauon based upon the sum of the loganthms of the

probabihtres given m figure 2 would have given the correct combmation as the :first choice

Note the results shown m figure 6 This calculataon gives the correct combination as :first

choice, mz, 7-6, WIth a loganthmically-weigbted value of 17 35 as against a value of 16 51 for

combmation 7-8, which was the first one tned on the baSIS of merely the sums of the frequency

values of the digraphs

As 11 matter of interest, It may be observed that the combmanon 7-6 IS 7 times more probable

than combmation 7-8, since the difference between 1735 and 16 51 IS 84, which IS the logarithm

of 7 Likewise, combination 7-6 ISroughly 15,000 times more probable than combmation 7-9

since 1735-1317=418 '

8 The probable-word method of solution -a The probable-word method of attack IS as

Important in the solution of transposinon CIphers as It IS m the solution of substitutaon CIphers

and If the cryptanalyst IS able to assume the presence of such probable words as are llSUa.n;

encountered in military commumcations, the solution, as a rule, comes very qwckly

b As an illustrataon, looking at the first row of letters in the rectangle shown in figure I}

the letters I S T B R TAT F almost at once suggest FIRST BATTALION as the mrnal words of th~ message A rearrangement of the columns of the cryptogram to bnng the necessary letters

moo juxtaposition at once disclosea the key Thus

9 1 6 2 8 4 763

FIRSTBATT

A L ION

It will be noted that this assumption requires that there be a column headed by F A, another

headed by I L, another headed by R I, and so on Had such columns not been found, then the

word BATTALION would not be possible In that case the word FIRST would still remain as a

point of departure for further expenmentataon

c In the foregoing rllustrataon, the probable word was assumed to appear lD the first hue

of text m the rectangle If the probable word being sought IS in the interior of the message the

steps must be modified somewhat but the baSIC principle remains unchanged The modifications

are of course ObVIOUS

9 General remarks on solutIon.-a In solving transposmon CIphers advantage should be

taken of all the charaotenstacs and idiosyncrasies which are apphcable to the language of the

324155--41-2

13

( 1) (2) (3) (4)

t

.. '" s '" t '" a

lil§ J 1 ., ., ~§ 5! s fa!

~1 ~1 1

1 5 ::til

] , 7 2

.. ~'"

)

110 ..:l 7 6 110 ..:l 7 8 s 7 9 110

A Sr----- 41 1 61 A To

_____ 47 1 67 A T______ 47 1 67 A F______ 4 0 60 o 0_____ 6 78 o U_____ 37 1 57 o N_____ 77 1 89 o A______ 7 85 N N____ 8 90 N T_____ 82 1 91 N F______ 9 95 N T______ 82 1 9] A S_____ 41 1 61 A C______ 14 1 15 A R ___ 44 1 64 A Y______ 12 1 08 J 0_____ 2 30 J U___ 2 30 J A____ 1 00 J E____ 2 30 I 0____ 41 1 61 I V _____ 25 1 40 I N____ 75 1 88 I C_____ 22 1 34 U E ___ 11 1 04 U R _____ 31 1 49 U F______ 1 00 U F_____ I 00 P E______ 23 1 36 P A ____ 14 1 15 P M._____ 4 60 P X. ____ 0 -1 00 o E_____ 3 48 o U____ 37 1 57 o N_____ 77 1 89 o R 64 1 81 L E ____ 37 -- 1 57 L 0 ___ 13 1 11 L D ____ 9 95 L T_____ 8 90 R I._____ 30 48 R 0 ____ 28 1 45 R M___ 9 95 R G______ 7 85 S 0______ 15 1 18 S 0_____ 15 1 18 S A___ 24 1 38 S E_____ 49 1 69 o E ____ 3 48 o F______ 25 1 40 o S______ 14 1 15 o T_____ 19 1 28

M F______ 1 00 M D ____ I 00 M A ___ 36 1 56 M A______ 36 1 56

TotaL_ 262 13 40 Total___ 371 17 35 TotaL_ 427 16 51 TotaL_ 313 13 17

F10UD 6

FI0U~1I: 6

9 1 6 284 7 6 3

FIR S T BAT T

A L ION F 0 U R

THINFANTR

YHASREACH

EDROADJUN

C T ION F I V E

FIVEFOURA

XENEMYPAT

ROLENCOUN

TEREDALON

GUN IMP R 0 V

E D R 0 ADS 0 U

THWESTOFT

ATEFARMDL

A T T F

OUR A

N T R T

A C H Y

J U N E

I V E C

U R A F

PAT X

o U N R

LON T

R 0 V G

SOU E

OFT T

M D L A

FIOUD 4-A FIGU~II: 4-B

choice of combmation (3) was a bad one, even though It gave the greatest total when frequency

values for the digraphs were summed The second greatest total was fOI combination (2) m

which columns 7 and 6 were put together The mfrequent digraph J U suggests a word such as

JUST or JUNCTION If!t WeI e the former there shouldbe a column contamu.g an S in the 5th row,

and there IS no such column If the word IS JUNCTION, there should be a column containing an N

m the 5th row, and there IS only one such column, the 3d Placing column 3 after columns 7-6

grves the tngraphs shown m figure 4-A All of these tngraphs are excellent except the last, and

that one may be either an abbrevianon of a signature, or possibly nulls added to complete the reotangle Ifthe word JUNCTION IS correct then there should be a column with a Cm the 5th row, but

none IS found However, column 9 has a Cin the 6th row, and If It happened that the last column

on the right IS No 3, then column 9 would be the 1st column Thus, as shown in figure 4-B, the

arrangement of columns becomes 9 7 6 3

763 977'77763

A T T

OUR

N T R

A C H

J U N

I V E

U R A

PAT

o U N

LON

R 0 V

SOU

OFT

M D L
15

d It IS likely that the digit 1 on the first level m the key-word reconstruction diagram

represents a letter at or at least close to the beginning of the alphabet SInce the digits 2 and 3

are on the same level as the dIgIt I, It 18 hkely (1) that the letter represented by 1 occurs 2 more

J The presence of many Q's, or K's, or X's In a transposrtion CIpher should not, however, be

taken as p1"tma Jac~e evidence of the type of replacement noted In the preceding subparagraph

It 18 possible that such letters may be used as sentence separators or other punetuation, possibly

they may be nulls, although the alert cryptographer would either use nulls not at all or, If he

had to, would use letters of medium or high frequency for this purpose

9 Because It IS Important that the cryptanalyst take advantage of every pecuhanty speoificallyapphcable to 0. cryptogram to be solved, especially as regards the presence of low-frequency

letters, It IS advisable that a umhteral frequency distnbution be prepared, Just as though he

were gomg to deal WIth a substitutaon Cipher Tlus IS probably the quickest way of bringing to

4ght the pecuhantres which may be helpful In solution

10 Reconstruotlon of hteral key -a The reconstruction or recovery of the hteral key

from which the numerical transpoartton key was derived IS naturally the last step In the solution

of cryptograms of this type It IS often of more than merely academic mterest, because If It IS

found that the enemy IS employmg for this purpose some well-known book, or words or phrases

of a SImple nature nssociated With the locale of operations, this fact may be of highest Importance

m subsequent work

b In this process there are only a few guiding pnnciples to be noted and much must be left

to the mgenuity and nnagmatrve powers of the cryptanalyst Takmg as an example the numerical key uncovered In the solution of the cryptogram In paragraph 7, the procedure will be set

forth below

c The numencal key referred to was found to be 9 1 5284763 Assummg that this

sequence was derived In the usual manner, by assigning numbers to the letters of a key word In

accordance With their relative positrons m tho normal alphabet, the sequence forms the baSIS for

the key-word reoonstruetum. dtaqram shown In figure 7-A, In which the mdrvrdual key numbers are

wrItten from left to right on dIfferent "levels" so that each level contains only numbers normally

In succession

F!l'UBd. 7-B

9 1 5 2 8 4 7 6 3 = =ABC = --ABC --= = 1==

ABC

DE DE DE

1 2 3 ------------FOB ---- 11

4 ------KLM ----------

KLM -- NO NO

5 6 ------------------ LMN

OP

7 ----------I-------- MNO

PR

8 ------------ R-Z

I 9 I I

2

4

6

1

3

5

FIl'UBB7-A

9 1 5 2 8 4 7 6 3 --= ------= = = 1=

1 2 3 ------------I-----

4 ------------------

5 6 ------------------

7

I-----------------

8

I----------------- 1

9 I I I

3

4

2

5

6

1

14

enemy, because they often afford clues of considerable assistance to the cryptanalyst In all

languages there are certain letters, usually of medium or low frequency, which combine With

other letters to form digraphs of high frequency For Instance, In Enghsh the letter H IS of

medium frequency, but It combines With T to form the digraph T H,which IS of highest frequency

m literary text, It also combines With C, a letter of medium frequency, to form the fatrly frequent

digraph C H The letter V IS almost In the low-frequency category yet It combines With E to

form the digraph V E, which in military text IS the 14th In frequency The low-frequency letter

K often combines with C to form the digraph C K Consequently, In workmg With transposition

ciphers In Enghsh, when there IS an H, attempts should be made to combine It first With a T or

With a C, a Vshould be combined first with an E, a Kshould be combined first with a C, and so on

b There IS usually In every language at least one letter which can be followed by only a

certain other letter, forming what may be termed an obl'LfJatory sequence, 01 an ~nvanable d~graph

In all languages having the letter Q, the combination QU constitutes such an invariable digraph 7

In bonafide words of the German language the letter C IS never used by Itself, when present the

letter CIt> mvanably followed by an H, except on rare occasions when the digraph C KIS employed

In Enghsh, the letter J can be followed only by a vowel, the letter X can only be preceded by a

vowel and, except at tho end of a word, can only be succeeded by a vowel, or by one of a limited

number of consonants (C H P T), and so on Letters which behave In this manner, that IS,

letters which have what may be called a lunued ajfintty in combmmg With other letters to form

digraphs, constitute good pomts of departure for solution and are therefore of sufficient Importance to warrant their bemg designated by the more or less descnptrve name of pdot letters

c The presence of pilot letters In a transposiuon CIpher often forms the baSIS for the assumption of probable words Obviously, a special lookout should be kept for words of rather high

frequency (m rmhtary correspondence) which contain letters of low o!. medium frequency

The frequent word CAVALRY, for example, would suggest Itself If the cryptogram has the letters

C, V, L, and Y, which are all of medium frequency The Important word ATTACK suggests

Itself If the cryptogram has a K, a letter of low frequency, and a C, one of medium frequency,

and soon

d The mechamcs of SImple columnar transpositaon make possible the production of rather

long sequences of vowels and long sequences of consonants In the text of the cryptogram Note,

for example, In the cryptogram on p 6, the sequence of vowels 0 0 E E E E I 0 E, and the

sequence of consonants V N L R N R W If the enciphenng or plain-text rectangle 18 consulted, It will be seen that these two sequences belong together, that IS, they are In adjacent

columns In that rectangle It IS a charactenstio of plain text that consonant-vowel or vowelconsonant digraphs are much more frequent than consonant-consonant or vowel-vowel digraphs,'

and therefore when long sequences of consonants and of vowels are found In transposition

Ciphers, a good start toward solution may result from assuming that such sequences come from

adjacent columns

e. It should, however, be noted In connection With tell-tale letters such as Q (entermg Into

the composition of QU) and C (entenng mto the compositaon of CH), that astute cryptographers

who reahze the clues which such letters afford often replace mvanable digraphs by single characters, usually those rarely used In the language In question For example, CHin German may

be replaced by Q, Q U In French, by K, and so on When this IS done, solution IS made more

dIfficult, hut only in those cases where It IS dependent upon findmg letters formmg obhgatory

sequ<>nces In plain text does this sort of subterfuge become a factor of Importance

, The letter Qmay, of oourse, be part of an abbrevratron, suoh as SQfor "square," or It may be usedas a null,

or as a SIgn of punetuation However, unless there are good reasons for belIevmg that thIs letter ISusedfor such

purposes, QU may be eonsrdered to be an mvanable digraph

8 The CVand VC dIgraphs constItute about 62 peroent of all dIgraphs
16

times m the key word, or (2) that the digit 2 represents another letter, also near the begmmng of

the alphabet, and that this letter IS repeated, or (3) that the digits 2 and 3 represent 2 dIfferent

letters both near the begmnmg of the alphabet, or (4) that all three digits represent different

letters but all near tho beginnmg of the alphabet The digit 4, on the second level m the reeonstruction diagram, must represent a letter beyond the letter represented by the digit 3, the dIgIt

5 must represent one beyond the letter represented by the digrt 4, and the dIgIt 6 may represent

the same letter as 5, or a letter not much beyond that represented by 5 Assummg that the

letters composmg the key word are faIrly well distributed over the entire alphabet, the digit 7

must represent a letter near or shghtly beyond the middle of the alphabet, the digit 8 must represent one further toward the end of the alphabet than does the digit 7, and so on AssIgnmg

several values to the digits, In accordance with the foregomg principle, the results are as shown

m figure 7-B

e It IS perhaps possible that some students may find the process of reconstructmg the literal

key somewhat easier If the variant possible letters are merely hsted under the respective key

numbers as shown in figure 7-C The candidates for the successrve posiuons in the hteral key

thus appear in a rather condensed space and the eye IS able to pick up "good" oombinations

very quickly

9 I 6 2 8 4 7 6 3

RAKAMFLKA

SBLBNGMLB

T C MC 0 H N MC

U D N D P ION D

VEOERJPOE

W

X

Y

Z

FIGtllUl 7-0

J Now comes the trymg process of findmg a "good" word in this assemblage of letters The

begmnmg and end of the word are the easiest points of attack, and It IS useful to keep in mmd the

relative frequency order of letters as mmal and final letters of the language m question For

EnglIsh, the data are as follows 9

As mitral letters T S A F COR D N P E M I WB H LUG Y V J Q K Z X

As finalletters E T D S N Y R 0 H L A F G P M X C K W UBI Z Q J V

Studymg the candidate letters at the end of the key, It IS seen that E IS one of the pOSSIbIlItIes

If that IS correct, then a good endmg would be one of the type vowel-consonant-vowel, WIth E as

the final letter There IS but 1 vowel In the fourth level In the column under the digit 7, the

letter 0 This gives 0 K E, 0 L E, 0 M E, 0 N E as possible termmal tngraphs, the best of which

from a frequency standpoint IS ONE Seemg the letters P and H m columns 8-4, the endmg

PHONE and then the word TELEPHONE suggests Itself Checking to see If there are any moonsistencres, none IS found and the solution IS

Numencal key 9 1 5 2 8 4 7 6 3

LIteral key T E L E P H 0 N E

• Taken from Tables 2-D (2) and 2-E (2). P 111. Mllztary Cryptanalyau. Part 1

,.

I

17

9 In future studies, cases will be encountered wherem the reconstruction of the numerical

key 18 an essennal or, at least, a useful element after the solution of one or more cryptograms has

been achieved by cryptanalysis Thia IS done m order that subsequent cryptograms m tho same

key can be read directly WIthout cryptaaalysis The reeonstr uction of the numerical key IS,

however, a different process than the one illustrated In tlns paragraph, wherem the problem IS

solely one of building up a literal key from ItS numerical equivalent The purpose m reconstructlDg the literal key IS to give clues as to the source from which keys are derived or taken SometImes this may lead to ascertammg a book which IS used for this purpose and which may be

avaI1able by purchase at bookshops, or It may be a well-known document, a telephone directory,

etc Obviously, If the source document or book can be located the solution of future cryptograms in the same system becomes merely a matter of decipherment and such crj ptograms no

longer form the material for cryptanalytic efforts The method of reconstructmg the literal

key 18, obviously, easier to apply m the case of long numerical keys than m the case of short ones,

In general, the longer the numencal key the easier IS the recovery of the hteral key

11. Column and row transposmon -It should be ObVIOUS that when the rows as well as

the columns of a completely-filled rectangle undergo transposmon the increase In security 18

hardly worth mention, since the underlymg procedure lD solution alms SImply at assemblmg a

few columns on the baSIS of "good" digraphs and tngraphs brought to light by JuxtaposIng

columns After three or four columns have been properly Juxtaposed, the placement of additlonal columns becomes easier and easier, merely by oontmumg to build upon the fragments of

words tn the rows Hence, the cryptanalyst IS, durmg a large part of the process, not particularly

mterested m the mtelhgibihty of the text he 18 building up, only at the end of the process does

thIs become a factor When all of the columns have been assembled m proper order, then the

text will read contmuously m the normal manner (left to nght, top to bottom) If It does not,

thenIt IS usually a very simple matter to rearrange the rows of the rectangle to bring this about,

smce the letters at the ends and begmnings of the rows give the necessary clues for contmuity
SECTION III

12 General principles underlying solution --a In the system designated keyed columnar

transposition the feature which differentaates an mcompletely-fillod rectangle from one that IS

completely filled IS a very simple one from the cryptographic point of VIew The bottom row of

the rectangle m the former case merely lacks one or more letters, a feature which only very

slightly compheates the system in practical operation But the consequences of this simple

dIfference between the two types are, from the cryptanalytrc pomt of VIew, quite profound, and

the cryptanalytic effect of this small change m cryptographic procedure IS seemingly all out of

proportion With the simphcity of the difference

b Cryptograms rnvolvrng completely-filled rectangles are lather easy to solve because of two

crrcumstances In the first place, srnce the rectangle IS completely filled, the various possible

dimensions of the rectangle can be ascertained by noting the factors of the total number of letters

Usually only a few possibihues are mdicated and thei efore this matonalty reduces the amount of

experimentation that would be requirod In the absence of this situation, since It IS obVIOUS that

when workrng With mcomplctely-filled rectangles a good many rectangles of vunous dimensions

become possrbihtres for tnal In the second place, the columns m a completely-filled rectangle

all contam the same number of letters, and therefore the anagrummmg process (matclung and

assemblrng of columns) can be performed WIthout any mcntal reservatrons such as must be made

m workrng WIth rncompletely-filled Iectangles because of uncer tamty as to whether the letters

which are Juxtaposed to form digraphs and tngraphs reallv come from the same lOW in the plaintext rectangle The latter statement calls for a bit more explanation

c The columns of an incompletely-filled rectangle are of two SOl ts whir h may convemently

be designated as long and short The long columns are at the left of the rectangle and each one

contams Just one more letter than the short columns, wluch ure at the right ThIS follows, of

course, from the fact that It IS only the lll<,t lOW rn such a lectangle wlll(h I.t( k~ one or more lettms

to complete the rectangle The term wulth, ab apphed to a tranSposItIOn r('(tangle, wIll be convement to deSIgnate the number of columns, whICh I~, of course, determrned by the length of the

numerICal key or the number of lettels In the lIteral key Given the WIdth of the rectangle and

the total number of letters m the cryptogram, the length and number of the long and the short

columns may be found by a SImple calculatIOn Multiply the WIdth of the rectangle by the

smallest number whICh will ywld a plOduct greater than the total number of letters rn the

cryptogram The multiplIer gIves the If'ngth of the long columns, thIS multiplIer mrnus 1 gIVes

the length of the short colmnns, the excess over the total number of letters gIves the number of

short columns, the latter deducted from the WIdth gIves the number of long columns Thus,

WIth a cryptogram of 287 letters and a rectangle 15 columns ill WIdth [(15X20)-13 287] the

(18)

", \' -

INCOMPLETELY-FILLED RECTANGLES

General prmciples underlvmg solution _ _ _ __ __ _ _ _ _ _

D:Jrmiting the lcugtbs of the columns of the rectangle, constructmg tlu, "hat" dldgI am Bolutron of example, _ _ _ __ _ _ _ _

AlternatIve method of solunon, _ __ _ _ __ __ _ _

Concluding remarks on sunple columnar transpositron

.Paragraph

12

1J __ 14

15

_ 16

19

long columns will have 20 letters, the short ones, 19 letters, there Will be 13 short columns and 2

long ones

d Now If the cryptanalyst were able to cut up the text of a cryptogram produced from an

Incompletely-filled rectangle rnto sections corresponding m Iength WIth the actual long and short

columns, he could handle these columns In exactly the same manner that he handles the equallength columns In the solution of a cryptogram produced from a completely-filled rectangle In

fact, the solution would bc easier because he knows that all the short columns fall at the right,

all the long columns at the left of the transposiuon rectangle, and therefore the amount of expertmentation he must undertake In Ius attempts to Juxtapose columns m the unagrammmg process IS

eonsiderably reduced But, unfortunately, there IS usually no way In which, at the imtial stage

of solution, the cryptanalyst can find out, from a smgle cryptogram, which ale the long columns

and wluch the short ThIS IS obviously a matter directly connected WIth the specific transposition key, and the latter IS the sole unknown factor m the whole problem

e If It were practtoable to transcribe a cryptogram of this type according to all the possible

transposition keys for a given Width of rectangle, solution would obviously merely consist In

scanning the vanous rectangles to find the one which IS correct-for there WIll be only one such

rectangle A rectangle 15 columns m Width may have been enciphered by anyone of factonal

15 transposttion keys I "\\'lule It IS conceivable that machmery might be devised for this purpose,

so that the production of the milhons of possible rectangles could be effected In a relatively short

tame, In the present state of the art no such machinery has yet been devised FUIthermore, It IS

problematical whether a solution by such means could bc achieved m a reasonable length of time

even If the maclunery were available, because of the immensity of the task It would have to

perform 2

J However, this question may be asked GIven a cryptogram of t letters and a r( ctangle of

n columns m WIdth, IS It possible to transcnbo the text within a smgle rectangle so that the latter

will show what letters will constitute the respccuvo columns for all possible transposiuon keys of

n elements? If so, then such a rectangle would be useful m trymg to solve the cryptogram,

because the rectangle would then limit the amount of expenmcntauon that would have to be

performed by the anagrammmg process, SInce It would show whether or not two letters which

are brought together m that process to form a digraph could possibly have been In the same row

In the plain-text rectangle If not, then of course there would be no use in formmg such digi aphs,

and thus the number of trials becomes much reduced Anotlll'r way of mdicatmg what IS meant

IS to say that such a rectangle would show the maximum amount that one column may be shifted

up or down In trymg to match It WIth another column In the anagrammmg process ThIS Will be

made clearer In a subsequent paragraph At this pomt It will merely be stated that It IS easy to

prepare a rectangle of the nature mdicatod above for any keyed, columnar-taansposrtion

cryptogram

1 Factonal15, or 15X 14X13X X 1, equals 1,369,944,576,000 dJ1ferent transpOSItIOn keys

I It IS nevl'rt':leless pertlllE'nt to mdlCah.. that mac':llllery for faclhtatmg the "mat('hlIlg" or d.ll&/trammmg of

oolumns has be('n deVIsed and found to be qUltr pral-tlcalm the "olutlon of prohlem'llmohmg columnar transPOll1tlOn

1

i

At

L
FlOVBBS

20

c..

1 2 3 \I 5 6 7 II II 10 11 12

1 tmu~e

2 e e b met e

3 t a e e t e s y

4 1 d a e e tea r t r

50NMCMHYTOAFA

6 D I A T I BON 0 I I T

7 N E N R A V lOT ITS

8 N T L MIT K THE A 0

9 PGNSTBNREANA

10 T N 0 C E E K A A T L L

11 IWELASTACENO

12 R T B C I R N V N END

13 N T 0 S J S DRS AQ,VI

14 T M@O N Y A I H L A R

15 D E H E S L H REA C 0

16 T D E FOX I SEE L R

17 (IDs N C I R R T V N R Y

18 R T L F V 0 H GTE E N

19 0 E E F F R Q S R E N N

20 E 0 S T M lEE M R R

21 X lEE B M E F S Y T G

22 ~A E lET E R TRY

23 L D A E E TEA

FIOURB 9

21

c The rectangle shown m figure 8 IS the same as though It had been assumed that the key

numbers 9, 10, 11, and 12 happened to fall at the extreme right m the numencal trensposrtion

key Columns 1 to 8, inclusive, would then be long columns, and columns 9,10,11, and 12 would

be short columns But suppose that the key numbers on the extreme right happened to be 1, 2,

3, and 4, instead of 9, 10, 11, and 12 Then columns 1, 2, 3, and 4 would be the short columns,

5 to 12 the long ones In this case, making reference to figure 8, the final letter of column 1

would pass to the top of column 2, the final 2 letters of column 2 would pass to the top of column

3, the final 3 letters of column 3 would pass to the top of column 4, the final 4 letters of columns

4,5,6,7, and 8 would pass to the top of columns 5, 6, 7, 8, and 9, the fina131etters of column

9 would pass to the top of column 10, the final 2 letters of column 10 would pass to the top of

column 11 , and the final letter of column 11 would pass to the top of column 12 The results of

the foregomg reasoning are embodied in the mntrix or diagram shown in figure 9

d Now the capital letters m this matrix or dragram, which IS often called a crown or hat

dIagram,· figure 9, represent the l~tters which are 10 the columns m case the fir...t hypothesis

(key numbers 9, 10, 11, 12 at the extreme nght) IS true The capital letters above the heavy

black line together WIth the lower-case letters at the top of the diagram represent the letters

which are 10 the columns 10 case the second hypothesis (key numbers 1, 2, 3, 4 at tho extreme

nght) IS true Therefore, since the hat diagram covers the two possible extremes WIth reference

to the pOSItIOns occupied by the short columns and embraces all possible mtermedrate conditions

by showmg what letters may be in the respective columns under any possible arrangement of long

I Because the lower-case letters at the top form what IS usually called the crown or hat

W T T M E

A ACT R

N SOl V

o I K N K

T G S E' F

TEE A L

RAT S 0

lET G N

N L ESE

TEA I J

U MET Y

V R IRS

A I I E A

R E N R T

EXALN

B 0 U H E

E MI A I

L X R 0 R

o T R A A

T RES R

N U A C L

CRYPTOGRAM

D T U R 0

N L N 0 E

F F TEE

E S R S Y

E T E T N

SHE E V

TAN L N

NRGY

DISTRIBUTION

T I R N T

lTD M A

S 0 E F C

H B V T B

I R H Q I

H E A C N

MY T F I

R 0 R Y N

- ~~ ~~~

--~- -~ ~~~~ ~~~ ~~~~~~~~~-~~~~~--~~~~~-~~

ABCDEFGHIJKLMNOPQRSTUVWXYZ

194888163818129720151118122& \I \I 1 280(224)

1 2 3 \I 8 6 7 8 9 10 11 12

ONMCMHYTOAFA

D I A T I BON 0 I I T

N E N R A V lOT ITS

NTLMITKTHEAO

PGNSTBNREANA

TNOCEEKAATLL

I W E LAS T ACE N 0

RTBCIRNVNEND

N T 0 S J S DRS A U I

TMUONYAIHLAR

DEHESLHREACO

T D E FOX I SEE L R

USNCIRRTVNRY

RTLFVOHGTEEN

OEEFFRQSRENN

EOSTMUIEEMRR

X lEE B M E F S Y T G

ATAEIETERTRY

LDAEETEA

o D N N P

D S TEO

MS C L C

F MB I E

TNDAH

E A 0 0 T

A ENE E

A L 0 D I

13 Del1mltmg the lengths of the columns of the rectangle, constructmg the "hat" dIagram -a GIven the followmg cryptogram of 224 letters and an assumed width of 12 columns

m the enciphenng rectangle

b A cryptogram of 224 letters and a rectangle of 12 columns [(12X 19)-4=224] mdicates 4

short columns of 18 letters and 8 long columns of 19 letters The outlmes of a rectangle of this

speciflcation are drawn on a sheet of crosa-secnon paper and the text IS transcnbed withm It,

for the moment assuming only that the transposinon key consists merely of the straIght sequence

of numbers 1 to 12 Thus
Hence, combmanon 7-1 IS Impossible, and combmanon 7-6 IS the only one that needs to be

considered further There are many excellent digraphs in It, and only one WhICh admittedly

looks rather bad, the H X Seeing the digraphs KBand KS ill these columns, a good assumpnon

to make I~ that the K's are preceded by the letter C Is there a column WIth2 C's In approximately

the correct region? Column 4 meets this requirement Note the excellent tngraphs It yields,

as shown In figure lOc It now becomes fairly easy to add columns to this nucleus For instance,

the tngraph R Y B suggests a word ending ill R Y,such as INFANTRY, ARTILLERY, CAVALRY,

the tngraph M 0 Vsuggest MOVING, the tngraph C K B suggests the word ATTACK, followed by

a word begmmng With B, and so on Trial of only a few columns soon yields what IS shown m

figure 10d, from which It soon becomes probable that the long columns end With column 12, smce

the letters after L Y yield an impossible sequence (E E E Y) Smce It was ongmally assumed

that there are only 4 short columns m the transposition rectangle, and since 4 columns have

already been placed at the right (4-7-6-10), the rectangle, With the columns thus far placed,

must be as shown in figure 10e 'I'lns, then, at once tells what the limits of columns 2,3,5,8,9,

and 11 must be, and the rectangle can now be filled in WIthout further delay The completed

rectangle IS shown illfigure 11

22

and short columns, the hat dw,gram t8 applicable to any posstble numeneal key jor the cryptogram

tn questwn and for the assumed I1Jtdth oj rectanale Therefore, 10 the anagramnurg process the

hat diagram shows the maximum possible amount that any column may be shifted up or down

In juxtaposing two columns to form digraphs of letters assumed to come from the same row

In the plain-text rectangle TIns IS because all the letters of the first row of the actual enciphermg rectangle will be found III rows 1 to 5, mclusive, of figure 9, all the letters of the second

row of the rectangle will be found III lOWS 2 to 6, mclusive, and so on, as indicated by the braces

at the nght In figure 9

e Thus there arises the followmg Important pnnciple Designating the number of short

columns In a specific diagram by n, only such letters as full withm (n+l) consecutive rows, will

be letters that may have appeared ill the samc row ill the actual transposition rectangle Or,

another way of stating the principle IS tlns Both members of any pair of letters actually In the

same row In the transposition Iectangle will be found only among the letters appearmg In (n+l)

consocutrve rows In the correct hat dragrnm In the case under discussron, If the first letter

of such a parr I~ located 11l row 8, for example, the other letter cannot be m rows 1, 2 3, or 13 to

23 of figure 9

f The usefulness of this principle in connection with the construction und employment of

the hat dragram will soon become apparent For Hample, agam referring to figure 9, take the

letter Q10 row 1<), column 7, It must be followed by It U In the plum te~t There are 4 U's In the

message they are 10 lOW 13 column 11, row 14 column 3, row 17 column 1, and row 20 column 6

Now the question IS, can any of these 4 U's follow the)", or may one or more of them be eliminated

from considerution at once? Since the U's In row'> 13 and 14 fall outside the 4 consecutive rows

above that In which the }1IS located, It follows that neither one of these U's can be the one that

succeeds the lt1 Thus two candidates are automatrcally ehmmated from consrderution TIlE' U

In row 17 and the U In lOW 20 are both possible candidates

14 Solution of example -0 With the foregoing prehmmaries out of the way, the solution

of the cryptogram can now be carried forward with rapid progress It has been indicated that

the QIn row 19, column 7 (fig 9), may be combined with either the Uill row 17 column I, or the

UIn row 20 column 6 Suppose the columns of figure 9 are now cut apart for ease m anagrammmg

Juxtaposing the indicated columns yields what 10;; shown In figure 10 Since the combmation

shown at a 11l figure 10 Involves column 1, It obviously begins with the letter 0 and ends with the

letter A or L, no other letters can be added to this column Since column 7 IS already the maximum length thl'> column can be under any circumstances, no letters can be added to It at the

bottom Ther efore, all the drgrnphs possible to form by [uxtapoemg these two columns are

Indicated In figure lOa There are only 17 digraphs m all, whereas there should b{' at least 18

I

I 7 1

u

m

e

t

Y

o

I 0

K D

N N

K N

T P

NT

D I

A R

HN

I T

R D

H T

QU

I R

E 0

T E

E X

A

L

a

7 e

-

u b

m 1

e e

t H

Y B

o V

I T

KB

N E

K S

T R

N S

D Y

A L

H X

I R

R 0

HE

gu

I M

E E

T T

E

23

4 7 e

-

e

a u b

a m 1

c e e

T t H

R Y B

M 0 V

SIT

C K B

L N E

C K S

S T R

o N S

E D Y

F A L

C H X

FIR

E R 0

THH

E g U

E I M

E E E

T T

E

c

FIGURB 10

a u b

a m 1 e

Ore e e s

D A T t H r

NTRYBA

NSMOVI

P 0 SIT I

T A C K B E

ILL N E A

ROCKST

NDSTRE

T ION S E

DREDYA

T 0 F ALL

URCHXA

R Y FIR E

ONERON

ENTHEE

XREQUE

AGEIMM

LXEEEY

T T T

E

d
FIGURE 13

FIGURE 12.

8 2 5 3 11 9 1 12 4 7 6 10

JKL

MN

6

JKI

MN

5

8 2 5 I 3 11 9 1 12 4 7 6 10

- - --- - ------- - - - A

1 - - --------- ----- --- DEF DEF I

om uar

2 3

-1- 4

- - - -- - - - JKL N

MN I

5 6

- - ------- --- - - - - 0

7 - - - ------------- - - PRS PRS S

8 9 10

- - --- ----- ----- - - T T

11 I 12

MNO

I P

7

Q

~~"j---II--- ~~?--- --~~? 8 I 9 10

------n-z R-Z I 11 12

25

b The last step, recovermg the hteral key, IS then taken The key IS to be found among

the letters of the hteral key reconstruction diagram m figure 12

ABC

1

- 8~r--18~r- --I-----8~i ------ 2 3 4

The termmation ATIONS seems a hkely possibihty If this IS correct, assignmsnj of letters

becomes modified as shown in figure 13

The word PENETRATIONS WIll fit and It IS taken to be presumably correct There IS no absolute

certamty about the matter, for It IS conceivable and possible that there are other words which

can be made to fit the sequence of key numbers grven

15 AlternatIve method of solution -a The foregomg solution WIll no doubt appeal to the

student as bemg straightforward and slillple-if the orunmal assumptuni as to the undih. oj the

tramspoeuum. rectangle '/,s correct But, unfortunately, there IS no way of knowing whether such

an ongmal assumption 18 correct until solution IS well under way In practice, of course, what

FIGURE 11

8 2 5 3 II 9 1 12 4 7 6 10

E N ElM Y ~I~ R c E E S ------~~

T I M A T E D A T T H R --- - - - - - - - - - -

E E I N F A N T R Y B A - - - - - - - - - - - -- T T A L I 0 N S M 0 V I - - - - - - - - - - - -

N G I N T 0 P 0 S I T I --- --- - - - - - - - - 0 N T 0 A T T A C K B E - - --- - - - - - - - - T W E E N H I L L N E A - - - - - - - - - ----- R T A B L E R 0 C K S T - - - -

NIA

- - - - - -

A T I 0 N D S T R E

A M J U N C T I 0 N S E - - - --- --- - - - - -

V E N H U N D R E D Y A - - - - - - - - - - - -

R D S E A S T 0 F A L L - - - - --- - - - - - -

I S 0 N C H U R C H X A - - - --- - - - - - - -

R T I L L E R Y F I R E - - - - - - - - --- - - S E V E R E 0 N F R 0 N - - - - - - - - - - - - T 0 F S E V E N T H R E - - - - --- - - - - - - G I M E N T X R E Q u E - - - - - - - - - - - - S T B A R R A G E I M M - - - - - - - E D I A T E L Y

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

24

1 12 4 7 6 10

FIGURE lOe

I I , ,

I I 0 R C E E S - --1--- -

D A T T H R - - - --- - - - - - - - N T R Y B A --- - - - - - ~- - - - -

I N S M 0 V I - - - - - - - - - - - - P 0 S I T I t-- - - - - - - - - - -- T A C K B E t-- - - - - - --- - - -

I L L N E A t-- - - - - - - - - - -

R 0 C K S T

r--1--- - - --- - - - -- N D S T R E

r--i-,-- - - - - - - --

-I-I- T I 0 N S E t-

--1- D R E D Y A

T 0 F A L L t-- - - - - --- - - - -

U R C H X A

r-- - - - - - - - - - -

R y F I R E

r-- - - - - - - - - - - 0 N F R 0 N - - - - - - - - --- - - E N T H R E

r-- - - - - - - - --- -

X R E Q u E - - - - - - - - - --- - A G E I M M - - - - - - L y

1

2

11

10

12

13

14

15

16

17

18

19
27

R R 5

NAT

PRE

TOR

A V A

RED

T H R

C H U

C K A

ILL

TIN

eRA

B E 5

Z E R

E A 0

FIGURE 16

RR

N A

P R

T 0

A V

R E

T H

C H

C K

I L

T I

C R

B E

Z E

E A

12346 1 2

bored column of the rectangle and therefore there ISno uncertamty at least as to the letter which

IS at the bottom of that column

c Suppose that a good mmal juxtaposition has been found for the portion of the text that

has been wntten on the sliding strip, and that a senes of excellent digraphs has been brought to

hght The novt step I~, of COUI..,e, to udd to these digraphs on either

SIde by finding sections of text that WIll yield "good" tnginphs and

tetragraphs FOI example, suppose that the imual juxtaposition hus

YIelded what IS shown m Iigur o 14 TIl<' rhamph P R suggi sts thut It

must be followed by a vowel, preferably E, A, 01 0, the digraph A V

might be par I, of tho WOld CAVALRY, In which case It will be followed

by A, the.' dun aph C R suggests that it mlgllt be followed by the vowel

A or E A place IS therefore sought, III the rest of the tevt, Whf'IP

there I~ a sequence of the letters her e dosu ed, and, of course, at the

proper vnterials Suppose such a sequence IS found and yields "hat Ib

shown III fl~UIC 15 The skeletons of "Old.. arc now begmmng to

appeal Assummg that A V A 1" indeed part of the WOld CAVALRY,

there ..hould be an L to follow It, the trigiuph TIN suggests the tormmauon G, the tngruph Z E R suggests the WOld ZERO A section of

text IS therefore bought, wluch "WIll have the letters L, G, and 0 III the

order L G 0 Enough has been ..hown to demonstrate

the procedure In the course of the WOIk It soon becomes evident

whet e the ends of columns are, because the dlg'1 nphs above and below

the nuclear OI "good" portion become "bad" qurte 'luddenh', Just ,t" J IIGURE 14

soon as letters belongmg to nonadjacent columns In tIl(' ongmal rectangle ale brought together .For e'l:ample, m figure 15 It IS obser\'ed that the tllgraph at the

top, R R 5, IS hIghly 1IIlpIObable, as IblIkeWIse the trrgraph at the bottom, E A 0 ThIS suggests

that these letters have been brought together erroneously, that IS, that they do not belong In

adjacent columns III the enCIphermg rpctangle If thIS IS true then the "good" portIOn 18 composed of the 13 letter<; bet'\\-een these two e""tremltlCs and therefore the columns are about 13

letter!> long .AddItIOnal wOIk WIll SOOIl show eJl.actly how long £-ach column really IS, and when

thIS has hpen asccrtaIned the pIOblem has b<'pn pJactlcally completed, smcc at the <lame t1IIle

that thIS becomes evu]ent the "equence of colnmu"l hab al...o become eVIdent

d An example of solutIOn by tIns alternatIve method may be helpful UblIlg the CIyptOgIam of paragraph 13 as nn pxample, hgme 16 sho" s how the text mIght be transcrIbed on a sheet

of crOSS-bectIOn pllper NotIng that the ml'ssage contams a Q as the 129th letter, a Sl'ctron of

text to mclude the Q IS transcrIbed on a strrp of cross-sectIOIl paper and thlb strrp IS then Juxtaposed agaInst the remaInmg tl'~t to brmg the Q III flOnt of a U How many lettPls should be

mcluded m thIS strrp? The mesbage contams 224 letters, If a WIdth of say 10 t020columnslS

assumed, the columns of the re( tangle will be about 12 to 22 letters m length It WIll be safer to

assume a convement length closCI to the maXImum than to the mlmmum, conbequently a length

of 20 lettl'rs WIll be tentutlvely assumed Now the Qmay be at the top of a column, at the mIddle,

1

¥

L

26

might be dono wrthm a well-orgaruzed cryptanalytIc umt would be to drvido up the work among

the mdrviduals constituting the unit, each being assigned one or more specific hypotheses to try

out with respect to width of rectangle Then one of these individuals would find the correct

width and he would be joined by the others ns soon as an entcnng wedge bad been found In this

way Of, If the cryptanalyst I~ working alone, he must try out successive hypotheses as to

WIdth of rectangle until he hits upon the correct one In making these hypotheses he must be

guided by previous expenence with enemy correspondence, which may afford clues ab to minunurn

and maximum WIdths of rec tangles

b However, there Ib another method of uuack WhICh does not necessitate makmg any

definite mrtml assumptrons with respect to the WIdth of the transpositron rectangle ThIS method

IS a modifica uon of the method s< t for th In the pr er edmg pal agr aph The tevt of the cryptogram ISwritten out columnwise on cress-section paper, every fifth letter being numbered for purposes of reference Plenty of space ISleft between the columns, and about 10 01 15 letters at the

bottom of each column are repeated at the top of the next column so that at any POInt In the

transcnption there '\\-111 be in a single unbroken string at least one complete column of letters from

the transposiuon rectangle Then a section of consecutive letters of text IS written on a separate

strip of cross-section paper, columnwiso of course, and by juxtaposing this strip against the whole

text, shdmg It to various pomts of coincidence against the text, an attempt IS made to find that

positron In which the best digraphs are formed of the letters on the movable stnp and the fixed

sequence Of course, If there IS a Qin the cryptogram, the sliding-strip section IS made to contam

this letter, und the strip IS then placed against the text where a UIS found, so as to form the digraph

QU The digraphs formed above and below the QU all' then studied, possibly a wntten record IS

made of the digraphs found Then the 'lame thmg Ib done with the Q and all other U's in the

text, to InSUI c that a correct star 1,IS made It IS this mitral step which IS hkely to grve the most

dIfficulty (If thC're IS anythmg dlffiwlt at all m the plocedure) and It IS Important that It be correct If thlb fllbt ~tep Ib eabY, then ..olutIOn followb qUIte rapIdly, If the cryptanalyst IS unlucky

and makes sevelal false starts, thp procesb IS hkely to be a slow one In chOOSIng from among

several pOSSible JuxtapobltIOns It may be adVIsable to calculate the probabilIty value of each

pOSSIbilIty by addmg the logarlthm~ of the frequpncy value~ of the dIgraphs, as explaIned m

paragraph 7q In the absC'nce of any Q's m the te""t, rewurse must be had to the fOlmation of

other probuble dlgruphs, bused upon the presence of (,(~rtUIn other telltale low-frequency letterb,

such as C,H,J, K, V, and X The cryptanalyst IS fortunatp If therp are two or three of these lowfrequency letters close to one another In a selles of letters, for m thI" case he can search for a

place where there are hIgh-frequency letters (m a correspondIng sequence) that mIght be combmed wIth them For e""ample, suppose that a tp"t shows a sequen(,e V E H H K

A bequence such as ART C C would bp excpllent to try, for It wIll ywld the dlglahhs

AV, RE, TH, CH, CK Or If there IS a long sequence of consonants, the cryptanalyst should

look for a cOlrespondmgly long sequence of vowels, SInce thesc make the best cOmbInatIOns and

are therefOle most probable For thpse reasons It pays to study the text qUItC carefully befole

chOOSIng a startIng pomt, to find all such pecuhar sequences as mIght be useful In affordmg a

good POInt of departure It should also be noted that there are at least two correct posItIons at

whIch the sIrdmg stnp can be luxtaposC'd agamst the text, smce m the cnCIphermg rectangle the

letters m one column form dlgraph~ WIth the letters m the column not only on the rIght but also

on the left In the abseme of any Q's, or othpr 10w-freqUl·nc,y letters SUItable for a pomt of departure, the very first 20 or 25 lettpfs of the cryptogram may be uscd as the startmg pomt, smce

these letters come from column 1 of the transposItIOn rectangle and therefore there ISno uncertamtyat least as to the letter whIch IS at the top of that column, or, the last 20 or 25 letters of

the cryptogram may be used as the stal hng pomt, sm(,e these letters come from the last-num-
28 29

1 2 3 4

0 OT 28 OF 91 OE 177

o I D 31 M 61 F 01 T 121 E 151 A 181 A 211 110 R 110 RM 110 RM 110 RE

D 5 5 M N A E L U UE 80 UB UA N T C B D 0 N 0 I M MO MI ML 180

N E L I A 0 E 0 E E5 EE 9" EA P 6 o as C 611 E 9" H125 T 155 E 185 I 216 T TT TH TE T I 5 H I H M R lUi Y 115 YE 115 YB 115 YN

I T 0 B R E Y 0 0 00 35 OV OE R 0 E V H A T R IO 1 II IT IE 185

N M F T Q C F Y KO KT KB 100 KM T 10 A(Q C 70 B 100 I 180 N 160 I 190 N220 NN NO NE NY D N F E E 5 T N 120 KN 120 KM 120 K5 120 KT

T L F 5 T H A R TP 5 TA (Q TR TF U N T R E E N G NT NN N5 NI 190

R 0 E 5 T E L Y DI DL DY lOS DT o 16 E~ E 75 Y 105 N 135 V 185 N IllS AR AN AL AA E B E L 0 T N 126 HN 125 HO 126 HX 126 HN

X 0 M X T R U IT 10 IE 45 IR IL A U I R R E A RD RB RO RN 19"

L H A 0 A 5 C HT HO HR 110 HN N 20 E 50 I 80 R 110 A 1(Q R 170 L200 --. QU QU QU QU ...- I N T U V A R 130 IR 130 IH 130 IM 130 IA

E L E M R I E EO 15 EE 50 EE EC T E A E I I N TE TN TT TL 200

G 5 I T R E R EX EL EY 115 ER N25 E 55 J 8ll yll5 5 145 A 176 T2116 TA TE TO TE W A N 0 T T R 135 NL 135 N5 135 NI 135 NN

T A 5 I G E A ON 20 OE 55 OK OR T C 0 K 5 E T TI TA TN TT 205

M T I N E A 5 RE; RA RK 120 RR E 80 ROO V90 K 120 F 150 L 180 o 210 AT AC AT AA 0 M F T E A A 140 AG 140 AT 140 AN 1(Q AT

5 5 M N A E L VN 25 VR 60 VD V5 T C B 0 0 N 0 RW RM RA RO 210

E L I A 0 E D IT I5 IH 126 IA o 35 C 85 E 95 H125 T 155 E 185 I 215 RT RC RI RL I 5 H I H M R 1~ 5M 145 5L 145 5R 145 50

T 0 B R E Y 0 TE 30 TC M TH TD 0 E V H A T R GO G5 GQ GI 215

M F T Q C F Y 55 SO 5I 130 SR A 40 C 70 BIOO I 130 N 160 I 190 N 2:0 ET EE ET EO FIOUBJ: 16 1 2 3 4

FWUBB17-A

824155-41-8

L
30 31

Iigure 17-C The upper and lower hrmts of the columns are now fairly definite and are

marked by the horizontal bars, tetragraphs E E E Y at the bottom and A M I E at the top

are very Improbable The :tetragraph C E E S below the top bar IS possible, because It may

represent the end of a word hke FORCE followed by the begmmng of the word ESTIMATED, the

tetragraph above the bottom bar suggests a word ending In E followed by the word IMMEDIATE

It seems hardly necessary to continue WIth the demonstranon, In a few moments the entire

diagram IS ieconstructed and yields the solution During this process as soon as a section of

text in figure 16 has been used It IS crossed off, so as to prevent ItS letters from bemg considered

as further possibihnes for addition to the reconstruction diagram Thus, as the work progresses

the number of available sections becomes progressrvely less, and the choice for successive secnons

for addition to the diagram becomes a quite easy matter

f When two or three operators are assigned to work upon a cryptogram by this method,

solution can be reached In a very short space of time, especially If each one of the operators takes a

different POInt of attack After a few minutes the fragments of texts obtained may be assimilated into one message which IS then completed very speedily

g Tlus and the next four subparagraphs will be devoted to some remarks of a general natur e

concerning columnar transposition of the foregoing type The degree of cryptographic seounty

afforded by SImple columnar transposition methods, especially when Incompletely-filled matrices are employed, IS considerably Increased If some of the cells of the matrix are occupied by

nulls instead of sigmficant letters If nulls are employed JUdICIOusly their presence serves to

confuse the cryptanalyst by mtroducmg unusual digraphs, tngraphs, and polygraphs which

may lead him to discard correct combmanons of columns In the anagrammmg process and thus

retard solution Obviously, the use of low-frequency letters such as J, Q, X, or Z as nulls does

not commend Itself for this purpose, as such letters would not only distort the normal frequency

distnbution and thus give clues to the presence of nulls, but also they would be quicklv

"spotted" m the anagrammmg process

h Another subterfuge, and a good one, to put stumbling blocks in the way of a quick

solution IS to leave "blanks" wrthm the transposmon matrix, that IS, certam cells are left unoccupied by letters of the text If only a few cells distnbuted irregularly within the columns

of the transposrtron matrix are designated as blanks, the disturbing effect upon the anagrammmg process IS quite marked TIns more or less effectively hinders the cryptanalyst In hIS

attempts to ascertain the lengths of the columns and considerably increases the difficulty of

the anagr ammmg process

'/, In order to fix defimtely the pOSItIOns of the nulls or of the blanks In the transposinon

matnx, defimtc prearrangements between correspondents are necessary These may be in the

nature of "forms" outhmng the matru., ShOWIng the number of columns and the pOSItIOns of the

cells to be occupIed by nulls, or of the cells to be left vacant m the InSCnptIOn process, or the

pOSItIOns of thcse cells may be denved from the elements of the transpOSItIOn key Itself If

"forms" are employed, they may be used WIth varyIng transpOSItIOn keys, so that even though

there may be only relatIvely few dIfferent forms, the use of varyIng transposItIOn keys serves to

mcrease cryptographIC sewnty to a rather marked degree

J If nulls, or blanks, or both, are dlstnbuted Irreglliarly but symmetrIcally throughout the

transposItIOn matrIX (as, for example, blanks are dIstnbuted m cross-word puzzles) solutIOn

of SIngle messages pro(luced by SImple keyed-columnar transposItIOn from such a mahlX

becomes an extremely dIfficllit If not ImpossIble problem Naturally, If nulls and blanks are

dIStrIbuted Irregularly and assymmetncally the matter becomes hopeless, as far as a smgle

message ISconcerned

k Of course, If scveral messages of IdentlCallength and In the same key are avaIlable for

supenmposltIOn, the presence of the nulls or blanks then makes httle dIfference, because the

L

SOFV

ERMT

AUBR

AMIE

CEES

TTHR

RYBA

MOVI

SITI

CKBE

LNEA

CKST

STRE

ONSE

EDYA

FALL

CHXA

FIRE

FRON

THRE

EQUE

EIMM

EEEY

SOF

ERM

AUB

AMI

CEE

TTH

RYB

MOV

SIT

CKB

LNE

CKS

STR

ONS

EDY

FAL

CHX

FIR

FRO

THR

EQU

ElM

EEE

MTT

lEY

ATO

INI

TOK

ETN

ARK

IAT

JAN

-3 FIGUBII: 17-B

SIO

CKD

LNN

CKN

STP

ONT

EDI

FAR

CHN

FIT

FRD

THT

.. EQU

EIR

EEO

MTE

lEX

ATA

INL

TON

ETI

ARE

IAT

JAG

-1

Or at the bottom-there IS no way of tellmg at this point Hence, to make sure that nothing

IS overlooked, suppose a section of 41 letters IS taken, with the Qat the center There are 4 U's

10 the message, and 4 trials are to be made The results are as indicated m figure 17-A Exammmg combmation 1m figure 17-A, the digraphs formed both above and below the QUare not at all

bad In fact, not one of those above the QUIS impossible and the same

IS true of those below the QU until the digraph V NIS reached Hence,

combmation 1 IS possible As fOI combmauon 2, this at once appears

to be bad Digraphs such as I I, and I H RIP highlv improbable, and

this combmatron muv be discardI'd WIth 'mfl'ty Combmation ts

possible from the top digraph, 0 F, to the 12th digraph below the Q U,

ulthough the digraph H X looks Vl'ry bad However, the X might be a

sentence separator, so that this combmation cannot be discarded

Combination 4 looks very Improbable, WIth the digraph H N occurrmg

twice, and other equally bad digraphs showing Of the fOUI possibilrues then, combmations 2 and 4 are discarded, leavmg 1 and J for

fUI tlier study It IS very difficult to dIOOSl' between these two pOSSIbihtres All the digraphs m combmatron 1 down to digraph V N are

possible. many of them are excellent As for combmatron 3, all the

digraphs down to V D are also possible and many of them ale excellent

There does not seem to be much use to add the frequency values of the

digraphs (or loganthms thereof) m each combmanon because It IS hard

to know WIth what digraphs to begin or end, although as a last resort

this could of COUIse be done However, perhaps 'It '/,s not essentw,l that

a c!W1-Ce be made at once, poss'/,bl'l/ further work along ~he hmee now to

be demonstrated unll show 'lJ'h1,Ch eombuuuum '/,8 correct

Notmg the 2 K's (m the digraphs K Band K S) among

the combmations before the Q. assume that these K's are

parts of the digraph C K Is there a sequence C C in

the text? There IS but one SUdI place, at the 63d letter

Suppose the correspondmg section IS placed m front of

the combmations 1 and 3 of figure 17, as shown in figure

17-B It immediately becomes evident that combmation 3 IS the correct one, for note the excellent tngraphs It gives, as compared WIth those 10 combmauon

1 Also note that the second tngraph below the E Q U

111 combmation '3 consists of 3 E's, mdicatmg that the

end of the columns has been reached JU'lt before tIll'!

trlgraph As fOl the top tngraphs of figUIe 17-B they

are good all thl' way up But now the skeletons of

word!> al e begmnmg to appear The T H R ImmedIately above thl' E Q U suggest<~ C'lther THREE or THROUGH, the FRO above the T H R suggests FROM or

FRONT Suppose the word REQUEST IS assumed fOI the E Q U, and the \\ord

THREE IS assumed for the T H R above It ThIS reqUIres a sectIOn WIth 2 E's m

succebSlon

e Therl' are several such places m thl' text, and further hmltatIOn IS adVIsable

The 8th tngraph from the top IS certamly suggestIve of the WOld MOVING, whICh

reqUIrl'S an I to follow the V Is there a place 1Jl the text where an I occurs 12

letters before a succeSSIon of two E's? There IS one !>uch place, and the correspondmg sectIOn IS Juxtaposed at the proper place, yleldmg what IS shown 1Jl FIaUBII: 17-0
Iv,

generalsolutwn to be explained m a subsequent paragraph (par 26) can be applied Or If messages with similar beginnings or similar endings are available, solution IS facilitated here as m the

simpler case where nulls or blanks are not employed, as will be explained m subsequent paragraphs (pars 23-24) Oonsrderatrons of space prevent going into detail m the solution of an

example, and the student should undertake a study of these cases for himself

('i' 16 The C~P and the P~C sequences -a Two numerical sequences which constitute the

bases for several very Important cryptanalytic operations and procedures m the solution of

transposrtion ciphers may be denved from, and are applicable to, most CIphersof this class They

are as follows

(1) A sequence the suceessrve terms of which indicate the position numbers that the

sUCCeSSIVl:' letters of the plam text occupy m the CIpher text TIDS sequence WIll heremafter be

designated the pla'/,~c'/,pker sequence, or Pr--Osequence

(2) A sequence the sueeessive terms of which indicate the pOSItIOn numbers that the

successive letters of the CIpher text occupy m the plain text ThIS sequence will heremafter be

designated the ctphe~platnsequence, or O~p sequence

b These two sequences are obviously related, one being the tnl erse or indexed version of the

other GIven one of the sequences, the other can he derived from It by the SImple operation of

mdexmg, in a normal sequence, the positions occupied by the numbers consntutmg the sequence

on hand An example will be grven presently

c Note the encipherment shown in FIgure 18-A

T RAN S P 0 SIT ION

12 9 I 4 10 8 6 11 2 13 3 7 5

THE QUI C K B ROW N

FOX J U MP S 0 V E R T

HELAZYDOG

Term No I 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 31 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35

CIpher E X LBO G 0 E Q JAN T C P D WRIM Y HOE U U Z K SOT F H R V

FlOvpl8-A

Now, If, instead of letters, the SUCCl:'SSIVe numbers 1,2, 3, are mscnbed in the cells of the

matnx, m normal order of wntmg, the "CIpher text" becomes the P~C sequence and IS as

follows

12 9 1 4 10 8 6 11 2 13 3 7 5

01 02 03 04 05 06 07 08 09 10 11 12 13

14 15 16 17 18 19 20 21 22 23 24 25 26

27 28 29 30 31 32 33 34 35

Term number. _ _ 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 31

P~C equences 03 16 29 09 22 35 11 24 04 17 30 13 26 07 20 33 12 25 06 19

n 22 23 24 25 26 27 28 29 30 33 M U

32 02 15 28 05 18 31 08 21 34 01 14 27 10 23

FIGURE 18-B

The student may easily verify that the P~C sequence IS what It purports to be by notmg that,

according to It, the 1st letter of the plain text of the illustratrve message, Tp , becomes the 31st

letter of the CIpher text (since the number 01 occupres position 31 m the P~C sequence shown

above), and that in the cryptogram the 31st letter IS To,the 2d letter of the plain text, Hp , becomes

the 22d letter of the CIpher text and that in the cryptogram the 22d letter IS Ho , and so on In

connection With the P~C sequence, It IS to be noted that successive terms m the sequence,

33

m the case of smgle transpoertion, show a constant difference except when passing from a greater

to a smaller number, which happens every time a transition IS made from a term applymg to

the bottom element of one column to a term applymg to the top element of the next column

For example, m the case of the 1st three terms in the sequence 16-03=13, 29-16=13

However, m the case of the 3d term of the sequence (29) and the 4th (09) the passage 1& from

a greater to a smaller number and the constant difference, 13, no longer I~ evident ThE' cause of

the constant difference IS, of course, ObVIOUS and follows directly from the mechamcs of till:' transposinon system Itself The pomt to be specially noted I'" that the existence of ..uch a constant

difference (WIth the exeeptions noted above) may bl:' taken as one of the idennfymg oharaotenetics

of single columnar trensposmon, double columnar transposrtion or other types of complex transpOSItIOn WIll show no such constant difference throughout the P~C sequence

d GIven the P~C sequence m subparagraph c, Its mverse, the C~P sequence IS eetabhshed

merely by preparing an indexed version of the former Thus

Term number _ _ _ __ _ _ __ 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 :II

r--o sequence 03 16 29 09 22 35 11 24 04 17 30 13 26 07 20 33 12 25 06 19

n 22 23 24 25 26 27 28 29 30 33 M U

32 02 15 28 05 18 31 08 21 34 01 14 27 10 23

Term namber _ __._____ _ 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20

C~p sequence 31 22 01 09 25 19 14 28 04 34 07 17 12 32 23 02 10 26 20 15

n 22 23 24 25 26 27 28 29 30 33 M U

29 05 35 08 18 13 33 24 03 11 27 21 16 30 06

e The C~p sequence can also be produced in another way Suppose that numbers are

mscnbed in the cells of the transposinon matnx, not in the normal manner of writing from left to

nght and form the top downward, but aecordmg to the route followed m transcnbtng the numbers

to form the "CIpher text," that IS, in key-number order m the columns of the matrix Thus

12 9 1 4 10 8 6 11 2 13 3 7 5

31 22 01 09 25 19 14 28 04 34 07 17 12

32 23 02 10 26 20 15 29 05 35 08 18 13

33 24 03 11 27 21 16 30 06

FIGUBIII8-C

If these numbers are now transcribed acoordmg to the normal manner of wntmg (from left to

nght and from the top downward), the sequence produced IS 3122010925 ,whIch comeides With the C~p sequence shown in subparagraph d above, which m turn was denved from the

P~C sequence

Term number 01 02 03 04 05 06 07 08 09 10 11 12 13 14 16 16 17 18 19 20

C~p sequence 31 22 01 09 25 19 14 28 04 34 07 17 12 32 23 02 10 26 20 15

n 22 23 24 25 26 27 28 29 30 33 M U

29 05 35 08 18 13 33 24 03 11 27 21 16 30 06

j The C~p sequence may also be called the anagramsequence because It can be established

as a result of a solution accomphshed by anagremmmg superimposed messages of identical length

It IS clear that what IS acoomphshed m such a solution IS to rearrange the letters of the Cipher

text to bnng them back into their ongioal order in the CIphertext, that is, the solution mvolves a.

C~P conversion

g The P~C sequence IS called by a recent French author the Kp sequence (from the Greek

word /cryptos) because It grves the order of the plain-text letters as they occur in the cryptogram

The p~C sequence IS also termed the enctpkersequence by another wnter, and still another has

called It the transposuwn sequence The present author believes that the termmology adopted

herem, mz, p~C sequence and C~P sequence, IS less confusmg and serves more accurately to

Identify or ehsractense these sequences than the other designations herem mdicated

L
P--+Csequence+L 04 17 30 10 23 36 12 25 05 18 31 14 27 08 21 34 13 26 07

1-4 """d=7 4-10 ""5:"i2 6-11 7-

20 33 03 16 29 06 19 32 09 22 35 02 15 28 11 24

B=1 10-8 11-2 U=9 13=3

The equrvalencres between Identities, as indicated above, indicate not only that the eneiphenng

matnx has 13 columns, but also they may be used to estabhsh the actual transposrtion key or

at least a cychc permutation of the key, by constructing a cham of equrvalents Thus

1=4,4=10,10=8,8=6,6=11,11=2,2=13,1'3=3,3=7,7=5,5=12, 12=9,9=1

ThIs Yields, by ehmmatmg the term common to successive equivalents, the followmg cham or

transpOSitIOn key

1 4 10 8 6 11 2 13 3 7 5 12 9

Reference to figure 18-A will show that the foregomg key IS a cychc permutation of the actual key

1 There remain only some minor remarks which, being of a general nature ansmg from the

meehemcs of SImplekeyed-columnar transposmon, are worth notmg They are discussed in the

subsequent two subparagraphs

m An appreciation of the difficulnes mtroduced by employmg only mcompletely-filled

rectangles indicates that It would be very useful If there were some method whereby m the mitral

stages of solution the CIpher text could be divided up correctly into ItS component long and short

columns, for the subsequent steps of rearranging the columns by the anagrammmg prmcipls are

qurte SImple If, for example, there were some feature which provided a means of sscertaimng

when m encipherment a transit was made from the bottom of one column to the top of the next

column, then the location of these transrtion pomts or "breaks" would obviously permit of breakmg up the Cipher text mto ItS correct long and short columns In later studies cases of this kmd

Will be encountered

n It IS useful sometimes to be able to ascertam Just where breaks cannot occur, that IS,

where a passage from the bottom of one column to the top of the next one cannot occur m the

CIpher text, for this Willlimit the field for expenment A oonsideratson of the mechamcs of the

system WIll afford an excellent clue to the fact that thiS determmation IS easy to make In any

transposmon rectangle mvolvmg SImple keyed-columnar transposition the interval, m the Cipher

text, between two consecutive letters which are m the same row m the matrix IS the sum of a

10 11

35

8 9

Denvatrve 2__•______ 11 27 21 16 30 A Z Y 0 0 28 - K

Denvatrve 3.•••••___ 12 28 22 17 31 N K H W T 29 - S

h The term number IS useful merely to facihtate findmg and referrmg to specific terms or

numbers in a sequence, whether the latter be a C--+P or a P--+Csequence The number simply

mdicates the locus or position a term occupies m the sequence In connection with a plamtext message the consecutive term numbers 1, 2, 3, may be used as loci for the successive

letters of the message, in connection with a cryptogram the consecutive term numbers 1, 2, 3,

may be used as 10Cl for the successive letters of the cipher text

In single, keyed-columnar transposrnon an mterestmg relanonslnp exists between sections

of the C--+P sequence Consider the C--+P sequence given In subparagraph d above, and note

that by adding the mteger 1 to the successive numbers thereof, sections of the ongmal sequence

show certain Identities with sections m C--+Psequence + 1 Thus

Term number - - - _ __ 1 2 3 • 5 6 7 8 9 10 11 12 11 14 15 16 17 18 19 20 21 22

C--+P sequence 31 22 01 09 25 19 14 28 04 34 07 17 12 32 23 02 10 26 20 15 29 05

C--+Psequence+L_ 32 23 02 10 26 20 15 29 05 35 08 18 13 33 24 03 11 27 21 16 30 06

u M M

35 08 18 13 33 24 03 11 27 21 16 30 06

36 09 19 14 34 25 04 12 28 22 17 31 07

In fact, If the successive numbers of the C--+P sequence are set down in rows to produce sequent

numbers lD columns, the followmg mterestmg diagram IS obtained

31 22 01 09 25 19 14 28 04 34 07 17 12

+1 32 23 02 10 26 20 15 29 05 35 08 18 13

+1 33 24 03 11 27 21 16 30 06

FIGUBlIi 18-D

34

Reference to figure 18-e Will show the Identity of this diagram with that figure Such an

arrangement of course mdicates at once the number of columns ill the transposrtron rectangle,

from which It follows that 1fthe C--+P sequence IS available It IS an easy matter to estabhsh the

outlines of the transposition matrix The phenomena dealt With m this subparagraph are but

a reflection of those discussed m subparagraph c above

:J The phenomena Just Indicated may, however, be employed to advantage ill another

manner ill the solunon of an unknown example Referrmg to the Illustrative cryptogram In

subparagraph c above, suppose that the cryptanalyst has reason to suspect the presence of the

probable word QUICK The letters necessary to produce this word (and their term numbers m

the cryptogram) are as follows 2~

9 26 19 11 28

QUI C K

The sequence 9-~~-19-14-28 now constitutes a portion of the C--+P sequence Addmg the

integer 1 suecessrvely to these C--+P numbers, let thc cmrespondmg letters be set down alongside the numbers Thus

25 Basc___________________ 9 26 19 14 28 - QUI C K

26 U Derivative L_______ 10 27 20 15 29 - J Z M P S
36

Paragraph

17 __ 18

__ 19

OPPORTUNITIES AFFORDED BY STUDYING ERRORS AND BLUNDERS MADE BY

ENEMY CRYPTOGRAPHERS

SECTION IV

17 Importance of the study of errors and blunders In early work upon an unknown

system --a Blunders and rmstakes made by cryptographic clerks In the execution of cryptographic clerks in the execution of cryptographic mstructions should be rare m a well-trained and

well-disciplmed cryptograpluc service Nevertheless, blunders and mistakes are committed

despite all that can be done to prevent their OCCU'ITence Especially m the excitement prior to

or during an Important action or movement do such instances take place and these afford golden

opportumties for the enemy cryptanalytic service ThIS situation exists 111 respect to all types of

cryptographic systems and no cryptanalytic instruction would be complete If cognizance were not

taken of the advantages which may be leaped from the blunders, the nnstakes, and, occasionally,

the downright ineptitude of the adversary's cryptographers

b Practically every cryptographic systcm affords opportumtres for the commission of errors

m Its application, and each system more or less presents a separate case That IS, the errors which

may be made 111 one type of cryptographic system may be peculiar to that type alone and to no

other type, hence, the astute cryptanalyst IS constantly on the lookout for instances of cryptograms contammg the specific type of error by which that system IS handicapped Furthermore,

the general types of blunders or errors that may be committed are nearly as numerous as are the

general types of cryptographic systems, so that no complete hst of such as may be encountered In

practice can be drawn up

c After the cryptanalyst has by pamstakmg and more or less arduous labors solved a system

and has become thoroughly fannhar WIth ItSmechemcs, he should carefully review the details of

the mechamcs to learn what thmgs can go wrong, what sorts of mistakes the enemy cryptographic

personnel are hkely to make, and then study the externalman~festatwns oj these aberratwnssothat he

may beable to recogn~ze snstamee« oj the~r occurrence ~n subsequent cryptograms ThIS sort of study

has no value in rtself particularly, ItS Importance lies in the fact that the effects of erroneous

treatment may lead to very rapid solution or to quick recovery of keys to subsequent messages

d When an unknown system IS under mvostagation and the cryptanalyst IS striving to ascertam Just how It operates (which IS often the most difficult step In solution), a study of the cryptograms representmg correcnons to preVIOUS messages contairung errors IS a most fruitful source of

data Indeed, at times this sort of intensive study will yield clues for solvmg a system which

might otherwise resist all efforts to break It down for a very long time

18 SIgmficance of terms "speeialsoluucn" and "generalsolution "--a Now the Importance

of the comments made in the foregomg paragraph will be clear If It IS noted that a study of the

blunders and errors often leads to the elaboration of methods for the rapid breaking down of

cryptograpInc systems But It must also be realised that m some cases no blunders or errors are

essential to a rapid solution of the type alluded to above Sometnnes the very mechanics of

(37)

Importance of the study of errors and blunders In early work upon an unknown '!!)''!!tl.m

SIgnificance of terms "special solution" and "general solution" -

1 2 3 4 5 6 Examples to be studied _

7 8 9 10 11 12

13 14 15 16 17 18

19 20 21 22 23 24

25 261

---

0 4 8 12 16

------

5 9 13 17 21

--

10 14 18 22 26

Length In

letters

No 01

long col

limns

5 4

o multiplec..,; 0 0

1st multiple.c.,.. 5 4

2d multiple 10 8

3d multiple - 12

4th multiple - 16

All the possible positions of breaks in the CIpher text, that IS, transrts from the bottom of one

column to the top of the next column, may now readily be ascertained by findmg the totals resultmg from making all the possible combinations of the mdicated multrples taken In pairs It IS

convenient to draw up a table to show directly the sums of the combinations Thus

o 1 2 3 4 -No 01sbort columns

o 4 8 12 16 __ -Lengtb ID letters

2 10

multiple of the length of the short columns and a multiple of the length of the long columns For

example, consider the adjacent letters CKIn the plain-text rectangle In figure 18-A In the CIpher

C.IS the 14th letter, K. IS the 28th and the Interval IS 28-14=14 The message has a total of

35 letters and the matrix has 13 columns, 9 long ones of 3 letters and 4 short ones of 2 letters

An Interval of 14 can therefore be brought about ill only one way (4X3)+(1X2)=14, which

means that 4 long columns and 1 short one mtervene between the C and the K m the plain text

and that the key numbers applicable to the two columns are 5 apart In sequence, that IS, If th~

column m which C IS located has key number 1, the column next to It on the right IS 6, or If the

former IS 2 the latter IS 7, 8.I1d so on Reference to figure 18-A WIll show that these deductions

are correct and that the key numbers mvolved are 6-11 However, a more general treatment IS

possible GIven a cryptogram of 26 letters and an assumen

WIdth of 6 columns, for example, the matrix can have only 2

columns of 5 letters and 4 columns of 4 letters Settmg down

the multiples of the two lengths m tabular form, for convenrenee, the followmg IS obtained

o 0

1 5

If, now, dragonal hnes are drawn from the 1000\'{'r left-hand corner to the upper right-hand corner

of the diagram, the locations of all possible breaks are given Thus, there can be a break between the 4th and 5th letters (passing from a short column to the next column, which may be

long or short, of c01ITSe) , there cannot be a break between the 5th and 6th letters nor between

the 6th and 7th, nor between the 7th and 8th, there can be a break between the 8th and 9th as

well as between the 9th and 10th, but not between the 10th and 11th, and so on Suppose that

for one reason or another the cryptanalyst has good reason to suspect that a break OCC1ITS immediately after the 13th letter ThIS means that there are 2 short columns (of 4 letters) and 1 long

column (of 5 letters) up to that break The diagram shows that there remain only 2 short

columns and 1 long one, and the only breaks that are possible beyond the one at the 13th letter

are Between the 17th and 18th, or between the 21st and 22d letters

o The Importance of the various principles set forth m this paragraph WIll become evident as

the student progresses In hISstudies of trensposinon ciphers
38

the system Itself are such that unavoidable or unpredictable circumstances arise so that special

solutions become possible The latter term calls for a bit of explanation

b When the crrcumstanccs surroundmg a specific cryptogram or set of cryptograms all' such

as to present peculiar or unusual condrtions that make a solution possible when m the absence of

these conditions solution IS either Impossible or improbable, tho methods employed m reaching a

solution m such cases constitute what IS commonly termed a special solutwll Some examples

WIll be demonstrated very soon Systems of which tIns may be true are, of course, cryptographically weak but It may be observed that It IS perhaps impossiblo to devise a system which may bp

consrderI'd to be absolutely free from tlus SOUI ce of weakness

c The advantages of a special solution for any type of cryptographic system are, as a rule,

two m number First, It often makes a solution possible when otherwise this might not be the

case Secondly, If often afford"! a method of aclnevmg a Vl'ry rapid solution m the case of a

problem which otherwise might require a long time But a special solution presents one baSIC

disadvantage It IS by ItS very nature dependent upon the existence of unusual CIrcumstances, m

other words, upon chance or good fortune brmgmg about a set of circumstances favorable for a

solution Whl'n these unusual conditions or circumstances do not obtain, then solution may be

Impossible 'Therefore, It IS desirable to have, If possible, for l'vpry tvp« of system a more or less

generalsolutwn which may be applied m the absence of the unusual condiuons nocessary for the

apphcation of a special soluuon In other words, a goneral solution m cryptanalysis implies 8

method or procedure which If applied 111 ordmary eases and under normal condrtions Will yield

the solution However, the term generalsolutwn in cryptanalysis must not be taken too hterally

The situation m cryptanalysis IS not exactly analogous to that which obtains m the field of pure

mathematics, for the CIrcumstances are often quite different in the two sciences A general

soluuon m mathematres IS expected to, and will, solve every case that falls withm ItS provmce,

a general solution in cryptanalysis IS likewise mtended to solve every case that falls within ItS

province but this usually partakes more of the nature of a prayer or hope than an expectation

Much depends upon the amount of traffic available for study, the length of individual cryptograms, and the indefinable element called luck, that IS, a set of fortmtous ctrcumstances which

happen to make a solution easy or difficult, such as the presence of many or exceptionallv long

repetinons, etc Furthermore, wh('rpas m mathl'matlC s a gpnefal solut'lon prescribes th(' exact

steps to be followed m arnvmg at the solutIon and thl' lattl'r can be apphed m all mstancps

WIthout varIatIon or deVIatIOn from a fixpd procpdure, m cryptanalysIS a general solutIOn ml'fl'ly

outlmes a broad path that may be followl'd m order to anne at a solution ApplIcatIOn of a

genpral solutIOn m cryptanalysIs m spPCIfic mstances may mvolve mmor detours to CIrcumvent

unpxpected obstacles, or It may mvolve qmte large changes or modificatIOns m the gl'nl'ral

procl'dure

19 Examples to be studIed -a As stated above m paragraph 17, a complete hst of the

speCIfic blunders that cryptograplnc clerks are prone to pl'rpetrate cannot be drawn up Cel tam

of them may be descnbed m gpneral terms and examples gIven of some which have already bl'l'n

encountered m tins and m precedmg tl'xts Commonly It IS the casp that these blundels do not

become eVIdent untIl two or more cryptograms are avaIlable for companson OnP of the most

frequent sources of cIrcumstances leadmg to the transmiSSion of cryptograms affordmg ruh

matenal for cryptanalytiC companson IS the follOWing A cryptograplnc cl('Ik preparl'S a cryptogram, m the course of winch he makes a mistake of such a nature as to render the cryptogram

dIfficult or ImpOSSible to deCIpher by the cryptographic clerk servmg the addressee A request

for repetitIOn ensues, whereupon the enCIphenng clerk reexammes hiSongmal work and finds that

he has made amIstake He then commIts the grave blunderof reenCIphermg the IdentICalmessage

(WIthout paraphrasmg) and transmlttmg what to the enemy cryptanalysts IS obViously a second \

L

39

version of the ongmal message The consequences are often fatal to cryptographic security

The least that can happen IS that the key for this particular message may be disclosed very

qmckly, more senous, the baSIC or primary elements for the entire day's traffic may be wrested

from the blunder, but most serious are the consequences If It happens that the blunder has been

committed Immediately or soon after a new cryptographic system has been msntuted and the

enemy cryptanalysts are exertmg strenuous efforts to learn its mechamcs, for then IS when the

information to be gained I"! most valuable

b In lll~ previous studies the <tudent hal> observed the many opportumties for quick

cryptanalync success afforded by enemy addicnon to the use of stereotypic phraseology, espeorally at the begmmngs and endings of messages Stereotypic phraseology affords even more

golden opportumties for cryptanalytic success in the case of transposmon systems than It does

In the case of substrtutron systeme

c In the next few paragraphs some specific examples of the consequences of cryptographic

blunders and ineptitude in the case of transposrtion systems will be studied These are mtended

to grvo the student some Idea of the far-reaching effects such studies may have It IS Important

that he grasp the fundamental prmciples, for they Will enable him to develop for himself the

methods that he may find necessary ill practical work Incidentally, It may be added that the

student should not get the Idea that these instances are purely theoretical It IS sometnnes almost

unbelievable that cryptographic clerks With any common sense would perpetrate the stupid

blunders that they do occasionally commit
B ReF T

ESE P Q

o V 0 E Y

FIGURE20

CRYPTOGRAM

R E F E R R I N G T 0

l----------------- ----

Y 0 U R N U M B E R

f--.---------------- - -- -

A

I-- --------------- --

0

I-------------- ------

D

- -------------------- R

- ------------- ----- M

I-------------- ----- G

I-------------------IR

--------------------IN

- ----

41

FlOURB22

columns of 10 letters The text can now be marked off into sections of proper lengths and, moreover, guided by the letters which must be at the heads of columns, the text can be mscnbed in

the rectangle in key order For example, column 1 must end WIth the second group, R MG R N,

column 2 therefore begins With E R There 18 only one possibility, VIZ, the fourth column

Tlns 18 a long column, and must therefore have 11 letters, makmg column 3 begin With R Y

Th18 defimtely fixes the position of the number 3 m the key, and so on The solution 18 reached

aftel only a very few moments and 18 as shown m figure 23

Here a column til headed by I M, so that this 18 a possible arrangement If the Width of the

rectangle IS II, Its outlmes are as shown in figure 22 There are 5 columns of 11 letters and 6

Paragraph

20

21

22

23

24

25

26

27

28

I MAO D R MG R N ERN I N T U S F S DRY E P

o I R N W T MOl SOl E G E D HOP N C H L F U

E R I A R U H I A G P A U 0 0 S sse ION R R E

EMEVG TRIAF HTEPB NBTNE AEETA

e Assummg that previous expenence has indicated that the enemy uses keys varymg

from 10 to 20 letters III length, the arrangement of the letters in the tops of columns under a

key length of 10 would be as shown m Fig 20

12346678910

REF ERR I N G T

OYOURNUMBE

R

The first group of the cryptogram begins With I M The arrangement shown above gives I U

as the top of a column, hence a key length of 10 IS not correct A key length of 11 IS then tried

123 4 6 6 7 8 9 ro II

REF ERR I N G T 0

YOURNUMBER

SECTION V

SPECIAL SOLUTIONS FOR TRANSPOSITION CIPHERS

FlQUU 21

(40)

20 Solution when the beglnmng or end of the plarn text IS known --a It often happens,

when correspondents have fallen into the bad habit of sending stereotyped commumcatrons,

that the begmnmgs or the endings of messages become so fixed m then form and content that

the enemy can WIth a fall" degree of certamty guess what these WIll be III specific cases If so,

a quick solution can be reached, the key reconstructed for one message, and this will, of course,

enable him to read all other messages III the same key ThIS IS partrcularly tIue of SImple,

keyed-columnaa-taansposrtion CIphers It IS only necessary that the cryptanalyst cut, the text

up m such a manner as to bnng the letters composing the assumed text all within the same row

or rows of the transposition rectangle

b Suppose that the enemy frequently uses the mtroductory expression REFERRING TO YOUR

NUMBER Here IS a cryptogram assumed to begin With this phrase

Solution when the begmnmg or end of the plain text I., known

The eOM of an omitted column --- ---------- - ---- --- - -

The case of an mterchanged pair of columns - _ __ _ - ----- --- ------ - --- -

Messages With Similar begmnmgs _ _ _ _ -___ - _ - - -- - ------- -- -

Message':! with Similar endmgs -- - - - ---- --------- - -

The solution of a <lingle message contaunng a long repetrtion _ _ - - - - - --- -

Bolutron when several eryptogram-, of identical length and III the same key are available ---

Reeonstruetion of the keys In double transpoeraon _ __ __ _ -- -- -- -- - - ---

SpeCIal cases of solutron of double trsnsposrnon CIphers -- -- -- - --- -- -

L

,I
~IGURB 23

b The column WhICh was omitted IS ERN I N T U S F S D, and falls between columns

1 and 3 Smce the omitted column contams 11 letters and column 1 contams 10, the dimensions

of the rectangle immediately become known Thus, uneertemties as to the dimensions of the

T ERN F

D ETA N

T E R P S

D ETA N

FIRST VERSION

N T T H D G SOH A o 0 Q S G

N F U E H R W R R I RAT P E

R 0 G I 0 S

SECOND VERSION

N T T H D G SOH A o 0 Q S G

R PSI N ENE R I RAT P E

R 0 G I 0 S

o D NIL

U E H R W

o 0 COO

o D NIL

I N ENE

o 0 COO

c The two cryptograms are supenmposed as shown m figure 24 and their pomts of smulanty

and difference noted

43

FIOURB 24

rectangle are dissolved and a large step forward has been made m the solution Also, the

general whereabouts of columns 1 and 2 are now known, since the former IS a short one, the

latter a long one

22 The case of an Interchanged p&ll' of columns ---a The keying element III the case of

columnar transpoeition IS SImply a practical means of controlling the order m which the columns

of the enciphenng rectangle are transcribed m formmg the cipher text Commonly this numerical

key IS derived from a literal key Suppose that a cryptographic clerk makes a mistake m the

latter step For example, suppose that the literal key IS ADMIRATION and that as a result of a

slight relaxation m attention he assigns the number 5 to the let tel N and the number 6 to the

letter M A pair of columns will become interchanged as regards then order of selection m the

transcnptaon process, and likely as not a repetinon will be requested by the addressee If a

second version IS sent, enciphered by the correct key, a comparison of the two versions will dISclose the WIdth of the enciphering rectangle and possibly the general posmon (left or right) of

the columns that were interchanged

b An example will serve to make the matter clear Assume the two cryptograms to be as

follows

d The two versions ale alike except for a pair of mterchanged sequences, the bracketed

sequence PSI N ENE in the first version IS matched by the same sequence in the second

version, but at a different pOSItIOn m the message, likewise the bracketed sequence

N F U E H R WR m the first version IS matched by a similar sequence m the second version,

but at a different posmon in the message The various deductions which can be made from the

srtuation will now be set forth

e One of these sequences contams 7 letters, the other contams 8 It follows that the columns of the enciphenng rectangle are probably 7 and 8 letters m length, hence, WIth 61 letters,

the Width of the matnx 18 8 Since there are 23 letters from the begmnmg of the messages to the

first point of their difference, It follows that there are 2 columns of 8 letters and 1 column of 7

letters mvolved in this section [(2X8)+(lX7)=23], and that the error made m encipherment

does not involve columns 1, 2, or 3, which are therefore properly placed in the first version Smce

FIrst versionc., 0 D NIL N T T H D G SOH A 0 0 Q S GTE R[P SIN ENE]

Second version, 0 D NIL N T T H D G SOH A 0 0 Q S GTE R[N F U E H R W

[N F U E H R W R]R I RAT P E D ETA N 0 0 COO R 0 G I 0 S

R]P SIN E N E]R I RAT P E D ETA N 0 0 COO R 0 G I 0 S

M 0 ISO

H I A G P

R I A F H

I R N WT

R I A R U

MEV G T

n II 10 8

ReF T 0

S E P Q E

V 0 EYE

CRYPTOGRAM

RYE P B

H L F U E

N R REO

E ETA

R E F E R R I N G T 0

- ------------------IY 0 U R N U M B E R S

I--------------- ------ E V E N W H A T D I S

--------------------IP 0 S I T I 0 N H A S

- -------------------

B E E N M A D E 0 F C

--------------------- R Y P T 0 G R A P H I

--- ---------------

C E Q u I P M E N T 0

--------------------- F M E S S A G E C E N

--------------------- T E R F 0 U R T H P R

I---------------------

0 V I S I 0 N A L B R

I-----

I G A D E

R M G R N

HOP N C

sse I 0

B T N E A

I MAO D

I E G E D

A U 0 0 S

T E P B N

d The same general pnnciples, modified to SUIt the circumstances, may be followed m the

case involvmg known or suspected endings of messages The probable words are wntten out

according to varIOUS assumed key lengths and the supenmposed letters falling at the bottoms

of columns are sought in the cryptogram

21 The case of an oDlltted column ---a Sometames a very careless clerk ormts a column III

transcnbmg the text from the enciphering rectangle and fails to check the number of letters m

the final cryptogram Obviously such a cryptogram will be difficult If not impossible to decipher

at the other end, and a repetinon IS requested and sent If now the identical plam text IS enCIphered correctly, two cryptograms are at hand for comparison ThIS will disclose the length

of one column, which can be assumed to be either a long one or a short one The positron, in

the correct cryptogram, of the column omitted from the incorrect one will often afford direct

clues as to the exact dimensions of the eneiphenng rectangle For example, suppose the cryptogram m paragraph 20b had first been transmitted as follows

,I
two columns which have an 0 in tIH' proper row, columns 2 and 8 The tnal of combmation

3-4-5-8--6, wlule producing TROOP m the proper lOW, grvcs bad pentagraphs m the other rows,

but the combmation 3-4-5-2-6 shows excellent pentagraphs, as will be seen in figure 25c The

words SQUADRON and HOSTILE are clearly evident, the completion of the rectangle 18 now a

very simple matter The result ISshown m figure 25d The recovery of the numenoal key now

WIll enable other cryptograms to be read directly

23 Kessages WIth slJwlar begInwngs -a In nnhtary correspondence It IS often the case

that somewhat snmlar mstrucnons or mformation must be conveyed by a superior commander

to several subordinate commanders simultaneously Such a situation frequently results in the

CIrcumstance that two or more cryptograms addressed to different stataons will begm WIth exactly

the same words When simple columnar transposition 18 the system used for encipherment,

then It will result, in such cases as the foregomg, that the first two or more rows of the transposinon rectangle will be rdentical in the messages which begin ahke Therefore, the cryptograms

will show identical sequences of two or more letters, distnbutsd throughout the texts and by

studymg these identrtres the cryptanalyst IS able at once not only to ascertam the WIdth of the

rectangle but also to divide up the CIphertext into sections corresponding WIth the exact columns

of the rectangle, thus ehmmatmg the only real difficulty in solution, mz, the determinatron of

which are the long columns, which the short An example WIll demonstrate the short cut to

solution which such a situation provides

b Here are two cryptograms WhICh are assumed to have been mtercepted within a few mmutes of each other, the messages bemg addressed to two battalion commanders by the regimental

commander

a c

t 0 d 0

o H 0 N PRE 0

D D Q F SIT R

N G SUI R A 0

I S G E NAN G

LOT H E T 0 I

N HER N P 0 0

TAR WEE C S

TOR D 0

a

44

c

ado

o TON E R P 0

D H 0 F TIS R

N D QUA RIO

I G SEN A N G

L S G HOT E I

NOT R 0 P N 0

THE W C E E S

A R ROD

b

FIOUBB 25

c d

L

45

CRYPTOGRAM 1

BNTSE ARKCL CETTN BITER ROTAE LTNNO NNENO

OTOKM SZTGN YITDK LANAE FTFSN PGNPA RWOIA

OFGTF CTOTD NINOE WXERF ASIOS TIDRR RMMAO

ARPAT OUTIO BIEOA GAAPN ElK

CRYPTOGRAM 2

B N T S E I N DOT L C E T S A F P L E R ROM 0 ISO E N NON S T

I I U T 0 K M FEY K P C Y I T D V S I N T A E F T F S T 0 NTNAR

W 0 A R 0 EEKTF C TTL T A E A N 0 E W X P V TIT I 0 S T T T F

o C M M A o 0 S C A N R 0 U T lEE L S o A G A A ABITR T

c The cryptanalyst, notmg the smnlantres in the first few letters of the two messages, carefully compares the two texts, looking for additional identrcal sequences of letters between the

cryptograms For example, No 1 begms WIth B N T S E and so does No 2, after an interval

of 4 letters in Noland 5 letters in No 2 he notes the iden tical sequences L C E T, after an

interval of 5 letters in No 1 and 5 letters in No 2 he notes the identical sequences ERR 0,

and so on The identrties are underlined or marked m some distmctive manner throughout the

texts, as shown in figure 26

CRYPTOGRAM 1

B NT S E ARK C L C E T T N BIT E R ROT A E L T N N 0 NNE N 0

o T 0 K M S Z T G N Y lTD K LAN A E F T F S N P GNP A R W 0 I A

o F G T F C TOT D N I N 0 E W X E R F A S lOS TID R R R M MAO

A R PAT OUT I 0 B lEO A G A A P N ElK

CRYPTOGRAM 2

B N T S E I N DOT L C E T S A F P L E R ROM 0 ISO E N NON S T

I I U T 0 K M FEY K P C Y I T D V S I N T A E F T F S T 0 NTNAR

W 0 A R 0 E E K T F C TTL T A E A N 0 E W X P V TIT I 0 S T T T F

o C M M A o 0 S C A N R 0 U T lEE L S o A G A A A BIT R T

Fll'UBB 26

d Now It IS ObVIOUS that these rdentitaea eXIst because the two messages begin alike, and

by taking advantage of the identical portaons in the cryptograms It will be possible to transcnbe

the texts of the latter into transposition rectangles which will not only have the identical portions m homologous pOSItIOns, but also will show which are long columns, which are shot t

All that 18 necessary IS to begin transcnbmg the texts on cross-secnon paper, in columns, arranging

matters so that the identical sequences WIll fall at the tops of the columns Thus, the first

column of No 1 will contain the letters B N T SEA R K C and the first column of No 2 will

contain the letters B N T S E I N DOT, the second column of No 1 will contain the letters

~....£..I T N BITand the second column of No 2will contain theletters L C E T S A F P L,

324155-41-4
FIOllBB 27a

FIOUBB 27b

lAMND RYHRV MENRI

RHlTN DEYEN RNERV

ALOLT XOMAH HRREI

2

7103126114958211134

ENE M Y BAT TAL ION

FOR MIN G FOR C 0 U N

T ERA T T A C K W EST 0

F WOO D SAT MOT TIN

SXMOVEATFASTES

T P 0 S SIB L ERA T E T

o V I C I NIT Y 0 F F L I

N T SAN D T A K E P 0 S I

T ION TOR E PEL C 0 U

NTERATTACK

47

1 2 7 10 2 11 13 4 7 10 2 11 13 4

E N L ION E N L ION

F 0 C 0 U N F 0 C 0 U N

T E EST 0 T E EST 0

F W TTl N F W TTl N

S X T ION S X S T E S

N E N D B E T P ATE T

P R B R I N o V F F L I

G F • IRE 0 N T P 0 S I

N A T ROO T I L C 0 U

P S N T FlrUBB 27e

1 7103 6 11 4 9 5 8 2 11 4

ENE M Y BAT TAL ION

FOR MIN G FOR C 0 U N

T ERA T T A C K W EST 0

F WOO D SAT MOT TIN

S X T A K E P 0 SIT ION

NEARLANTZANDBE

PRE PAR EDT 0 B R I N

G F LAN KIN G FIR E 0

NAT T A C KIN G T ROO

P S

24 Messages WIth slJIlllar endings -a What has been said at the begmmng at the preceding paragraph WIth respect to the nature of milrtary correspondence and the presence of

identical phraseology m the messages sent by a supenor commander to hIS subordmates also

operates to produce messages in which the endmgs are identical It has been noted that when

two messages WIth similar begmnings are available for companson, the reconstruction of the

transposinon rectangles aud the recovery of the transposition key IS an easy matter It will

now be shown that solution IS an even easier matter when two messages having Identical endmgs

are avaalable for study

b GIven the followmg two cryptograms

No 1

V A F L N

MRREA

N F N A D

No 2

KYENR UEERB TSREH TlANT

NOLTM NNEDE TROOP UNARA

FIOllBB 27d

j The remammg columns 1, 3, 5, 6, 8, 9, 10, 12, and 14 form a third group of columns to be

anagrammed, but tills IS rather easy now that the columns on either Side are fixed The completed rectangles are shown m figure 27d

ETRTE EESOA AEUNl

EETRO UDCCC OHTCY

SRBEN lGSKA lLNRA

TLVSX OPNRE MEFDS

lVYMR VESlR EENEl

ClAAl NSCWN A

1 J 3 4 5 6 7 8 q 10 11 n 14

B L E N T YEA T N I M 0 A

NCR N 0 I F R F 0 0 MUG

T E R 0 K T T W C E SAT A

S T 0 N M D F 0 T W T 0 I A

~SMSFV§ATITOEA

I A 0 T EST R L P T S E B

NFl I Y I 0 0 T V F C L I

D PSI K NNE A T 0 A S T

o LOU P T TEE I C NOR

T E CAN KAT R T

2

2

B LEN T

NCR N 0

T E R 0 K

S TON M

S M S F

I A 0 T E

NFl I Y

D PSI K

o LOU P

T E C

1

B LEN T

NCR N 0

T E R 0 K

S TON M

T T N S

A N A E Z

R BEN T

K I LOG

C T TON

12 & 4 567891011121314

1

B LEN T YEA T N I M 0 A

NCR N 0 I F R F 0 0 MUG

T E R 0 K T T W C E SAT A

S TON M D F 0 T W T 0 I A

T T N S K § I 0 I I A 0 P

ANAEZLNATEDRBN

R BEN TAP 0 D R R PIE

K I LOG N G F N F RAE I

C T TON A N G I ART 0 K

P S

and columns 2, 4, 11, and 13 as another group, the exact pOSItIOns occupied by these 6 columns

are easily ascertained, as shown m figure 27c

and so on It appears that the identical portion embraces the first four rows of the rectangle and

runs over a number of letters on the fifth row This IS because the identrcal sequences COnsISt

of 4 and 5 letters FIgure 27a shows the identatres between the first 5 columns of the two transpositron rectangles Only once m the case of this partrcular example does any uncertamty arise

as to exactly where an Identical sequence begins or ends, and that IS m connection WIth the

seventh pair of identaties, involving the series of letters A EFT F S N P GNP m No 1, and

A EFT F S TON T N in No 2 These sequences contain 6 identical letters, but even here

the uncertamty IS of only a moment's duration The untaal letter A does not belong to the identical portions at the top of the transposition rectangle because the A's arc needed to complete

columns 6 in both rectangles (If the A were placed at the head of column 7 in No 1, then

column 6 would lack a letter at the bottom) Cases of "accidental rdentities" of course comphcate the process of cuttmg up the text mto the respectrve columns, but they only serve to

add a small degree of interest to what would otherwise be a purely cut and dned process

The final results of the transenption mto columns are shown m figure 27b

e It ISObVIOUS from a comparison of these two skeletonized matnoes, and a consideration

of the fact that the long columns must of necessity go to the left SIde, that the numbers 7 and 10

occupy the first two positaons m the key, and that the numbers 2, 4, 11, and 13 occupy the last

four pOSItIOns m the key By segregatmg and anagrammmg columns 7 and 10 as one group,
FIOURE 23

No 2

8103129147211613

I N FAN TRY POI N T

REDCOLUMNPASS

EDSILVERRUNCR

EEKATSEVENTWE

NTYAMXREMAINH

ERE I NOB S E R V A T

ION

-lbR N R Y F N T A E 0 IL~2a

T S L S S LED H N o R I I S

sa 3b

R C N N 0 R V T T A o GNU Q 6a

R A S T B o S A A A o S N 0 0

6IJ

SET F Y HLAUX TAO G G

84 -SbA WI A 0

SSM Y E -'bS W E R N6a

H 0 N E M

~~T~ISSO UUPV

9a -9/1-

No 1

8 10 3 12 9 1 4 7 2 11 6 13 6

HEADREDCOLUMN

INFANTRYANDAR

TIL L E R Y MAR CHI

NGNORTHREACHE

DSILVERRUNCRE

EKATSEVENFORT

YAMXREMAINHER

E I NOB S E R V A T I 0

N

N C E T S L S T 0 C

2b

FEB N N UUPWE

-'aG T I F E R S E 0 M

-5-bI B 0 S 0 CAY H L

-7a- -7bP R S V L Y E EGG

OEAEL TRSED HNUFF

la

e The equivalent of identaty 9 of cryptogram 1 IS rdentity 4 of cryptogram 2, and the number 4 IS placed between the numbers 1 and 7 III this sequence, for the sequence may be regarded

as partakmg of the nature of a cycle or a contmuous senes From this pomt on, the process IS

the same as before, and finally the followmg IS obtained

1 2 3 4 5 6 7 8 9 10 11 12 13

1 4 7 2 11 6 13 5 8 10 3 12 9

f After little expenment It becomes ObVIOUS that column 8 belongs on the extreme left

because m cryptogram 1 there IS only one long column, number 8, ascertained by counting the

number of letters between successive identities in that message The number 8 bemg at the

extreme left the final actual transposition key IS 8 10 3 12 9 1 4 7 2 11 6 13 5 The completely

deciphered messages are shown in figure 28

g The pOSSIbIlIty of the rapid solution of columnar transposition CIphers by means of the

method of sumlar begmnmgs and endmgs, constitutes one of the most serious drawbacks to the

use of transposrtaon CIphers in nnhtary cryptography, because It IS almost impossible to aVOId

such cases where many messages must be sent in the same key each day

26 Solution of a smgle message cont&1ll1ng a long repetition -a SometImes a lengthy phrase

or a senes of numbers (spelled out In letters) IS repeated within a message and If the message is

enciphered by 0. transposinon rectangle of such narrow WIdth (in oompanson WIth the length of

the repeution) that the repeated portion forms identical sequences within the text of the cryptogram, a solunon somewhat similar in pnnciple to that explained in paragraph 24 may be achieved

withm a few mmutes

b Note the followmg cryptogram, III which identical portions have been underlmed

CRYPTOGRAM (169 letters)

No 1

E T R T E E E S 0 A AEUNI VAFLN I A M N 0 RTHRV MEN R I

-.or -,- .,- .,....

E E T R 0 U 0 C C C o H T C Y MRREA R HIT N DEY E N R N E R V

--r- -r- -rS R BEN I G S K A I L N R A N F N A 0 A L 0 L T X 0 M A H H R REI

,.... ----w- ""il 12 13

48

The cryptanalyst now carefully compares the two texts, searching for identical sequences 01

letters, but m this case instead of trymg to locate identrtaes in what may be termed 0. parallel

progression (as in the precedmg case) he searches for idontical sequences of two or more letters

appeanng in both messages For example, m the present case, he notes the sequence T R 0

formmg the final tngraph of the 8th group of No 1 and finds a sirmlar sequence formmg the

mitral tngraph of the 13th group of No 2 Gomg through both cryptograms III this way, all the

identrties are marked off m some fashion, by colored crayon or underlmmg, as shown below In

this search for identrties the cryptanalyst bears III mmd that when all have been found they

should be distributed at quite regular mtervals throughout the text For example, note in the

following that the identitaes III No 1 fall at intervals of 6 letters, WIth one exception, m No 2

they fall at intervals of 4 letters, WIth one exception The mtorvals between rdentitaes serve as a

guide in findmg them After they have all been located, the identrttes III the cryptograms are

numbered serially

c The identities between the two cryptograms may now be equated, usmg for this purpose

the numbers below the identmes For instance, identity 1 III cryptogram 1 matches identity 7

III cryptogram 2.rdentity 2 in crytogram 1matchesidentity 6 m cryptogram 2, and so on Thus

Cryptogram L________________ 1 2 3 4 5 6 7 8 9 10 11 12 13

Cryptogram 2 7 6 9 2 10 5 11 3 4 12 13 1 8

d Now cryptogram 1 has 105 letters, smce the key consists of 13 numbers (indicated by the

13 rdentities), the rectangle for cryptogram 1 contams 12 columns of 8 letters and 1 column of 9

letters Cryptogram 2 has 81 letters, and Its rectangle contams 10 columns of 6 letters and 3

columns of 7 letters The rectangle of cryptogram 1 has but 1 long column, whereas that of

cryptogram 2 has 3 long columns Relatrve to the pOSItIOn the last letter m each rectangle occupies in the last row of the rectangle, It IS ObVIOUS that the last letter of the rectangle for cryptogram 2 IS 2 letters in advance of the last letter of the rectangle for cryptogram 1 Usmg this

difference, rnz, 2, a cyclic sequence IS generated from the senes of equrvalencies given above

Thus, the equivalent of identity 1 of cryptogram lIS identity 7 of cryptogram 2, and the number

7 ISplaced two intervals to the nght of the number I, the equivalent of identity 7 of cryptogram

lIS identity 11 of cryptogram 2, and the number 11 IS placed two mtervals to the right of number

7, and so on until the followmg sequence ISobtamed

1 2 3 4 5 6 7 8 9 10 11 12 13

1 7 11 13 8 3 9

No 2

TLVSX OPNRE MEFDS KYENR UEERB TSREH TIANT

--r- -r- ---a- ,..... ----rIVYMR VESIR EENEI NOLTM NNEDE TROOP UNARA .,... -r- ,.... -g --rn- 11

C I A A INS C W N A
50

1a 2a 3a 4a 5a 6a 7a 8a 9a

3b 4b 2b 9b 8b 1b 6b 7b 5b

c There are 18 segments of underlmed letters, which means in this case that the rectangle IS

9 columns wide, because the repeated portion in the text Will give rise to two repeated sequences

m each column Tlus means that the rectangle has 7 columns of 19 letters and 2 columns of 18

letters The first two segments may therefore be assigned the numbers 1a and 1b, smce they

come from column 1, the next two segments may be assigned the numbers 2a and 2b, smce they

come from column 2, and so on, as shown above Identical segments may now be equated

Thus

51

first version of a message and a second (correction message) IS sent without paraphrasing the

onginal text, or that wherem two messages are alike except for a difference in a single word (such

as a number) and are cryptographed by identical transposrtion keys, or that wherein the numencal key has been mcorrectly derived from ~he h teral kcy and two versions of the same plam text are

available for comparison, one based on a transposruon by means of the mcorrect key, the second

based on a transposition by means of the correct key, both keys, however, being of the same

length

26 SolutIon when several cryptograms of identical length and In the same key are avaIlable -a Although the method to be descnbed in tills paragraph IS mcluded wrthm the category

of special solutions, It IS of such general applicabihty that It might well be treated as a general

solution for all transposrtion systems It IS based upon the very mecnanics of transposiuon as a

cryptographic scheme, mz, that the essential feature of the transposition method consists merely

m the alterations m the positions of the elements (letters, groups of letters, or words) oomposmg

the plain text, according to a specific key It follows, therefore, that the respective elements of

two or more messages of ulentwallengths,when transposed according to the same key, will undergo

Identical alterations m position in the course of encipherment, and therefore all plain-text elements occupying homologous positions m the onginal messages will emerge m homologous pOSInons in the cryptograms The situation IS very much hke that which may be observed m the

movements executed by two symmetrical groups of dancers in a chorus Suppose each group

consists of 8 dancers starting originally in definite posmons relative to one another When a

movement IS executed each dancer m each group performs eertam evoluhons, at the conclusion

of the movement the 8 dancers m each group may be m quite different posittons relative to one

another than they were at the begmmng of the movement, but the correspondmgly numbered

dancers m both groups find themselves in identical positaons relative to their neighbors Of

course, the fact that in this analogy the groups are based upon 8's 18 of no sigmficanee, If the

groups consisted of many more the prmciple would still apply Another way of looking at the

matter IS to call attention to the fact that '/,71 any type of transpos'/,twn the p08'/,twn whwh a spemfied

letter or element of the pla'/,n textunll occupy'/,n the final cryptogram '/,8 quue definuelya!'unclwn of the

numberof letters or elements tn thepla'/,n text uself For example, suppose that a plain-text message

contams exactly 100 letters, and suppose that the transposition system and specific key JS ouch

that the 1st plain-text letter appears as the 17th Cipher-text letter, the 2d plain-text letter, as the

68th, and so on, m another message of exactly 100 letters, enciphered by the same general system

and specific key, It IS ObVIOUS that the 1st plain-text letter must also appear as the 17th Ciphertext letter, the 2d plain-text letter, as the 68th, and so on In short, all correspondmgly numbered plain-text letters in both messages will appear in Identical positrons in the cryptograms

b Grantmg the obVIOUS truth of the foregoing, to what use can It be put in the solution of

transposmon Ciphers? SImply this It enables the cryptanalyst to reconstruct the pla'/,n texts of

cryptograms of idenneal length Wtthout even knoWtng what the transpos'/,twn key or system was that

produced them The process IS not at all complicated and If there are several messages the

process IS very easy It consists in supenmposmg the several cryptograms and anagramm'/,ng

the columnsformed by the superimposrtion, for It IS obVIOUS that any CIrcumstances which can

be used as a guide for rearrangmg the letters m one of the lines of supenmposed text in order

to form plain text will require, and can be checked by, the results of an identical rearrangement

of the correspondmg letters of the other lmes of superimposed text

c An example of the method involving the apphcataon of this general solution WIll now

be given, using as a baSIS five messages assumed to have been enciphered by an unknown but

complex type of transposition It WIll now be shown bow the security of such a system IS demolished when It IS used by a large number of mtercommumcatmg commands

FIGURa 30

A 0 P

A N R

o E S

S M V

N S L

o E Y

o T E

FIGll'BI: 29

R R E

I C R

INS

S N E

F 0 0

E R M

B V S

T

o

C

A

W

I

A

F

N

T

A

E

D

I

o

E

A

E

L

T

R

:[~ ~[~[~[~ [~ [: ; N N S P G R D A I

U C S W N A C U S

R S N Y [~ [~ [! [iISH

[H~ [~G P[~ Y 0 E FAG V

e Study of figure 29 shows that columns 2 and 7 are the short columns and belong on the

nght, either m the sequence 2-7 or 7-2 The cychc permutation of the transposihon key obtained

m subparagraph c IS 1-3-2-4-9-5-8-7-6 In order to bring the 2 and 7 adjacent m a sequence

2-7 or 7-2 one must take mtervals of 5 and 4, respectively, and "decimate" the cycle, grvmg the

followmg 1-5-3-8-2-7-4--6-9 or 1-9-6-4-7-2-8-3-5 Smce columns 2 and 7 belong on

the right, the key must be 4-6-9-1-5-3-8-2-7 or 8-3-5-1-9--6-4-7-2 Only a few moments are

necessary to establish the correctness of the former alternative and the solution IS at hand It 18

as shown m figure 30

j A good understanding of the pnnciples elucidated in tills and the preceding paragraph

will enable the student to denve for himself the procedure applicable to cases of somewhat

SImilar nature, such as that wherem a single letter or a whole group has been omitted from the

Tws gives nse to the cycle 1-3-2-4-9-5-8-7-6, which IS a cychc permutation of the actual

transposraon key

d By transcnbmg the text into a rectangle of proper Width, "cuttmg" the columns so as to

brmg the Identical portions withm the same rows, the result shown m figure 29 IS obtained

123466789 469163827

REP 0 R T 0 F A

I R R E CON N A

ISS A NeE T 0

S EVE N A MAS

F 0 L LOW SEN

E M Y T R lED 0

B S E R V A T I 0

N W EST 0 F L I

NEG E TTY S B

U R G D ASH M 0

U NTH 0 L L Y S

P R I N GSA N D

WAS U N sue C

E S S F U L X E A

S T 0 F GET T Y

S BUR G D ASH

M 0 U NTH 0 L L

Y S P R I N G S H

E A V Y FOG

I

I I
52

ll..!!. 10 51 23 'lO 51 23 '1 'lO 51 23 31 22

Q U G Q U S Q U S QUA S QUA D

N 0 N N 0 T N 0 T NOT T NOT C

H T G H T G H T G H T A GHTAX

A I F A I R A I R A I N R A I N F

A T OAT BAT BAT T BAT T A

FIGURS 3211 FIl'URE 32b FIl'UBE 33. FIC'URE 33b

6257413

01 02 03 04 05 06 07

08 09 10 11 12 13 14

15 16 17 18 19 20 21

B

oonsntutmg the C~P sequence, IS shown m figure 34 as the second row of numbers

Term number __ _ 1 2 3 4 5 6 7 8 'I 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 2~ 26 27 28 29 30

C-+P sequence __ 28 8 14 46 19 37 25 47 48 26 35 41 2 34 27 12 36 45 17 13 40 18 9 24 13 8 1 50 44 11

Message No 1 __ __ H A V E 0 R D ERE D RAT ION WAG 0 N S 0 F FIR S T

Message No 2..___ __ ENE M Y D E F EAT E D D IRE C T ION 0 F RET REA

MessageNo 3_ _ _ SEC 0 N DEC H E LON W ILL LEA V E HER EAT E I

M~ No 4 _ _ _ _ A N I MAL D RAW N V E H I C L E S 0 FEN GIN E E R T

M~ No 5___ A M M U NIT ION T R A I N INC L U DIN G H 0 R SED

53

Term number, _ 31 82 33 34 85 36 87 38 39 40 41 42 43 44 4~ 46 47 48 49 50 51

C-+P sequence 80 51 23 31 22 16 7 21 32 42 10 49 4 43 15 5 39 29 20 38 6

Ml'S~age No 1 __ S QUA D RON TOG 0 L DEN V ILL E

Message No 2 __ _ T NOT C E R T A I N AMP U R SUI N G

Message No L. __ G H T A X M X FOR G 0 L DEN V ILL E

Message No 4 _ _ __ R A I N F 0 L LOW FIE L D T R A INS

Mllll8IIB8No 5 __ _ _ BAT TAL ION M 0 V E SAT S I X A M

FIGURE 34

;FIGUKII: 851

g The solution by supenmposmg and anagramnnng equal-length messages m the case of

trausposttion constitutes a general 80lutwn which IS applicable m all cases WIthout exception

Indeed, the pOSSIbIlIty of solution by this method constitutes the most serIOUS, If not fatal, weakness of transpositron as a cryptographic method, for not only IS It applicable to the most complex

as well as to the most SImple types of transposition, but, what IS much more senous, the procedure IS very SImple, requiring very little cryptanalytic mgemnty or expertness The chref

drsadventege of this general solution IS, of course, that It IS dependent upon the more or less

fortuitous availebihty of messages of Identical lengths, and while this fortunate contmgency IS

quite frequent in a volummous correspondence, It would naturally be better from the pomt of

VIew of the cryptanalyst If this requirement were not essential ill all cases Deeper study of

the subject will show that the method can still be applied m a modified way to the case of messages of almost the same lengths when the transpositaon IS not too mvolved To illustrate,

a case of SImple keyed-columnar transposition will be used and It will be assumed that several

messages of approximately identical lengths are at hand

h FIrst, take the case of two messages which have been enciphered by completely-filled

rectangles, one messsge having, for example, one more row of letters than the other In the

dISCUSSIon, the consecutive numbers 1, 2, 3, will be employed as though they constituted

the sucoessrve letters of a plain-text message that IS being enciphered This method of treatment IS very useful in connection With studies of the mechanics of transposition CIphers m

general, and especially so m the case of double transposiuon Note the P~C sequences that

result from the transposinon

6257413

01 02 03 04 05 06 07

08 09 10 11 12 13 14

15 16 17 18 19 20 21

22 23 24 25 26 27 28

A

P-+C sequence for A 06 13 20 27 02 09 16 23 07 14 21 28 05 12 19 26 03 10 17 24 01

08 15 22 04 11 18 25

f-+C sequence for B. 06 13 20 02 09 16 07 14 21 05 12 19 03 10 17 01 08 15 04 11 18

F T D N R L V 0 ROD S WEE R 0 R Q

RDTEDNSOEIPECMFEARN

-RWLLDLVVORDELOCHOTH

.IHNLLNRFVWLREMRAIEA

-HITNIASDRMSECUIOVSA

FmuRE 31

MessageNo 1

MeIIlIIIi8 No 2_

Mllll8IIB8No 3

MessageNo 4

M_Il8No 5

d Let the following be five cryptograms Isolated from among many messages intercepted

on the same day and therefore suspected of being in the same key These five cryptograms

have been isolated because they all contain exactly the same number of letters They are here

shown superimposed (fig 31) and therefore all the letters in one column have undergone exactly

the same evolutions or changes m positron ill the course of enciphermont

Column No__ _ _ 1 2 3 4 5 6 7 8 'I 10 11 12 13 14 15 16 17 18 19 20 21 22 21 24 25 2fI 27 28 29 30 31 32

first row suggests the word SQUARE or SQUADRON, that m the last row suggests BATTLE or

ATTALION ThIS means that a column with an A at the top and a T at the bottom should be

sought There 18 only one such column, 31 Addmg It to the 30-51-23 combination grves

what 18 shown m figure 33a Lookmg for a column with a Dat the top (for SQUAD) and either an

A (for BATTALION) or an L (for BATTLE), there IS only one candidete, column 22, yieldmg the

sequences shown in figure 33b Enough has been shown of the procedure to make further demonstrataon unnecessary Once a good start has been made, progress IS quite rapid, unless the

cryptanalyst IS unfortunate and arrrves at a point where all the messages simultaneously termmate m complete words, without a clue as to what follows or precedes in anyone of the messages In such a contmgency the only thmg he can do IS to try all sorts of possible contmuauons,

either "fore" Or"aft," that IS, m front of the original starting pomt or after It, until he picks up

another word which will enable him to continue Or he may have to search for a new pomt of

entry and build upon that, later jommg this structure with the other In the case under exammanon no serious difficulties are found and the entare set of five messages IS reconstructed

j In the course of thts reconstruction the numbers apphcablo to the columns become assembled m proper sequence, that IS, in the correct Older to reproduce the plain text. Tlns sequence,

M~Nol I A A L N E 0 F S G TOG V ERA N 0 L N DUO DEI HIS A T

M_ge No 2 _T D N M R G REO N A R I E U E T N Y I T C 0 F E A I E U T T A

M~No3_ A N E L N E X E H GIL ACE M E E N L F X TEE E I S I GAO

Message No 4 E ENE T S L N N FTC 0 I DOS E A I L FIG D W I A A R N 0

M~No 5 _R A MET M ION 0 DIU MAL LIN X 0 A T G T N N A I B T N

Column No 33 34 '5 36 37 38 19 40 41 42 43 44 45 46 47 48 4'1 50 51

e Notmg a Q 111 message 1 column 51, the obligatory sequence Q U IS nssumed to be present

m that message There IS In message 1 but one U, whioh IS fortunate Combmmg columns 51

and 23, the results are found to be farr (fig 32a) The H T In the third lOW suggests a word

ending m G H T, such as FIGHT, MIGHT, EIGHT, etc, Searching In message 3 for a G, two candidates are found columns 10 and 30 The tngraphs yielded by each combmation are shown m

figure 32b The second of the two possibihtres looks much the better The tngraph In the
54 55

FIGURK d5b

It IS possible to superunpose these two sequences bv shiftmg the seotions m lme Batter certam

numbers Thus

P-+C sequence for ll 06 13 20 27 02 09 16 203 07 14 21 05 12 19 26 03 10 17 24 01 08

15 22 04 11 18 25

P-+C sequence for B 06 13 20 02 09 16 23 07 14 21 05 12 19 03 10 17 24 01 08 15 22

04 11 18 25

It IS obvIOUS that the two sequences may be superimposed so as to bnng rdentical sections into

supenmposrtion Thus

ll 06 13 20 27 02 09 16 23 07 14 21 28 05 12 19 26 03 10 17 24 01 08 15 22 04 11 18 25

B 06 13 20 0 02 09 16 0 07 14 21 0 05 12 19 0 03 10 17 0 01 08 15 0 04 11 18 0

Tenn number ____ I 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

C-+P sequence___ 28 3 14 46 19 37 25 47 48 26 35 41 2 34 27 12 .:16 45 17 13 40

22 23 24 26 26 27 28 19 30 31 32 33 lK 35 36 37 38 39 40 41 42

18 9 24 33 8 1 50 44 11 30 51 23 31 22 16 7 21 32 42 10 49

43

" <Ill 46 47 4lI 49 m III

4 43 15 5 39 29 20 38 6

Tenn number____ 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

P-+C sequence___ 27 13 2 43 46 51 37 26 23 41 30 16 20 3 45 36 19 22 5 49 38

22 23 24 26 26 27 28 29 30 31 32 33 lK 35 36 37 38 39 40 'I 42

35 33 24 7 10 15 1 48 31 34 '39 25 14 11 17 6 50 47 21 12 40

43 " '5 40 47 4lI 49 1lO 51

44 21) 18 4: 8 9 42 28 32

FI011RK 3611

J The foregomg pnnciples WIll naturally not be applicable to cases where two messages differ

in length by but one letter and this small difference brings about a profound difference m the P~C

sequences apphcable to the messages ThIS IS what happens often in the case of true double

transpositaon,' but the principle can nevertheless be apphed even here 1ln explanation of the

procedure hes beyond the scope of the present text, however, and no more will be indicated herem

concermng the matter in the case of true double transposrtaon However, m certain cases of

combined subatrtution-trensposrtaon to be discussed in a later portion of this text the principles

elucidated in these last few subparagraphs may be found to be applicable

27 Reconstruction of the keys In double transpesmon -a Having reconstructed the plain

texts of the messages solved by supenmposmg and anagramnung, as explained in paragraph

26 d, e, can the transpositaon key be found? First, It IS necessary to ascertain whether a single

columnar transposrtion had been used and, If not, then the assumption WIll he that a double

transpositron had been used

b If a single transposinon were the case, the relationslnp pointed out in paragraph 16c, concernmg the existence of a constant difference between successrve elements of the P-+C sequence,

should obtain Having the C-+P sequence, the P~C sequence may readily be estabhshed by

mversion of the former Hence, the P-+C sequence IS constructed by inversion, as shown m

6 2 5 741 3 figure36a

01 02 03 04 05 06 07

08 09 10 11 12 13 14

15 16 17 18 19 20 21

22 23 24 25

B

6 2 574 1 3

01 02 03 04 05 06 07

08 09 10 11 12 13 14

15 16 17 18 19 20 21

22 23 24 25 26 27

II

The I blank spaces m the B hne mark the ends of the columns in the transposition rectangle

The regularity in the distribution of the blank spaces follows from the mechamca of encipherment

If two messages were supenmposed m this manner It IS clear that a solution by anagrammmg

becomes perfectly feasible Moreover, anagrammmg of columns IS perhaps unnecessary, for

anagrammmg merely the letters that would occupy m hne II the pOSItIOns marked by the blanks

m lme B will yield the transposition key duectly Extension of these pnnoiples to the case m

which the two rectangles ddfer by 2,3,4, complete rows IS obVIOUS

Takmg next a case wherem two rectangles ddfer by one or two letters in the bottom row,

It IS clear that by shlftmg the letters of one message one or two spaces to the right (or left) from

a grven point will brmg most of the text into proper supenmposmon for 0. solution by anagrammmg Note the P-+C sequences apphcable to the following transpositions

1l 06 13 20 27 02 09 16 23 07 14 21 05 12 U 26 03 ]0 17 24 01 08 15 22 04 ] 1 18 25

B 06 13 20 0 02 09 16 23 07 14 21 05 12 19 0 03 JO 17 24 01 08 15 22 04 11 18 25

In the case of actual messages corresponding to the foregoing P-+C sequences, supenmpositaon

of the two texts in the manner mdicated would at once permit of a solution by anagrammmg of

columns The unknown factor, of course, IS the 100atIOn of the blank spaces Where the two

messages differ m length by only one or two letters brief expenmentauon would tell the story,

where the messages ddfer in length by a good many letters the process would be much more

difficult but not at all hopeless of fruitful results Only a small section of text reconstructed by

anagraznmmg willsoon lead to complete solution Hence, It follows that by regulatmg the number of blanks to be left here and there and JUdICIOUS shiftmg of sections of text, solution by superimposmg and anagrammmg homologous secnons of text from several messages in the same transposition key will often be possible

e (1) Smce there appears to be no constant difference between successrve terms ill the

P -+ C sequence m figure 36a, single columnar transposrtion IS ruled out and double transposrtaon

IS assumed to have been employed In passmg, It IS worthwhile noting that the reeenstruction

of the keys employed 1Il the case of true double transposrtion IS quite Important, because It IS

often the case that concentrated effort directed toward the cryptanalysis of one or more messages

and the subsequent recovery of the transposition keys will, of course, greatly facilitate the

reading of all other messages 1Il the same keys

(2) There are at least four methods SUIted to the purpose and they Will be dealt WIth 1Il an

order most conducive to their comprehension by the student

(3) II prehmmary to the reoonstruction of the keys in the case of each of the four methods

to be studied COnsIStS m estabhshmg or ascertaining the Width of either the T-l or the T-2

matl'lX, usually the former, because It IS easier to do

I See Bpeoiel Text No 166, AdlJanced M~lJtary Oryptography, sec IV
FIGUBJ: 37/1

56

07 08 ./1

33

06

32

0/1

31

o.

30

03

29

02

28 26 '127

22 127

1811 01

Term no In p~c sequence

57

There IS a constant difference between the supenmposed terms The reason for ItS appearance

IS not hard to understand If reference IS made to figure 37a and the matter IS studied in the hght

of the mechamcs of the method of encipherment As for the two terms 28 and the 20, while

they come from different columns m the T-2 matrix, both come from the same column of the

T-l matrix, as do 14 and 06, 41 and 33,23 and 15 But the 05 and the 48 not only come from

different columns m the T-2 matnx, but also from different columns m the T-l matnx, this

representing a case where there IS a transit from the bottom of one column to the top of the next

column m the trsnsposruon process Now the constant difference IS in this case 8 because

the supenmposed terms happen to be sequent in the columns in which they fall in the T-l matrix

If the superimposed terms are m the same column m the T-l matrix but separated by one row,

the constant difference Will be 16, If separated by two rows, the constant dIfference will be 24,

and so on Thus, for example

6th to 11th terms____________ _ __ _ 44 30 21 03 39

29th to 34th terms 28 14 05 41 23

16 16 16 16

Here the difference, 16, 18 a multiple of 8 because the supenmposed terms are separated by one

row in the T-l matnx, as can be seen by refernng to figure 37a

e The foregomg phenomena afford a method of ascertammg the Width of the T-l matrix

m an unknown case, and, as noted above, this constitutes the first step m recovermg the transposition key or keys For IT a study be made of the terms of the P C sequence ill figure 36a,

based upon findmg sections thereof which show a constant difference, the latter will correspond

to either the Width of the T-l matrix or a multiple of the Width An easy way to make this

study IS to take a section of the P C sequence in figure 36a, add 5, 6, 7, (in successive

steps) to each term of the selected section, and then look for repetraons between the ongmal

P C sequence and tbe P C sequence plus the addrtive A begmnmg will be made WIth an

assumption of a T-l matrix of 5 columns Smce the cryptograms contam only 51 letters, all

totals greater than 51 will be disregarded Hence It IS best to take a section which has a long

series of low numbers, so that when the additrve IS applied the majority of the totals W1l1 not

exceed 51 Such a series IS the following (only one term illIt, the 29th, IS close to the maximum)

Term number____ _ _ _ 21 25 28 m 00 31 32 M 35 36 37

P C sequence 38 35 33 24 07 10 15 01 48 31 34 39 25 14 11 17 06

P~Csequence+5--- 43 40 38 29 12 15 20 06 36 39 44 30 19 16 22 11

Searehmg for repetrtrons between the P~C sequence and the P~C sequence +5, the results are

negative Trial is then made of addrtrves 6 to 11, mclusrve, WIthsmnlar negative results When

an additive of 12 IS applied, however, the results obtained give positrve mdication that the T-l

matrix IS 12 columns in Width Thus

Term number____________ _ _ 21 22 2d 2. 25 26 27 28 29 30 31 32 33 3. 35 36 37

P~C sequence 38 35 33 24 07 10 15 01 48 31 34 39 25 14 11 17 06 P~C sequence +12 50 47 45 36 19 22 27 13 43 46 51 37 26 23 29 18

It WIll be seen, on refernng to figure 36a, that the followmg repetrtions (WIth the term numbers ill

each of the sequences indicated) are present

Term no In p~c sequence +12 21 22/123 2. 2/1

Repetations.L. 5,::0:....-...:.47+4~5:.-:3:::.:6:.._1~9:......:==_v,..::..::....-==-......:..:=--.::.:....---=-=--.::..::...---=-:..-.::..::...--=.=___H_.::..::...----=..::

38 39111/1 16 17

The WIdth of the T-l matrix IS therefore 12 and ItS outlmes may at once be drawn, since the total

number of letters In each message, 51, indicates that there are 3 long columns of 5 letters and 9

short columns of 4 letters

It

14 05 41 23

06 48 33 15

888

3 9 7 • 2 11 8 10 6 5

T-2

04 12 20 28 36 44 02 10 18 26 34

42 50 06 14 22 30 38 46 08 16 24

32 40 48 05 13 21 29 37 45 01 09

17 25 33 41 49 03 11 19 27 35 43

51 07 15 23 31 39 47 I

627 5 3 8 •

01 02 03 04 05 06 07 08

09 10 11 12 13 14 15 16

17 18 19 20 21 22 23 24

25 26 27 28 29 30 31 32

33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48

49 50 51 I

T-l

m m M M

01 35 28 14 05 41 23 10 46 37 19 12 50

u w w n M

17 51 36 22 13 49 31 34 24 09 43 26 16

Term number -- ------- - --- -- - - - _ _ _ _ _ _ 01 02 OJ 04 05 06 07 08 00 10 11 12 13

P C sequence- ------- 20 06 48 33 15 44 30 21 03 39 04 42 32

Term number _

« n m M

40 25 07 18 08 45 27 02 38 29 11 47

m 00 M M M M

46 29 49 07 20 13 04 21 28 16 36 48 10

« n m M

40 32 12 24 06 45 35 51 03 19 39 15

U 15 16 17 18 19 m 21 25

30 05 26 14 43 37 01 08 17 33 22 41 25

(4) As ill paragraph 26"', the expositaon will employ matnces ill which the consecutrve

numbers I, 2, 3, take the place of the successrve plain-text letters in the T-l matrix,

because in such handling signifieant facts arising from the mechamcs of encipherment are brought

to hght

d In order to study the effects of true double transposrtion on this matter of reconstructmg

the keys an example will be employed, mvolvmg transposrtion With two different keys Let

the "message" and the keys be as shown in figure 37a

------ - 01 02 03 04 0Ii 06 07 08 09 10 11 12 13

C P sequenee.. - ----------- 27 47 09 11 31 02 42 44 23 34 50 38 18

Nothmg m the nature of a series of constant dIfferences between 8'UCCe88'1.ve terms IS now discernible

m the P C sequence But there IS, as can readily be seen, a faIrly constant relatronship

between segments or sections of this sequence For example, take the 1st to 6th terms of this

P C sequence (20 06 48 33 15), set them under the 29th to 34th terms (28 14 05 41

23), and find the dIfference between supenmposed numbers (When the rnmuend IS less than

the subtrahend the supenmposed terms are disregarded ) Thus

29th to 34th terms 28

1st to 6th terms . 20

Differences . . . ---S----------=-
I I

I

7421181066

384

3 9

T-2

11 38 01 29 16 06 47 34 43 25 21

12 39 02 30 17 07 48 35 44 26 22

13 40 03 31 18 08 49 36 45 27 23

14 41 04 32 19 09 50 37 46 28 24

15 42 05 33 20 10 51~I------~

FIGURB 37c

FIGURB 37d

6 2 7

01 02 03 04 05 06 07 08

09 10 11 12 13 14 15 16

17 18 19 20 21 22 23 24

25 26 27 28 29 30 31 32

33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48

49 50 51 I

5 3 8 4

(Term numbers 04-09) __________________ --- 43 46 51 37 26 23

(Term numbers 30-35)________ ----------- -- 31 34 39 25 14 11

DIfferences ______________________________________ 12 12 12 12 12 12

627

T-l

27 47 09 11 31 02 42 44

23 34 50 38 18 30 05 26

14 43 37 01 08 17 33 22

41 25 46 29 49 07 20 13

04 21 28 16 36 48 10 40

32 12 24 06 45 35 51 03

19 39 15 I

TakIng the sections of the P----+C sequence from which the longest repetinon arises and findmg

the constant difference between the terms mvolved, a Width of 12 for the T-1 matnx IS mdicatcd

Thus

59

TIllS IS Identical WIth the results found by the other method The T-l matrix for the messages

of paragraph 26d IS therefore 12 columns m WIdth

9 Having ascertained the Width of the T-l matrix, the next step IS to ascertuin whether

the WIdth of the T-2 matrix IS the same as that for the T-l, or different If the same, the suspICIOn IS warranted that the transposition keys for both matnces may be identrcal, in which case

It IS necessary to recover but one key If the WIdths of the two matnces are different, then

It IS obVIOUS that two different transposinon keys are mvolved Having ascertained the WIdths

of both matrices, one can proceed to reconstruct the transposrtion key or keys which apply

thereto There are, as stated once before, at least four methods SUItable for this purpose They

will now be taken up m tum, and each method will be explamed in detail

h (1) In explaining the first method the dISCUSSIon will be imtiated WIth a reconsideration

of figure 37a If the C----+P sequence established m that figure IS treated as though It were plain

text and enciphered by the double transposiuon method, usmg the same two transposrtion keys

as before, an mterestmg phenomenon IS observed Not the following (fig 37c)

Here It IS seen that the numbers m the columns of the T-2 matrix are consecutwe Obviously, If

the columns of this T-2 matrix were retranscnbed m a matrix of the same outImes as the T-l

matnx, the numbers would be consecutive m rows and would represent the plain-text sequence

1,2,3, , mscnbed within a T-1 matrix m the normal fashion Thus (fig 37d)

Term number.i, _ 16 17 18 19 20 21 22 23 24

P----+C sequence 36 22 13 49 31 34 24 09 43

P----+C interval sequence.,, -14 - 9 + 36 -18 + 3 -10 -15 + 34 -17

Term number __ __ 01 20 03 04 05 06 07 08 09 10 11 12 13 14 16

P----+C sequence 20 06 48 33 15 44 30 21 03 39 04 42 32 17 51

P----+C interval seqlU'nce __ -14+42-15-18+29-14 -9-18+36-35+38-10-15+34-15

58

Term number__ _ 38 39 40 41 42 43 44 45 46 47 48 49 60 61

P----+C sequence - 12 50 40 25 07 18 08 45 27 02 38 29 11 47

P----+C interval sequence +38 -10-15 -18 + 11-10 +37 -18 -25 +36 -9 -18+36

FIGURB 17b

Term number __ _ 25 26 27 28 29 30 31 32 33 34 35 36 37

P----+C sequence 26 16 01 35 28 14 05 41 23 10 46 37 19

P----+C interval sequence -10-15+34 -7-14 -9+36-18-13+36 -9-12 -7

f (1) There IS another method of ascertammg the width of the T-1 matrix, which IS perhaps

a bit shorter and more direct than that described above Basicelly both methods are the same,

the one now to be presented being but another way of lookmg at the matter Suppose that the

differences between successive terms m the P4C sequence of figure 37a are calculated and set

down as shown below, and then repetrtions are sought in the senes of differences, the latter

constitutmg what will hereinafter be termed the P----+O ~nterval sequence Thus

Several repetrtions are noted and underscored, in the same manner that ordinary repetrtions are

indicated m analogous cryptanalytic procedure Now take the longest repetition, -14-9+36

-18, and find the terms from which It ongmates in the P----+C sequence, a constant difference of

8 will be found Thus

(Term numbers 16-20) 36 22 13 49 31

(Term numbers 29-33) 28 14 05 41 23

Differences_______________________________ 8 8 8 8 8

The other repetitions will show the same constant difference The terms which produce the

repentrons WIll be found to be located ill the same columns of the T-2 matrix m figure 37a, and

reference to that figure will show that the constant difference between the sets of terms producing

repetmons in the P----+C mtervnl sequence IS merely the result of the mechamcs of encipherment

(2) In similar manner, If the interval sequence IS constructed for the P----+C sequence of

figure 36a, the repetrtions underscored in figure 366 are noted

Term number. - 01 02 03 04 06 06 07 08 09 10 11 12 13 14 15

P----+C sequence, - ----- 27 13 02 43 46 51 37 26 23 41 30 16 20 03 45

P----+C interval sequence __ -14 -11 +41 +3 +5 -14 -11 -3 + 18 -11-14 +4 -17 +42 -9

Term number 16 17 18 19 20 21 22 23 24

P----+C sequence 36 19 22 05 49 38 35 33 24

P----+C mterval sequence __ -17 +3-17+44-11 -3 -2 -9-17

Term number --_ 26 26 2/ 28 29 30 31 32 33 34 35 36 37 38 39

P----+C sequence.; __ 07 10 15 01 48 31 34 39 25 14 11 17 06 50 47

P----+C interval sequence __ +3 +5-14+47-17 +3 +5-14-11 -3 +8-11+44 -3-26

Term number.i... __ 40 41 42 43 U 45 46 47 48 49 50 61

P----+C sequence 21 12 40 44 29 18 04 08 09 42 28 32

P----+C interval sequencec., -9 +28 +4 -15 -11-14 +4 +1 +33 -16 +4

FIGURB 36b
2346678

FIGURE 37,

60

IGLRE 3if(6) (7) (8)

111 38 01 29 16 061

102 30 17 07 48 351

144 26 22 13 40 03131 18 08 49 36 451

127 23 14 41 04 32 19109 50 37 46 28 24 151

142 05 33 20 10 511

III 38 01 29 10 061

102 30 17 07 48 351

144 26 22 13 40 01/31 18 08 49 16 451

127 23 14 41 04 32 191

/42 05 33 20 10 511

111 18 01 29 16 061

147 34 43 25 21 12 39102 30 17 07 48 351

144 26 22 13 40 03131 18 08 49 36 451

127 21 14 41 04 32 19109 50 37 46 28 24 151

142 05 33 20 10 51 I

Step (7)

Step (8)

Step (b)

124H"i-41-11

111 38 01 2q 16 06147 34 43 25 21 12 391

147 34 43 25 21 12 39102 30 17 07 48 35/44 26 22 1& 40 031

Step (9) 144 26 22 1~ 40 03131 18 08 49 36 45127 23 14 41 04 32 191

127 23 14 41 04 32 19109 50 37 46 28 24 151

109 50 37 40 28 24 15142 05 33 20 10 511

FIGURI! 37/ (9)

9 7 4 2 11 8 10 ft 6

~IGURI! 3ig

61

11 &8 01 29 16 06/47 34 4& 25 21 12 391

/47 34 43 25 21 12 39/02 30 17 07 48 35144 20 22 13 40 031

/44 26 22 13 40 03/31 18 08 49 36 45127 23 14 41 04 32 191

/27 23 14 41 04 32 19/09 50 37 46 28 24 151

109 50 37 46 28 24 15142 05 33 20 10 51 I

The T-2 matnv may now be drawn withm tho confines of the structure shown m this last figure

The pOSItIOns of vertical Imes to be placed at the left and right to mark tho exact outhnes of the

matrix may now readily be found by referring to the matnx In figure &7e It IS obVIOUS that the

column WIth the terms 11-15 belongs at the extreme left of the T-2 matrrx, the column WIth the

terms 21-24 belongs at the p~trpml' right The transposition key for the matrix may then be

cstabhshed directly from the matn.... itself, by following the sequence of numbers In the columns

TIlU'3

In the column 1Il which 06 and 07 appeal there IS JUbtroom enough f01 08 and 09, since the term

10 IS already shown at the bottom of the column Hence

The process IS continued in tlus manner until, as shown m figure 37f(9), all the numbers of the

C~P sequence have been placed (Here the la'lt number IS 51 ) FIGUR& 371(1)

FIGURE 371(2)

/ 11 38 01 29 16 06 /

I 11 38 01 29 16 06 I

102 30 17 07 48 35 I

27 47 09 11 31 02 42 44

23 34 50 38 18 30 05 26

14 43 37 01 08 17 33 22

41 25 46 29 49 07 20 13

04 21 28 16 36 48 10 40

32 12 24 06 45 35 51 03

19 39 15 I

Step (2)

Step (1)

Note the ascending superimposed numbers 01,02,29,30,16,17,06,07 Contmue to build up

on this structure m the manner depicted in successive steps as follows

111 38 01 29 16 06 I

Step (3) 102 30 17 07 48 35 I

144 26 22 13 40 03 I

111 38 01 29 16 06 I

Step (4) /02 30 17 07 48 35 I

144 26 22 13 40 03 I

/27 23 14 41 04 32 19 1

111 38 01 29 16 06 I

102 30 17 07 48 35 I

Step (5) 144 26 22 13 40 03 I

127 23 14 41 04 32 19 I

142 05 33 20 10 51 I

FIGURE 371(3) (4) (6)

The numbers 01 to 05, melusrve, here have formed the baSISfor building up the structure shown

as Step (5) The next term m the sequence IS 06 but It IS already In the structure, as IS also 07

Fmd the column in which term 01 appears and set that column down honzontally, placing a

vertical bar before and after the senes of numbers to set them off as belonging to one column

Then find the column m which the term 02 appears and set It down under the row of numbers

given m Step (1) Thus

The result of these three steps has been to effect a return to the original T-1 matnx contammg

plain text m normal sequence The pnncipal point to be noted here IS the appearance of the

T-2 matrix in figure 37c, for It IS the basis of the first method for recovermg the transposmon

keys, as well as for other operations m connection with double transpositron

(2) To demonstrate the procedure, the data afforded by figure 37a again will be employed

Let the C~P sequence be mscnbed withm a matrix of 8 columns (the width having been estabhshed by one of the methods set forth m subpaas d-f) Thus
62 63

The process explamed In subparagraph h (2) above IS now upphed The successrve steps have

been omitted hut the final result IS shown herewith

28 OJ 14 46 19 37 25 47 48 26 ,J.> 41

02 J4 27 12 .J6 45 17 13 40 18 09 24

3J 08 01 50 44 11 30 51 23 31 22 Ib

07 21 J2 42 10 49 04 4'3 15 05 39 29

20 38 06 1

Reference to figure 37e will show the exact correspondence between the T-2 transposrtion key

and the T-2 matrix of figure J7g with these same elements indicated m figure 37e The transposrtaon key for the T-l matrix in figure 37e call now easily be denved from figure 37g It

must be as follows

Thrs transpositaon key and T-l matnv are rdentic al WIth till' key and T-l matrix of figure J7e

'" Note the apphcation of the foregomg method to the C~P sequence shown m figure 36a

m connection with the messages solved in paragraph 26d-e It has ulreadv been found that the

Width of the T-l mutnx IS 12 Tho C~p sequence of figure' 36a IS therefore mscnbod within a

matrix of 12 columns

16

24

32

01

09

17

26

34 35

42 43

51r""" 1--------...... t_ ...

FIGUBII: 37J

FIGURII: 371

The transposrtion key for the T-l matrix IS now found to be as indicated at the top of figure 366

J A second method for reconstructing the keys will now be explamed To demonstrate

this method the data afforded by figure 37a Will again be employed Going back to the point

where the P~C interval sequence for this example was established in subparagraphj(l) above,

the terms, 111 figure 376, which gave rise to the thnee-appeanng repetition In the interval sequence

(-10 - 15 +34) are found to be' ab follow b

Ivt appealluu,c (term numbers 12-16)_ __ _ _ __ 42 32 17 51

2d appearance (term numbers 21-25) .H 24 09 43

3d appearance (term numbers 25-29) _ _ _ 26 16 01 35

These sequences may be rearranged so RS to bnng the numbers in ascending order within

columns Thus

The constant difference, 8, within the columns of this structure IS, of course, the same constant

difference as was found before, and corresponds With the WIdth of the T-l matnx It derives

from the T-l matrix, as may be spell on referring to figure 37a The columns of the structure

m figure 37) are seen to be portions of the T-l matrix, lying m the followmg positions m that

matrix

26 16 01 3.3

34 24 09 4J

42 32 17 51

7 8 9 10 11 12

6 3 8 ,

I'll Lilli '1&

FIGURII: 37h,

5 6

2 7

3 4

6

27 47 09 11 31 02 42 44

23 34 50 ,J8 18 30 05 26

14 4J J7 01 08 17 .M 22

41 25 46 29 49 07 20 13

04 21 28 10 Jh 48 10 40

32 12 24 06 45 J5 51 03

19 39 15 1

2

FIGURB d711

In the T-2 matrix.. these numbers fallm the followmg POSItions 114 27 01 32 06 119 3b 44 10 I

I 48 40 23 15 I 28 02 33" 07 20 I 37 45 11 49 I

I 41 24 16 29 I 03 34 08 21 38 146 12 50 42 I

125 17 30 04 135 09 22 39 147 13 51 43 I

126 18 .31 05 I I'IGUR.... 36d

All the numbers from 01 to 51, mclusive, are contained witlun this structure Extending Ii to

the left or right to make the T-2 matrix complete, by rofoirmg to the T-l mntrix, It IS found

that tIIP structure must be made as shown herewith

42

32

17

51

FlGUBB 37/

1

26 34

16 24

01 09

35 43

14 27 01 32 06 119 3b 44 10 I 48 40 23

15 128 02 33 07 20 I 37 45 11 49 141 24

16 29 I 03 34 08 21 38 I 46 12 50 42 125

17 30 04 I 35 09 22 39 I 47 13 51 43 I 26

18 31 051

148 40 23

141 24

125

126

4 8 2 6 9 11 3 12 10 6

15 I

16 29 I

17 30 04 I

18 31 05 I

Now If the dunensions of the T-2 rna tnx were unknown, these numbers could nevertheless be

placed m a skeletomzed T-2 matnx us follow'!

26 34 42

16 24 32

01 09 17

35 43 51

FIGl1BB 37m(l)

FlGUKE 'l6t
, I 102 10 18 26 34 42 50 01 02 03 04 0'> 06 07 08 09 10 11 12

I 108 16 24 32 40 48 I 13 14 15 16 17 18 19 20 21 22 2'3 24

01 09 17 25 33 41 41} I 25 26 27 28 21} 030 31 32 33 34 35 '3(;

! Ol 11 19 27 '35 43 51 37 38 31} 40 41 42 4.l 44 4'> 46 47 48

I<IOUKE 17m(2) 49 50 .11 1<1C't.RJI''lIl/1

I<IGUKI: 17m (5)

07 10 15 01

27 103 02

31 34 39 25 14 11

403 46 51 037 26 2'3

FIOURE J6f

The mntnx 1'01 prepm ed

11 12

07 031 4.l

10 J4 46

1'> 27 39 51

01 103 25 37

02 14 26

11 23

]0IOt.KI: 36h(I)

1 07 11} 31 4'3

2 10 2? H 46

3 OJ J 1 27 39 51

4 01 11 25 37 49

:; 02 14 26 38 50

6 11 203 3'> 47

FIOl.1 E .l6Il(2)

65

The constant difference, 12, indicates a T-l matnx of 12 columns

2 4 5 6 8 9 10

I<IC'URIl: 36h(3)

ThIS structure IS extended by referring to the T-l matnx (figure 36g)

1 234 567

The terms wrtlnn the columns of tlll' structure lTl figure 3bf all' trunscnbed mto rows (of the

skeletonized T-2 matnx)

I< 1l't.'RJI' 36h (4)

Notmg that till' uutial terms of the P-C sequence III figure J6a (27 13 02) ale present III

this structure (m the 3d column) this gIVI'S the top of the T-2 matnx as comcidmg With the 3d

row of the structure The P-C sequence m figure 36a reads 27 13 02 43 46 , the

43 and 46 afl> 0.1'10 m the structure in figure 3611 (2) m the 1st and 2d rows, column 5, henr e the

structure in figure '36h"(2) can be rearranged thus

O~ 15 27 39 51

01 IJ 25 037 49

02 14 26 '38 '>0

07 19 31 4~ 11 23 35 47

10 22 34 46

'I'he structure may now be extended by refernng to the p~C sequence 111 figure '36a

35 03 15 27 J9 51 05 17

'33 45 01 13 25 37 49 06

24 36 48 02 14 26 38 50

07 19 31 4l 11 23 35 47

10 22 34 46

42 50 06 14 22 30 038 46

032 40 48 05 13 21 29 37 45

17 25 303 41 49

51 07 15 2l 31 19 47

44 I 02 10 18 26 034 42 50 06 14 22

30 ~8 46 I 08 16 24 '32 40 48 105 103

21 29 ~7 45 01 09 17 25 sa 41 49

10~ 11 II} 27 35 4~ 51 07 15 23 ~1

} IGUKE 17,,,(3)

04 12 20 28 36 44 02 10 18 26 34

42 50 06 14 22 30 038 46 08 16 24

032 40 48 05 H 21 29 37 45 01 09

17 25 H 41 49 03 11 19 27 '35 4.l

51 07 15 2.l ~1 039 47 1

By referrmg to tho T-l matrix of figure 37a and the foregomg structure, the key fOI T- 1 can be

recovered It I!> 6-2-7-1-5-3-8-4 By rcfemng to the P-C sequence III ngure 37a the key

fOl the T-2 matrix just constructed may be estabhshed It IS 3-9-1-7-4-2-11-8-10-6-5

J.. Applymg tins method to the messages soh I'd in paragraph 26d-e, the steps are as follows

The width of the T-1 matrix has been estabhshod a"! being 12 The P~C interval sequence In

figure 36b shows the repctrtion +3 +5 -14 -11 -3 appearing two times, the repetition

+3+5-14 appearing three times, and the repetition -14-11app<'afmgthre('tnnl's The

terms grvmg rise to these repotmons are arranged m a structure With ascending numbers withm

the columns TI1U~

and the block of numbers could be extended on both sidee by referrmg to the T-l matrix m figure

37a Thuq

Agalll the structure may be extended bv referrmg to the T-l matrix Thus

04 12 20 28 036 44 02 10 18 26 34 42 50 06 14 22 30 38 46

06 14 22 30 38 46 08 16 24 32 40 48 05 13 21 29 37 45

05 H 21 29 37 45 01 09 17 25 33 41 49

03 11 II) 27 35 43 51 07 15 23 31 39 47

} IGURI: ~im(4)

Noting th« appearance of the ter m Ob III the lvt 10\\ and also III till' 2d 10\\ of the su uctui e, tho

latter may be uunscubed as follows

Tlns suucturc may nevt be extended by ll'fl'frlll~ to the P-C' sequence in figure 37a, by completmg the par ual columns of the qt}ur tui ('
2 It 1<; to be noted that the B sequence (that 1<;, the P~C sequence plu-, the addrnve) must be u..ed as the

base. otherwlSI' the cham of equn alents wIII hE' 8 reversal of the correct cham

Thus, by referring alternately to the P~C sequence and the T-l matrrx the structure IS extended

to the following

If now the procedure explamed In paragraph 16k, 24c toj, and 25(, to e IS applied to the repentions

noted illfigure 3711, It becomes dear that the T-2 man IX In tIns CMe must have 11 columns Tho

transpositron key for that matrix IS then estabhshed, 8S follows 2

8 9 10 11 12

2 11 6 3 10

12 10 6 4 7

7 8 9

01 4R 31 34 39 25 14 11 17 06 50 47

13 60 43 46 31 37 26 23 29 18 62 59 . 7 8 9

10 11 12 . 12 40 44 29 18 04 08 09 42 28 32

24 52 56 41 30 16 20 21 54 40 44

10 11 12

FIOURF 361

3 4 5 6 7

]2 7 9 4 1

25l}113

21

33

B _ _ __ _ 1 2

A_ _ _ 8 5

Cham _ 1 8

1 l 3

A (F--+ C sequence) ___ _ _ ____ 27 13 02 43 46 51 37 26 23 41 30 16 20

B (P.....C sequcnce+ 12)_ ___ 39 25 14 5:> 58 63 49 38 35 53 42 28 32 . 1 2 J

4 5 b

03 45 3b 19 22 05 4Q 38 35 33 21 07 10

15 57 48 31 34 17 61 50 47 45 36 19 22

4 5 6

15

27

67

ThIS IS a cyclic permutation of the key for the T-2 matnx, to obtam the actual key It IS necessary

mcrelv to fix the positron of one (\f the kov numbers with respect to the matrix It IS ('JSy to

find which number belongs at the extreme left 01 evtremo right of the matnv Only a few

minutes exponmontatron wrth the kov lind the T-2 mutrrx grves the corn-et stat tmg pomt for

the key, which IS found to be 3-9-1-7-4-2-11-8-10-£>-5

(3) The recovery of the transposition key for thc T-1 mutrix I'" no" a simple matter Its

WIdth havmg boon established as 8 columns, a mere transcription of the P~C sequence numbers

from the T-2 matrix Into the T-1 mntrix gIVPS the key 6-2-7-1-5-3-8-4 The two kl'ys and

matrices are found to be different

(4) The procedure set forth In this subparagraph IS apphcuble without modification to the

ease where the two taansposrtion matrices are the same and have the same transposrtton key

ThIS will be noted In the followmg domonstration of the recovery of the matrices and keys for

the messages solved In paragraph 26d and e by anagrammmg It has already been shown how

the width of the T-l matrix was ascertamcd a<;l bemg 12 columns (subpar f) The addrtive 12

IS then applied to the entu e P~C sequence, rdentrtre-, are established between sertions of the

ongmal sequence and sections of the c;eqUl'ltcp + 12, and these identical sections are equated m

the usual manner, loading to the establishment of a cychc permutation of tho transposrtion kpy

for the T-2 matrrx Thus (fig 36~)

Smce secnons 1,4, and 7 of the P~C sequence contam 5 terms (=long columns), the other

sections only 4 (=c;hort columns), It follows that the key numbers 4-7-1 go to the left and the

actual key for the T-2 matrix IS 4-7-1-8-2-5-l}-11-3-12-10-6 Smc« the number of elements

In this kpy IS the same ac; in the key for the T-l matnx, It IS likely that the same key 1<;1 employed

for both transposrtions SImple experiment will quickly veufy this assumption and the transposition matriees for the first of the I) IDp<;I<;agp"l of paragraph 26(/ may be <;ppn 111 tho followmg

(figure 361)

45 I

36 48 I

19 31 43 I

22 34 46 I

l} 10 11

168

.J 3 l}

11 47112150 40 25 59 I ;l

51 I 34 24 09 I 47

6

27120 58 48 33 151

9

It

11

24

5

46 37

678

5 4 10

8 10 6

4 ;)

2 3

2 ]]

FlOUR. 37ft

FIGURJI: 36Il(5)

06 48 33

\

22 13 49

03 15 27 3l} 51 I 05 ]7 29 41 109 21 33

45 101 13 25 37 49 I 06 18 30 42 112 24

&b 48 I 02 14 26 38 50 104 If! 28 40 I 07

19 31 43 III 23 35 47 I 08 20 32 44 110

22 34 46 I

B 123

A __ __ _ __ 7 11 9

Cham., _ _ __ 1 7 4

35

33

24

07

10

4

28 14 057

18 08 45

10

(B) P~C sequence-j-S____ -----f 28 14 56

1

44 30 21

4

36 22 13

7

26 16 53

10
3 ThE' basic prmerph 'I undr rly mg tIll'! Iourt h and mo ..t Important method were drscovr red and fir..t presented

]~34 by Solomon Kullhaek, Ph D, then Junior Oryptanalv..t, R I S

Cryptogram, _ I A A L N E 0 F S G etc P~C sequence 27 13 2 4~ 46 51 37 26 23 41 etc IoIl.URE J/iJ

m (1) A fourth and possibly the most elegant Solution to the problem of reconstructmg

the keys fOI double transposrtaon will now be presented 3 Rt'fl'rence will be made to the two

matncos and kevs shown m figure 36J Let the P-)C1 and P~C2 sequences resultmg from the

first and the second transposrtions, respectively, be shown, as seen below

1 Term number ____ 01 02 03 04 Oil 06 0, 08 09 10 11 12 Id 14 III 16 17 2 P~Cl sequence__ 03 15 27 JlJ 51 05 17 29 41 09 21 3,3 45 01 13 25 37 P~C2 sequence __ 27 13 02 43 46 51 37 26 23 41 30 16 20 03 45 36 19

18 19 20 21 22 21 24 25 26 27 l8 29 30 31 32 33 14 49 06 18 30 42 12 24 36 48 02 14 26 38 50 04 16 28 22 05 49 38 35 ,~3 24 07 10 15 01 48 31 34 39 25 14

d5 36 37 38 39 40 41 42 41 44 H 46 47 48 49 110 III 40 07 19 Jl 43 11 23 ,-I5 47 08 20 32 44 10 22 34 46 11 17 06 50 47 21 12 40 44 29 18 04 08 OlJ 42 28 32

FIr URE d6k

OJ 03 04 05

15 27 39 51

13 02 43 46

6 7 9 10 11 Il

FIGUBJ: 3'1

3 4 5

01 02 03 04 05 06 07 08 09 10 11 12

13 14 15 16 17 18 19 20 21 22 23 24

25 26 27 28 29 30 31 32 33 34 35 36

37 38 39 40 41 42 43 44 45 46 47 48

49 50 51 I

1 Term number, __ _ 01

2 P~CI sequence 03

3 P~C2 sequence, _ 27

69

A casual exammation of these three rows of numbers discloses an inter estmg uuarumt relationship between any pair of supcnmposed numbers m lOWS 1 and 2 and In rows 2 and 3 FOi

mstancc, take tbe very first pair, g~ III lOWS 1 and 2, III IO"TS 2 and 3 tho same pair of superimposed numbers WIll be found (under term No 14) This same relatronslup l'XIStS IH'hH'l'I1 all

the superimposed pnirs III rows 1-2 and 2-3

(2) GIven only the third row of numbers III figure 36k, that IS, tho P~C2 sequence (which

has heretofore been designated merely as the P~C sequenr e), obtamed as a result of a solution

bv superimposing and anagrammmg several messages, It IS not difficult to reconstruc t the second

lOW, the P~CI sequence The width of the T-l matrix can be ascertamcd by erther of the two

methods indicated In subparagraphs e and f It IS now known to be 12 A 12-eolumn matrix

IS therefore constructed, contammg 51 cells numbered III the normal manner ThIS will, of

course, give the T-l matnx seen In figure 36J, but without the transposinon key OI the letters

In the cells Thus

The mvanant relatronslnp pointed out III subparagraph (1) above may now be used to estabhsh the T-l key Since the key IS known to contain 12 elements, a start may be made With

any one of 12 possibihtres Suppose that the key begms WIth 1 The fhst five terms m the

P~CI sequence would be as mdicated herewith

1 Term number, 01 02 03 04 Oil

2 P~CI sequence 01 13 25 37 49

3 P~C2 sequence 27 13 02 43 46

Two "conflicts" 01 contradictions are at once manifested g~ III lOWS 1 and 2, ~~ III rows 2 and 3,

02 13 also, 1,3 III rows 1 and 2, 13 In lOWS 2 and 3 The conclusion IS ObVIOUS that the key number 1

does not occupy the 1st position III the transposition key Suppose key number 1 belongs In the

2d posrtion III the key The supcnmposed sequences are then as follows

1 Term number_ __ 01 02 03 04 OJ

2 P~CI scqucnce.c., _ 02 14 26 38 50

3 P~C2 scqucnce.c.c.,; _ _ __ _ _ 27 13 02 43 46

01 26 02 02 Here agam two confhcts are noted 02 in rows 1 and 2, 02 m rows 2 and 3, 14 1Il1OWS 1 und 2, 27

III rows 2 and 3 Only a smgle contradictron IS sufficient to permit of discardmg an hypothesis

ThE' key number 1 does not occupy the 2d positron III the kl'y A trial is made of the 3d POSItIOII

for by number 1 ThE' results RIC as follows

9 11 3 12 10

T-l

8 l 5

68

S 116 In 1'9 In I 117 U 41 9 1.1 liS

V I I T Elo N S G R 0 U

------------- ---- 6 IIlIa 16 37 8 18 4t I' .~

E H A F 0 L R W T 0 R 0 ------ -- '8 48 • 14 S8 60 18 .8 40 7

R I A T F N L E 0 R 0 D

1-------------------------- 19 1,1 4/ 11 " $6 47 Ii ItO lit 44 10

A S L D S D V E G Q D E I

'. J4 1~6

N A I N

4 7 8 2 9 11 3 12 10 6

T-2

1 ! IS 6 8 7 8 I9 10 11 I!

;-"A_"V "E_"O_"R "D .,E_I"R "E "D "R

A T ION WAG 0 N S 0

'-----------------------1-

n u u n " q

F FIR S T S QUA D R
FIGURE 3611

FIC'UEII: 36m (2)

35 d6 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51

3 9 74211810811

01 02 03 04 05 06 07 08 Oq 10 11

12 13 14 15 16 17 18 19 20 21 22

23 24 25 26 27 28 29 30 31 32 33

34 35 36 37 38 39 40 41 42 43 44

45 46 47 48 49 50 51 I

B

627 II 3 8 4

01 02 03 04 05 06 07 08

09 10 11 12 13 14 15 16

17 18 19 20 21 22 23 24

23 26 27 28 29 30 31 32

33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48

49 50 51 I

A (=T-l)

FIGURE 170

All the terms of the P~C2 sequence are represented, except the number 24, wInch stands by

Itself If now each of these chams IS slid against itself, \\IJ('n properly juxtaposed, tho superunposed pmrs are identical WIth those In rows 1 and 2 III figure J611 Note the following

04 12 20 28 36 44 02 10 18 26 34

42 50 06 14 22 30 38 46 08 16 24

32 40 48 05 13 21 29 37 45 01 09

17 25 33 41 49 03 11 19 27 35 43

51 07 15 23 31 39 47 I

C (=T-2)

The apphcntion of the foregomg phenomena ill the case under study IS obvious Here It IS not

even necessary to ascertain the WIdth of the T-l matrix before proceeding to try to establish

the T-l key Of course, the number of chams which may be estsbhshed will vary WIth the

FIGUEE 86P

71

(1){01 27 15 45 18 22 35 11 30 31 34 14 03 02 13 20 49 42 40 21 38 50 28

03 02 13 20 49 42 40 21 38 50 28 01 27 15 45 18 22 35 11 30 31 34 14

(2){04 43 44 29 48 09 23 33 25 07 37 06 51 32 39 47 08 26 10 41 12 16 36 17 19 05 46

39 47 08 26 10 41 12 16 36 17 19 05 46 04 43 44 29 48 09 23 33 25 07 37 06 51 32

01 27 15 45 18 22 35 11 30 31 34 14 03 02 13 20 49 42 40 21 38 50 28

04 43 44 29 48 09 23 33 25 07 37 06 51 32 39 47 08 26 10 41 12 16 36 17 19 05 46

FIGURE 360

39 74211810611

ThIS IS merely the mvt rse of the actual key , the latter may be obtained by inver-ron Thus

1 2 1 4 5 6 7 II 9 10 11 12

4 7 1 8 2 5 9 11 J 12 10 6

Compunson of this key with the T-1 key shown III figure 16) will establish the iden 1,1 ty of the t \\ 0

The deterrnmatron of the T-2 key IS ObVlOU'>, having the T-l at hand In tlns case both matrices

and keys an' rdentical

n Attontion will be du ccted to a further mterestmg phenomenon III tIll"! ( nse Roforrmg to

figure 36n, If chains of equivalents are constructed between clements of the l st and 1d lOWS only,

the following two chams arc obtained

02 03 04 05 06 07 08 09 10 11 12 13 14 16 16 17

15 27 39 51 05 17 29 41 01 13 25 37

13 02 43 46 51 37 26 23 41 30 16 20 03 45 36 19

11 17 06 50 47 21 12 40 44 2q 18 04 08 09 42 28 32

FIGURE 36m (1)

18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 84

49 02 14 26 38 50 04 16 28

22 05 49 38 35 33 24 07 10 15 01 48 31 34 39 25 14

18 19 20 21 22 23 24 .l~ 26 27 211 29 30 31 82 33 84

49 06 18 30 42 12 24 36 48 02 14 26 38 50 04 16 28

22 05 49 38 35 33 24 07 10 15 01 48 31 34 3q 25 14

07 ThC' new placement- now permit of placing numbers III the P~Cl sequence For example, 17

in rows 1 and 2 permit of placing the number 07 above the number 17 m the P~C2 sequence, ~g

III rows 1 find 2 permit of placmg the number 08 above the number 29 m the P~C2 sequence,

and so on In only a few moments the' entue P~CI sequence can be established Thus

1 Term number 01 02 03 04 05 06 07 08 09 10 11 12 18 14 1& 16 17

2 P~Cl sequence 03 15 27 39 51 05 17 29 41 09 21 33 45 01 13 25 37

3 P~C2 sequence.,__ 27 13 02 43 46 51 37 26 2.3 41 30 16 20 03 45 36 19

70

(3) The determmauon of the T-l kr-v IS now a very simple matter Since It IS known that

the key has 12 numbers, It I'> only n('('C'''I<:IHV to note III the P~CI sequence' the relatrve order of

the numbers 1 to 12 It 1<: R"! follows

1 2 1 4 6 7 R 9 10 11 12

3 Q 1 fl 12 2 4 7 11 R 10

35 86 37 38 89 40 41 42 4d 44 45 46 47 48 49 50 51

40

11 17 06 50 47 21 12 40 44 29 18 04 08 09 42 28 32

18 19 20 2\ 22 23 24 25 26 27 28 29 30 3\ 32 33 34

02 04

22 05 49 38 35 33 24 07 10 15 01 48 31 34 39 25 14

35 88 37 38 19 40 41 42 43 44 46 46 47 48 49 50 51

40 07 19 31 41 11 23 35 47 08 20 32 44 10 22 34 46

11 17 06 50 47 21 12 40 44 2q 18 04 08 Oq 42 28 32

HC'll' thoro me no contradicuons and one check 01 corroboration ~~ III lOWS 1 and 2, ~~ In 10W<:

2 and 1 If key number 1 ll'l111y OCCUpWb tho 3d POSltIOll III the key, then the aupenmposmon

data given m the last <:I't of IO\\S of superimposed numbers ma v be employed, by transferrmg the

data to the proper POSltIOll'3 111 tho skeletonized figure 36m (1)

1 Term number 01 02 03 04 05 06 07 08 09 10 11 12 13 a 16 16 17

2 P~CI sequence 03 15 27 39 51 05 01

3 P~C2 sequence 27 13 02 43 46 51 37 26 23 41 30 16 20 03 45 36 1q

It then becomes at once possible, by 1cfcrnng to the T-l matnx, to mSN t mor P numbers III tho

P~CI sequence Thus

1 Term number 01

2 P~Cl sequence 03

3 P~C2 sequence., 27
72

1 'I'cun number _ __ __ __ 01 02 OJ 04 O~ 06 07 08 09 10 11 II 13 14

2 P-7CI sequence fOI T-l __ __ 04 12 20 28 36 44 02 10 18 26 34 42 50 06

3 P-7CI sequence for T-2_ 03 14 25 36 47 06 17 28 39 50 01 12 23 34

4 P-7C2sequence _ 20 06 4R 3.3 Hi 44 10 21 01 39 04 42 12 17

2 3 4 b II

01 02 03 04 05 06 07 08

09 10 11 12 13 14 13 16

17 18 1c) 20 21 22 23 24

25 26 27 28 29 30 31 32

33 34 35 16 37 .38 39 40

41 42 43 44 45 46 47 48

49 50 51 I

(2) The' WIdth of the T-l matrix IS established fl'> 8 and tho T-1 lllUtll".. ,>(,t down

(4) An attempt IS now made to construe t a T-2 matrix wluch \\111 produce the distnbution

and spar ing of the numbers III row 3 For example, from the pOSItIOn of the number 05 the matrix

would have to be'of such drmcnsions that there arc short columns of 21t'ttpI<' and long columns of

3 letters, or short columns of 3 letters and long columns of 4 letters The former hvpothesis

can be' dIscarded at once, for the Illtl'rv.11b bptwe'pn the numhl'ls 03, 07, 02, 01, and 06 III row 3

make It untenable The latter hypothl'sls may also be (hscardl'd, tor thc mtl'l vals between 03

and 07 and betwecn 01 and 06 make It ImpOSSIble Hpllce l...C'Y nuwbC'1 1 cannot occupy tIlE' fUbt

pOSItIOn III thE' T-l key POSItIOn 2 IS u.,sumpd fOJ kl'y numbC'r 1 and the procedure rl'peated,

also \\'Ithout good J('bults Note \\holt happens \\lll'll ]lobltlon 4 IS 'l"lsumed for k('y number 1 III

the T-l key

T-l

FI('UR~ 17q

(3) Assunung that key number 1 OCCUpJl'b the first position m the' T-1 I...l'y, the numbers are

inserted III row 2, iepresentmg the begmnmg of the P->C'I sequeru e tor T-1 The superimposed

pairs in rows 1 and 2 arc distnbuted III rows 3 an<l4, with the results shown III figure 37r(l)

1 Term number, -------- - - - 01 02 03 04 05 06 07 Ob 09 10 11 12 13 14

2 P-7CI sequence for T-l ______ 01 09 17 25 33 41 49

J P-7CI sequence for T-2______ 05 03

4 P-7C1 sequence_ _________ 20 06 48 33 15 44 30 21 01 39 04 42 32 17

15 16 17 18 10 20 21 22 23 24 2~ 26 27 28

07 02 01

51 30 22 13 49 31 .34 24 09 43 26 16 01 35

20 30 31 32 13 34 3~ 16 37 31- dO 40 41 42

Of> 04

28 14 05 41 23 10 4b 37 19 12 50 40 25 07

4d 44 H 46 47 48 40 50 51

18 08 45 27 02 38 29 11 47

FICURE 17r (1)

38 30 40 41 42

49 03 11 19 27

02 13 24 35 40

12 30 40 25 07

21 .l2 23 24 25 26 27 28

16 24 32 40 48 05 13 21

11 22 33 44 10 21 32 43

34 24 09 43 26 16 01 35

FIGURE st»

20 30 31 32 33 J4 30 36 37

29 37 45 01 09 17 25 33 41

04 15 26 37 48 08 19 30 41

28 14 05 41 23 10 46 37 19

.~ 16 17 18 10 .lO

14 22 30 38 46 08

45 05 16 27 38 49

51 36 22 13 49 31

4d 44 45 41. 47 48 40 JO H

35 43 51 07 15 23 31 39 47

09 20 31 42 07 18 29 40 51

18 08 45 27 02 38 29 11 47

specific matrices and I...l'yb, but the general pnnciples herem presented mav nevertheless be

applied In some cases It may be n('('l'e;e;flry to juxtapose two different chams obtained by

oquatmg terms from rows 1 and 3, rather than juxtaposmg one cham against rtself OnlJ a

few minutes oxporum-ntatron WIll be necessary to establish contradrctrons which WIll permit of

discarding fallacious hvpotln "('b

o (1) In tho foi ogomg ovplanauon, the tw0 tr.ur-po-ation keys aud matrices were idenucal

Evon when they nrc diftoront tho same principles, with minor modificattons, may be applied

The matnccs and koy-, of figure 37a WIll agam be employed to demonstrate the necessary modincations

(2) Fnvt, pn pau tho two matnce-, with convor utrv e numbers III the cells of bothmatrices,

.IS shown at A lind Bill figure 370 and then prepare tho T-2 matrix shown ut C

(3) Wntc the P-7C'1 sequence for T-l, under It wnto tlu P-7C I for T-2, und under

the Inttcr write the P-7C2 sequence for the finnl crvptogram TIme;

Note>, now, the mvanant relattonship between rows 1-2 and 3-4 The' same phenomenon Ie;

here rnarnfested ae; was oncountcrc d m tho precodmg case where the T -1 and T-2 matrices and

keys wero identical It follows, therefore, that the prmciplos elucidated under subparagraph m

may be apphed, with some modificauons, also to the case where different keys and matrices are

employed tor double transposition The width of the T -1 matnx mav be ascertained III the

manner aheadv rr.dicated , an assumption is mude us to the pOSItIOn occupied by key number 1

of the T-l key, this assumption provides data fOJ mnkmg nil nssumptron as to the width of the

T-2 mutrrx 'Wh"n the correct pur of nssumptrons IS made, the' data III rows 1 and 2 are corroborated by those III rows 3 and 4 From that point on the rest IS easy And follo\\s along the'

same Imes as beforc'

p (1) The proct'dUfl\ will be Illustrated by employmg the P-7C se'quence m figure 37b

(whIch IS tIll' Sdme as that labelled P-7(;2 e;l'quence III figure 37p), It bE'mg assumed that nothmg

IS known about the matmes, flnd th It the "lequence was obtamcd from .1. e;olutlon by superImposmg and flllllgr,llllmmg S('"l'rnl ml'S"lIlJH'<, of IdpnhcnllC'ng th
74 75

1 Tcrm number.. ________________ 01 02 03 04 05 06 07 08 09 10 11 12 13 14 1 Term number_____________ ________ 01 02 oa U4 U5 06 U7 08 011 10 11 12 13 14 2 P~CI sequence for T-L_______ 04 12 20 28 36 44 2 P~CI sequence for T-L______ 04 12 20 28 36 44 42 50 3 P~C2 sequence for T-2 _____ 03 06 01 3 P~Cl sequence for T-2________ 03 14 25 36 47 06 17 28 39 50 01 12 23 34 4 P~C2 sequence_______ _ _____ 20 06 48 33 15 44 30 21 03 39 04 42 32 17 4 P~CI sequence_________________ 20 06 48 33 15 44 30 21 03 39 04 42 32 17

15 16 17 18 III 2U II 2J l3 24 J5 26 27 28 16 II> 17 18 19 20 21 lJ 2d 24 2\ 26 l7 28

14 22 030 032 40 015 1& 21

05 45 05 10 27 JS 49

51 30 22 1& 49 031 &4 24 09 4.3 20 16 01 35 51 36 22 13 49 J1 34 24 01) 43 2h 10 01 35

29 30 31 32 33 34 35 36 37 38 d9 40 41 42 29 so dl 32 33 34 35 36 37 38 d9 40 41 42

17 25 41 49 03

04 02 04 15 26 37 48 02 13 24 35 46

28 14 05 41 23 10 46 37 19 12 50 40 25 07 28 14 05 41 23 10 46 37 19 12 50 40 25 07

43 44 45 46 47 48 411 50 III 43 44 45 46 47 48 49 50 51

51 07 23 31 39

18 08 45 27 02 38 29 11 47 18 08 45 27 02 38 21) 11 47

FIat/RI: 37r (2) FIGVRE 37r (4)

(6) If matrix A IS COHee t, then the numbers in columns 3, 6, 1, 5, 4, and 2 can be transferred

to row 3 In figure 37r (2), these WIll permit of msertmg numbers m lOW 2 No contradrction-,

and many checks all' found Here IS the diagram

{

7 (long) X5=35

Key of 11 ---- -- 4 (short)X4=16 51

r {& (long) X5= 15

Key of 12_ - --- - 9 (short) X 4=36 51

Each of these T-2 matrices IS tested 6S a possrbihty

(7) In tho firvt place note, m row 2, the constant diflercncc 8, grvmg many corroborations

that the Width of the T-l matrix IS 8, ill the second place no conflicts whatever become mamfest

between the pairs of rows Thus, the validity of the assumption of a T-2 matnx WIth 11 columns

IS well established The rest follows quite readily, WIth tho final result that figure 37r becomes

completed, and tho recovery of both keys IS a simple mat ter In faot, both keys may be estabhshed from a SImple study of rows 2 and 3 of the final figure (which would, of (OUISe, be identical

WIth that shown III fig 37p and need not here be repeated)

q A careful study and good gIIJ,SP of the pnnciples and methods elucidated 111 tills paragraph

will be sufficient to mdioate to the student that when, as It result of 11 close study of several

messages ill the same keys, parnal C~P sequences become available, the entire C~P sequence

or sequences can usually be reconstructed from the partial sequence or sequences and the messages solved WIthout too much difficulty For mstance, suppose It has developed that the

enemy has become addicted to stereotypic begmmngs, so that the first few letters of a message

or of several messages (an be reconstructed WIth some assurance> of certamty The construction

of partial C~P sequences and then completion by means of the pnnciples set forth, especially

those presented in subparagraphs m-p, may result m rcoonstruction of the complete C....,.P

sequences and ultimate recovery of the transpositaon key or keys

28 SpeCial cases of solution of double transposition Ciphers -a When the double transpOSItIOn system IS employed in the held and IS used for a voluminous traffic It IS almost inevitable

that cei tam SItuations will arise which make possible a rather easy solution ASIde from the case

III which several cryptograms of identacal length and in the same key are mtercepted, other cases

of a special nature may arise Some of these WIll be discussed in this paragraph

b FIrst, there IS the case m WhICh an inexperienced cryptograplnc clerk fails to execute the

double transpositron properly and causes the transrmssion of a cryptogram which IS only a single

transposinon The solution of this message will be a simple matter and will, of course, yield the

key If the key IS the same for both uunsposiuons It I"l obvious that tills WIll permit the reading

of all other messages even though the latter hav e been correctly cryptographed The only

difficult part of the matter IS to find among a large number of intercepted cryptograms one which

mvolves a blunder of tills SOl t When the cryptanalyst has, as a result of considerable expenence, become adept in the solution of transposrtion ciphers the \\OIk of testing cryptograms to

ascertain whether 01 not they involve single columnar n aneposrnon IS not difficult and goes quite

B

2 3 4 5 6 7 8 19 10 11 12

01 02 03 04 05 06 07 08 09 10 11 12

13 14 15 16 17 18 19 20 21 22 23 24

25 26 27 28 29 30 31 32 33 34 35 36

37 38 39 40 41 42 43 44 45 46 47 48

49 50 51 I

FIGURE 37r (3)

234567891011

01 02 03 04 05 06 07 08 09 10 11

12 13 14 15 16 17 18 19 10 21 22

2J 24 25 26 27 28 29 30 31 32 33

34 35 Jo 37 38 &9 40 41 42 43 44

45 46 47 48 49 50 51 I

A

(5) Hell' thoro are found no contradictiona of the nature of those pointed out above The

T-2 matrrx appears to have columns of 4 and 5 letters, since the interval between 04 and 02 III

row s can accommodate a short column of 4 and a long column of 5 letters, the interval between

0.15 and 04 can accommodate 2 short columns of 4 letters and 1 long column of 5, the intervals

between OJ and 06, 06 and 01, 01, and 05 can accommodate long columns of 5 letters each

Only 2 matrices (an be consti ucted of 51 letters with long columns of 5 and shot t columns of

4 letters They are
76

(3) The columns of figure 39b are now anagrammed, as in figure 3ge, and the rows rearranged,

as m figure 39d

d When the enciphermg rectangle IS not a perfect square but nevertheless a complete rectangle, solution of a smgle cryptogram becomes somewhat more difficult Here the columns are

all equal m length, since the last row of the rectangle IS completely filled Two cases will be

considered, first, when the WIdth of the rectangle IS a multiple of the depth, 01" number of letters

m tho columns, and second, when the depth 18 a multiple of the WIdth

e (1) Takmg up the first case, note the followmg encipherment

rapidly FOl only a few minutes SICsufficient to give him the "feehng" that the cryptogram IS 01

I~ not solvable by single transposition He might not be able to pomt out any specific mdications

which give him this feeling If asked to do SO, nevertheless It must be recognised that hIS mtumon

IS alone sufficient to tell hun when there IShope of solution along this line and when further work

upon the hypothesis of single transpositaon ISuseless

c (1) Next comes the case III which the enciphering rectangles of a double transposition

cryptogram happen to be perfect squares (that IS, both T-l and T-2 rectangles arc perfect

squares) In this case, not only IS such a cryptogram detectable at once, smce the total number of

letters IS the square of the number of elements in the key, but also the cryptogram can be solved

mil. very snnplo manner For the cryptogram now represents a case in which a completely-filled

rectangle has been employed, and moreover there IS no need even to assume varIOUS WIdths

(2) GIven the followmg cryptogram of 49 letters (7X7) as an example, the te'tt IS transcribed as shown m figure 39a and retranscnbed as III figure 39b

ILL F I

o V I S E

H G 0 L 0

N LET V

yields WHEN W

yields., I G H T A

yields N REA C

and

77

H I WL E

G 0 I I H

R H N 0 E

ION L E

and

and

and

NFl WL

T SEA V

A L 0 C G

Section SectIOn

r- 4

9 10 5 7

r- 2

6 1 8 3

2 - 14 19 20 15 17 7 - 12 16 11 18 13

Category A_____ 3 - 24 29 30 25 27 Category B____ 8 - 22 26 21 28 23

4 - 34 39 40 35 37 9 - 32 36 31 38 33

5 - 44 49 50 45 47 10 - 42 46 41 48 43

p~C sequence.i..c, 34 3lI 40 35 37 14 19 :I) 10 17 32 36 31 dB 33 2 6 1 8 3 46 n 48 48

Cryptogram_________ ION L E S R 0 Q A N LET V H I WLEG 0 I I H

4 9 W 5 7 44 00 26 28 U 11 29 30 25 27

NFl WL T SEA V R H N 0 E SUR 0 TAL 0 C G

2 1 6 8 or or or or 86101475Q23

R S T S QUA 0 R 0

Expenment ma.y now be made WIth two other soctions, applying the same transposition Thus

12345 678910

2 I 6 8 or or or or 8 10 I 4 7 5 9 2 3

o I N E

E N V ILL E TON

Obviously the proper key for rearrangement IS 8-6-10-1-4-7-5-9-2-3 By continumg this

procedure the followmg additional lOWS of the T-l rectangle are reconstructed

I 2 3 4 5 6 7 8 9 10 8 6 10 1 4 • 9 2 3

• The fact that the length of the sections COl responds to 5-letter groups has, of course, no bearing on the

validIty of the method In thiS case It Just happens that the rectangle contams 5 letters per column

824155--41-8

(2) There IS obviously a definite regularity m the composrtion of the sections whereby, tf the

letters correspondmg to the numbers in one section can be assembled properly, all the letters

corresponding to the numbers in the other secnons belongmg to the same category (A or B,

respectively) will be assembled correctly too For example, m category B the letters correspond..

mg to the numbers occupying the third, first, and fifth pOSItIOns in each section are sequent m

the plain-text rectangle, m category A the letters correspondmg to the numbers occupymg the

first and fourth positions m each section are sequent Moreover, all the letters m each section

come from the same row m the T-l rectangle Consequently, tf two sections coming from the

same row can be identified, there will be 10 letters WhICh may be rearranged by experiment to

form plain text, and the key for this rearrangement will apply to all other pairs of sections

For example, the message m this case has a Q and only one U The Q (P~ sequence No

15) IS m the second section, the U (P~C sequence No 16) 18 ill the seventh section These two

sectiona come from the same row and the letters may be anagra.mmed 4

12345 678910

S R 0 Q A and SUR 0 T

If the P~C sequence IS examined It will be found that sections thereof fall mto two categorres, as follows

o U WOO

N N V E

261 5 3 7 4

H 0 S TIL E

FOR C E E N

COUNTER

E DON RID

GEROADS

EVENMEN

W0 UNO E 0 FIGURF 39d

GAS 0 E

o E E E M

'f-2 Rectangle

E T 0 L R

R FEN C

6 2 10 1 7 4 9 8 3 5

2615374

C 0 U N T E R

H 0 S TIL E

G E R 0 ADS

W0 UNO E 0

E DON RID

FOR C E E N

EVENMEN FIGURE 39r

N S A I T H S R N G

4 14 24 'J4 44 2 12 22 32 42

- - - - - - - - - -

F R L 0 S I U H L 0

9 19 29 39 49 6 16 26 36 46

- - - - - - - - - -

I 0 0 N E W R N E I

10 :I) 30 40 50 1 11 21 31 41

- - - - - - - - - -

W Q C L A L 0 0 T I

5 15 25 35 8 18 28 38 48

- - - - - - - - - -

L A G E V E T E V H 7 17 27 37 47 J 13 33 43

o E S H I

RON 0 I

1234567

U C T R N 0 E

S HIE T 0 L

R GAS 0 E 0

UWDDNOE

o E RON 0 I

R FEN C 0 E

EEMNNVE FIGURE 39h

U C T R N

N 0 E 0 E

'1-1 Rectangle

1234~6

U S R U 0 R E

C H G WE F E

T I A 0 REM

RESDDNN

N TON N C N

o 0 E 0 0 0 V

E L 0 E lEE FIGURE 39a

6 2 10 1 7 4 9 8 3 5

W H E N W I L L F I

1 2 3 4 5 b 7 8 9 10

- --- - - - - - - -

R SIT S Q U A 0 R 0

11

~~ 14 15 16 17 18 19 :I)

N R E A C H G 0 L 0

21 22 23 24 25 26 27 28 29 30

-- -- ---- - --- - - -

E N V I L L E T 0 N .II .12 Jd d4 35 3b 37 38 39 40

I--- - - - - - - - -

I G H T A 0 V I S E

41 42 4d 44 45 4b 47 48 49 50

Cryptogram _
78

43 U ID 45 44 U 42 8 33 6 M W 9 34 7 32

D H U lOA R TAG L V I ElL F I L N

3 9 1 7 5 I

R S T S Q

WHEN W

N REA C

U A D R 0

ILL F I

It IS obvious that If the 3d, 9th, 1st, 7th, and 5th columns are made sequent, good text will be

produced withm the 5 rows Thus

12345678910

T T R L Q N S 0 S E

EOWHWDNLHG

E I N DeE A S R V

D H U lOA R TAG

L V I ElL F I L N

The subsequent steps are ObVIOUS Here again in solving an unknown example It would be

necessary to test out varIOUS assumptions WIth respect to the dimensions of the rectangle before

attemptmg to apply the method outlmed

9 Whenever this simple relationship between the WIdth and depth of the rectangle obtains,

that IS, when one dimensron IS a multiple of the other, solution of a single cryptogram IS relatively

easy The reason for this IS not hard to see When the encrphermg rectangle IS a perfect square,

every column of the T-2 rectangle IS composed of letters which all come from the same row of

the T-1 rectangle Hence solution IS m this case the same as though a false double transposinon

were m effect, With merely the columns and the rows of a single rectangle shifted about When the

WIdth of the transposition rectangle IS twice the depth, a column of the T-2 rectangle contains

half the letters appearing on one row of the T-1 rectangle, two columns therefore contain all the

letters belongmg in the same row of the T-1 rectangle If the WIdth were three times the depth,

then three columns of the T-2 rectangle would contain all the letters belongmg in the same row

of the T-1 rectangle, and so on When the WIdth IS half the depth, a column of the T-2 rectangle

contains all the letters appoarmg in two rows of the T-1 rectangle, when the width IS one-third

the depth, a column of the T-2 rectangle contains all the letters appearmg m three rows of the

T-l rectangle, and so on But when this multiple relationship no longer obtains, solution becomes

more difficult because each column of the T-2 rectangle IS composed of letters commg from several columns of the T-l rectangle, m an Irregular distnbution Solunon IS, of course, most difflcult when mcompletely filled rectangles are used However, although solvable, even m the case

of a single message, the solution will not be dealt WIth in this text

79

., 1 2 3 4 5 6 7 8 9 10

3 28 1 26 5 30 4 29 2 27

8 33 6 31 10 35 9 34 7 32

13 38 11 36 15 40 14 39 12 37

18 43 16 41 20 45 19 44 17 42

23 48 21 46 25 50 24 49 22 47

T-2

3 8 13 18 23

E L T D E - ------I28 33 38 43 48

0 V T H I 11-6 - --I11 16 21

W I R U N --

26 31 16 41 46

H E L I D - ------I5 10 15 ID 25

W I Q 0 C - ------- 30 35 40 45 50

D L N A E - ------- 4 9 14 19 24

N F S R A

I-------- 2D 34 39 44 49

L I 0 T S

f--- ------I2 7 12 17 22

H L S A R

f--- - ----I27 32 37 42 47

G N E G V

T-l

1 2 3 4 5

W H E N W - ------I6 7 8 9 10

I L L F I - ------- 11 12 13 14 15

R S T S Q - -------- 16 17 18 19 ID

U A D R 0 - ------- 21 22 23 24 25

N R E A C - ------- 26 27 28 2D 30

H G 0 L D - ------- 31 32 33 34 ,~

E N V I L --------- 36 37 38 39 40

L E T 0 N

I-------- 41 42 43 44 45

I G H T A

I--------- 46 47 48 49 'ill

D V I S E

P--+C sequence 13 38 11 36 15 40 14 39 12 37 3 28 1 26 5 30 4 29 2 27 23 48 21 46 25 50 24 49 22 47

Cryprogram T T R L Q N S 0 SEE 0 WH WD N L H GEl N DeE A S R V

Takmg the numbers of the P-+C sequence and arranging them m sectaons of 10, the results

are as follows

The varIOUS rows are now assembled in sequence, grvmg the following

WHEN WILL F I

RSTSQUADRO

N REA C H G 0 L D

E N V ILL E TON

I G H TAD V I S E

The transposition key can now be reconstructed with ease

(3) The cryptanalyst in this case must, d course, make an assumption as to the WIdth of

the enciphering rectangle before he can apply the method WIth a number such as 50, the

dunensions lOX5 or 5X10 suggest themselves The process of findmg cipher groups which

form pairs on the same row IS one of "cut and try" If there IS a single Qand a single U m the

message, the untial pair of groups IS ObVIOUS

f When the depth of the rectangle IS a multiple of the WIdth, solution follows along the

lmes of the precedmg case Takmg the same message as before, note what happens m encipherment with a rectangle of 5 columns contammg 10 letters each

25143 25143

II

I
SECTION VI

Thus

A C H E ~I~ a A D J ~I~~ T I a N F I V E F

T E F A~I~ x S E C aND B A T T A L I a N ---- - B A T T A L I a N T a v I C I N I T Y a F H

10 11

I--- - - - - - - - - - - - - - - - - - - - - 53 69 54

I--- - - - - - - - - - - - - - - - - - - - - 28 79 29 - - - - - - - - - - - - - - - - - - - - - - 40 20 41 21 - - - - - - - - - - - - - - - - - - - - - - 34 61 35 62

I--- - - - - - --- - - - - - - - - --- - - 1-

45 2 46 3 - - - - - - - --- - - - - - - - - - - - - 1-

85 84

------- --- --- ---1 'lext __ •

81

FIGURE 4G-A

5

6

7

1

2

3

Matrix reeonatruenon dlagram_____ 4

b The anagramming process IS applied to the superimposed complete secnons, using the

letter J m the first section as a startmg pomt and buildmg up text on either side, until the followmg partiallv reconstructed text IS obtained

M M 2 W 00 N M M 3 M 11

40 34 45 85 2 61 20 28 53 10

41 35 46 84 3 62 21 29 54 11

They show a quite defimte relanonshrp, leading to the suspicion that the C~P sequence IS

systematic m Its composition The numbers arc then Written down on cross-section paper so that

consecutrve numbers appeal on the same level, as shown m figure 40-A

C~P sequence________ _ _ _ 40 M 45 85 2 61 20 28 10 69 79 41 35 M 3 21 54 11

A C H E D R a A D J U N C T I a NFl V E F

T E FAR MX SEC aND BAT TAL I a N

BAT TAL I aNT a v I C I NIT Y a F H

c Exumuung the numbers forrnmg this partial C~p sequence, note the followmg sections

of the sequence

d From tlus skeleton of what may be termed the matru-reconstructwn dULfJTam It IS possible

to derive direct clues for the continuance and completion of the C~P sequence and the text of

the message For example, It would appear that the very next column to the left should be 78,

the one to the left of 78 should be 68, the one to the left of 68 should be 9 Tnal gives the

followmg

9687840M46852

SREACHED

F TAT E FAR

aURBATTA

To the right of column 11 should come columns 70 80 42 36 47

29114117080423647

V E F I V ESE

I aNT H I RD.

aFHARMaN

Paragraph

__ 29

_ __ 30

PRINCIPLES OF MATRIX RECONSTRUCTION

Special designs or geometric figures, _ __

Reeonstruenon of transposition matrix

29 SpecIal designs or geometnc figures -a It ISimpovuble here to elucidate and demonstrate by example all the methods which may be used for the solution of cryptograms produced

by the many various types of transposition designs or geometuc figures other than the simple

rectangular ones thus far treated Reference may be made to such matrices as triangles, trapezoids, and polygons of various symmetucal shapes Most of these matrices, however, are unpractical for mihtary correspondence 1Il any case, so that no attention need be given them in this text

b If such designs were used, although It might be difficult to solve a single or even a few

messages in the same key, the general solution described in paragraph 26 IS apphcable whenever

two or more messages of idenucal lengths but 1Il the same key are available for study Since

most of these designs are of a fixed or inflexible character WIth regard to the number of letters

that can be accommodated With one apphcation of the design to the plain text to be enciphered,

the production of several cryptograms of identical length m the same key IS by no means an unusual Circumstance The general solution can usually be depended upon to Yield the answer to

cryptograms of this category but It then becomes advisable to try to ascertam the exact nature of

the specific design or geometric figure employed, that IS, to reconstruct the transposttion matrix

For this purpose a general method Will be mdicated by means of a specific example, leaving other

cases to the ingenuity of the student after he haslearned the general method

30 ReconstructIon of traneposmon matrIX -a Assume that the enemy IS employmg an

unknown geometric figure of rather small dimensions so that It appears from a study of the traffic

that It accommodates a maximum of 85 letters A long cryptogram has been intercepted and It IS

broken up moo sections of 85 letters, which sections are then superimposed, as shown below

It will be noted that there are 3 complete sections of 85 letters each, plus a final section of but

491etters The final section will be dealt WIth later

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 III 20 21 22 23 24 25 2627282930

1 T D N F R A a I S J FER a E EAR Y a I E P T L T H A V N I, 2 WR T D L U a S F C N N T U I N Mas x L NaN P A T S I F

I: 3 MA I S V ITS a T H L T E S R I a v I y V WN G PEa a I I 4 G RUT S a E B R M L R Ma a ETC N N DYE E H T Q C N T I: 313233M35 36 37 38 39 40 41 42 43 44 45 46474849150 51 52 sa M 55 Ii6 Ii7 58 59 60

1 ANN C T S Y a A A C E ME H I E I B I HAD E X T C T U R

2 WD H E B R N D T T DIY A F A D A G R D a E a A A J T R E

3 A T U A C a D P a B I MN R T I N E S H a Y NFL I H N R a

4 Ma aCE a I B R S E P Y C S S S S F

61~636465 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85

1 R F V S T N N R U I N a U R T F FEN V E L N a E

2 MA I a N vaT a T T RNa I E U A N H R aCT A

3 L T Y E X A E U a A E F R T E X Y R V R A U I N T

(80)
82

ThIS, of course, speeds up the work mvolved in the anagrammmg process and when completed the

text, the C~p sequence, the P~C sequence, and the matrix reconstruction diagram are as

shown m figure 4o-B In the cells of tho diagram there have been inserted m the upper left

hand corner small numbers m itahcs, the latter numbers bemg merely the term numbers

applying to the C~P sequence

e The matnx-reconstruetton diagram m figure 40-B shows a total of 7 levels of numbers

Let the term numbers correspondmg to the consecuiue C~p sequence numbers on the

same level in the dragram be set down Thus, for the C~P sequence numbers 4 to 16, mclusrve,

on the first level the term numbers are

C~Psequencenumber 4 5 6 7 8 9 10 11 12 13 14 15 16

Term number 1 3 7 13 21 31 43 55 65 73 79 83 85

On the second level there are two sets of consecutive C~P sequence numbers, those from 48

to 58, inclusive formmg one set, those from 64 to 74, mclusrve formmg the other set Two series

of term numbers are therefore denved

C~P sequence number 48 49 50 51 52 53 54 55 56 57 58

Term number_________________________ 2 6 12 20 30 42 54 64 72 78 82

C~P sequence number____________ 64 65 66 67 68 69 70 71 72 73 74

Term number________________________ 4 8 14 22 32 44 56 66 74 80 84

What has been said of the 2d level applies also to the remammg levels, and the term numbers

are therefore set down m the followmg tabular form

C-+P sequence numbers to whICh 2 3 4 s 6 7 8 9 10 11 12 13 applicable

1 1 3 7 13 21 31 43 55 65 73 79 83 85 (4-16)

2 2 6 12 20 30 42 54 64 72 78 82 (48-58)

3 4 8 14 22 32 44 56 66 74 80 84 (64-74)

4 5 11 19 29 41 53 63 71 77 (24-32)

5 9 15 23 33 45 57 67 75 81 (75-83)

6 10 18 28 40 52 62 70 (17-23)

7 16 24 34 46 58 68 76 (38-44)

8 17 27 39 51 61 (59-63)

9 25 35 47 59 69 (33-37)

10 26 38 50 (1-3)

11 36 48 60 (45-47)

12 37 (85)

13 49 (84)

FIGUlIJI: 41.

f There are m all 13 sets or series of consecutIve C~P sequence numbers, mdicatmg

that the transposmon matrix has 13 columns, the number of letters m each column correspondmg

WIth the number of different terms in each senes Thus, there IS a column of 13 letters, 2

columns of 11 letters, 2 columns of 9 letters, and so on ThIS leads directly to the Idea of a

very symmetncal matrix of the form shown m figure 42-A
Term number______ 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 2S 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43

FIR S T BAT TAL ION F 0 U R T H I N FAN TRY HAS REA C H E D R 0 A D J

4!

10

!B

2

n

85

till

45

81

9

16

1

'1

8

18

7

7

6

8

5

38 110

EVE N S I X E I G H T A X PRO P 0 S E YOU M 0 V E YOU R BAT TAL ION T

A LON GUN IMP R 0 V E D R 0 ADS 0 U T H W EST 0 F TAT E FAR M X SEC

------------------------------------------------------------------------------------

, 4 6 B l' 14 10" 60 Sf 41 44

48 64 49 65 50 66 51 67 52 68 53 69

--1----~4------;5--~5------;6------~6-----;7----------;7------;8--------------~8------·

-------- ---- ---------------------------------------------------------------------

w M

17 38 18 39 19 40 20 ------------~-------------------------------------------------------------------------

nun U till

59 33 60 34 61

s

t

4

7

6

2

3

5

1

FlOUBB 4O-B

Plam text D

i

-e

4

I

j

Term number _

sequence_ __ 26

I <. .:........,;-...:..-.:.......,;,-...;..-.;.......;.-..;...-;.........;.-..:...-;.......-..;.......;-...-.:...~-...-.:.......,;,-..:..-.;.......;.-..:...-:......:..-.-......;----~....I- ....-...:.-~--------------....:.-....-:..-.....,;"..

C--+P sequence.i., 4 48 II 64 24 49 6 6S 75 17 211 so 7 66 76 38 59 18 26 51 8 67 77 39 33
I

41 42 G .. 46 U 'll 49 50 51 62 6d M 66 li6 57 liS 59 60 61 62 63 64 65 66 87 68 69 70 71 72 73 74 75 76 77 78 711 80 81 82 83 M 8li

- --- ------- --------------------------------------- ----------------------I28 53 10 69 711 41 3~ M 3 62 21 29 M 11 70 80 U 36 47 63 22 30 55 12 71 81 G 37 23 31 li6 13 72 82 44 32 57 14 73 83 58 16 74 16

- ------------- ------------------------------------- - --------------------------- ----IA D J U N C T I 0 N F I V E F I V E S E V E N X E N E M y P A T R 0 L E N C 0 U N T E R E

- ----- ------- ------- ------------- ------------ - - - ----- --------------------------IS E C 0 N D B A T T A L I 0 N T H I R D I N F A N T R y N 0 W A T R 0 A D J U N C T I 0 N

--------------------------------------------- --- - - - --------------------------------I0 N T 0 V I C I N I T y 0 F H A R M 0 N y V I L L E A N D W A I T F U R T H E R I N S T R - ----

43 ------------------------

66 - ------------------ 66 - - - ----------

78 ------------79 --------

88 --lu

10 11 12 13 14 15 16 - --------------------------------------------------- - ------ ------------------------- '" 44 64 66 64 66 71 74 78 BO 81 84

53 69 54 70 55 71 56 72 57 73 58 74 - - ------------------- ----------------------------- - ----- --------------------------- 46 6:1 67 (IS 87 71 76 77 81

!8 79 29 80 30 81 31 82 32 83 - -----------------I-------- ----------------------- - ---------- - --------------------I-

.fB 61 68 61 68 70 76

41 21 42 22 43 23 44 - - ----------------------------------- --------- --- - --------------------------------- 47 61 69 61 69

35 62 36 63 37 - ------------------------------------------------- - - --------------------------------- 48 60 t10

46 3 47 - - --------------- --------------------------------- - ----------------------- --------- .f9

84 - --------------------------------------------------- - ---------------------------------- I U G 44 411 47 'll 49 50 61 52 113 M 55 li6 57 liS 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 711 80 81 82 83 M 8li

-------------------------------------------------- - - ----------------------- ---------- I 113 68 76 36 48 60 2 6 12 20 30 U M 64 72 78 82 17 27 39 51 61 4 8 14 ZI 32 « 116 66 74 80 M 9 16 23 33 45 57 67 76 81 49 37

F

il

'I:1

I

~1

l

,

.

?

•

4O-B 32UlIll--41 (Facep 82)
I

83

r---

1

2 3 4

5 6 7 8 9

-- 10 11 12 13 14 15 16 ------

17 18 19 20 21 22 23 24 25 ----------

26 27 28 29 30 31 32 33 34 35 36

E: ------------------ 38 39 40 41 42 43 44 45 46 47 48

50 51 52 53 54 55 56 57 58 59 60

---------f-------- 61 62 63 64 65 66 67 68 69 ------ 70 71 72 73 74 75 76 1-00- ------ 77 78 79 80 81 --r--

82 83 84

85

I--

FIOllBJ:4~A.

g. The recovery of the transposition key (for the columns of figure 42-A) is now a simple

matter. Referring to the P--+C sequence shown in figure 4o-B, and noting the various columns

in figure 42-A in which successive numbers of the P--+C sequence fall, the key number 1 of the

transposition key obviously applies to the column containing P--+C sequence numbers 26-38-50;

the key number 2 obviously applies to the column containing P-+C sequence numbers 1-3-7-13-

21-31-43-55-65-73-79-83-85; and so on. The complete transposition key and the matrix are

shown in figure 42-B. .

;-;i :~~

l :

\'

I'

I:

1

-j

'j

1,

,r
111111 I 1 11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111

1 • ,•• ,

.

Paragraph Revolving grilles ._ 31

Solution of examp1e_____ __ _ ___ ___ __ 32

Concluding remarks on the solution of revolving grilles • • . ._.__.__ 33

Indefinite or continuous grilles . ._.__.. • .________ 34

31. Revolving grilles.-a. In this type of grille 1 apertures are distributed among the cells

of a square sheet of cross-section paper in such a manner that when the grille is placed upon a

grid (a sheet of cross-section paper of the same size as the grille) certain cells of the grid are disclosed; then when the grille is turned three times successively through angles of 90° from an

initial position upon the grid, all the remaining undisclosed grid cells (or all but the central

grid cell) are disclosed in turn. Correspondents must, of course, possessidentical grilles and they

must have an understanding as to its initial position and direction of rotation, clockwise or

counterclockwise. There are two procedures possible in using such a grille. (1) The letters of

the plain text may be inscribed successively in the grid cells through the apertures of the grille;

when the grid has been completely filled the grille is removed and the letters transcribed from

the grid according to a prearranged route. (2) All the letters of the plain text may first be

inscribed in the grid cells according to a prearranged route and then the grille applied to the

completely-filled grid to give the sequence of letters forming the cryptogram. The two methods

of using the grille arc reciprocal; if the first-described method is used to encipher a message, the

second is used to decipher the cryptogram, and vice versa. The first of the two above-described

methods, the one in which the plain text is inscribed through the apertures, will here be referred

to as the alpha method; the second method will be referred to as the betamethod.

b. The number of letters in a cryptogram enciphered by such a device is either a perfect

square, when the grille has an even number of cells per side, or is 1 less than a perfect square,

when the grille has an odd number of cells per side, in which case the central cell of the grid is

not disclosed and hence remains unfilled.2

c. The manner of construction and the method of use of a grille entails certain consequences

which can be employed to solve the cryptograms and to reconstruct the grille itself. The student

who wishes to get a thorough grasp of the underlying principles to be explained will do well to

prepare a grille 3 and study the properties which characterize cryptograms produced by its use.

Three principles will be brought to bear in the solution, of grille ciphers of this type and they

will be demonstrated by reference to the grille and message shown in figure 43.

1 See Special Text No. 166, Advanced Military Cryptography, sec. V.

I Of course, the cryptogram may consist of the letters produced by several applications of the same grille.

For example, if a message of 170 letters is to be enciphered by a grille accommodating only 36lctters at a time,

the message is divided up into 5 sections of 36 letters each (10 nulls being added to make the total a multiple of

36). The total number of letters (180) here shows no properties of the type noted. Again, if the grille has a

capacity greater than the number of letters to be enciphered, certain of the grid cells may be cancelled, so that

the number of letters in the final cryptogram will not be a perfect square or 1 less than a perfect square.

r. I Detailed instructions for the construction of revolving grilles will be found in Special Text No. 166, Advanced Military Cryptography, sec. V.

SECTION VII

SOLUTION OF GRILLES

'.I

,I

h. The solution of the incomplete section of the message (the last 79 letters) now becomes a

simple matter, since the matrix and the transposition key are both known. The matter can be

handled as if simple transposition were involved, by outlining the matrix to contain exactly 79

letters and inscribing the cipher text in the columns in key-number order.

i. The foregoing principles and procedure will be found quite valuable not only in facilitating the ansgramming of the text in its initial stages (as in subparagraph d) but also in reconstructing various types of matrices based upon symmetrical designs used with single transposition (subperagraphs e-g). It should be noted that the number of leoels in the reconstruction

diagram corresponds with the number of different-length columns in the matrix; the number of

different categorU8 of term numbers (es in figure 41) corresponds with the number of columns

in the matrix.

: .

84

13 1 9 3 4 8 2' 10 11 6 5 7 12 Vi.~,

~.~;

.J};

' ..-

2 3 4

5 6 7 8 9

11 12 13 14 15' 16

19 20 21 22 23 24

29 30 31 32 33 34

41 42 43 44 45 46

53 54 55 56 57 58

63 64 65 66 67 68 69

71 72 73 74 75 76

77 78 79 80 81

82 83 84

IiI' 85 , i

i i

I FIGURE 42-B.

(85)

: : ,

.:,

i_

L

"t:." . , :f:·

; . '.

'-,'lI~.'

.- .

'~'I"l;" II '

J' ;-
"!I~' h

in !~

ij

1:L-

: :- i i~ ...

I ,;;.

.i.~;

1·

I -

',; ii

:J ~- ':n 1= tI :-

!I:;

!i I

Jr

.;~

"~

;1 !

I ;

; !

. j

" .j'

:1:

1

; !l!

; , , ,

.; iI

'! iI

i I

il L

~~ r :1 if i If

I

1:1

I ••••••••••••••••••••••••••••••••••••••••••••••

b

F

c

POSITION 4

0 U C

1 2 a 4 /I 6 7 8 ,--- - - - - - 1-

9 10 11 12 18 14. 111 16

f--- - - - - - - - H A N

17 18 19 20 21. 22 28 :H

f--- - - - - - - 1-

G E

211 26 27 28 211 ao 31 32

f-- - - - - - - IT H E

33 34 35 36 37 38 811 4.0

I-- - - - - - -

41 4.2 .. 44 411 4.6 4.7 48 I-

.. - - 0 U

• /12 lIS 114 6/l 116

l- IT E

/17 118 /ill 60 61 62 63 64

87

E

p

'I ..

FINAL GBID

CBYP1'OGBA.1I

0 0 M Y U C H 0

1 2 3 4 /I 6 7 8

f--- - - - - I-- 1-

M U E L A R N L

9 10 11 12 18 14. 1/1 16

f--- - - - I---- - lF H A I R L N E

17 18 19 20 21 22 28 24

I-- - - - - - 1-

R I D N P G E 0

2& 26 27 28 211 30 31 32

I-- - - - - - IT S T H E E Q E

33 at 3/1 86 87 88 811 4.0

f--- - - - - - - IS C U T 0 U T T

4.1 4.2 48 44. 4/1 411 4.7 48

f--- - - - - - - 1-

H R E 0 I S S U

• 10 III Il2 /l8 114 /1/1 /l6

f--- - - - T C B Y Y T E S

/17 118 /19 60 61 62 63 64

d

..

POSITION 3

H

1 2 3 4. /I 6 7 8

I--- - - - - - IE L L

9 10 11 12 18 14. 16 16

I--- - - - - - - F I R E

17 18 111 20 21 22 28 :H

I--- - - - - - - R

211 26 27 28 211 ao a1 32

I--- - - - - - - E Q

88 at a/l 86 87 88 811 4.0

I--- - - - - - - U

4.1 42 a " 4./1 4G 47 411

I--- I-- - !-- - E S

• /10 /11 /12 &8 114 /l/l 116

I--- - - - - - IT y.

/17 118 /ill 60 61 62 63 64

o

q

OOMYU CHOMU ELARN LFHAI RLNER IDNPG

EOTST HEEQE SCUTO UTTHR EOISS UTCBY

Y T E S

D

-_._-- ------_._..._._------------------- . -_........

c

•

A

c

POSITION 2

0 M

1 2 a 4. /I 6 7 8 f-- - - - - - 1-

M A N

II 10 11 12 18 14. 1/1 16 I-- - - - - 1-

17 18 19 20 21 22 28 :H - - - - - - - 1-

D P 0

26 26 27 28 211 30 81 82

I-- - - - - IS T

88 at 8Il 86 87 88 811 40 I-- - - - 1-- I--

C U T

4.1 42 a " 411 4.6 4.7 48 - - - - - 1--.- -

• 10 /11 /12 /13 114 Il/l /16 - - - - - - - B Y S

/17 /18 /19 60 61 62 63 64

J'lGuua

b

b

e

1 2 345 6 7 8

d

a

MESSAGE

86

1

2

3

4

s

6

7

8

POSITION 1

Grille: 8X8.

_2_1_3_1-1

0

1 6 6 7 8 l- IU R

II 10 11 12 18 14. 1/1 16 I---- - -- L

17 18 111 20 21 22 28 :H I--- II N

211 26 27 28 211 30 a1 32 I--- IE

88 at 8Il 86 37 88 811 4.0 I--- IS T 0 T

41 42 a " 4.Il 4.6 4.7 a >--- - - 1-

H I S

• 10 /11 /12 &8 M /1/1 116 I--- - 1- C

/17 118 /III 60 61 62 oa M

a

d

B

YOUR LINES TO THIS· COMMAND POST CUT BY SHELL FIRE REQUEST YOU CHANGE

THE ROUTE.

1.---

1 , ,

\

\

d. The:first principle may be termed that of symmetry. When a revolving grille is in position

1 a certain number of cells of the underlying grid are disclosed (uncovered). For each such

disclosed cell of the grid there is a symmetrically-eonesponding cell on the same grid which is

disclosed when the grille is turned to positions 2, 3, and 4, because the apertures of the grille

remain fixed-only their positions change as the grille is turned in the process of encipherment.

Now two 8UCCe8ftt76 aperturesin position 1will, ofcourse,be occupiedby a plain-text digraph (alpha

method of encipherment). When the grille reaches position 3, after a turn of 180°, the two

. t- o '

.i .i

't .j

._------------------_.. _--------
band of the grille are marked so that they cannot become apertures. The result is shown in

figure 45-B. Conforming to the principle of sequence, the U to be combined with tho Q is

sought to the right of the Q in figure 43-F. There are three candidates, in positions 43, 46, and

56.· They yield:

i

r

! .-

, .

i;

; :

I,:,,:

.'

;'~

I

:j . , , ; i

r:

1

·:,

. , .. I

Ulf

FIOUU 41l-B.

t F; g ". g 9 L 1 - - - - X- - - L 1 F; g g t F;

.-

9 S t F; g t F; g

- X- - - - - - g g t t t s - "

" g F; t t s S

e--- 1-

s F; t s t 1 g 9

- - - )<:- --- Z t S S t t L

e---

t L 9 S B"T-z " t

1

2

3

4

5

6

7

8

89

FIOUU 46-A.

1 2 I 3 4 5 6 7 1

- - - - 7 1 2 3 4 5 1 2

- - - - 6 5 1 2 3 1 2 3

- - - - 5 4 3 1 1 2 3 4

- - e---

4 3 2 1 1 3 4 5

e---

3 2 1 3 2 1 5 6

- - - - - - - e---

2 1 5 4 3 2 1 7

f-- - 1 7 6 5 4 3 2 1

1

2

3

4

5

6

7

8

Thesecond principlemaybe termed that of eulurion.. On accountof the system upon which

the construction of a revolving grille is based, a knowledge of the location of an aperture in one

of the bands brings with it a knowledge of 3 other locations in which there can be no apertures.

For example, referring to A in figure 43, the presence of the aperture at coordinates 1-4 precludes

the presence of apertures at coordinates 4-8,8-5, and 5-1. By virtue of this principle of exclusion, the number of possibilities for choice of letters in solving a cryptogram prepared by means

of a revolving grille becomes much reduced and the problem is correspondingly simplifled, as

will be seen presently.

. . J. The third principle may be termed that of 8equence. When trying to build up text, the

letters which follow a given sequence of plain-text letters will usually be found to the right and

below, that is, if the normal method of writing was used (left to right and from the top downward). For example, referring to figure 44, if the trigraph QUE is to be built up, neither the U

in position 5 nor the Uin position 10 is very likely to be the one that follows the Qithe Uin position

43 is the most likely eandidato because it is the first one beyond the Q. Suppose the Uin position

43 is selected. Then the E for QUE cannot be the one in position 40, or in any position in front

of 40", since the E must be beyond the U in the diagram.

g. In solving a grille, it will be found advisable to prepare a piece of erose-section paper of

proper size for the grille and to cut each aperture as soon as its location in the grille becomes

quite definite. In this way not only will the problem be simplified but also when completed the

proper grille is at hand.

32. Solution ofeumple.-a. Suppose the cryptogram shown in figure 43 is to be solved. It

has 64 letters, suggosting a grille 8X8. The cryptogram is first transcribed into a square 8X8,

yielding what has already been obtained at F in figure 43. The Qin position 39 suggests that it

is part of a word inscribed when the grille was in position 3, since there willbe 16 plain-text letters

inscribed at each position of the grille. Then a piece of cross-section paper is prepared for

making the grille as shown in figure 45-A, and an aperture is cut in the proper position to disclose, in position 3, cell 39. It will be found that this is the aperture located at coordinates 4-2

of the grille shown in figure 45-A. At the same time the other 3 cells numbered 4 in the second

1:184 Ii 678 1:1 8 eli 678

J

,,------

t r

l,.,i'"

"

1 8 5 25 11 23 19 22

64 57 60 40 54 42 46 43

2 16 6 17 12 31 20 30

63 49 59 48 53 34 45 35

3 24 7 9 13 26 21 27

62 41 58 56 52 39 44 38

4 32 10 15· 14 18 28 29

61 33 55 50 51 47 37 36

:nou•• ca.

·.KUH~M"~UftO«~~~.~~np~MNM~~~~n~gM

TSTHEEQESCUTOUTTHREOISSUTCBYYTES

OEGPNDIRENLRIAHFLNRALEUMOHCUYMOO

Flouu«.

apertures concerned will disclose two cells which will also be occupied by aplain-text digraph,

butthe letter8 composing the digraph tvill be in.rever8e order in.the IJlain. te:&t. This property is true

also of two 8UCCe88ifJe apertures in position 2 when they turn up in position 4. Let the student

verify this by means of the grille which he has constructed. Thus, referring to figure 43, at A

is shown the grille in position 1. In the first row are shown 2 apertures, at coordinates 1-4 and

1-8. At B are shown the results of the first application of the grille to the grid. Note the letters

Y 0 (first 2 letters of message) in cells 4 and 8. Now note that the symmetrically-corresponding

cells disclosed when the grille is in position 3 are cells 57 and 61 and these correspond to cells 4

and 8 in the reverse order. The letter T in cell 57 therefore symmetrically corresponds with

letter 0 in cell 8; the letter Yin cell Bl corresponds with letter Yin cell 4. The same is true of all

other lettersin positions 1 and 3. As a consequence of this property of grilles, 0.single cryptogram

can be handled as though it were really two cryptograms of identicollength having certain

characteristics by means of which an assumption made in ono text may be verified by what it

yields in the other text. That is, when the cryptogram is transcribed as a series of letters in one

line and the same text is written in another line under these letters but in reversed order, then the

superimposed letters will bear the symmetrical relationship pointed out in this paragraph. If

two letters in the upper line of such a transcription are taken to form a digraph, the two corresponding Iottors in the lower line must form a digraph but in reversed order in tho plain text.

For example, if the cryptogram of figure 43 is written out as explained above, tho result is as

shown at figure 44. Now the presence of the Q in position 39 suggests that it be combined with

128 4 5 6 7 8 9 ro II aD" U U U U m m • u • • • M m a

OOMYUCHOMUELARNLFHAIRLNERIDNPGEO

SETYYBCTUSSIOERHTTUOTUCSEQEEHTST

a U. If the U in position 43 is taken, then the symmetrical digraph corresponding to Q U would

be L I; if the Uin position 56 is taken, the symmetrically-corresponding digraph would be MI.

Furthermore, two apertures which are in the same column and 'Which do n.ot MfJe an. in.terf1ening

aperl:ure between. them, will yield a good digraph in all 4 positions of the grille. For example, note

apertures 2-6 and 3-6 at A in figure 43. "\\-nen the grille is turned to positions 2,3, and 4 they will

disclose two sequent letters in each case. An analysis of the symmetries produced by an 8X8

grille yields the following table, which shows what cells are disclosed in the other 3 positions when

an aperture is cut in anyone cell in 1 of the 4 positions of tile grille. For example, an aperture

cut in cell 11 (position 1) will disclose grid-ce1l23 when the grille takes position 2, grid-ce1l54 when

the grille takes position 3, and grid-ce1l42 when the grille takes position 4.

Po8ItioDl: 1-8 H 1-8 H 1-8 2-4 1-8 H

i

II

,

I

I,

II·

i

!

I ••••••••••••••••••••••••••••••••••••••••••••••
FinCKE 45-<:'.

(Orille I" 1""iUon :1)

b. Enough has been shown of the procedure to make further demonstration unnecessary.

Given the sequence OUR LI one begins to build on that, assuming a word such as LINE. Thi~

yields possibilities for the placement of additional apertures in the grille; these are tested in

positions 2,3,4, and so on. When any 16 consecutive letters of plain text have been established

all apertures have been ascertained and the problem has been completed. Subsequent cryptograms prepared by the same grille can be read at once.

91

c. If attempts at solution on the basis of the alpha method of using a grille have failed, the

obvious modifications in procedure on the basis of the beta method can readily be made.

ss. Concluding remarks on the solution of revolving grilles.-a. There is nothing about the

mechanics of revolving grilles which prevents their employment in enciphering complete words

instead of individual letters. However, the assembling of whole words in intelligible sequences

and thus the reconstruction of the original plain text is a much easier matter than assembling

single letters to form the words of the original plain text.. ..

b. In case the same grille has been employed several times WIth separate grids to encipher a

message that is considerably longer than a single grid will accommodate (see footnote 2, par. 31b),

the several sections each representing the set of letters enciphered on one grid may be superimposed and the general solution described in paragraph 26 may then be ~pplied.

c. In case the capacity of a grille is in excess of the number required by the length of the

text to be enciphered, either of two procedures may be agreed upon. The grid cells which would

otherwise be unoccupied may be filled by nulls, or the grid may be left incomplete. As regards

the former procedure, little more need be said than that the presenc~ of a few nulls will only

delay solution a bit until the fact that nulls are being employed for this purpose becomes established. But the second type of procedure calls for more comment. If the grid is to be left

incomplete it is necessary, before applying tho grille, to count the number of plain-text letters

and to cancel from the grid a number of cells equal to the number of cells ill excess of the

total number required. The position of the cells to be cancelled must be agreed upon: commonly,

they are those at the end of the grid. Such cells are marked so that when they bec?me expos~d

during the rotations of the grille they will nut he used. Thus, for eXQl~lple, the grill~ shown ill

figure 43-A is intended for a grid of 64 letters; if the message to be enciphered contam.s onl~ 53

letters, 12 cells of the grid must be canceled, and by agreement they may be cells 53.to 64,inclusive.

The solution of a single cryptogram of this sort, or even of several of them of different lengths,

may become a rather difficult matter. First of all, clues as to the dimensions of the grille are no

longer afforded by the total number of letters i~ the cr:vptogra~, so that.this ~form~tion can

be obtained only by more or less laborious experimentation. Grilles of vanous dimensions must

be assumed, one after the other, until the correct dimensions have been found. the second

place the symmetrical relationships pointed out in paragraph 31 no longer obtain, so that a

singl~ cryptogram cannot be handled as though it were constituted of two messages of identical

length. Of course, in trying out any assumed dimensions, the 64 letters of the cryptogram may

be written out in two superimposed lines, blanks being left for those positions which are unfilled.

The procedure then follows the normal lines. Ab.out the most h.op.eful clues wou~d be obt~ined

from a knowledge of the circumstances surroundmg the transmission and affording a baSIS for

the assumption of probable words. However, were such a syste~ em~loyed for regular communication there would undoubtedly be cases of cryptograms of identical lengths, so that the

type of solution given in paragraph 26 will be applicable. Once a solution of this sort has been

obtained the dimensions of the grille may be ascertained. Subsequent cryptograms may then

be attacked on the basis of the normal procedure, with such modifications as are indicated by

the absence of the number of letters needed to make a completely-filled grid .

S4. Indefinite or continuous grilles.-a. In his Manual of Cryptography, Sacco illustrates

a type of grille which he has devised and which has elements ?f practical importance. An example of such a grille is shown in figure 46. This grille contams 20 columns of cells, and each

column contains 5 apertures distributed at random in the column. There are therefore 100

apertures in all, and this is the maximum number of letters which may 1;>e encip~ered in one position of the grille. The plain text is inscribed 'Vertically, from left to nght, usmg only as ma~y

columns as may be necessary to inscribe the complete message. A 25-letter message would require

.",;.;

.~.•

39 56 63

QUE

I M 0

(=0 M I)

39 46 63

QUE

I A 0

(=0' A I)

90

CGrl11e In position 3)

39 46

39 46 61

QUE

I A R

(=R A I)

39 43 63

QUE

I L 0

(=0 L I)

39 41

39 43 51

QUE

I L R

(=R L I)

None of the symmetrical correspondents of the QUE's are impossible sequences in plain text,

although 0 A I is not as probable as the others. (The 0 could be the end of a word, the AI

the beginning of the word AID, AIM, AIR, etc.) Each of these possibilities would be tested by

principle 2 to see if any conflicts would arise as to the positions of apertures. As in all cases of

transposition ciphers, the most difficult part of the solution is that of forcing an entering wedge

into the structure and getting a good start; when this has been done the rest is easy. Note what

the results are when the proper apertures are assumed for QUEST in this case, as shown in figure

45-C. In position 1 this yields OUR LI ...; in position 2 it yields two digraphs AN and UTi

in position 4 it yields two digraphs H A and R O. TIll' student should note that the indicated

digraphs A Nand R 0 in positions 2 and 4, respectively, are certain despite the fact that there is

a space between the two apertures disclosing these letters, for the principle of exclusion has permitted the crossing off of this cell as a possibility for an aperturc.

1 !I £ It; g :1 9 Il i 1 ______1 •• _

_1.:IX~i.~!-~!X!XI~ 9 XIX!~!£IX!~iE gl'-;-IEf-l-i-~I;~"-E-it !: I I

--;-I-E-I i-~-- :-l-i-E-iQQlg -'------1-1

-

1

- - - - - ---- - E ~0IEI~IXIX!9

zXI~I-;-iElzI0l ~191_g_1__;_I-E-I~- -1- .., I I I ;

Q U Q U Q U

I L(=L I p ) I A(=A I p ) I M(=M I p )

All of the symmetrical correspondents of these 3 Q U's are good digraphs and it is impossible to

eliminate any of the three possibilities. The Uin position 43 would place an aperture at coordinates 6-3 in figure 45-B; the Uin position 46 would place an aperture at coordinates 6-6; and the

Uin position 56 would place an aperture at coordinates 7-8. All of these are possible, none being

excluded by principle 2. Suppose the Q U is followed by E. There are only two possibilities:

an Ein cell 51 and E in cell 63. The following possibilities are presented:

i

; :

i

;
92

but 5 columns. To form the cryptogram the letters are transcribed horizontally from the rows,

taking the letters from left to right as they appear in the apertures. If the total number of

letters is not a multiple of 5, sufficient nulls arc added to make it so. In decryptographing, the

total number of letters is divided by 5, this giving the number of columns employed. The cipher

text is inscribed from left to right and top downwards in the apertures in the rows of the indicated

number of columns and the plain text then reappears in the apertures in the columns, reading

downward and from left to right. (It is, of course, not essential that nulls be added in encipherment to make the length of the cryptogram an exact multiple of 5, for the matter can readily

be handled even if this is not done. In decipherment the total number of letters divided by 5

FIGURE 46.

will give the number of complete columns; the remainder left over from the division will give

the number of cells occupied by letters in the last column on the right.)

b. Such a grille can assume 4 positions, two obverse and two reverse. Arrangements must

be made in advance as to the sequence in which the various positions will be employed.

c. The solution of a single cryptogram enciphered by one and only one position of such a

grille presents a practically hopeless problem, for the apertures being distributed at random

throughout the grille there is nothing which may be seized upon as a guide to the reconstruction

of either the grille or the plain text. It is conceivable, of course, that a person with an infinite

amount of patience could produce an intelligible text and a grille conformable to that text, the

grille having a definite number of columns and a fixed number of apertures distributed at random

throughout the columns. But there would be no way of proving that the plain text so obtained

is the actual plain text that was enciphered; for it would be possible to produce several "solutions"

of the same character, anyone of which might be correct.'

d. However, suppose a grille of this sort were employed to encipher a long message, requiring

two or more applications of the grille. For example, in the case of the grille shown in figure 46,

having a capacity of 100 letters pel' application, suppose a message of 400 letters were to be

enciphered, requiring two obverse and two reverse applications of the grille. It is obvious that

symmetrical relationships of the nature of those pointed out in paragraph 31 can be established.

Of course, if the grille is used several times in the same position to its full capacity, producing

cryptograms ofmultiples of 100 letters, then the sections of 100 letters may be superimposed and

the general solution elucidated in paragraph 26 applied.

4 In this connection, see Military Cryptanalysis, Part In, sec. XI, footnote 8.

Ii

I

I l."

,

i

93

e. If the grille shown in figure 46 were used to encipher two messages, one of 80 letters, the

other of 85, it would be possible to solve these messages. For by eliminating 5 letters from the

longer message, the two cryptograms can be superimposed and handled as in paragraph 26. The

difficulty would be in finding the 5 extra letters. Of course, if it should happen that one of the

messages required 3 or 4 nulls and letters such as J, X, or Z were employed for this purpose, the

nulls would be likely characters for elimination. But regardless of this, even if letters of medium

or high frequency were used as nulls, patient experimentation would ultimately lead to solution.

The latter, it must be conceded, would be difficult but not impossible.

3241Cili-41-T
; i.

,

I:

SECTION VIII

COMBINED SUBSTITUTION·TRANSPOSITION SYSTEMS

Paragraph

Reasons for combining transposition with substitution . .______________ 35

Other types of combined substitution-transposition 8)stclIlH.._____________________________________________________________ 36

35. Reasons for combining transposition with substitution.-a. Transposition methods are,

from the cryptographic point of view, rather highly regarded because they are, as "hand methods"

go, rather rapid in operation and usually quite simple. However, from their very nature they

entail the disadvantage that a single-letter omission or addition may render their decryptographing difficult if not impossible for the average cryptographic clerk. But from the standpoint of

modern cryptography the principal disadvantage of transposition methods is that they can be

mechanized only with great difficulty-certainly with greater difficulty than is the case of sub.

stitution methods. Only one or two attempts have been made to produce machinery for effecting

transposition, and these have not been successful.

b. Pure transposition, that is, transposition by itself, without an accompanying substitution

or other means of disguise for the letters of the plain text, hardly affords sufficient guarantees for

cryptographic security in the case of a voluminous correspondence which must be kept really

secret for any length of time. For no matter how complex the method, or how many transpositions may be applied to the letters of a single message, sight must never be lost of the fact

that when there are manymessages in the same key there are bound to be two or more of identical

length; and when this is the case the type of solution described in paragraph 26 may be applied

to these cryptograms, the transposition keys recovered, and then all other messages in the same

key translated.

c. A message may undergo monoalphabetic substitution and the resulting text passed through

a simple transposition. When this is the case a uniliteral frequency distribution will, of course,

exhibit all the characteristics of monoalphabeticity, yet the cryptogram will resist all attempts

at solution according to straightforward simple substitution principles. It is usually not difficult

to detect that a transposition is involved because there will not only be long strings of lowfrequency letters or high-frequency letters but what is more important, there will be very few or

no repetitions oj digraphs, trigraphs, and tetragraphs, since these will be broken up by the transpoBition. When a uniliteral'distribution presents all the external evidences of monoalphabeticity

and yet there are no repetitions, it is almost a positive indication of the presence of transposition

superimposed upon the substitution, or vice versa. (The former is usually the case.)

d. When confronted with such a situation the cryptanalyst usually proceeds by stages,

first eliminating the transposition and then solving the substitution. It is of course obvious

that the general solution for transposition ciphers (cryptograms of identical length in the same

key) will not be applicable here, for the reason that such a solution is based upon anagramming,

which in turn is guided by the disclosure of good digraphs, trigraphs, and polygraphs. Since the

letters of a combined substitution-transposition cipher are no longer the same as the original

plain-text letters, simple anagrariuning of columns formed by superimposing identical-length

(94)

..... ...-i.-..

95

cryptograms can yield no results, because there is nothing of the nature of plain text to guide the

cryptanalyst in his juxtaposition of columns.'

e. Of course if it should happen that the substitution process involves known alphabets,

the cryptanalyst'can remove the effects of the substitutive ?ro~ess before proceeding to el~­ inate the transposition, even if in the encipherment the substitution came first. For example, If

a standard cipher alphabet were employed for the substitution the uniliteral frequency distribution would give indications thereof and the cipher letters could immediately be converted

to the normal plain-text equivalents. The latter ma! then be studied as though merel! ~r~sposition had been applied. But if unknown mixed CIpher alphabets were employed, this initial

step can not be accomplished and a solution must usually wait upon the re~oval of .the tr~nsposition before the substitution can be attacked. The latter may be very difficult or impossible

where a good transposition method is used; where simple columnar transposition is used the

removal of the transposition can be effected if the message is long enough.

f. Of course if nothing is known about the s!stem ?f transposition that ~a.s b~en employed,

there is hardly anything to do but experiment WIth varIOUS types of transposition in an attempt

to bring about such an arrangement of the text as will show repetitions. If this can be done,

then the problem can be solved. For example~ suppose that a messa~e ha~ been .en?iphered by a

single mixed cipher alphabet and the substitution text has then ~een ~scnbed within a re~tangle

of certain dimensions according to one of the usual routes mentioned m paragraph 5 of this text.

Repetitions in the plain text will of course be preserved in the substitution t~t ~ut will be

destroyed after the transposition has been applied: The cryptanaly~t~ however, m hi.s attempts

to eliminate the transposition, may experiment WIth route transpositiona of the various ~ypes,

employing rectangles of various dimensions as suggeste~ by th~ total n~mber of letters m the

cryptogram. If he perseveres, he will find one route ~hICh he will know IS correct as ~oon as he

tries it because it will disclose the repetitions in the platn text, although the latter are still covered

by a substitution. . ., .. g. Practically all the methods of transposition which may be applied to plain text may also

be applied to a text resulting from an initial transforma~ion by su?~titution. As already t;n~ntioned, route transposition may be used; reversed and rail-fence writing, columnar.transposition

with or without keying and with complete or incomplete rectangles are also possible". FI:0m.80

practical standpoint, keyed-columnar transposl~lOn. apphed to mo~oalphabetl~ s~bst~tutlon IS

not only a popular but also a fairly secure combination bec~use in this case the ehmmatIOn?f the

transposition is a rather difficult matter. If the rectangle IS completely filled th~ probl?m IS not

insurmountable in the case of a long message transposed by means of transposition With a rectangle of fairly small dimensions. For by assuming rectangles of various ~~ensions suggested

by the total number of letters, cutting the columns apart, and then combining column~ on the

basis of the number of repetitions produced within juxtaposed columns and between different

sets of juxtaposed columns, it is possible to reconstruct the rectangle and thus remove the transposition phase. This, however, is admittedly a slow and difficult process .even un~er the most

favorable conditions; and if the rectangle is incompletely filled the process IS very difficult. For

in the latter case the lack of absolutely clear-cut knowledge as to the lengths of the columns,.the

juxtaposition of columnar mat~rial become~ replete. with uncertainties and engenders feelings

of confusion, hopelessness, and inadequacy m the mind of the cryptanalyst. However, he need

1 It should, however, not be inferred that anagramming processes are entirely eX~luded in the cryptana~ysis

of all combined substitution-transposit.ion systems. In certain cases the Itna~ra~mm~ process may be ~U1ded

by considerations of frequency of letters or fragments of letters. A case of thls kind will be encountered 1Il the

solution of the ADFGVX cipher, par. 40.
(97)

SOLUTION OF THE ADFGVX SYSTEM

96

not be wholly in despair if he is confronted with 8 problem of this nature in war time when

many cryptograms become available for study. For there are special methods of solution suitable

to the occasion, created by special circumstances attendant upon the interception of a voluminous

traffic. .In s~bsequent paragra~hs the student will come to understand what is here meant by

the special oircumstances and will learn of these special solutions.

36. Other types of combined substitution-transposition systems.-a. There is no technical

obsta?le to the ap?lication of a transposition to the text resulting from any type of substitution,

even If the la~ter ~s polyalphab~tic ?r pol:ygraphic in nature. The obstacles, or rather objections,

to such combinations are practical in their chnraeter-they arc too complex for ordinary use and

the prevalence of errors ~akes them too difhcult. to handle, as a general rule. However, they

have been and are sometimes used even as field ciphers. For instance on the southeastern front

d~rin? th~ Worl~War, the Central Powers made use of a somewhat iIT~gular polyalphabetic substitution mvolvmg four standard alphabets and a keyed columnar transposition with incompletely-filled rectangles of.a relatively large number of columns. Nevertheless, messages in this

system were solved by taking advantage of the possibility of devising special solutions.

. b: A few remarks. ~ay be made in re~ard to the order in which the two processes, sub3tItut~on .and. transposition, are employed 1Il a combined system. It is clear that when the

substitution I~ m~noa.lphabetic it is immaterial, so far as cryptographic security is concerned,

wh?ther substitution ~s followed by transposition or vice versa, because the equivalent of each

plam-t~xt letter remams fl.:'ed regardl~ss ?f t~lC order in which the plain-text letters appear in

the plalI~ ~ext. However, If the substitution IS polyalphabetic in character it is better that the

transposltIo~ process precede the substitution process, and that the number of alphabets emplo:y~d b? different from the number of elements in the transposition key, if columnar transpOSItIOn IS the case. The best situation, from a cryptographic security standpoint is when

the two key lengths (substitution a~Id transposition) have no common factor. If the'two keys

are of the same length, the letters m each column are enciphered by the same cipher alphabet

and thus the cryptogram woul.d c~ntain a cert~in number of sections of approximately equal

length, composed of letters falling m the same CIpher alphabet.

. c. Digra~~ic subst~tution, such as that produced by the Playfair Cipher, may be combined

WIth tra~~positlOn to YIeld. cryptograms of fair security. But here again the elimination of the

transposition phase by .t~king a~vantag.e of.speci~ circumstances or by rearranging the 'Iext so

as to uncover .the repetIt~ons which are inevitable ill the Playfair Cipher, will result in solution.

d. A particularly f:UItfulsource of combined substitution-transposition is to be found in those

me~ods genera~y designated as frac~ionating systems, in which in the substitution phase each

plain-text letter IS replaced by an equivalent composed of two or more components or "Iractions"

and then these co~ponents are subjected to transposition in a second phase. This latter may be

followed by a third phase, recombination of distributed components and a fourth phase the

repla~em?nt of the reeo~bined components by letters. Thus, such a'system comprises a'first

substitution, a transposition, a :ecombination, and a second substitution." In the subsequent

paragra~hs certain systems of this sort will be dealt with in detail. They are interesting examples

of practical systems ~f eryptogr~phy which have been used in the field of military operations in

th~ past an~ may again be used.~ the future. The first one to be discussed is particularly interestmg for .thiS.reason alone; but It IS also of interest because it will serve as a model for the student

~o follow in Ius study of methods for the solution of combined substitution-transposition ciphers

ill gcneral.

aBee Special Text No. 166, Advanced Military Cryptography, sec. XI.

1,_,.·

\ .

.\

SECTION IX

Paragrapll

Introductory remarks ------------- 37

Special solu tion by means of identical endill~lL--------------------------------------------------------------.----------------38

Special solution by means of identical be~innings-----------------------------------------------------------------------------39

Special solution by the exact factor method --------------------.-----------.---- 40

General solution for the ADFGVX system .. . ------------ 41

Basic principles of the general solution . .. -.-.------------- 42

Illustration of solution.. . . .. . .--------- 43

37. Introductory remarks.--a. One of the most interesting and practical of the many

methods in which substitution and transposition are combined within a single system is that

known in the literature as the AOFGVX cipher.' In this system a 36-character bipartite substitution checkerboard is employed, in the cells of which the 26 letters of the alphabet and the 10

digits are distributed in mixed order, often according to some key word. The row and column

indicators (coordinates) are the letters AOFGVX, and, taken in pairs, the latter are used as substitutes for the letters of the plain text. These substitutive pairs are then inscribed within a rectangle and a columnar transposition takes place, according to a numerical key. The cipher text

consists then merely of the 6 letters A, 0, F, G, V,and X.

b. The AOFGVX cipher system was inaugurated on the Western Front by the German Army

on March 1, 1918, for communication between higher headquarters, principally between headquarters of divisions and corps. When first instituted on March 1, 1918, the checkerboard consisted of 25 cells, for a 25-letter German alphabet (J was omitted), and the 5 letters A, 0, F, G, and

Xused as coordinates. On June 1 the letter Vwas added, the checkerboard having been enlarged

to 36 cells, to take care of a 26-letter alphabet plus the 10 digits. Transposition keys ranged from

15 to 22 numbers, inclusive, and both the checkerboard and the transposition key were changed

daily. The number of messages in this system varied from 25 a day upon the inception of the

system to as many as 150 per day, during the last days of May 1918. The first solution was made

on April 6 by the French. The cipher continued in use rather extensively until late in June but

from that time until the Armistice the volume of messages diminished very considerably.

Although only 10 keys, covering a period of as many days were ever solved, the proportion of

solved messages in the whole intercepted traffic was about 50 percent. This was true because of

the fact that the keys solved were those for days on which the greatest number of messages was

intercepted. The same system was employed on the southeastern front from July 1918 to the

end of the war. Keys were in effect at first for a period of 2 days and beginning on September 1,

for a period of 3 days. In all 17 keys, covering a total of 44 days, were solved.

c. At the time that the Allied cryptanalytic offices were working with cryptograms in this

system only three methods were known for their solution and all three of them are classifia.ble

under the heading of special solutions, because certain conditions had to obtain before they

could be applied. No general solution had been developed until after hostilities had ceased."

I Special Text No. 166, A'Zvanred Military Cryptography, sec. XI.

a The general solution to be described in paragraphs 41-43 was not established until after the Armistice.

Bad it been elaborated earlier there would no doubt have been many more solutions than were actually effected

by the methods then available.
d. The delimitation and marking of identities between these two cryptograms is a procedure

similar to that explained in paragraph 24b, except that a little more study may be necessary in

this case because occasionally there may be considerable uncertainty as to exactly where an

identity begins or ends. The reason for this is not difficult to understand. Whereas in paragraph 24b the process involves "unfractionated" letters and there are about 18 or 20 different

letters to deal with, so that an "accidental identity" is a rather rare occurrence, in the present

problem the process involves fractions of letters (the components of the bipartite cipher equivalents), and there are only 6 different characters to deal with, so that such "accidental identities"

are quite frequent. Now the cryptanalyst is not able at first to distinguish between these accidental identities and actual identities and this is what makes the process somewhat difficult.

What is meant will become perfectly clear presently.

e. Taking the two illustrative cryptograms, the first step is to ascertain what identities

can be found between them, and then mark off these identities. For example, it is obvious that

if the messages end alike the last several letters in No.1 should be found somewhere in No.2,

and likewise the last several letters in No.2 should be found somewhere in No. 1. The number

of letters in identical sequences will depend upon the length of the identical text and the width

of the transposition rectangle. Searching through No.2 for a sequence such 88 A G D X, or

GO X, or at least DX, the tstragraph AGO Xis found as letters 151-54. The last column of No.2

ends with F GA Vi searching through No.1 for a sequence F GAV, or GAV, or at least AV, the

tetragraph F G A V is found as letters 87-90. These identities are underlined or marked off in

some fashion, and search is made for other identities. It would be a great help if the width of

the transposition rectangle were known, for then it would be possible to cut up the text into

lengths approximately corresponding to column lengths, and this would then restrict the search

for identical sequences to those sections which correspond to the bottoms of the columns, Suppose the key to contain 20 numbers. Then the rectangle for No.1, containing 152 letters,

would consist of 12 long columns of 8 letters and 8 short ones of 7 letters; that for No.2, containing 194 letters, would consist of 14 long columns of 10 letters and 6 short ones of 9 letters.

If that were correct then in No.1 the end of the first column would be either X V D D, or X V D.

Searching through No.2 for either of these a sequence XV0 0 is found as letters 84-7. Column

1 is probably a long column in No. 1. The word probably is used because the identity may

extend only over the letters XV0, and the next 0 may be an accidental similarity, since the chances

that D will appear by pure accident are 1 in 6, which is not at all improbable. It must also be

pointed out that a certain number of telegraphic errors may be expected, and since there are

99

No.2

To CG 23d Brigade:

6 10 15 20 2/1 30

F 0 F F F F V F A 0 o V F V 0 G A F 0 F o A GAO FOFAF

35 40 45 50 M 80

,< V A X G 0 V X G F X V X D X V, A A A A D G X F F 0 VFAAG s~'

65 70 75 80 85 90

.,:

V G V F F FDA F F FXOAF X G A F D V F V X V DOFAO

95 100 105 110 115 120

D A A A X A A F F A FVFXF FAXXA ADVXA VDAVF

)1".

~f~ . 126 180 136 140 146 150 .~~ ...

,.,.., D F A V X V A 0 X F A X F F X X A A V X X A O·X A AAVVG

1M 100 165 170 115 180

AGO X X F 0 F A X FOG 0 F F X D G X FAG 0 F F 0 D V 0

185 100

n X 0 A F A G X X A F G A V

"." .~.

.\

I

i

-':,

Bec~use the~ are int~resting and ~eful some attention willbe devoted to both the general and the

s~eCIal solutions. SillC~ the special solutions are easy to understand and serve as a good introduction to the general solution, they will be taken up first.

38. Spec~al solution by means ofidentical endings.-a. In paragraph 24it Was demonstrated

how th~ solution of keyed-columnar transposition ciphers can be facilitated and simplified by the

com~ans~n of two cryptogr~s which are in the same key and the plain-text endings of which

~e l~e~tlcal. It was noted ill that case that a study of the irregularly distributed cipher-text

identities between. the two cryptograms permits of not only cutting up the text into sections

that c~r~espond with the.l?ng and the short columns of the transposition rectangle but also of

estabhsh~g the trensposition key in a direct manner almost entirely mathematical in nature.

When this has been accomplished the plain texts of these two messages are at once disclosed and

all other messages in the same key may be read by means of the key so reconstructed. '

b. The same method of solution is applicable to the similar situation, if it can be found, in

the case of the AOFGVX system, except that one more step intervenes between the reconstruction

of the tr~nsposi~ion .rectangle and the appearance of the plain text in the rectangle: A monoalph~betlc s~bstltutlOn must be solved, since the text in the rows of the rectangle does not

consist of pla~-te~t letters. bu~ of pairs of components representing these letters as enciphered by

means of a ~lpart1te .SUbstltutIOn alphab?t. Moreover, this latter step is comparatively simple

~hen ~here IS a sufficient amount of text in the two rectangles; if not, additional material for use

ills?lvmg t~e monoalphabet ~~ be obtained from other cryptograms in the same key, if they are

availabl~, sl~ce t~e transp08ltIO~ key, having already been reconstructed from the two cryptogz:~ Wlt~ identical endings, will permit of inscribing all other cryptograms in the same key within their proper rectangles.

c. A demonstration of the application of the principles involved in such a solution will be

useful. The followingcryptograms have been intercepted on the same date, the 20th:

9S

i!

i

No.1

To CG 22d Brigade:

5 10 15 20 2G 30 XVAAX V 0 0 A G n A 0 V F AOAOA F X G F V X F A X A

35 40 46 00 65 80 XVAVF AVXAO G F F X F F GAG F n GOG 0 n G A F 0

66 70 16 80 86 90 AADDO XDAVG GAAOX AOFVF FOFXF G F G A V

I/Ij 100 106 110 1111 120

I:

AFAFX FFXFX F V 0 V X AFFGX AAAVA VAFAG

r

12/1 130 135 140 145 100 I ' n 0 FAG V F A 0 V F A V V X GVAAA FDFAX XFAAG , OX
No.1

6 10 16 20 :as 30

X V A A X V D D A G DADVF A DAD A F X G F V X F A X A

---- -.,.........

1 2 3 4

36 to 41i 50 /iii 60

X V A V F AVXAD G F F X F F GAG F D G D G D D G A F D

5 ----6 7 8

86 70 76 80 8Ii \lO

A ADD D XDAVG G A A 0 X A 0 F V F F D F X F G F G A V

9 ---- 10 11 12

l/6 lOll 1011 110 116 120

A F A F X F F X F X F V D V X A F F G X A A A V A V A FAG

13 14 ---- 15 16

126 130 1311 Ito lU 150

D D FAG V FAD V FAVVX G V A A A F D F A X XFAAG-...- 17 18 19

DX

-20

J'IOUBJI f7.

101

From these tables it follows that as regards message No.1 there can be a break after the 7th, 8th,

14th, 15th, 16th ... letters but not after the 6th letter, nor after the 9th to 14th letters, nor

after the 17th to 21st letters, and so on; as regards message No.2 there can be a break after the

9th, 10th, 18th, 19th, 20th, ... letters but not after the 8th letter nor after the 11th to 18th

letters, nor after the 21st to 27th letters, and so on. Referring again to the two VFAD sequences

in No.1 which may correspond with the VFAD sequence in No.2, it was found that the first

candidate would require a break immediately after the 17th letter. But the break table for No.1

precludes this possibility; hence the first VFAD sequence in No.1 in position 14-17 may be eliminated as a candidate, leaving the second VFAD, in position 126-130, as 8. candidate. This would

require a break after the 130th letter and reference to the break table for No.1 shows this to be a

possibility. Hence, the VFAD in position 126-130 in No. 1 will tentatively be accepted as

matching the VFAD sequence in No.2. Another section of the text of one or the other cryptogram is next selected, with a view to establishing additional identities. To go through the

whole process here would consume too much space and time. Moreover, it is not necessary,

for the only purpose in carrying the demonstration this far is to indicate to the student the

general procedure and to show him some of the difficulties he will encounter in the identification of the similar portions when the text is composed of only a very limited number of different

letters. In this case, after more or less tedious experimentation, the hypothesis of a key of 20

columns is established as correct, whereupon two sets of 20 identities are uncovered and the

identities are found to be as shown below.

\.

.S<'

.:~ '.

w··

[: .

";'1,

..a:..

\.*";-" ....., \ ....

0 8 16 24 32 40 48 56 64 72 80 88 96

f--- ----------------------I7 15 23 31 39 47 55 63 71 79 87 95 103

I---------------------------- 14 22 30 38 46 54 62 70 78 86 94 102 110 ,.....-- --------------- -------- 21 29 37 45 53 61 69 77 85 93 101 109 117 '------------------------- 28 36 44 52 60 68 76 84 92 100 108 116 124 - ----- ----------------I35 43 51 59 67 75 83 91 99 107 115 123 131

f-------------------------I42 50 58 66 74 82 90 98 106 114 122 130 138

f------------------------ 1-

49 57 65 78 81 89 97 105 113 121 129 137 145

f--- ----------------------I56 64 72 80 88 96 104 112 120 128 136 144 152

35

42

"Break" table for No.2 (194 letters)

21

"Break" table for No. 1 (152 letters)

14

7

28

100

o

o 8 16 24 32 40 48 56 64 72 80 88 96

56

49

o 10 20 30 40 50 60 70 80 90 100 110 120 130 140

0 10 20 30 40 50 60 70 80 90 100 110 120 130 140 --------------------------I9 19 29 39 49 59 69 79 89 99 109 119 129 139 149 - ------- ----- ------------I18 28 38 48 58 68 78 88 98 108 118 128 138 148 158 ------------------------:-

27 37 47 57 67 77 87 97 107 117 127 137 147 157 167 --------- -------------------- 36 46 56 66 76 86 96 106 116 126 136 146 156 166 176 ------------------- ---------- 45 55 65 75 85 95 105 115 125 135 145 155 165 175 185 --------- -------------------- 54 64 74 84 94 104 114 124 134 144 154 164 174 184 194

only 6 different letters the chances that an F, for example will be received or recorded as a D

are fairly good. Column 1 of No.2 ends either with VFA D'or V F A. Searching through No.1,

a seque~ce V FAD is found as letters 14-17; a sequence VF A is found as letters 34-6; a sequence

V F F 18 found as letters 79-82; a sequence V FAD is also found as letters 126-130; a sequence

V F A IS found as letters 130-2. Here are several possibilities; which is the one to choose? Two

of these possibilities coincide exactly with the full sequence being sought, V FAD. Can one of

them be eliminated as a possibility? Perhaps tables to facilitate the location of possible "breaks"

will be helpful in making the elimination (see paragraph 16n). "Break tables" are therefore

constructed for the messages on the basis of rectangles of 20 columns, and are as shown below.
102

No.2

8 10 18 20 211 30 F D F F F F V FAD D V F V D G A F D F D A GAD F D F A F

1 2 3

311 40 45 50 55 60 V A X G D -......--

V X G F X V X D X V A A A A D G X F F D V F A A G

4 ----5 6

65 70 75 80 311 90 V G V F F FDA F F F X D A F X G A F D . V F V X V D D FAD

7 8 9

95 100 105 110 115 120 D A A A X A A F F A F V F X F F A X X A A D V X A V D A V F - ---..-....

\. 10 11 12

1211 130 1311 140 145 150 D F A V X V A D X F A X F F X X A A V X X A D X A A A V V G

13 14 --15

155 160 165 170 175 180 A G D X X , F D F A X F D G D F F X D G X FAG D F F D D V D

16 i7 18

1815 190 D X D A F A G X X A F G A V

19 20

FIGl1RE 47-Contlnued

f. A table of equivalencies 3 is then drawn up:

No. L 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

No. 2 9 6 8 10 13 11 17 2 19 15 7 20 14 12 5 18 1 4 3 16

Since the rectangle for No.2 has 2 more letters in the last row than the rectangle for No.1,

two chains of equivalents at two intervals are constructed. Thus:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 10 16 17 18 19 20

1 9 19 3 8 2 6 11 7 17

4 10 15 5 13 14 12 20 16 18

These chains must now be united into a single chain by proper interlocking. Since cryptogram

No.1 has 12 long columns, and since the identities of these 12 columns are now known (I, 3,

5,7,9,12,13,14,16,17,19,20), the interlocking of the two chains and hence the transposition

key must be this:

1 2 3 4 5 6· 7 8 9 10 11 12 13 14 15 16 17 18 19 20

7 5 17 13 1 14 9 12 19 20 3 16 8 18 2 4 6 10 11 15

g. The two cryptograms may now be transcribed into their proper transposition matrices

as shown in figure 48. '

• It is necessary to remark that in setting up the table of equivalencies, after determining the width of the

rectangle, that message which has the lesser number of long columns is used as the basis for the normal sequence

1, 2, 3, • • •. If the one having the greater number of long columns is employed as the base the reconstructed

key will be reversed. '

)I:.

103

No.1 No.2

7817131 14 II 12 19 20 3 16 8 18246101110 7 8 17 13 1 14 9 12 19 20 3 U 8 2 4 61011 10

FXDAXFAFVXAVGVAFAVAF AFXVFVAFFFFAAFDFAFAX

GVFFVXAXAXDADFGVDGDF AXFDDAFAFADAFFVVDAFA

AAAAAFDFAFAVDADXGGFG GVDAFDDXDGAAFXFAGDFA

GVGFAVDGAADAGVAFFAVX VXFVFXVXDXGVFDVXXDAV

FFVXXDDFFAAFAVDAFAFA GDAFFFFAVXAVXGDGFAFX

DAFFVVXGDGFAFXVXXDFA VXXDFAVADADGDXGDFAVX

GVAFDXDAFDXGDGFAFXDA FVFFVXXDDFFAAFAVDAFA

DXDXDAAVAXGD FADAFFVVXGDGFAFXVXXD

FAGVAFDXDAFDXGDGFAFX

DADXDXDAAVAXGD FIGl1BB 48.

h. A frequency distribution is now made of all the bipartite pairs, so as to solve the enciphering checkerboard. There is no necessity for going through this part of the solution, for it falls

along quite normal lines of monoalphabetic substitution. The two plain-text rectangles are

shown in figure 49. The checkerboard 4 is found to be as shown in figure 50a.

No.1

7 8 17 13 1 )4 II 12 19 20 8 16 8 18 2 4 6 10 11 18

H A V E 0 R D E R E

F X D A X F A F VX A V GV A F A V A F

D C 0 M M A N D I N

G V F F VX AX AX D A D F G V D G D F

G G E N E R A L 2 3

AA AA A F D F A F A V D A D X G G F G

D B R I G A D E T 0

G V G F AV D G AA D A G V A F F A V X

C 0 U N T E R A T T

F F VX XD D F F A A F A V D A F A F A

A C K W I T H 0 U T

D A F F VV X G D G F A F X V X X D FA

D E L A Y W I T H A

G V A F DX D A F D XG D G F A F X D A

L L A R t4 S

DX DX DA A V AX GD FIOURE 49.

• Since the second cryptogram is addressed to the CG 23d Brigade and the first cryptogram mentions that

the commander of that brigade has been ordered to do so and so, the solution of the groups GG (....2) and FG

(....3) is made by inference. This gives the placement of these two digits in the cipher square.
No.1

V D 0 F A X F A A X o X G G F F V F X F G X D X G DGAGF

A G DAD V G G D A A A D X X D X A F F A A 0 A F OFFOA

No.2

G X 0 D A D D G D F V G X A X X X G X G A A A A 0 FAD D X

A V 0 X F XAO

No.3

XDAAA G X 0 D X V F F V D GAD F 0 X A A A G OFAOG

A FDA D G V G D V F D F X A G F X A F A F A X 0 ODD F 0

XAXVA o X F X F D GAG F G GAO 0 AGO G X AVGDG

A D A F A X F A A G V A A G A F D V D V D X F 0 A X F 0 F F

G D X D V DAD A V o ADO D GAD A G A A A F G G D X A X

F G V X 0 D G D D F A FAG V A F G X G V D 0 A X X 0 V F F

F FOX G V G D F G A V A D A X D A F A A FOG F VFXXX

A A GAG A FOG X A F A F X X G GAG A A F F A A F D G A

G A F V X D G G F G D A A A F n A DAD XVVAX FVADD

G A F F F GXAXO F 0 0 F X A A A A A

No.4

A F G F X A G X A G X D D A F AAXAV G D D D D FAFGV

DGOXA FOX A X G F GOO V A 0 X A X G F A X FOAOO

G 0

No.5

XAAAD n G A A G DDOXF F A V G A XOGGD FFAVA

DAAXA GDXDX XXXDG V FAD A D F F F F V V G F D

X FOG G DAXOG ADFD

105

(fig. 50b). The complete checkerboard may therefore be taken almost certainly to be as shown

in figure 50c. The date (20th) indicates that the transposition key will have 20 numbers in it.

The transposition key was evidently derived from the first 20 letters of the mixed sequence:

G E R MAN I L T Y C PHS B D F J K 0

7 5 n 13 1 H 9 20 3 8 18 2 4 6 m II U

39. Special solution by means of identical beginnings.-a. In paragraph 23 was demonstrated the method of solution based upon finding two cryptograms which are in the same key

and the plain texts of which begin with the same words. The application of this method to the

corresponding situation in the case of the AOFGVXsystem should by this time be obvious. The

finding of identical sequences is somewhat easier in this case than in the case of identical endings

because the identities can be found in parallel progression from the beginning to the end of the

two cryptograms being compared. Moreover, the discovery of two cryptograms with similar

beginnings is easier than that of two with similar endings because in the former case the very

first groups in the two cryptograms contain identities, whereas in the latter case the identities

are hidden and scattered throughout the texts of the two cryptograms. On the other hand, the

complete solution of a case of identical endings is very much more simple than that involving

identical beginnings because in the former case the establishment of the identities carries with it

almost automatically the complete reconstruction of the transposition key, whereas in the latter

this is far from true and additional cryptograms may be essential in order to accomplish this

sinequanonfor the solution.

b. The following represent 8 cryptograms of the same date, assumed to have been enciphered

by the same key.

FIGURB 5Oe.

G 6 E 5 R M

- - - - - - A ! N I 8 L - - - - - - T Y C 3 P H

- - - - - - 7 S B 2 D 4 - - - - - - F 6 J 0 K 0 - - VIW- - Q u X Z

FIGl1IlE SOb.

G E R M

- - - - - -

A N I L

- - - - - - T Y C 3 P H

- - - - - -

S B 2 D

- - - - - -

F K 0 - - - - - - (Q) U V W X (Z)

FIGURBliOIJ.

G E R M - - - - - - A N I L - - - - - -

T Y C 3 P H - - - - - -

S B 2 D F - - - - - -

K 0 - - - - - - U V W X

i. Speculating upon the disposition of the letters within the enciphering checkerboard, it

becomes evident that the key phrase upon which it is based is GERMAN MILITARY CIPHERS.

The fact that the digit 2 follows B and the digit 3 follows C suggests that the digits are inserted

immediately after the letters A, B, C, ..., as they occur in the mixed sequence. Note the cells

which still remain vacant after the key word mixed sequence is fully developed in the checkerboard, and all the letters which do occur in the two messages are inserted in their correct cells

j'

i

;

104

No.2

7 5 17 13· 1 14 9 12 19 20 3 16 8 18 2 4 6 10 11 15

E X P E C T E N E M

A F XV F V A F F F F A A F D F A F A X

M Y A T T A C K A T

A X F D D A F A F A D A F F V V D A F A

0 A Y L I G H T S T

G V o A F 0 D X o G A A F X F A G D F A

0 P H 0 L 0 Y 0 U R

V X F V F X V X D X G V F D V X X 0 A V

;

;

; S E C T 0 R W I T H

G 0 A F F F F A V X A V X G D G F A F X

0 U T F A I L S T 0

V X X 0 F A V A D A D G D X G 0 F A V X

p C 0 U N T E R A T

F V F F V X X D D F F A A F A V D A F A

T A C K W I T H 0 U

F A D A F F V V X G D G F A F X V X XD

T D E L A Y W I T H

F A G V A F D X D A F 0 X G D G F A F X

A L L A R M S

o A D X D X D A A V AX G D

FIGUBB 49-Contlnued.

2nd component

A D F G V X A D F G V X A D F G V X
FIGll'BJ: 51.

DG

107

FXXFD

XGGAA

X F D F F - 7

AAAFG GOXAX

ODD F D - 4

AGDGX AVGDG 5o X FDA

AAFFA AFDGA

13

DADAD XVVAX FVADD

VDDAX XDVFF

10

XDAFA AFDGF VFXXX

11

X G GAG

AAAAA

XFFFF AAXDA , FVDXG

GVDVD DOAGD GGDAA 5

VAGVA XAAGG XGXDD OADXF 6

A F G A X FFDVD OOAGA FADAV 8

FGDOF FDGDV DGGXA XAXOA 9 G FDA G

No.6

XVGDD AVGXA DXAAD 2

DFFDD FDDFX

DAGDG GAAAF OXAXA

14

VFAFF FGDDA DODFA GDF'AX

15

11

VAGAF OGDAV VODOD OFXGV

12

OFF A F

XAAAG OFADG 2

FDFXA GFXAF AFAXD 3

OGAGF GGADD

A D F F G D G FDA 7

DDOAV GAVAD

FOXAX GAXFF .

FGVXD DGDDF AFAGV 9

FFDXG VGDFG AVADA

ADAFA XFAAG VAAGA FDVDV 6

G D X0V DAD A V DAD D D G" A D A G8

A F G X G

4

GGFDD DVFFV

AFFAA FFFOV

13

VAXOA GADXD

AAGAG AFDGX AFAFX

12

GAFVX DGGFG DAAAF

14

GAFFF GXAXD FDDFX

15

DXDVF FXVAX

10

XFOAG AGAVD

XDAAV DXDGF 1

GDFDA AAGAX DVFDF 3

V D V A F

No.3

XDAAA GXDDX VFFVD GADFD 1

AFDAD GVGOV

XAXVA DXFXF -

106

No.6

XDAAV DXDGF XVGDD AVGXA DXAAD XGGAA

GDFDA AAGAX DVFDF DFFDD FDDFX FXXFD

FDXAX GAXFF VDVAF GVDVD DDAGD GGDAA

GGFDD DVFFV VAGVA XAAGG XGXDD DADXF

ADFFG DGFDA AFGAX FFDVD DDAGA FAOAV

ODD A V G A V A D F G D D F F D G 0 V D G GX A X A X D A

DXDVF FXVAX GFDAG XFFFF AAXDA FVOXG

XFOAG AGAVD VAGAF DGDAV VDOOD DFXGV

AFFAA FFFDV OFFAF DAGDG GAAAF DXAXA

VAXDA GADXD VFAFF FGDDA DODFA GDFAX

D G

No.8

DFGFX DFAFF XDXAG ADGGG DDFGA XGVDF

VVFDA AAXGO AVDVA DDGVD AFAG

No.7

AGFGV DDDDF DDFXF DDGDF AXVOD VDVXA

DOAXX AAODF AGGFFAXDDG XOFAD DFOGD

D V A X A X FX D A F X D D G F X G D V G F F G X DAD F A

DDAFF VDGXA ADXFX GVADA XGXAG AGOGV

X 0 D V

The cryptograms have been examined for identical beginnings, and Nos.3 and6 apparently

begin alike, identical portions being underlined as shown in figure 51. Now the number of

identical sections in the two cryptograms is 15; this indicates that the width of the transposition

rectangle is 15. Therefore, No.3 (290 letters) has5 long columns of 20 letters and 10 short

columns of 19 letters [(15X20)-10=290]. No.6 (302 letters) has2 long columns of 21 letters

and 13 short columns of 20 letters [(l5X21)-13=302]. 'I'he identical sections in No.3 and

No.6 having been marked off as shown in figure 51, the next step is to transcribe the texts into

their correct column lengths as given by the study of identical sections, writing them merely

in their serial order, as shown in figure 52. In this transcription no serious difficulty is usually

encountered in the division into correct column lengths, this process being guided by the identical

sequences, the number of letters between the identical sequences, and the maximum and minimum

lengths of the columns as calculated from the dimensions of the rectangle. Whenever difficulties

are encountered in this process, they are brought about by accidental identities of letters before

and after the true or actual identical sequences. In the present case no such difficulties arise

except in going from column 12 to column 13. The identical sections for column 13 here consist

of the sequence A F F A A F; if these sections are placed at the head of column 13, it leaves column

12 one letter short at the bottom in each diagram. This means that the initial A's in these

identical sequences represent an accidental identity; these A's belong at the bottom of column

12 in each diagram, and the true identical sequences are F F A A F, and not A F F A A F. In

some cases there may be many more instances of such accidental identities before and after the

true identical sequences. Another thing to be noted is that the identical beginnings in this

case run along for at least4 complete rows and part of the fifth row in the transposition rectangle.

Therefore, the identical sequences should consist of not less than 4, and not more than5 letters;

any letters in excess of5 in any identical sequence are accidental identities. There are several

such accidental identities in the case under study, viz, in columns5 and 12.

i::1
FIGURE 62.

X D D FDA DOG X A A F A A

1---------------

1

-

o X V DOG FAD 0 X G F A F

--------------1-

A A F X A V F G 0 V 0 A A A F

1---------------1- A A 0 A GAG A E F A F A F F

1---------------1-

A AE 0 A 0 A A F F 0 FOG '-- - - - - - I-=-

G G X V G G X A F FAG 0 A X

1------=--------=---1-

X D A A X A 0 F A FAX GOA

1---------------1-

D F GOA F V G G 0 F A A A X

--------------- D A F X V 0 D G V X 0 F GOD

1---------------1-

X D X F G V A 0 A G G A A X F

1---------------1-

V G A X 0 0 0 X F V F F F V 0

,....--1------------

1

-

F A F F G V A A G G V X V V D

1---------------1- F FAD A 0 V X X 0 F X X A F

V D F G DXDFG'FXIGDXIX

1---------------1-

D A A A A FAG V G X G G F A

1---------------1-

G 0 X G F 0 0 V 0 A X A G V A

1---------------1-

AGO F A A D X 0 V A G F A A

1---------------1-

D V 0 G X X D 0 A A A A G D A

1---------------

1-

F G D G F F G 0 X D GAD 0 A

1----------------

D A A AG

iI

,

234

108

No.3

6 7 8 II 10 11 12 13 14 16

109

No.6

2345678111011121314141

X 0 0 F 0 A

0

0 G X

A

A

0 X

V

0

0

G F A 0 0 X G F A ~I~'~

F

-

-

-

-

-

-

-

-

-

-

-

- --

- 1-

A A F X A V

F

G

0

V

0 A A A

F

-

-

-

-

-

- --

-

-

-

-

-

-

-

-

AA 0 A G

A

G

A

E

F

A

F

AF

F

-

-

-

-

-

-

-

-

-

-

-

-

- --IV 0 E x 0 X 12 F F E E 0 E 12 Q

-

-

-

-

-

-

-

--

-

-

-

-

-

-

0

X 0 G

Q

A G A 0 X V

Q

F

X

0

- -

-

-

-

- - -

-

-

-

-

-

- IX G F A G A F 0 G V 0 D F A 0

- -

-

-

-

-

-

-

-

-

-

- - - '-

D

G

F

X 0 G

0

A D A

X

A

D

X

A

- - - -

-

- - -

-

-

-

- - -

-

G

A 0 F A G

A

V

V

X G V V A

0

-

-

-

- - -

-

-

-

-

-

-

-

- IF A 0 F A X A 0 0 G X V D V 0

-

-

--

-

- - --

-

-

-

-

- IX G F V G G F D G F F 0 F A 0

- -

-

-

-

- - -

-

-

-

- - - IV D 0 0 G X G 0 G 0 0 0 F X F

-

-

-

-

-

-

-

- .-

-

-

-

-

- 1-

G F

0

V

F 0 A A

X

A

A

0

A

0

A

- - --

- ----

-

--

-

-

-

-

- '-

0 0 F A

0

0

X

V A G

G

0

F

A

G

-

-

- - -

-

-

-

-

-

-

-

-

- 1-

0 A

X

F

0

0

F

G

X

X

A

0

0

G

D

-

-

-

-

-

-

-

-

-

-

-

- - - 1-

A

A

F

G

0

A

F

A

A

F

G F A A F

-

-

-

-

-

- - -

-

-

-

- - - IV A X V V 0 0 V X F A X G D A

- - - -

-

- - -

-

- - -

G

G X D F X V A 0 F

V

G D X X

- - - -

-

- - -

-

-

-

-

-

- IX A F V F F 0 0 A F 0 V G 0 0

-

--

-

-

- - - --

-

-

-

- - -

A X D D

V

A D F 0 A

V A G V

G

I-

- - -

- -1-

-

-

-

-

- - - -

V

F

FmURR 52-Continued.

c. Now comes the attempt to place the columns in proper sequence in the respective transposition rectangles. Since No.6 has only 2 long columns, viz, 5 and 14, it is obvious that these

two columns belong at the extreme left of the rectangle. Their order may be 5-14 or 14-5;

there is no way of telling which is correct just yet. Since No.3 has 5 long columns

, viz,.," 3 4 5

7, 14, and since from No.6 it has been ascertained that 5 and 12 go to the extreme left, it is

obvious that columns 3, 4, and 7 occupy the third, fourth, and fifth positions in the rectangles.

Their order may be any permutation of the three numbers 3, 4, and 7; their exact order must be

ascertained by further study.

32411111-41-8
h. The distribution is fairly good. Five oecurrences of AA are noted, 3 of FD. These must

represent high-frequency letters. The q, (Phi) test for monoalphabetieity may be applied.

Expected value of {for plain'text=.0667X21 X20=28.01

Expected valueof q, for randorri~text = .0385X 21X 20= 16.17

Observed value of q, in this case=(5X4)+(2X1)+(2X1)+(3X2)+(2X1)+(2X1)=34

The observed value of q, is considerably greater than the expected value for plain text and more

than twice as much as the expected value for random text. Using the distribution in figure 53 as

a basis, an attempt is made to add to the 5-14 combination a column selected from among columns

3,4, and 7, so that the second, fourth, sixth ... pairs down the second and third columns in the

rectangle will give bipartite pairs that will conform to the distribution noted in figure 53. Since

the results sought will be very materially affected if the combination 5-14 should really be 14-5,

all possible combinations of 5-14 and 14-5 with 3,4, and 7 must be tried. The various combinations tested are shown in figure 54.

20 COMPONENT

A D F G V X

l1IJ -- I --_1-

II II I I ------------ III r----- --------III

f--- ---------- II I ------------ I

111

~- No.3 No.6 -

Col. Col. -

Col. Col.

,,;c. ...L-!! )": 1 D A 1 D A

D A D A

3 A A 3 A A

G F G F

5 D D 5 D D

G A G X

7 X D 7 G A

A A D X A

9 V D 9 A A ~D G X A V iii

ll:

11 D V 11 G A ~F

G V G X :II

0

13 A A 13 F D °G

D X D A fa"'v 15 A F 15 D G

F V D A X

17 A A 17 V D

X D F X

19 F D 19 F D

A G V V

21 V F

}'IGVBB 53.

I Number of column.

Cryptogram 'rotal number I Lengths of

_ ;:::;-=-_1__ Short -= No. ofletters I columns

---------1-------- 1 60 4 All same length

2 38 3 and 2 8 I 7

4 62 5 and 4 2 I 13

5 74 5 and 4 14 I 1

7 124 9 and 8 4 11

8 54 4 and 3 9

I

6

d. In this study, to fix the exact order of the columns and thus to reconstruct the transposition key, advantage can be taken of the diverse lengths of other cryptograms that may be

available in the same key. In this case there are 6 additional cryptograms, Nos. 1, 2, 4, 5, 7,

and 8, suitable for the purpose. The following calculations are made:

110

Now No.7 has 4 long columns, and these must consist of 4 columns from among the 5 already

ascertained as falling at the extreme left, viz, 3, 4,5,7, and 14. Columns 5 and 14 have furthermore been placed in positions 1-2, -leaving columns 3, 4, and 7 for positions 3-4-5. Which

of these three possibilities is to be omitted as a long column in No.7? A means of answering

this question involves certain considerations of general importance in the cryptanalysis of this

type of system.

e. Consider a transposition rectangle in which the number of columns is even, and consider

specifically the first pair of columns in such a rectangle. The combinations of bipartite components formed by the juxtaposition of these 2 columns correspond to plain-text letters, and therefore the distribution of the bipartite digraphs in these columns will be monoalphabetic in character. The same is true with respect to the bipartite components in the third and fourth columns,

the fifth and sixth columns, and so on. Hence, if a long cryptogram of this nature is at hand,

and if the 2 columns which belong at the extreme left can be ascertained, then a distribution of

the bipartite digraphs formed by juxtaposing these columns should not only be monoalphabetic,

but also this distribution, if it is at all normal, will afford a basisfor matching other columns which

will produce similar distributions, for the text as a whole is monoalphabetic, In this way, by

proper matching of columns, those which really go together to form the pairs containing the

bipartite equivalents of the plain-text letters can be ascertained. From that point on, the solution of the problem is practically the same as that of solving a columnar transposition cipher

with nonfractionated letters.

f. But now consider a plain-text rectangle in the ADFGVX system, in which the number of

columns is odd, and consider specifically the first pair of columns in the rectangle. Now only the

alternate combinations of bipartite components in these columns form the units of plain-text

letters. The same is true of the bipartite components of the third and fourth, the fifth and sixth

columns, and so on. In all other respects, however, the remarks contained in subparagraph e

apply equally to this case where the width of the rectangle is odd.

g. Returning to the problem under study, it has been ascertained that columns 5 and 14 fall

at the extreme left. Whether their correct order is 5-14 or 14-5 cannot at the moment be ascertained, nor is it essential. The thing to do is to make a distribution of the bipartite pairs and

see what it is like. Since the width of the rectangle here is odd, only the 1st, 3d, 5th, ... pairs

down the columns can be distributed in a. frequency square. The results are shown in Fig. 53.

:I

1,1

iI

I'

"

ij

! '

i, -

i

i

,!
(3) [5--14-7]

A D F G V X

(6) [14-5-7]

A D F G V X

"II /I /I I

- - "---

.__.

- 1/1/ lHl /I I( I

- --- ,--

_..._-

-

-

I

I /I

-

- -'-

- ----'-

/I

I 1/1/

I

,-- -

- ---

- 1/

- --._-_._- ----_.---

-

I

lHl 1/1/

I II

-

- ------ ---

- /I 1/1 I I

-----

- ----

- fII /I

- ...-

- --

-

- 11/

- --

- --

-

_.._--

/I 1/1/

I

-

-

-

_..- ---

-

I 11/ /I

I

(2) [.5-14--4]

A D F G V X

F1GURII 115.

(5) [14-5--4]

A D F G V X

lHl 11/

I /I

I

-----'-

- ._--_.

-

I 1/1/ 11/ /I /I /I

-- -_._.--- ---

I I I

I

-

- _. __.---

-

-

/I /I /I

I

I

-'

- ---

-

- -- 1/

- ----,-

-

-

-

I

l1f 1/1

I

I

I

I-- -'---

-

- -- II I' /I I

--'--

-

- - -

/I 11/

-",----

-

-

-

1/1

- ---

-

-

- 1-

/II 1/1I

I--

-

-

-

- --

11/

I /I

I

(1) [5-14-:~]

A D F G V X

(4) [14-5-3]

A D F G V X

1IU 1/1/ 11/

- - '-

-

- -- /I "II 1/1/ I

t-- - --

-

I

I /I

- - -

-

-

-

1HlI 1/

-

- - -

-

-

/I

-

-

-

-

-

-

I

lHl 1/1

I /I

I

- - --

-

-

-

/I 11/

I

I

-

-

- - - 1-

lHl

r--- - - - - -

/II

-

-

-

- - - 1/1/ /I

I

-

-

-

-

-

-

1/1 /I /I

GVXADF

(5X4)+ (3X2) + (1XO)+ (2X 1)+ (1XO) +

(2X 1) + (3X2)+(1 XO)+ (1XO)+ (5X4)+ (2Xl)+

(1XO)+ (4X3)

+ (2Xl)+ (1XO) + (3X2)+(2X2)+ (2Xl)=82.

(1)=82 (4)=120

(2)=76 (5)= 70

(:-1)=78 (6)=110

113

The observed values of q, for 11.116 frequency distributions are shown herewith:

j. These distributions are now tested for monoalphabeticity, by applying the q, test. The

number of occurrences in each distribution is 41. Then 41X40X.0667=109.4 is the expected

value of q, for plain text; 41X40X.0385=63.1 is the expected value of q, for random text.

Here are the calculations for the first distribution (combination 5-14-3) yielding thc observed

value of q, as 82:

i. Frequency distributions are now made. If combination 5-14-3 is correct for No. :~, it is

also correct for No.6. Hence, It single distribution is made of the bipartite pairs in rows 1, 3, 5,

... of columns 5-14, and of the pairs in rows 2, 4, 6, ... of columns 14-3. Similar distributions are made of thc pairs given under euch of the other combinations. These distributions arc

shown in figure 55.

112

No.3

( 1) (2) (3) (4) (5

) (6

)

..!i...ll...i .ww .!!....!....l

1 DAD D A F DAD ADD A D F ADD ..~;:

.

2 D A V DAD. D A F A D V ADD A D F .,...

\~:.

3 A A F A A X A A F A A F AAX A A F ~~

G F D G F A G F G F G D F G A F G G .~.:

4

I ~"

5 D D F D D X D D D D D F D D X D D D

''

6 G A X G A V G A X A G X A G V A G X 7 X D A X D A X D D D X A D X A D X D ''i 8 A A G A A D A A V A A G A A D A A V 9 V D F V D X V D D D V F DVX D V D

10 G X X G X F G X A X G X X G F XGA

11 D V A D V X D V D V D A V D X VDD

12 G V F G V F G V A V G F V G F V G A

13 A A A A A D A A V A A A A A D A A V

14 D X F D X G D X D X D F X 0 G XDD

15 A F A A F A A F A F A A F A A F A A

16 F V X F V G F V D V F X V F G V F D

17 A A D A A F A A D A A 0 A A F A A D

18 X D D X D G X D D D X D

n X G

n X 0

19 F D D F D G FOG D F 0 D F G

n F G

20 A G D A G A A G A GAO G A A G A A

No.6

( 1) (2) (3) (4) (5

) (6)

...!..li...! ..!W....J

DAD D A F DAD ADO A 0 F A 0 0

'2 D A V DAD D A F A 0 V A 0 D A D F 3 A A F A A X A A F A A F A A X A A F 4 G F D G F A G F G F G D F G A F G G 5 D 0 F n D X DOD D D F DOX 000 6 G X D G X G G X G X G 0 X G G X G G 7 G A F G A A G A F A G F A G A A G F 8 D X F n X X D X,D X D F XOX X 0 D 9 A A D A A F A A A A A 0 A A F AAA

10 A V D A V F A V A V A D V A F V A A

11 G A F G A V G A F A G F A G V A G F

12 G X 0 G X D G X G XGO XGD XGG

13 F D D F 0 V FDA D F D D F V

n F A

14 D A F

o A A D A X A D F A 0 A A 0 X

15 D G X D G F D G F G 0 X G 0 F G 0 F

16 D A F D A G D A F A D F A 0 G A 0 F

17 V D X V 0 V V D D D V X D V V

n V 0

18 F X X F X D F X V X F X X F D XFV

19 F 0 F F D V F D D D F F D F V D F D

20 V V D V V D V V D V V D V V D V V 0

21 V F V F V F F V F V F V

FIGURE 54.

I' ;I

j

II

.;

:,

iI

I;!

i
(4)

14 II 7 4 3

ADD F D

A D F D V

A A F X F

F G GAD

D D D X F

X G G G D

A G F A F

X D D X F

A A A F D

V A A F D

A G F V F

X G G D D

D F A V D

A D X A F

G D F F X

A D F G F

D V D V X

X F V D X

D F D V F

V V D D D

F V

(2) [14-5-3-7-4]

A D F G V X

'W lIf /11 11/ I

- - - --- - /I lIf 'W 1/1/ 11/: /I

- - '-- - I lIf' 1111 / I /I

- - - - - - /I lIf I I /I

- ~I- - - -

I---

~I-I---1-'

- I

(3)

14 II 7 3 4

ADD D F

A D F V D

A A F F X

F G GOA

D D D F X

X G G D G

A G F F A

X D D F X

A A A D F

V A A D F

A G F F V

X G G D D

D FAD V

A D X F A

G D F X F

A D F F G

D V D X V

X F V X D

D F D F V

V V D D D

F V

FIGURE 107.

(2)

No.6

FIGURE M-C'ontlnlled.

14 II 3 7 4

ADD 0 F

A D V F D

A A F F X

F GOG A

o D FOX

X G D G G

A G F F A

X D FOX

A A D A F

V A D A F

A G F F V

X G D G D

D FDA V

A D F X A

G D X F F

A D F F G

o V X 0 V

X F X V D

OFF 0 V

V V DOD

F V

(1) [14-5-3-4-7]

A D F G V X

'Iff /1{J /1{J /I

- -

W

- - -

11/ /I 'W I

-

/1{J 11/ 'W - - - - - 1-

'Jjj /I I /I

f--- - - - -

/I I

I--- - - - - -

/I I I

A

D

F

G

V

X

(1)

115

14 II 3 4 7

1 ADD F D

2 A D V D F

3 A A F X F

4 F GOA G

5 D D F X D

6 X G D G G

7 A G F A F

8 X D F X D

9 A A D F A

10 V A D F A

11 AGFVF

12 X G D D G

13 D F 0 V A

14 A D F A X

15 G D X F F

16 A D F G F

17 D V X V D

18 X F X D V

19 D F F V 0

20 V V D D D

21 F V

m. The additional bipartite pairs given by adding columns 4-7 to the basic combination

14-5-3 are distributed in the 4th frequency distribution square of figure 55, yielding the distribution shown in square (1) of figure 57. The other squares in figure 57 are constructed in the

same way, for the other combinations of figure 56.

(1) 14-5-3-4-7 (3) 14-5-7-3-4

(2) 14-5-3-7-4 (4) 14-5-7-4-3

l, The following sets of columns correspond to these 4 combinations in the 2 cryptograms

(fig. 56):

No.3

(1) (2) (3) (4)

14 II 3 4 7 14 II 3 7 4 14 II 7 3 4 14 5 7 4 3

1 ADD F D ADD D F ADD D F ADD F D

2 A D V D F A D V F D A D F V D A D F D V

3 A A F X F A A F F X A A F F X A A F X F

4 F G D A G F G D G A F G G D A F G GAD

5 DDFXD DDFDX DDDFX DDDXF

6 AGXVX A G X X V A G X X V A G X V X

7 D X A A D D X A D A D X D A A D X D A A

8 A A G D V A A G V D A A V G D A A V D G

9 D V F X D D V F D X D V D F X D V D X F

10 X G X F A X G X A F X G A X F XGAFX

11 V D A X D V DAD X V D D A X V 0 D X A

12 V G F F A V G F A F V G A F F V G A F F

13 A A A D V A A A V D A A V A D A A V D A

14 X D F G D X D F D G X D D F G X DOG F

15 FAAAA FAAAA FAAAA FAAAA

16 V F X G D V F X 0 G V F D X G V F D G X

17 A A D F 0 A ADD F A ADD F A A 0 F D

18 DXDGD DXDDG DXDDG OX D G D

19 D F D G G D F D G G D F G D G D F G G 0

20 GAD A A GAD A A G A A D A G A A A 0

FIGURB M.

114

Only two of these distributions give close approximations to 109, the expected value of til, and

they may be retained for further experiment. They are the ones for combinations (4) and (6),

with values of 120 and 110, respectively.

k, Selecting combinations (4) and (6) viz, 14-5-3, and 14-5-7, since columns 14, 3,4,5 and

7 form the group of 5 columns at the left of the transposition rectangle, the following combinations are possible:

j

: .'

, . , .

,

.. !

I

, I

I

!'

? . I j

! [!

! :

I
FIGURII: 57-Continued. 11

A

X

o

A

F

A

A

F

n

G

F

V

F

X

X

X

A

A

G

6 II

AG

G 0

V 0

AF

AA

G F

AA

F G

n V

VA

o F

VG

OX

XG

FV

00

AD

XA

F X

2 8

00

XA

AG

AA

AA

GA

DF

F G

AG

00

GX

AA

F X

D F

AG

OV

GX

V 0

GO

13 1

F X

F 0

AA

AA

F A

OG

G X

AO

GO

AX

F V

V F

XF

DV

G 0

G G

F A

G 0

DF

No.3

FIGURII: all.

AA

F G

FA

FF

GO

XG

AX

XA

n F

FA

o F

DX

FX

XG

AG

AA

AG

AA

AA

7 10 1& 12

OX

F 0

F V

GF

n F

XF

n F

V D

OX

AG

OV

AG

VO

OF

AG

OA

OV

OA

GD

A

a 4

n F

V 0

FX

OA

FX

XV

AA

GO

FX

XF

AX

F F

AO

FG

AA

XG

n F

n G

OG

n A

14 5

A 0

A 0

AA

F G

00

A G

OX

AA

OV

XG

VO

VG

AA

XO

F A

VF

AA

OX

DF

GA

117

10 columns which are to be anagrammed to ascertain their correct sequence. The column to

follow column 7 is ascertained on the basis of the repetitions which are brought about when the

selected column is placed on the right. These repetitions should fall into those cells of frequency

distribution (1), figure 57, which are of high frequency. In other words, the process is one of

selecting from among columns 1, 2, 6, 8, 9, 10, 11, 12, 13, and 15 that column which will yield

the most repetitions of bipartite digraphs with the digraphs given by the juxtaposition of columns

L4-5-3-4-7, as distributed in frequency square (1) of figure 57. The column thus selected turns

out to be No. 10. Then other columns are added by proceeding along the same lines, the work

becoming progressively more easy as the number of available candidates decreases. Sometimes

the discovery of what appears to be a long repetition within one of the cryptograms or between

two cryptograms facilitates the process. In this 'case the results obtained from the 3 cryptograms under study are shown in figure 59.

=::

;."

:~~:.

(4) [14-5-7-4-3J

A 0 F G V X

'/If TIll /I /I /I

- - - - - - / lIf' 'II/, / TIll TIll

/ /I - - --- - - /I /I /I 11/ 11/

- - - - - - /I 11/ /I TIll /I

- - - - - - 11/ /

---- - - - - / /

116

268 II ro II U U

Jo'JaURIIi 58.

(3) [14-5-7-3-4]

A 0 F G V X

'/If 11// /I /

- - - - - -

TIll 'II/, 'III" 1/ /I 11/

- - - - - -

/I / TIll /I /I /I

:---- - - - -

/I 1// 1/1/ /

:---- - - - -

/ /11/

f--- -/1-/ - -

/I /

14 5 3 4 7

A X 0 V 0 IA 0 F

~L.~-L~-~ 0 A G :--- - - - 0 A G 0 F G F F ~J~~~ A A 0

f-- -- - A A 0 V A F 0 A viA G 0 F 0 G

f-- -- A"!FDA - X 0 F X o G 0 X F X V

-- -.--- - G 0 A A 0 V F 0 X X V 0 V F X

I--- - - - - - - ---- - --- - - X F X 0 F 0 X 0 A 0 G F 0 X 0

I-- - A A V 0 0 0 F G X 0 F A G G 0

- - - - - --- - - - - - - - G G 0 A G 0 0 X F G F 0 X V V - -

A G 0 X

n. Again applying the .;-test, the expected value of q,is 81X80X.0667=432. The observed

values for the four combinations of figure 57 are as follows:

(1) For combination 14-5-3-4-7, q,=436

(2) For combination 14-5-3-7-4, q,=276

(3) For combination 14-5-7-3-4, q,=344

(4) For combination 14-5-7-4-3, q,=318

The combination 14-5-3-4-7, giving the greatest value for q, (a little better than the expected

value), is very probably the correct one.

o. Examining the other cryptograms that are available, it is seen that No.7 is the third

longest one of the entire set, with 124 letters; moreover, the dimensions of the rectangle [(15X9)-

11= 124] are such as to bring about 4 long columns of 9 letters and 11 columns of 8 letters. The

first 5 columns are definitely fixed in position, since it is known that the first 5 key numbers are

14-5-3-4-7. The resulting diagram is shown in figure 58. There is now a section consisting of

; 1

i

i -

I
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

Lltezalkey .• _.•_ THE FLO W R S A B MIN P G C 0 J K Q U V X Y Z

Numerical key_____ 14 5 3 4 7 10 III 12 13 1 2 8 6 9 II

FIGUBIIl60. FIGUBB 61.

No.1 • 14 5 3 4 7 10 15 12 13 I 2 8 6 9 11

R E G I M E N T

o V A G GG F X F V A G G 0 A

I N P 0 S I T

AF X G OG F D F 0 X F X A A

I 0 N S H A L L

F X D F G 0 OX A 0 F A n 0 0

I A T T A C K

o F X F A A A A A F AG X V X

No.2

14 5 3 4 7 10 15 12 13 1 2 8 8 9 11

R E Q u E S T I

OV A G X A X 0 A G OX AA F

N S T R U C T

X G o 0 X A A 0 V X o G X A A

I 0 N S

F X o F G D OX

FIGUBIIl 62.

2D COIIPONIIlNT

A D F G V X

T H 8 E 5 F - - - - - -

6 L 0 W R S --- - - - -

A 1 B 2 M I --- - - - -

9 N P G 7 C - - - - - -

:3 0 4 J K - - - - - -

Q U V X y Z

V

X

A

2D COIIPONBN'r

A 0 F G V X

T H E 5 F - - - - ---

L 0 W R S - - - - - -

A B M I - - - - - -

N P G 7 C --- - - - -

0 J K - - - - - - U V Y

119

A

0 ..II;

li: F

o

S G

V

X

118

No.6 14 Ii 3 4 7 10 15 12 13 1 2 8 6 9 11

A D D F DX A A F X DD A G A , A D V D F D F G F D XA G D X 'i·,

AA F X F V F A A A A G V D D

F G DA G F F F AA A A A F A

", i D D F X D F G D F V D F XF F

X G D G GX D G F 0 XA AD V . !

A G F A F V OD F X GD AG D If

,: XD F X D A A A D D G A G 0 X l i

": A A o F A X D V V G AV G V G l"

"! : V A D F AG DV o F AD XO X

A G F V F F o D FX GD G G F

X G o 0 G D F D F V OD X G D

o F D V A A AD A G F A DX A

A 0 F A XG G D F 0 o V o A G

G 0 X F F X DD D D A G DX A

A 0 F G F F F F A A A A AA G

o V X V o F AX G V AV OX A

XF XD V F X G D G G A XD V

J; D F F V D F DV GX AD F A D

V V D D D A GA G A X F A 0 V

F V I . No.7 I 14 s 3 4 7 10 15 12 13 1 2 8 6 9 11

AX D V D F G D AA D D F X G

D A G D F X DA A G F 0 F 0 X

A A DV A G G F D F DV A A D

XO F X DO V F XG OA X F A

G 0 A A D V XV F V FX D X D

X F X 0 F G D D XO XA DO F

AA VD D F D G GO F X G 0 A

G G D A G F VX V 0 D F X G D

A G D X

jf

FIAt/BII: S9-Contlnued.

p. What the cryptanalyst now has before him is a monoalphabetic substitution cipher, the

solution of which presents no difficulties. The cipher square is reconstructed as completely as

possible, blanks being left where there are no occurrences to give clues as to the character involved,

usually some of the digits and the very infrequent letters. In this case the only letters which do

not occur in the plain text are Q, X, and Z. The digits 5 and 7 are recovered from the context,

, in message No.6, where the caliber of a gun is mentioned and the digits are confirmed at other

places in the message. The square that is obtained is seen in figure 60. Examination of the

mixed sequence discloses that it is based upon the phrase THE FLOWERS THAT BLOOM IN THE

SPRING. This permits of the establishment of the transposition key and of the position of the

digits in the checkerboard (as in par. 3Si). The results are shown in figure 61. The completely

solved messages are shown in figure 62.
.FI/ll'IlJli 62-Contlnued.

H 0 S TIL E T

AD OF OX AA FX DO AGA

ROOPSES

AD VO FO FG FD XA GOX

TIM ATE 0 0

AA FX FV FA AA AG VO0

NEB A T T A

FG OA GF FF AA AA AFA

L ION A T T A

DO FX OF GO FA AA AAF

C KIN G E A

AG XV XF XG OG GA GFA

ST0F COTT

OX AA OF AX GX OF AAA

E R

S TOPP

AA GO VO XA AD FG FGF

R ISO N E R S

OV FX OX OF GO AG OV0

CAP T U R E

XG XF AG FA AX DO VAG

D FRO

M COM

VO AX OV DF FV GX OFF

PANYA 5 7

FG FF AG OX VF AA VGV

THO I V I S I

AA AD VO FX XF FX OXF

o N I N 0 I C

XO FG OF XG OV OF XGX

ATE ENEMY

FA AA AG AG GO AG FVX

I N TEN 0 S

VF XG OA AA GG OV DOX

TOR E A C H H

AA OF OV AG FA GX ADA

U N T E R S T

OX OG OA AA GO VO XAA

OWN TONIG

OF OG GO AA OF GO FXG

H T

GAD A A

121

No.4

14 6 3 4 7 10 16 12 13 1 2 8 6 9 11

"T

H I R

T

Y

S

I

AA AD F X

oV AA X V OX

F

X

T

H

F

AL

E

XX

GA AA

oA X F . A D D A

G

A

V

I

N G G

0L

FA X F F X G

D G G G G

oF0

0

E N V

I

L

L

D V OA G G

oX F F

X

0o0D

E

A G

.~!l.,.

~.

--

No.5

145

3

4

7 10 15 12 13 1 2 8

6

9 11

•

C

0 R P

SW I L

f GX

oF

n V G F OX

DG F X

0

;:'-L

T

A

K

E

0V

o0

oA A F A V XA

G0 F X F

E

R T R

A F F I

A G

n V A A

oV F A AX A X

F

l'

C

C0

N T R

0

XG X G

X

0 F G

nA A D

V

0

F

L A T

0 N C

E

D D F A AA

o F G0 G X A G

FIOl1BB 6~ontlnaecL

2 8 II 9 11

120

No.3

14 Ii 3 4 7 10 15 12 13 1

,!!

!

!1

i.

I.I;

I:
122 123

No.6 No.7

146

3

4 7 10 16 12 13 1

2

8

6 II 11 If

6

34 7 10 16 12 13 12

86 II 11

H

0

S

TI

LE

T .' ~;

F

R0

N

T

LI

N

A 0nF

oX AA F X

o0 AG

A AX

oVo F G 0 A Ao 0 F X

G

R 0 0

p

S

ES

E0U

T

P

0S A 0 V 0 F 0 F G F 0 XA GO X OA G 0 F X OA A G F 0 F 0

X

T

IM

A

T

E

0

0

A A F X F V F A A A A G VO

0

T

RE

P

0

RT

S

N

EB A T

T

A A A

o V A G G FoF

oV AA

0

F G

n A G F F F AA A A A F A

0

U

RIN

F

A

LI

0

N

M0

VI XD FX DD V F X G DA XF

A

D D F X D F G 0 F V D F XF

F

N

T R Y

M

IS

S

N

GUP

S

TR G 0 A A D V XV F V F X DX

0

X G D G GX

o G F D XA A D

V

E

AM

LI

NE

S

I0N S SH0

AG F A F V

o D F X G D AG

0 X F X 0 F G

o0 X 0 XA D D F

0

UTH

W

E

S

T

0

0

WNI

NE

XD F X D A A A

n0 GA GD

X A A V 0

nFnG G 0 F X G 0

A

T

0

FR

J

5

7

7

N

EMYLI

N

AA D F AX D V V G A V G V

G G G

o A G F V X V 0

oF XG0

I

H

A

N0

A

S

S

V A

o F A G D V

oF AD X 0

X

ES

EM

B

L

I

NG

I A G

oX

A G F V F F D 0 F X G 0 G G F No.8 N W 0 0 0 S N

X GoD G 0 F 0 F V D 0 XG

D 4.

63

4 7 10 15 12 13 1 2 8

6 II 11 ..

0

RT

H

EA

ST

W

I

REL

INE

oF

oV A A A 0 A G F A DX

A

oG F XoV A Go0 FX G 0 A

0

F

G

0

L

0E

T

0B

R

I G A

A 0 F A XG G 0 F 0

oV DA

G G A A D F F F 0 V F X G G F A

N

VIL

LE

ST

0

INTE R R

U

G 0 X F F X

o0o0 A G OX

A V 0 F X G D A A A G D V OV

X

'I

0

p

BA T T

E

T

E A 0 F G F F F F A A A A A A G P0

'I D G F A A A G V 0 R Y 0 F 7 5 S F : n V X V o F A X G V A V DX A FIGURa 62-Continued. ;1

il

I

R

I

N G F

R 40. Special solution by the exact factor method.-a. The student who has comprehended I, X F X 0 V F X G o G G A X 0 V the successive steps in the solution of the example discussed in the preceding paragraph is in a 0 M 0 R C H A R position to grasp at once the mechanics of the special solution by the exact factor method. The o F F V o F o V G X A 0 F A 0 latter is based upon the interception of a number of cryptograms, preferably lengthy ones, which 0 L E E F A R have been enciphered by rectangles in which the last row is completely filled with letters. The

i

V V D 0 DA GA G A total number of bipartite components in the case of such

a cryptogram will yield clues as to the X F A 0 V

:

M dimensions of the transposition rectangle. Then the text is transcribed into columns of approF V priate length, all being equal in this respect, and the process of combining columns, as explained

FlOURa 62-0ontlnoed. in paragraph 3ge,is applied in order to produce the best monoalphabetic distribution of bipartite

I;

:1

:i
+

ODD NUMBER OF COLUMNS

+ + + + +

81 8, 81 8, 81 8, 81 8, 81 82 81 8, 81 8, 81 8, 8 1 8, 81

81 8, 81 82 81 8, 81 8, 81 8, 8, 81 8, 81 8, 81 8, 81 8,

81 8, 81 8, 81 8, 81 8, 81 8, 81 8, 81 8, 81 8, 81 8, 81

a b FIGUIl.II: 63.

+

not to expect that in practical work a general solution will, in the cryptanalytic as in the mathematical field, invariably lead to a solution. If there is a sufficient amount of text and if the text

contains no abnormalities, the attempt to apply the general solution will usually be successful.

But the cryptanalyst must remember that the ADFGVX system is by no means a simple one to

solve even under the best of conditions and if there is only a small amount of text, if it happens

that the transposition key is unusually long, or if the text is abnormal, he may not succeed in

solving the messages by the straightforward method to be set forth below, and he may have to

introduce special modifications. For the latter he can only rely upon his own ingenuity and

intuition.

42. Basic principles of the general solution.--a. Every transposition rectangle in the

ADFGVX system must conform to one or the other of two and only two fundamental types: the

number of columns must be either odd or even. A number of important consequences followfrom

this simple fact, some of which have already been pointed out in paragraph 3ge. They will be

elaborated upon in the next subparagraphs.

b. Consider a rectangle with an even number of columns. Each of its rows contains an

even number of bipartite components, half of which are initial components, half, final components, alternating in a regular order from left to right in the rows. When the transposition is

applied, all the components within a given column are of the same class, either initial or final.

No intermixture or alternation of the two classes is possible. On the other hand, consider a

rectangle with an odd number of columns. Each of its rows contains an odd number of bipartite

components, the 1st row containing one more initial component than final components, the 2d

row containing one more final component than initial components, and so on, this arrangement

alternating regularly in the successive rows of the rectangle. When one studies the various

columns of the rectangle, it is seen that in each column there is a perfectly regular alternation of

initial and final components, the odd columns (Ist, 3d, 5th, . . .) beginning with an initial

component, the even columns (2d, 4th, 6th, . . .) beginning with a final component. This

alternation in components remains true even after the transposition is applied. These remarks

become very clear if one studies figure 63. Two transposition rectangles are shown, one with

an even number of columns, the other with an odd number. Instead of the actual components

(ADFGVX), the symbols 81 and 82 are used to indicate the two classes of components, initial and

final, because in this analysis interest centers not upon the actual identity of a component but

upon the class to which it belongs, initial or final. At the top of each column is placed a "plus"

to denote a column occupying an odd-numbered position in the rectangle, or a "minus" to denote

a column occupying an even-numbered position.

EVEN NUMBER OF COLUMNS

+ + +

c. In what follows, the term "odd column" will mean merely that the column in question

occupies an odd position (lst, 3d, 5th, . . .) in the transposition rectangle; the term "even

column," that it occupies an even position (2d, 4th, 6th, ...) in the rectangle. The odd or

even designation has no reference whatever to the nature of the transposition key number applicable to that column, whether it is odd or even. Now when the transposition is applied to the

even-width rectangle a, figure 63, the cryptographic text will consist of a number of sections of

letters, each section corresponding to a column of the rectangle, and therefore the number of

324155-41-9

124 125

digraphs down the juxtaposed columns. There is nothing to prevent the simultaneous use of

all cryptograms that have been enciphered by completely filled rectangles, for it is clear that

if, for example, columns 15 and 4 are to be paired in one cryptogram, the same columns will be

paired in all the other cryptograms. Hence, even if the rectangles are small in depth they can

be used in this process; it is necessary only that all columns of any rectangle be of the same

length. Now if only two or three such pairs ofcolumns can be set up correctly, solution follows

almost as a matter of course. No additional or new principles need be brought into play, beyond

those already possessed by the student.

b. In this special solution, the important step is, of course, the initial one of experimenting

with rectangles of various dimensions until the correct size has been hit upon. In some cases,

excessive experimentation may not be necessary if the total number of characters is such as to

yield only one or two possibilities with regard to the length of the columns. For example, suppose

that previous work has established the fact that the enemy uses transposition rectangles not

less than 15 and not more than 22 columns in width. A message totaling 703 letters would

indicate a rectangle of 19 columns of 37 letters, since these two numbers are the only factors of

703. If this then were corroborated by other cryptograms of 76 (19X4), 152 (19X8), 190

(19X 10) letters, the probability that 19 is the width of the transposition rectangle becomes quite

persuasive. Of course, there will be and there should be other cryptograms of lengths that do

not factor exactly; these represent the ones in which the rectangles are not completely filled in

their last row. They do not enter into the solution at first, but just as soon as the positions of

two or three key numbers become fixed, the data afforded by these messages become available

for use in the later stages in the solution.

c. The exact-factor method is a useful one to know. For despite all instructions that

may be drawn up insisting upon the advisability of not completing the last row of a transposition

rectangle, the tendency to violate such a rule is quite marked, especially where a large cryptographic personnel must be employed. Itis not astonishing to find that for lazy or ignorant clerks

the temptation to fill the rectangle completely is particularly hard to resist when it happens that

a message falls just one, two, or three letters short of forming a completely-filled rectangle:

it is so much easier for such clerks to handle a rectangle with equal-length columns than one in

which this is not the case. Moreover, the number of errors and therefore the number of times a

shiftless or careless clerk must go over his work to correct errors is reduced to a minimum.

Hence, it often happens that in such cases an enciphering clerk adds one, two, or three letters

to complete the last row, thus leading to the transmission of not a few cryptograms enciphered

by completely-filled rectangles. Space forbids giving an example of such a solution.

41. General solution for the ADFGVX system.--a. All three of the foregoing methods of

solving cryptograms in the ADFGVX system fall in the category of special solutions and therefore

are dependent upon the fortuitous existence of the special conditions required under each case.

What is really desired in the practical situation is a method of solution which is not so dependent

upon chance or good fortune for SUCCess. A search for a general solution was, of course, made

during the time that the system was under minute study by the cryptanalytic agencies of the

Allies, but no general solution was devised. All the solutions made during actual hostilities

and for a number of weeks thereafter were of the special types described in the preceding paragraphs. The first published description of a general solution is to be found in Givierge's Oour«

de Oryptographie, 1925, but only in broad outlines. A complete general solution was independently conceived by a group of cryptanalysts in the office of the Chief Signal Officer 6 and

will be described in paragraphs 42 and 43.

b. The attention of the student is directed to the comments made in paragraph 18, with

regard to the significance of the term general 8olution in cryptanalysis. He must be cautioned

• See footnote 7 of this seetlon,
I

V D D G G G V F D F V D V V F V D GAD D A F F F

V D X F D DXDVX A D V D V F X G D F V ADD G

D G D G V G D D D F X FAD A V D V G D GAD X V

DAD A D F X A V F V D D A A V D F F D F V G D F

V D D G V D D D D A V A D A F ADD X A D D GAD

F V G F V D GAD V F X V X D G D D A G G D D X F

F D D X A D F G D A G X D D A V FDA F G V F V F

A F F V F A F X G F XDGVA D F V D G G A V G G

D D G D V X A X F D D X (212 letters)

II

V D A A V D D F X F X D D A X G X F X D D F X A D

VAGDD F A X D V AVDVD D F V F V F F G D G

F V A X V X A V G D V D X F D X D G A X G F G G F

V F G D F V D X A V X D D V G D D V G V A G F X F

AAAXD DXG (108 letters)

III

DAGAA FGAGV D A F G G XFDXD F V V X G

F X F D X D D A G A D D G V A D D V D D G A F G A

VGDGX D D D A V F V D D F D A A A A D X A G D

X A G G D D A V G V F G D V F V D G G X G G A F F

V FDA X G D D D G D A FDA D G GAD D G D X A

F V D F D X F V G D D V A V F D D D V F A G D F F

F X A A D FAD G G V FDA V D G X F V D A A V G

D X F G G D D X G D A (186 letters)

127

has a frequency value of 284 as an initial component of the bipartite cipher equivalents of plaintext letters, and a frequency value of only 169 as a final component.

Similarly, the letters V and X have frequency values of 47 and 69, respectively, as initial components and 120 and 198 as final components. It is obvious, then, that in this checkerboard the

weighted frequency values of the letters A, V, and X as initial components differ considerably from

the values of these same letters as final components, the value for G as an initial is only a little

less than its value as a final, the values of D and F as initials are only a little more than their

values as finals. But it is the wide variations in the weighted frequency values of certain of the

letters as initial components and as final components, exemplified ill the case of A, V, and X,

which form the basis of the general solution, because these wide variations afford a means for

making the various differentiations noted in subparagraph d.

J. Of course, in working with an unknown example, the composition of the checkerboard is

unknown and therefore no accurate frequency weights may be assigned to the ADFGVX components in the cryptograms. However, it is still possible to arrive at some approximations for

these weights in case there are several cryptograms available for study, as would normally be

true in actual practice. How this can be done will be shown very soon, by studying an example.

For the purposes of this study the set of 12 cryptograms given below will be used.

.:~:..

T I H E F 92 34 130 28 284

-------------- L 0 W R S 36 75 16 76 61 2M

----------I--- A B M I 74 10 25 74 183

- --------I--- N P G C

79 27 16 31 153 t-------------- D. J K 42 2 3 47

------ Q u V X y Z

3 26 15 5 19 1 69

169 I 217 I 127 I 169 I 120 I 198 I1.000

FIGURE 64.

• As given in fig. 3, p, 13, Military CryptanalyBia, Part 1.

Sums

V

1sT COMPONENT

G

F

2D COMPONENT

AD F G V X Sums

D

X

A

126

sections in this case will be even. Moreover, all the components in a section corresponding to

an odd column in rectangle a will be 0 1 or initial components, all those in a section corresponding to

an even column, 82 or final components. The sections or columns are completely homogeneous with

respect to the class to which their constituent components belong. On the other hand, when the

transposition is applied to odd-width rectangle b, the cryptographic text will consist of an odd

number of sections, each corresponding to a column of the rectangle. The components in the

sections consist of members of both classes of components in a regular alternation; in a section

corresponding to an odd column the order is 81""~82--+81 • • .; in a section corresponding to an

even column the order is 8 2--+81--+82 • . .. The sections or columns are not homogeneous in this

case as they are in the former.

d. Now if there were some way of distinguishing between initial components as a class and

final components as a class it is clear that it may be possible first of all to ascertain whether the

transposition rectangle contains an even or an odd number of columns. Secondly it may be

possible to identify those columns which are even and those which are odd. Finally, it may be

possible to ascertain which are the long columns and which are short, thus yielding the exact

outlines of the rectangle in case the last row is incompletely filled. From that point on, solution

follows along the same lines as explained in paragraph 40, with the modification that in the pair-

.ing of columns the number of possibilities is greatly reduced, since it is useless to pair two columns

both containing initial components or final components.

e. The foregoing depends then upon the possibility of being able to distinguish as a class

between initial and final components of the bipartite cipher equivalents in this system, or at

least between letters belonging to one or the other of these two general classes of components.

Now if the substitution checkerboard has not been consciously manipulated with a view to

destroying certain properties normally characterizing its rows and columns, the sort of differentiation indicated above is quite possible. For example, if in the checkerboard shown in figure 61

the normal frequencies of the letters as they appear in English telegraphic plain text 8 are inserted

in the cells and totals are obtained vertically and horizontally, these totals will permit of assigning frequency weights to the letters ADFGVX as initial and as final letters of the bipartite cipher

equivalents of the plain-text letters. This is shown below in figure 64. The bipartite letter A

i

I!

! !

i'

. :
128 129

IV IX

i

ADXVF X V G G V F 0 0 V A F G A A V FOG V 0 .\(" GOD DO X V G V 0 V 0 A V G F G 0 F V

o V A V 0

i. DOG 0 G F 0 V V A F G X F X F 0 DOD VGDAX

I!

G FAGX A V F F G V ADD

0 AXXAX DGADG

o A X 0 0o A G V F F A A 0 V GO F X G X G V GO ~; •...

.' XAVVD G X X A A A V A 0 A

o G X 0 V GOD DO

n 0 0 A 0 V X V F A VDAXX

n F A A F A V 0 V G G V F X A A V G G V F X 0 A F

o G V G A F GODF

V 0 V 0 0 AXDAA (110 letters) A V V G 0

o V 0 F Xo V 0 G F V A AGO X F 0 V A

I ;:. A 0 AGO A X F V G DOD A G V A V F G X X F 0 0

V G X F V 0 G GOA

Vo A G G Fo A X 0 X F F V G F

A X X A 0oF (182 letters)

o F X F 0n V V V 0 XFXFX F F F V A G FOX

A

V 0 A G Fo V 0 G F A 0 A A 0 F 0 V F G DAD F VX

F V F X G X 0 0 A G DVGVF

o G X X 0 F F GOG

X G V 0 0 V 0 0 F G F V GOD V F V A G X X 0 F V

o GODF V F A V 0 V FDA

0 G F V G V G G 0 F V

;I

o V V X 0o F 0 0 V G X G V 0 X G V G 0 X 0 G 0 X

o X A V F GAG A G A X 0 V 0 F X G V G DADO

X

A G X 0 A

o FOGX FOG G F V G X V V GOOD

A FXFDX V 0 A A 0

o F X 0 0 A F F A A F V FAG

G X V 0 G V 0 V G X

o 0 F 0 0 V A G A A

o GODF DAAGG FAXGV XXFXA

n G 0 F 0 G X GOA

n GAG0 F 0 0 0 0 X G V G V G G GOG X 0 F G F

o A X G V V V 0 A A G G V F G V A V F V AAGAX

A 0 (202 letters) G X 0 G A (130 letters)

VI XI

GOG F X A G V F Vo 0 X G X

o V 0 0 A XDAAX -VFDDV A X GOA

o F G G G G F GOD FXXDA

FAG V G

o X F F V

X FAD G F FOX A A F V X F FDDXG G A V G A GO V 0 FoF DOD G'A F A F

o F X F V GOG F X F 0 V V X V G 0 F V

n 0 V F 0

o A A A G V A V F G G V ADD GOD F G F V 0 0 A ... - _. ...

I F V V 0 V

o G G V F X F G V X F F V G V DOG 0 0n F G A Fo F V 0 0 F V V V A DAGDX FXXXF

DOG 0 0 A V G V X G A F F X F V DOD (120 letters) FOX G 0 FOG F 0oF GOA G F A A G GAD X 0

GVDGA V G V 0 F

o 0 F X G A G X F G V F V V 0

VII GVDXD F F F X G XGXAG A G V G 0 V V X G 'F

G A F G F F X F V F G F X A V A G G X 0 X X 0 0 F VDXDD XFVDD

X (186 letters)

A G V 0 0 V 0 V F F A 0 A V A V F V G G A 0 A A F XII

V F 0 F V DXFXX G 0 X 0 0 F V 0 F F X 0 V F X

V A 0 X V AXDVX A F F V 0 FOG X F

o G F 0 0 XFDFX V V 0 V 0 A V 0 A 0 V FAG

0 G V ADD

F V 0 V V A A F V F F V X 0 G F 0 0 V Ao 0 F 0 0 FDA A 0 X A 0 F V G V 0 G F X F GO V F V 0 0 0

o X F F A G F X F X A A G V 0 G G V 0 F G G G X 0

o G 0 V V A V V V F ADDAX A V F V Ao A X 0 V

F 0 F V A F F G F X GOA X 0 GOG G 0o A V 0 X GOD F A XDDGX G V F X A V X V F 0 G 0 X 0 F

.' A 0 F A F V F X 0 0 X V AGO V V 0 0 F XDGXX DVXAD V A V A V G V DOD A F 0 F An V F F V

o V F V F DOD 0 A A F 0 F XnX GOA A F V 0 F VGDAG F X 0 0 F A 0 V X Vn F X F F V V G F X

o V 0 0 V ADD V 0 V A V 0 G A F V F X F A A V 0 XGFVAV FAGGn A V V 0 XDXGDo V V A 0

o F V 0 (254 letters)

o 0 A G A A G X F G

o DOG V F G F V G V X G V F

VIII OFF 0 A A 0 V 0 0 X G 0 F 0

oV DOG A F G 0

(224 letters)

DG V V G F X G G G A 0 F A F VVVAX A V G G V

V 0 V G V V 0 A V Go GOG A V F 0 0 Ao 0 0 X X 43. IDustratioD of solutioD.

7

-a. Since the initial letters of all 12 cryptograms are in the

o X F V F X G V G G

o G 0 F G GOA 0 F

n 0 X A V same class, that is, either initial or final components, they may all be combined into a single

F 0 0 V F A 0 X G 0 A 0 G V A F F X A 0 FAD X 0 distribution. Furthermore, since it is certain that regardless of whether the transposition rectangle G FAD F DOG V 0 V X A V A o 0 X F F AGO X F has an odd or an even numberof columns the 3d, 5th, 7th . . . letters of the cryptograms are in

F V F G F G F 0 F 0 V 0 X X 0

o G G 0 (144 letters)

7 This illUBtration uses the same cryptograms and follows quite closely along the lines employed in a techi: nical paper of the Signal Intelligence Service entitled Qeneral Solution lor tAB ADFQVX Ciph6r, prepared by

Messrs. Rowlett, Kullback, and Sinkov, in 1934. ,.

'1
Flollllll: 65.

V

X

G

D

A

A

D

A

92

X

V

G

G

V A

D F

D

D

G

X

F

G

D

D

D

F

A

F

G D

D F

D

D

F A

F F

G G D D

D D X F

G

D

D

D

ADD V D D G

F D F D D D G

0.1 M 65 66 67 68 69

F D

F G

40 41

F G D V F V

F V V V A D

109 110 111 112 113 114 1111

X F

D X

D D

G F

V

D

D D FDA A A

ADD G D D F

85 86 87 88 89 90 91

D

D

X A A

V D X

G D

F V

F D X F V

G A V G V

V G

V D

G

F

G G X

G G G

152 111.1 154 1511 1116 1117 158 159 160 161

V

G

F

G

A

F

A

F

D D G V

G D V D

59 60 61 62

V F V

G G V

82 83 84

A

X

F

D

A X

G D

D

D

D

V

35 36 37 38 39

104 105 106 107 108

A

V

F

V

G A

G A

D

F

D

A

80 81

D

V

A

V

F D

D X

G

A

116 117 58

A F V D

D G V D

148 149 150 151

102 103

X

X

V

D

G D

F V

G

G

D

A

55

G V D

DAD

32 33 34

D

D

D

G

54

100 101

F A

G V

X

G

D

A

G A

X G

30 31

145 146 147

G X F

G V G

D G

G A

G

A

52 1i3

D

X

G X D

A G V

75 76 77 78 79

D

G

G D X A

DAD F

A F

V A

28 29

74

D D V

G X F

X F

D D

50 111

A

D

A V

F D

F

F

G

A

72 73

G A

D D

F

F

A

F 24 211 26 27

III. V F D

XI. X G A

III. FDA V D

XI. G X A G A

I!!.....!!

III. D A

XI. D X

III. D G G A

XI. G F A A

139 140 141 142 143 144

70 71

III. A D X

XI. G F V

93 94 95 96 97 98 99

III.G G X G G A F F V

XI. G D X F X X X F F

III. X G

XI. D A

47 48 49

III. A

XI. A

III. D

XI. V

181

116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138

e. The two distributions in figures 66 and 67 apply to the letters which come from column 1

of the transposition rectangles for the 12 cryptograms understudy. In this column, the V's and

X's fall predominantly in the odd positions, the F's fall predominantly in the even positions.

Therefore, beginning with position 1, the components in this column show an alternation of the

type 8c~ 82~ 8 1, By referring to figure 63 it will become clear that if class 1 components are

initial components, then it must follow that column 1 occupies an odd position in the transposition rectangle; but if class 1 components are final components, then it must follow that column

1 occupies an even position in the transposition rectangle. Which of these alternatives is true

cannot be ascertained at the moment. But theimportant point to be noted is thata definite reversal

in the type oj alternation oj class 1 and class 2 components indicates the transit, in thetransposition,

from the end oj one columnto the beginning of the next column. That is, if it is found that from the

beginning of the cryptogram the alternation of components is 81~ 82~ 8 1 and after a number

of letters this alternation changes to 82~ 81~ 8 2, the point where this change occurs marks the

end of column 1 and the beginning of the column 2. For the sake of brevity in reference, in the

subsequent paragraphs the type of alternation 81~ 82~ 8 1 will be designated as the"+ type,"

and this type of alternation characterizes columns which fall in the odd positions in the transposition rectangle i. e., in the 1Bt, 3d, 5th , 7th, ••• positions from the left. The other type,

8l1~81~82 will be designated as the" - type," and this type of alternation characterizes columns

which fall in the even positions in the transposition rectangle i. e., in the 2d, 4th, 6th , 8th , •••

positions from the left.

f. With these principles in mind, let cryptograms III and XI, each containing 186 letters, be

studied. They may be superimposed, since they have identical numbers of letters and therefore

the columns end at exactly the same points in both cryptograms.

1 2 3 4 II 6 7 8 9 10 11 12 13 14 III 16 17 18 19 20 21 22 23

Even (2d, 4th, . . .) letters

A D F G V X

lHJ '!IIJ '!IIJ lHJ /1/1 I

I

FIOUD 67.

F G V X

11/ lHJ 'It/, I'HJ

III I" t

FIOURa 66.

A D

11/ 'P

Odd (1st, 3d, ...) letters

Cryptogram Length Letters taken Cryptogram Length Letters taken

I 212 VDDGGGVF VII 254 GAFGFFXFVF

II 108 VDAA VIII 144 DGVVG

III 186 DAGAAFG IX 182 GDDDDXV

IV 110 ADXV X 130 DGDDF

V 202 DFXFDDVV XI 186 VFDDVAX

VI 120 GDGF XII 224 XFDFXVVD

180

c. Letters V and X are of high frequency in the odd positions (fig. 66) but of low frequency

in the even positions (fig. 67), whereas the letter F is of low frequency in the odd positions and of

high frequency in the even positions. There can be no question that the two distributions are

dissimilar, and the indications are clear tha.t the transposition rectangle involves an odd number

of columns.

d. Now the letters in figure 66 may be initial components, those in figure 67, final components, or the reverse may be the case. At the present stage of the study it is impossible to

ascertain which of these alternative hypotheses is correct. However, this information is really

immaterial at this stage. Suppose the letters in figure 66 are arbitrarily designated as class 1

components, those in figure 67 as class 2 components. Class 1 components (fig. 66) are characterized by a predominance of V's and X's (over their frequencies in fig. 67); class 2 components

(fig. 67) are characterized by a predominance of F's (over its frequency in fig. 66).

b. The odd and the even letters of these 12 sections are then distributed separately, the

results being shown in figures 66 and 67. A consideration of the mechanics of this system leads

to the expectation that if the transposition rectangle has an even number oj columns the two distributions will be similar; if it has an oddnumber, they will bedijJerent. The similarity or difference

between the two distributions is usually discernible with as few as 20 or 25 letters.

the same class as the first letter, the 3d, 5th, 7th ... letters may be added to the distribution,

so long as these odd letters come from the same section (column 1). It is; however, necessary

to limit the number of letters taken from the beginning of anyone cryptogram to a reasonable

length of column, depending on the size of the cryptogram. Assuming it is known that the

enemy is using transposition keys of not less than 15 nor more than 22 numbers, the latter could

be taken as the maximum possible size. But to be on the safe side it will be here assumed that

a transposition rectangle of not more than 25 columns is being used. Hence, so far as concerns

cryptogram I, which has 212 letters, on the basis of a key of 25 numbers [(25X9) -13=212]

there will be 12 columns of 9 letters and 13 columns of 8 letters. Since there is no way of telling

which are long and which are short columns, it will be safer to work on the basis of columns of

8 letters. Therefore, the first 8 letters of cryptogram I are to be taken. In the case of cryptogram II, with 108 letters, its first 4 letters will be taken, and so on, through the 12 cryptograms,

the number of letters to be taken in each case being governed by the length of the cryptogram.

The sections taken in the case of the 12 cryptograms are shown in figure 65.

I:

I '

I

i

I '

i j

II

f I
2 3 1 3

:::::. ;::: ""' - :::::::: .-.,; .' -...

Distribution of even letters

A, D F G V X

1- 0

FVVXGFXFDX. . -'

FXXDAFDDXG

3

III.

XI.

Distribution of odd letters

A D F G V X

On the basis of figure 69 normal (odd letters as 91'S, even letters as 92's):

0(3) +3(11) +3(3) +3(8) +0(11)+1(6)=72

72 72--=60

6

1(4)+3(10)+1(11)+4(5)+0(4) +1(1)=66 =66

On the basis of figure ~9 reversed (even letters as 91's, odd letters as 92's):

0(3)+2(11)+ 3(3)+1(8)+1(11)+3(6)=68 ' ... 68'

68--=57

6

1(4) +2(10) +2(11)+1(5)+ 1(4) +3(1) -=58 =58

Total= 122

Total= 115

133

Total= 126

On the basis of figure 69 reversed (even letters as 91's, odd letters as 92's):

1(3)+3(11)+1(3) +4(8)+0(11)+1(6)=77

77 77--=64

6

0(4)+3(10)+3(11)+3(5)+ 0(4)+1(1) _ 79 .79

On the basis of figure 69 normal (odd letters as 9 1's, even letters as 9 2's): . .

1(3)+2(11)+ 2(3)+1(8)+1(11)+3(6)=68

68 68--=57 ,6

0(4) +2(10) +3(1l) + 1(5) + 1(4) +3(1) =65 =65

J'IGUU 71.

1- 1

Total= 143

j. Now the frequency sums here obtained (126 VS. 143) indicate that an alternation of the

type 92-+91-+92 is in effect, that is, if a beginning is made with position 11, the type of alternation is "-". Since the type of alternation for the first 10 letters is "+" IlJId for the second

10 letters" -", the reversal in alternation would indicate that column 1 of the transposition

rectangle ends somewhere near the 10th letter. This same sort of reversal takes place after the

20th letter, as shown by the calculation in figure 71. . '.: ,.

These distributions, when evaluated in accordance with figure 69, yield a total frequency value

of 126; when evaluated in accordance with figure 69 reversed, yield a total frequency value of

143. The detailed calculations are as follows:

4 0

A D F G V X

1- 1 3

TotBl= 4 + 10 + 11 + 5 + 4 + 1 =35 letters

:rIGUU 70.

FIGURE 69.

A D F G V X

11 12 13 14 1Ii 16 17 18 19 20

DAFGGXFDXD

DFGGGGFGDD

Distribution of even letters

A D F G V X

::: :::: --

III.

XI.

Distribution of odd letters

A D F G V X

f- 0 3 3 3 0

'r9tal- 3 + 11 + 3 + 8 + 11 + 6 -42 letters

Since the odd letters have a total frequency of 42, the even, a total frequency of 35, for purposes

of equalizing the distributions in applying the weights it seems advisable to deduct one-sixth

from the total when applying the weights to odd letters.

i. Now in applying these weights to the letters, it must be borne in mind that since a transposition rectangle with an odd number of columns is involved, half of the letters are class 1 components, the other half are class 2 components. Hence, in finding the frequency value of the

letters it is necessary to apply the weighted frequencies to alternate letters in the sections, as

shown in figure 70.

132

1 2 3 4 5 6 7 8 9 10

III. D A G A A EGA G !

XI. !EDD!A~GDA

It is seen that there are 2 V's which fall in odd positions (1 and 5), but one V falls in an even

position (10). There is an X, which falls in an odd position (7); there are 2 F's which fall in even

positions (2 and 6). Unquestionably, then, the type of alternation, at least for the first 10

letters in each of these cryptograms, is +.

h. Take the next section of 10 letters in these two cryptograms. The letters are as follows:

11 12 13 14 15 16 17 18 19 20

III. DAEGG~ED~D

XI. D EGG G G E G D D

Here there are 4 F's; 3 of them fall in odd positions (13, 17, 17), and one falls in an even position

(12). There are 2 X's; one falls in an odd position (19), one in an even position (16). There are no

V's among these letters. So far as the evidence afforded by the F's is concerned, it would appear

that this section of text shows the type 2 or" - type" of alternation of components, since in

type 1 or II+ type" the F's occupy even positions and here the majority of them occupy odd

positions. But so far as the X's are concerned, the evidence is equally balanced: one Xfalls in an

odd position, one in an even position. There being no V's, no conclusions can be drawn from this

letter. To be guided solely by the evidence afforded by the 3 F's may be unwarranted. Is it

not possible to weight the frequencies of the letters so that it will be unnecessary to rely merely

upon a few of them and the evidence afforded by all the letters can be taken into account? Why

not assign frequency weights according to the two distributions in figures 66 and 67? The figures

then become as follows:

Odd (1st, 3d,. • .) letters Even (2d, 4th,. . .) letters

g. It has alreadybeen noted that beginning with the first letter of anyone of the cryptograms, the type of alternation for column 1 is +. It is therefore not astonishing to find, within

the first 10 letters, an alternation of the + type. Note how the V's and X's fall in the odd positions, the F's in the even. Thus:
o 2

=81

Distribution of even letters

A D F G V X

1- 1 3 3

0(4)+1(10)+5(11)+3(5) + 0(4) +1(1)=81

A D F G V X

Distribution of odd letters

1- 2 3 0 2 2 3

Total= 153

Weighted values of distributions:

On the basis of figure 69 normal (odd letters as 8t's, even letters as ~'s):

2(3) +3(11) + 0(3) +2(8) +2(11) +3(6) =95 95

95--= 79

6

1(4)+3(10)+3(11)+1(5)+ 0(4)+2(1)=74 - 74

On the basis of figure 69 reversed (even letters as 81's, odd letters as 82'S):

1(3)+3(11)+ 3(3)+1(8)+0(11)+2(6)=65 65

65--= 54

6

2(4) +3(10) +0(11) +2(5) + 2(4) +3(1) =59 - 59

Total= 113

Since the best values are obtained on the basis of figure 69 normal, the type of alternation for

the third section of 11 letters is 81-+82-+8h or II +".

III. V X G F X F D X 0 D A

XI. X D A F D, D X G G A V

Total= 159

Total= 118

185

On the basis of figure 69 reversed (even letters as 8 1' S , odd letters as 82's):

1(3)+3(11)+ 1(3)+4(8)+1(11)+2(6)=94 94

94--= 78

6

Since the distribution here begins with an even-numbered position (12), and the greatest

total is obtained on the basis of figure 69 reversed, the type of alternation for the second section

of 11 letters is therefore again 81-+82-+8h or II +".

THIRD SECTION (letters 23-33)

23 24 25 26 27 28 29 80 81 82 33

Weighted values of distributions:

On the basis of figure 69 normal (odd letters as 81' S, even letters as 82's):

0(3)+1(11)+5 (3)+3(8)+0(11)+1(6)=56 56

, 56--= 47

6

1(4)+3(10)+1(11)+4(5)+ 1(4)+2(1)=71 = 71

-~.

2 o

A D F G V X - ::::: ........ ......

Distribution of even letters

,- 5

Distribution of odd letters Distribution of even letters

A D F G V X A D F G V X

::: ::: - :::::

::::: - ,- 0 5 3 0 I- I 8 ., 2

Distribution of odd letters

A D F G V X

...... ::::::::- ,- 1 5 0 3 2

134

Weighted values of distributions:

On the basis of figure 69 normal (odd letters as 81'S, even letters as ~'s):

1(3)+5(11)+ 0(3)+3(8)+2(11)+1(6)=110 110

110--=92

6

5(4)+1(10)+2(11)+1(5)+ 1(4)+0(1)=61 =61

Total= 120

FIRST SECTION (letters 1-11)

1234567891011

III. D A G A A F GAG V D

XI. V F D D V A X G DAD

Total= 153

On the basis of figure 69 reversed (even letters as 8 1's, odd letters as 82'S):

5(3)+1(11)+ 2(3)+1(8)+1(11)+0(6)=51 51

. 51--= 42

6

1(4)+5(10)+0(11)+3(5)+ 2(4)+1(1)=78 =78

Beginning with the 21st position, the alternation is of type 81"-+82-+81 ; hence itis oftheII + "type.

Again the reversal in type of alternation occurs in passing from the 2d set of 10 letters to the 3d

set, and this indicates that column 2 of the transposition rectangle ends somewhere near the 20th

letter. But, fortunately, this time the exact location of the break is definitely indicated: The

simultaneous appearance of V and X in the sequent positions 22 and 23 leads to the idea that the

22d letter marks the end of column 2 and the 23d letter marks the beginning of column 3. There is

nothing oj an absolute naturein this point: Itis merely an indication based upon probabilities and

does not constitute a conclusive proof by any means. Now if there is this definite break at the

end of 22 letters it means that columns 1 and 2 must each contain 11 letters. The calculations

have heretofore been based upon sections of 10 letters and the results are therefore modified as

shown in the following calculation:

The type of alternation is 81-+82-+8h or "+".

SECOND SECTION (letters 12-22)

12 13 U 15 16 17 18 19 20 21 22

III. AFGGXFDXDFV

XI. F G G G G F G D D F X

.i I

I'

I

i

1 ;
A V G 0

X G F V

o V 0 V

A V 0 G

F X A A

G V 0 X

F V F 0

000 A

Even (2d, 4th,. • .) letters

A 0 F G V X

~'~ :::::

::::

i

Total = 9 + 15 + 14 + II + 7 + 2 - 55

F 0 A V 0 G X F V 0 A

G X A GAG V G 0 V V

GOA A 0 V 0 0 V A 0

F V 0 F

Cr)'ptogrBffi Length Letters taken Cryptogram Length Letters taken

I 212 VDDGGGVFDFVD VII 254 GAFGFFXFVFGFXA

II 108 VDAAVD VIII 144 DGVVGFXG

III 186 DAGAAFGAGV IX 182 GDDDDXVGVD

IV 110 ADXVFX X 130 DGDDFVF

V 202 DFXFDDVVVDX XI 186 VFDDVAXGDA

VI 120 GDGFXAG XII 224 XFDFXVVDVDAYQ

Total - 4 + 14 + 6 + 11 + 15 + 10 - 59

The new frequency weights are therefore as follows:

Odd (1st.. 3d,. . .) letters

A 0 F G V X

:::::

-

137

FIGURE72.-Contlnued.

FIGURE73.

111.0 F A 0 G G V

XI.O F F F X G X

VII.A F 0 F X 0 X

23 24 25 26 27 2S 29 30 31 32 33

III. V GOO V A V F 0 0 0 V FAG 0 F F

XI. V 0 F 0 0 F X GAG X F G V F V V 0

VII. V F X 0 0 X V AGO V X 0 G X X 0 V

V 0 0 F

FIGURE74.

III. V X G F X FOX 0 0 A

XI.XOAFOOXGGAV

VII. V 0 V F F A 0 A V A V

F V G G

177 178 179 180 181 182 183 184 185 186

III. X F G G .0 0 X GOA

n.o X 0 0 X F V 0 0 X

VII. A F V F X F A A V 0

o F V 0

Since the two totals are quite close together, no correction need be made of the nature of that

made in preceding calculations, where one-sixth was deducted from the total values of odd letters.

n. Beginning with position 23, in the case of cryptograms III and XI, the next 11 letters,

and, in the case of cryptogram VII, the next 15 letters are clearly of the u+" type of alternation. The data are as follows:

1I4 65 66

108 109 110

V F G 0

o F V V

X 0 G F

o 0 V A

X 0 F V

o 0 F X

o 0 F A

G V 0 0

62 63

106 107

60 61

A DO G V"A ,n 0 V 0

A G' 0 V OFI) "'F 0 0

o A .,A F V..,F ...D", F V 0

X F X X

n 0 0 A 'V F V DO F' t>'

V A V F G G V A,O n G

V'A 0 X V A X 0 V X A

F F V 0

F V F 0 A X GOO 0 G

F FOX G 0 FOG F 0

A A G VO G G V 0 F G

G G X 0

55 56 57

98 99 100 101, 102 103 104 105

IILO G A F G A V GOG X

XI.O G A F A FDA' A A' G

VII. G 0 X 0 0 F V 0 F F X

o V F X

III. V F V, 0 G" G X G G' A F

XI.V A OA G' 0 X F X X X

VII. 0 0 F 0 0 0 X:F 'FAG

F X F X

FIGURE 72.

111 112 113 114 '-115 ,'116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132

III. 0 A F 0 A D GG A ,,0 0 G 0 X A F V 0 FOX F.

XI. 0 'F "G" 0 AG F A A'G "G A -0 X 0 G V 0 G Av':i:f

VII. F 0 F V A F F G F X G G 0 "Q G' 0 "0 A V 0 X A'

o A X 0 0 F A F

III. V X G, f XFP X 0 0 A G

XI. X'DA"F ' 0" O'JC G G A V G

VII. V 0 V _F F AO A V A V A

F V G G

III. 0 A G A A F GAG V, 0 A F G G X F 0

XI. V F 0 0 V A X GOAD F G G G G F G

VII. G A F G F F X F V F ..G, A G,G X 0 X X

FX A V

'1S6

"

I

I,

]:

Ii
A D F G V X

:::

Distribution of even letters

A D F G V X

- 2 - :::: --

Distribution of even letters

f= 1 7 2 8

f- 3 4 6 4 0 0

Distribution of odd letters

A D F G V X

:::

f= Ii 4 4 2

Distribution of odd letters

A D F G V X

:::: - :::: :::: ::::

f= 4 3 3 4

3(4) +4(14) + 6(5) +4(11) +0(15)+0(10) = 142

4(9)+5(15)+1(14)+ 3(8)+ 3(7)+ 4(2)=178

Total=320

66 fIT 68 59 60 61 62 63 64 65 66

On the basis of figure 74 reversed (even letters as 8 1's, odd letters as 8 2's):

III. DDDAVFVDDFD

XI. V A V F G G V ADD G

VII. VADXVAXDVXA

F F V D

45 46 47 4H 49 50 51 52 53 M 65

III. DGAFGAVGDGX

XI. D G A F A FDA AA G

VII. GDXDDFVDFFX

D V F X

139

Weighted values of distributions:

On the basis of figure 74 normal (odd letters as Ot's, even letters as 02'S):

4(4) +5(14) + 1(5)+3(11) +3(15) +4(10) =209

3(9)+4(15)+6(14)+ 4(8)+ 0(7)+ 0(2)=203

Total=412

Since the distribution begins here with an even-numbered position (34), and the greatest total is

obtained on the basis of figure 74 normal, hence the alternation for the fourth section or column

is of the type 02~ 01~ O2, or 11_".

p. (1) The data for the letters beyond position 44 are as follows:

Since the distribution starts with an odd position (45) and the greatest total is obtained on the

basis of figure 74 normal, the type of alternation for the fifth section or column is 01~ Or+ 011

or II+".

q. The types of alternation for the first 5 columns, which are aJ1long columns, is therefore + + + - +. Since cryptograms III and XI contain but one short column, it is advisable

to be on the lookout for it as the work progresses. It is possible to continue with the process

detailed above. For example, the calculations for the next or sixth section of 11 letters are

shown below:

Distribution of even lettel'll

A D F G V X

::: §§ "'-

f- a 5 Ii 4 2

34 35 36 37 38 39 40 41 42 43 44

III. GAD D G V ADD'V D

XI. GAG D V D F D F D D

VII. A D A A F V F D V F D

XFXX

3(4)+8(14)+ 1(5)+0(11)+3(15)+2(10)=194

3(9)+5(15)+5(14)+ 4(8)+ 2(7)+ 1(2)=220

Tota.l=414

3(4) +5(14) + 5(5) +4(11) +2(15) + 1(10)=191

3(9)+8(15)+1(14)+ 0(8)+ 3(7)+ 2(2)=.!..86

Total=377

4(4) +4(14) + 5(5) +2(11) +0(15)+2(10) = 139

2(9)+4(15)+1(14)+ 3(8)+ 7(7)+ 3(2) 171

Total=310

2(4) +4(14) + 1(5)+3(11) + 7(15) +3(10) =237

4(9)+4(15)+5(14)+ 2(8)+ 0(7)+ 2(2) 186

Total=423

Distribution of odd letters

A D F G V X

:::: - :::: :::::

::::

f- a 8 1 0 a 2

138

/

Distribution of odd letters Distribution of even letters

A D F G V X A D F G V X

::::: - - :::: :::: - ::::: ::::: :::: :::: :::: :::::

f- 2 4 3 7 3 f- 4 4 Ii 2 0 2

On the basis of figure 74 reversed (even letters as 01'S, odd letters as 02'S):

On the basis of figure 74 reversed (even letters as 01'S, odd letters as 0'2'S):

Weighted values of distributions:

On the basis of figure 74 normal (odd letters as 01'S, even letters as 6JJ's):

Since the greatest total is obtained on the basis of figure 74 normal, the type of alternation for the

third section of letters is 81~ 02~ 8 11 or II + ".

o. Continuing the foregoing process with the letters beyond position 33, the data are as

follows:

Weighted values of distributions:

On the basis of figure 74 normal (odd letters as 01'S, even letters as 8 2's):

j
= A 0 F G V X

Distribution of even letters

A 0 F G V X

Distribution of odd letters

. Column

Assumption Summation of

+'1 and -'I

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

--- - - - - - - - - - - - - -

(1) 6th short___________________________ + + + - + + + + - + + + - - - - - 10+. 7-

(2) 7th short___________________________ + + + - + + - + - + + + - - - - - 9+, 8-

(3) 8th short___________________________ + + + - + + - - - + + + - - - - - 8+. 9-

(4) 9th short___________________________ + + + - + + - - + + + + - - - - - 9+. 8-

(5) lOth short_________________________ + + + - + + - - + - + + - - - - - 8+. 9-

(6) 11th short.________________________ + + + - + + - - + - - + - - - - - 7+. 10-

(7) 12th short_________________________ + + + - + + - - + - - - - - - - - 6+. 11-

(8) 13th short_________________________ + + + - + + - - + - - - + - - - - 7+, 10-

(9) 14th short_________________________ + + + - + + - - + - - - + + - - - 8+, 9-

(10) 15th short_________________________ + + + - + + - - + - - - + + + - - 9+. 8-

(11) 16th short_________________________ + + + - + + - - + - - - + + + + - 10+. 7-

(12) 17th short_________________________ + + + - + + - - + - - - + + + + + 11+. 6-

FIGURE 75.

'U. The correct assumption must satisfy the following conditions:

(a) There must be 9":-" and 8" +" columns.

(6) The short column must be" -".

324155--41----10

141

Assuming column 2 to be short, the letters of column 3 are X A V 0 A G F 0 V 0 G F.

f- 1 0 1 1 2 1 f- 1 3 1 1 0 0

Weighted values of distributions:

On the basis of figure 74 normal (odd letters as 81'S, even letters as 82's):

1(4)+0(14)+1(5)+1(11)+2(15)+1(10) = 60

1(9)+ 3(15)+1(14)+ 1(8)+90(7)+0(2)=

Total= 136

On the basis of figures 74 reversed (even letters as 81's, odd letters as 82'2):

1(9)+0(15)+1(14)+ 1(8)+ 2(7)+1 (2)= 47

1(4)+3(14) + 1(5)+1(11)+0(15)+0(10)=

Totol=109

Since the greatest total is obtained on the basis of figure 74 normal, the type of alternation is

8 1~82~81 and column 3 is a II+" column, which is consistent with the formula +++- +for

columns 1 to 5, as previously ascertained.

If all the foregoing reasoning is correct, and column 2 is the additional short column for cryptogram V, it must be the next to the last column of the transposition rectangle. Since it is a

U +" column, the last column must be a U -" one; therefore, there are 9 U -" columns and

8" +" columns. This definitely determines that the" -" columns are the odd ones, the U +"

columns the even ones, since in an odd-width rectangle there is one more odd column than even

columns.

t. The single short column which is common to cryptograms III, XI, and VII is one of the

columns beyond column 5. Assuming esoh possibility in turn, there is obtained for the type of

alternation in each column the distributions of"+" and" -" shown in figure 75.

1 2

- - ::::::

A 0 F G V X

Distribution of even letters

f= 0

Distribution of odd letters

A 0 F G V X

f- 1 0 II 0 0 0

1(4)+7(14)+ 1(5)+2(11) +8(15) + 1(10)=259

5(9)+4(15)+4(14)+ 1(8)+ 1(7)+ 2(2)=180

Total=439

On the basis of figure 74 reversed (even letters as 81'S, odd letters as 82's):

On 'the basis of figure 74 normal (odd letters as 8t's, even letters as 82's):

5(4) +4(14) + 4(5) + 1(11)+ 1(15)+2(10) = 142

1(9)+7(15)+1(14)+ 2(8)+ 8(7)+1(2) =202

Total=344

1(4)+0(14) + 5(5)+0(11) +0(15) +0(10) =29

0(9)+1(15)+1(14)+ 1(8)+ 1(7)+ 2(2)=48

Total= 77

On the basis of figure 74 reversed (even letters as 8t's, odd letters as 82'S):

1(9)+0(15)+5(14)+ 0(8)+ 0(7)+ 0(2)=79

0(4)+1(14)+ 1(5)+1(11)+1(15)+2(10) 65

Total=144

140

According to this calculation, column 2 of cryptogram V seems to correspond to the type of

alternation 82~81~82' that is U -". But from previous work it is fairly certain that column 2

is of the U +" type. Hence, column 1 of cryptogram V is probably not the additional short

column of that message. Assuming column 2 to be the extra short column, no such contradiction is obtained, for the calculation is as follows:

Weighted values of distributions:

On the basis of figure 74 normal (odd letters as 81's, even letters as 82's):

Since the distribution starts with an even position (56) and the greatest total is obtained on the

basis of figure 74 reversed, the type of alternation for the sixth section or column is 81""~82~8h

or U +".

r. But perhaps advantage should be taken of the availability of additional cryptograms,

For example, cryptogram V, of 202 letters, has 2 short columns [(17XI2)-2=202], whereas the

cryptograms thus far dealt with each have but one. That is, cryptogram V has one short column

in common with cryptograms III, XI, and VII, and one additional short column not possessed

by the latter. Can this additional short column of cryptogram V be located?

8. Suppose column 1 of cryptogram V is the additional short column. Then the letters of

column 2 'would be F X F X F F F V A G F D. These letters when evaluated on the

basis of figure 74 normal yield a total of 77; when weighted on the basis of figure 74 reversed,

a total of 144. The calculation is as follows:
V X Sums

FIGURC79.

G

2d component

A D F

I Q s U

74 3 61 2fl 164

------ T W C P

92 16 31 'D 166

------ G A N

16 74 79 169

X V J E B K

5 15 2 130 10 3 165

------ R M F L

76 25 28 36 165

------ D Z y 0 H

42 1 19 75 34 169

171 177 I 166 1115 158 183 1,000

D

A

V

X

Sums

8 The frequencies indicated as those given in fig. 3, p. 13, Military Cryptanalyria, Part I.

143

spective sections do not have to be distributed into odd and even letters. It is only necessary

to identify a section as being composed of initial components or of final components. This

analysis then produces a series of sections corresponding in number with the number of columns

in the transposition rectangle, This number will, of course, be even. By a careful study of

where alternations in composition of components (01 or O2) occur, the division of the text into

sections corresponding to long and short columns can be accomplished, The remaining steps

are obvious and follow the lines elucidated in paragraph 3ge-j.

y. The entire structure upon which this general solution rests is destroyed if the substitution

checkerboard has been consciously manipulated to equalize or flatten out the sums of the weighted

frequencies of the letters in its rows and columns. For example, note the following checkerboard,

which is not "perfect" but gives approximately similar frequencies in its rows and columns,"

z, If the statistical calculations upon which this general solution is based make use of the

logarithms of the frequencies instead of the frequencies themselves, much more accurate and

clear-cut data will be obtained.

I I I I I I-I I I-II::::: I::::: I 1-1-

-1-1-1-1 ,-

I I I I I

I-I 1-1-1

FI01TRE 77.

2d component

A D F G V X

A

j D

!:

V

X

E (et»=.0667X17X16=18.14

et> = 4

V I 9 K N G

- --------- 7 S C :3 R 0 --------- W H 8 T E 5

--------- L A .1 B 2 D

---------- 4 F 6 J 8 M

r------------- p Q u X y Z

2d component

A D F G V X

I I I I I

---I-I I I-II I I~I~I

:::::I~I I 1 1

I I I I I

I I-I I::::: I

A

FlGl'RE 78.

V

X

E (et»=.0667X17X16=18.14

et> = 22

x. All the foregoing details concern a case in which the transposition rectangle has an odd

number of columns. Now if the rectangle contains an even number of columns, this type of

solution is, of course, stilI applicable, and in fact is easier, since the letters of the text of the re142

16 5 7 6 9 3 14 1 13 II 17 10 4 12 t Iii II

V I KIN G S C ROW N HOT E L

2d component

A D F G V X

V

X

FIGURE7ll.

v. It is possible by introducing cryptograms with additional short columns to determine

more of the key. Thus, it was found by using cryptograms XII and VI that the first 3 numbers

of the transposition key are 16-5-7. But the process of ansgramming will yield the solution at

least as rapidly. In this process, of course, advantage may be taken of the fact that the columns

have been classified into the "+" and "-" types and no combinations of two "+" or two

" -"columns need be tested,since only combinations of the type"+ -" or" - +" are permissible.

'11'. The final transposition key and the substitution checkerboard are shown in figure 78.

Only assumptions (3) and (5), in which column 8 and column 10 are short columns, satisfy these

conditions. Therefore, column 2 is followed by either column 8 or 10. Testing the combination

2-8 for monoelphabeticity of bipartite pairs, the distribution shown in figure 76 is obtained.

When combination 2-10 is tested, the distribution shown in figure 77 is obtained. Obviously,

the 2-8 combination is the better.

I

I

I
2d comPODeut

1 2 3 4 5

SEA

, 3 1

5 3 2

SEA

, 3 1

5 3 2

SEA

4. 3 1(')

If a I

X B I

A T

1 2

2 2

A T

1 2

2 2

AT

1 2

I I

T I

LOS T , , , 2

1 2 5 2

LOS T , , , 2

1 2 5 2

LOS T , , , 2

1 I If I

U I WC

M A N U F

I---

C T R I G

I-------_ ...

B D E H K ---------1--

L- 0 p Q S

f----- --.------IV W X Y Z

REPORTED

2 3 , , 223 3

3 3 3 2 3 232

REPORTED

2 3 , , 2 2 3 S

aBBlalBI

EHHTDREI

FIGURE 1lO.

REPORTED

23"2233

33323232

P LAN E 4. , 1 1 3

al' / I'I' a

H M C E D

P LAN E , , 1 1 3

3 1 2 3 3.

Plain text O N E

Components__!' 1 3

2 3 3

c. Another and perhaps more simple way of accomplishing the same process is to set down

the bipartite equivalents horizontally and recombine them as shown below:

ONE P LAN E

13 33 .a 'I 12 13 33 .. V V 'V' V 'VI '\)' '\)' '\/'

C E H H M C E

145

The third process, that of recombination or recomposition, also involving a transposition, is now

to be performed and will consist in combining elements standing in diagonal relationship to the

right, that is, as shown by the arrows below:

The results are identical with those obtained from the preceding manner of operation. The

text is of course sent in 5-letter groups.

d. Instead of using the digits I, 2, 3, 4, 5, as the bipartite components one can use the

vowels A, E, 1,0, U, or Rny other characters that are deemed suitable. Perhaps digits are best

as they are less likely to be confused with letters of the text. .

e. As intimated above, the checkerboard used for-the recomposition may be different from

that employed in the decomposition. But it will be shown that the additional safety affo~ded

by Using two different checkerboards is somewhat illusory, and is by no means as great as may

appear on first consideration.

Plain O N E

Components.Y)' 11' 3)' h a a Cipher c E H

giving the pairs 21, 33, 34, 34, 11, 21, 33, etc. There are left, at the end of the process, one

element in the upper line at the extreme left and another element in the lower line at the extreme

right, yielding the pair 24, which may be placed at the head or tail of the resultant combinations)

as preagreed, The last or fourth process, that of recomposition or substitution, is to replace the

new pairs of components by letters from the original or a new checkerboard. If the same

checkerboard is used, it yields the text shown herewith:

,

"?

Paragraph

SECTION X

SOLUTION OF BIFID FRACTIONATING SYSTEMS

144

Review of principles underlying the cryptographic method________________________________________________________________ 44

Example of a simple bifid cipher___________________________________________________________________________________________________ 45

Principles of solution__________________________________________________________________________________________________________________ 46

Example of solution .___ 47

Special solution .____________________________________________________ 48

Periodic bifid ciphers . .__ _ 49

General principles underlying the solution . :__ .'10

Ascertaining the length of the period ._______________________________________________________________ 51

Illustration of sol11tion . . .___ 52

Special solutions for bifid systems_________________________________________________________________________________________________ 53

Solution of trifid systems . . ._____________________ 54

Concluding remarks on fractionating systems______________________________________________________________________________ _ 55

Concluding remarks on transposition systems . .__________________________________ 56

44. Renew of principles underlying the cryptographic method.-8everal bifid fractionating

systems have been explained in previous texts of this series.' In certain of these systems four

basic steps are involved, two of substitution and two of transposition. These steps may be

briefly described as follows: (1) A process of decomposition (substitution), in which each plaintext letter is replaced by two components, e~ and e~, of a bifid or bipartite alphabet; (2) a

process of separation (transposition), in which the e1e: components originally paired together

are separated; (3) a process of recombination (transposition), in which the separated components are combined to form new pairs; (4) a process of recomposition (substitution), in which

each new pair of components is given a letter value according to the original or a different bifid

alphabet.

45. Example of a simple bifid cipher.-a. One of the simplest bifid fractionating systems

is that exemplified in the following subparagraphs. It will be employed to set forth certain

principles in the general solution of systems of this and similar nature.

b. Given the 25-cell substitution checkerboard shown in figure 80, let the message to be

enciphered be ONE PLANE REPORTED LOST AT SEA. The first step is to replace the plaintext letters by the bipartite equivalents, the two elements or components being set down vertically beneath the plain-text letters. This represents the first two of the four processes referred to in paragraph 44, the first being that of decomposition or substitution, the second, that

of separation or transposition, represented by the manner in which the two bipartite elements

are set down vertically (instead of horizontally), thus separating the two elements from their

normal horizontal juxtaposition.

1 See Special Text No. 166, Adflanced Military Cryptography, sec. XI and Military CryptanalyBi8, Part I,

sec.. IX.. "
w !LJ D D R P E C

:<.

. :1· y T H E Y T T H E H A (B) (B) 54 22 M 33 54 22 22 84 33 34 12

0 !LJ K T R P E L

(1) (2)

o R M I 42 23 11 24

T B A

(7)

R

23

o

U

14

U B

(6 )

L P

41 43

Plain _

Cipher _

d. Note the following encipherments:

A 3-letter plain ten repetition appeers as a 3-letter cipher text repe- A 3-letter plain-text repetition appeers as a 3-letter cipher-text repetition. tltion becausethe 1stcomponentsofthe Dg and Hg happen to be Identical

(D and Hare In same row In obeckerboard).

14i

Here the B, is preceded by letters (U and T) which not, only art' not in thr-same column ItK t'iose

in the corresponding position in the case of the first five' enoipherments, but. also those two letters

are themselves in different columns. The cause of this is not. difficult to sec. It is merely that

the second component of the Pp and the second component of the Rp happen to be identical, the

first component of the Up and the first component of the Mp also happen to be identical, thus

producing the same cipher letter in both cases. This is a phenomenon which must happen by

chance a certain number of times, a number which is dependent not only upon the mechanics

of the system but also upon the exact composition of the checkerboard. Disregarding for the

moment the latter factor, it is obvious that if the checkerboard is perfectly balanced, the bifid

element 3, for example, should occur 20 percent of the tim,e as ~e first or as the second element

of a bifid pair, since there are 5 elements and each can theoretically appear an equal number of

times. However, since the checkerboard is not perfectly balanced, the bifid element 5 can, in

the case of figure 80, appear as a second component of the bipartite equivalent of a cipher lettel

only very rarely, since it corresponds to the first component of the bifid equivalents of the letters

V, W, X, Y, and Z, all of which are of low frequency. On the other hand, the bifid element 3, in

the case of figure 80, can appear very frequcntly as a first component of the bifid equivalent of

a cipher letter because it is the second component of the bifid equivalents for the high-frequency

plain-text letters N, R, snd E, which are all in column 3. However, since the exact composition

of the checkerboard is unknown when cryptograms of this sort are to be solved, frequency

weights can, of course, not be assigned to any of the components or bipartite elements and it

will have to be assumed that each one has an equal probability of occurrence, that is, one-fifth.

e. From the foregoing discussion it is obvious that it would be unwise merely to study the

prefixes and suffixes to identical single letters of the cipher text in an attempt to solve cryptograms of this sort, for the disturbing effect of the accidental identities of certain cipher letters

would be sufficient to retard solution. A few detailed examples of the type of study that must

be made in connection with repetitions in such systems as this will now be given.

f. It was stated in subparagraph a that the mechanics of the system tend to reduce by one

character the lengths of the repetitions in the cipher text. The expression II tend to reduce"

aptly describes the situation, for not only can it happen that a 3-letter repetition in the plain

text may appear to remain a 3-letter repetition in the cipher text, but also it can happen that

a 3-letter repetition in the plain text may even appear as a pseudo 4-letter repetition in the

cipher text. Study the following examples (based on fig. 80) and note what happens in each case:

F THE C THE D A M 22 M u M

:E

C E N 0 SEN D R E N C HEN A TEN Y

2 '3T 4 to '3T 3 2 '3T 2 3 3T 1 2 '3T 6

)'l )'l )'l )'l )'l )'l

1 3 3 2 6 3 3 2 3 3 3 1 4 3 2 3 2 3 3 to

N~H X~E E~D P Ii B RIiK

(l) (2) (3) (4) ( 5)

146

46. Principles of solution.-a. Note the following skeleton eneipherments, using the

checkerboard shown in figure 80:

These five eneipherments have in common a plain-text digraph EN. The five cipher versions,

however, have only a single letter in common, B. This is, of course, a phenomenon already

encountered many times by the student and its cause is easily understood by him: The mechanics

of the system tend to reduce by one character the lengths of the repetitions in the cipher text,

as compared with their lengths in the plain text, a trigraphic repetition in the plain text manifesting itself 8S a digraphic repetition in the cipher text, a tetragraphic one becoming a trigrsphic,

and so on. More will later be stated on this phase of the matter.

b. But now study the individual cipher letter immediately preceding and succeeding the

cipher letter which these five encipherments have in common. They are as follows:

Letters preceding Bo N, X, E, P, R

Letters succeeding Bo H, E, D, B, K

Reference to the checkerboard discloses the very interesting and important fact that the letters

preceding the cipher repetition (Bo) all come from the same column in the checkerboard, the leuere

8ucceeding the repetition all come from the same row in the checkerboard. How this phenomenon

is brought about is quite simple to see. Take the first of the five examples, that in which

C E N Op produces N B Ho. The No is the result of combining the second component of the

bipartite equivalent of Cp with the first component bipartite equivalent of Ep , yielding the combination 13, which is N. No matter what the other three letters in the plain-text tetragraph

may be, if the second letter is Ep, the second component bified equivalent of the first letter of

the cipher trigraph must be a 3. This means that this first letter of the cipher trigraph must

come from column 3 of the checkerboard. Exactly which row this letter will come from is determined by the identity of the second component of the bifid equivalent of the first letter of the

plain-text tetragraph. Hence, since the 5 tetragraphs in the example all have the same plaintext letter in the second position, the initial letters of the cipher trigraphs all must come from

the same column of the checkerboard. It is unnecessary to go through the reasoning, which is

parallel, in the case of the third letters of the cipher trigraphs: these all must come from the

same row of the checkerboard.

c. A good understanding of the phenomenon just noted can certainly be employed to

advantage in solving this and similar types of systems, for it becomes obviou8 that a careful study

of the leuer« immediately preceding and following cipher repetitions should facilitate a reconstruction

of the checkerboard employed in the substitution.s Indeed, if there were no other phenomena to

disturb this very simple relationship, solution would be quite easy. .All that would be required

would be to study the prefixes and suffixes to all the A's, B's, C's, . . . in the cryptogram, find

the letters which belong in the same columns and rows of the checkerboard, and the reconstruction of the latter would follow very simply. Unfortunately, however, there is a disturbing

phenomenon which must now be considered.

I The principle involved in such reconstruction was, to my knowledge, first pointed out and successfully

employed early in 1938 by Associate Crypt&na1ysts S. Kullback and A. Sinkov.
A 3-letter plain-text repetition appears as a 3-letter cipher-text repetl- A 3-letter plain-text repetition appears lIS 8 4-letter cipher-text repetlon because the second component of the N. and R. happen to be iden- Htlon because the phenomena of case 2 and case 3 occur simultaneously

tical (Rand N are in same column in checkerboard). (0 and Dare in same column: II and Nare in the same row In the checkrrboard).

g. From a study of these phenomena the rule maybe deduced that an n-letter repetition

in the plain text is really reduced to an (n-l)-letter repetition in the cipher text, but it can happen

fortuitously 8 that the real repetition is extended on either or both ends of the repetition by a

pseudo-repetitious letter. Hence, a 3-1etter plain-text repetition may appear as a 2-, 3-, or

4-1etter repetition in the cipher-text.

h, It is therefore possible to make wholly erroneous deductions from some repetitions, especially if the latter are short. Note for instance the following example, still using Fig. 80

as a basis:

Here are 2 sequences of 5 cipher letters, identical save in the central letter, and yet the 6-1etter

plain text sequences have only 2 letters in common. This example is cited to show that the

cryptanalyst must be very careful in respect to the deductions he may make in the case of short

repetitions. In the example cited it happens that the accidental repetitions are such as to make

the sequences as a whole almost appear to be identical.

i. It is these pseudo-repetitious elements which complicate the solution of what would

otherwise be a simple system. To illustrate what is meant, note that in case (1) of subparagraph

j the letters Wc and 00, the prefixes to the repetition RP0; do actually come from the same column

of the checkerboard; the letters Do and Ke, the suffixes, do actually come from the same row.

But now note in case (2) that while the prefixes Do and Te come from the same column, the suffixes Co and L, do not come from the same row. Note also in case (3) that while the prefixes

Le and To do not come from the same column, the suffixes, Do and Be, do come from the same row;

while in case (4) the prefixes turn out to be the same letter, Te (which constitutes an example

where the two prefixes come from the same column) but the suffixes, Moand Eo, come from different rows. Since the exact length of the real repetition, without its pseudo-repetitious elements,

does not readily manifest itself in the cipher text (although in favorable cases it may be deduced

by a careful detailed analysis and comparison with nearly similar repetitions) the nature of the

difficulties confronting the cryptanalyst become apparent.

[. The nature of the detailed analysis and comparison of repetitions referred to above may

. require a few words of explanation. Suppose that a cryptogram shows many occurrences of

RPe (=THEp in the foregoing examples). It would indicate a high-frequency plain-text trigraph,

A few repetitions of such cipher trigraphs as RPEe, DRPe, TRPBo, would lead to the surmise that

the latter are of the type where pseudo-repetitious clements have crept into the picture and there-

• Strictly speaking, of course, not really fortuitously. It depends upon the exact letters which precede or

follow the plain-text repetition and the exact positions these letters occupy in the checkerboard.

N

13

L

I

24

T H R

22 34 23

R 0

14 15 16

F THE

15 M 33

L W R P

ON D E

42 13 32 33

Q C E R

C

10

o

o

42

9 10 11 12 13 14 15 16

Q

Q

9

I

24

I

24

8

T

8

T

T

T I 0

24 42

T Q C

T

22

7

o

o

7

I

I

24

6

6

W

W

S I

45 24

W 0

S

45

S

46

5

5

I

I

o

42

o

42

4

4

P

~3

3

3

o R P 0 SIT ION L U 23 U 24 24 n 14

T H H I W 0 T Q C H M

H E P 0 SIT I

34 U 24 24

P H H I W 0 T

I S P 0 SIT ION 0 F

24 U 24 24 u u

Q Y H I W 0 T Q C H C

U R P 0 SIT ION S A " 23 U 24 24

o H H I W 0 T Q C H V

o

42

2

2

I

I

(4)

(3)

(2)

(1)

A

12

T

1

1

C

C D I

D

W

52

TAL P 0 SIT ION T I F LIS

n u u 46 24 22 24 24 U n 24 46

C I U H I W 0 T Q C D T L Y A Q

o N T

42 13 22

N

13

(4)

(2)

(3)

(1)

First, the 7-1etter cipher sequence H I W0 T QC is common to all four ceses: if only the cipher

text were available, one could conclude that the plain-text repetition consists of 8 letters. Second,

the letters Hand Y probably come from the same column in the checkerboard, but as for 0, P,

and T, they mayor may not come from the same column, most probably not. (Actually, 0 and

T do, but P does not come from the same column as these 2 letters.) Third, the letters Hand E

probably come from the same row in the checkerboard, but as for V, C, and M, they mayor may

not come from the same row, most probably not. (Actually, all 3 letters come from different

rows.)

k, Note the following cases of encipherment: The fact that the 7-1etter cipher sequence is

common to all four cases means that the plain-text repetition consists of 8 letters.

149

fore the cryptanalyst should be very hesitant to assume that the adventitious prefixed letters

are in the same columns, or that the adventitious suffixed letters are in the same row. In fact,

he would be warranted in tentatively assuming the very opposite condition, that they are not

in the same columns or rows, respectively. The conclusions derivable from a study of short

repetitions can be carried over to the longer ones. Note the following four cases from which

several conclusions may be reached:

.~

E T R P B E

(4)

I T R P B M

N D THE N E

34 33

T 0 THE M A

34 "

(B)

(A)

S 0 M E D U (TY)

45 42 " 32 14

Y C N D C

148

(3)

T D R P B

L D R P D

o R THE U

23 22 34 33 14

I N THE G

24 13 22 34 33 25

F 0 U R D A (YS)

15 42 14 23 32 12

Y COD C

(B)

(A)
;1,:

150

The pseudo-repetitious letters, I in the third position in cases (1) and (2), and the letters

Y" and U" in corresponding positions in cases (3) and (4) mean that I, U, and Y, come from the

same column of the checkerboard. The I" in position 2, in cases (I), (3), and (4) and the 0"

in the corresponding position in case (2) indicates that I" and 0" are probably in different columns

in the checkerboard. In position II, the Ho, Bo, and De give indications of being in the same

row of the checkerboard. In position 14, W" and Y" likewise give indications of coming from the

same row. But note now that from position 12 it may be deduced that W, A, and T come from

the same column of the checkerboard. These are examples of the type of detailed analysis

that the student should follow in his attempt to solve a problem of this sort.

l. In general it may be said that when the repetitions are numerous and fairly lengthy, that

is when there is a good deal of traffic all in the same checkerboard, and repetitions of tetragraphs

and better are plentiful, solution should be relatively easy. In fact, with a fairly large amount

of traffic, most of the work involved would consist in listing the 2, 3, 4 ... letter repetitions.

Then a chart would be drawn up to show the associations which the prefixes make among themselves and the associations which the suffixes make among themselves. For example:

X A B Q

NABR

Z A B T

NAB Q

LAB I

Z A B T

Here it is noted that L, N, X, and Z appear as prefixes to repetitions. The letter X is "found in

company" with N twice; the "association value" of X and Nis 2 units. The association value of

Z and Nis, however, 4 units, for the N occurs twice and so does the Z. The association value of

LX or LZ is 1 unit; that of LN or LZ, 2 units. Thus, the association value for each combination

can be studied in all the repetitions and, of course, when the value is high for a given combination it indicates that the two letters really belong together, or in the same column of the checkerboard.

m. What can be done with but one or two relatively short cryptograms depends largely

upon their lengths, the number of repetitions they happen to have, the exact construction of

the checkerboard, and the ingenuity and patience of the cryptanalyst. Once the letters that

constitute the columns and the rows of the checkerboard employed in the recomposition are

known, the proper assembling of the columns and rows is a relatively simple matter. If a keyword has been used as the basis for the distribution or mixing of the letters, naturally the reconstruction of the checkerboard is much facilitated. If not, then either the original or an equivalent checkerboard may be reconstructed. Having the recomposition checkerboard at hand,

the determination as to whether it is the same as that used in the decomposition follows directly.

If not the same, the reconstruction of the decomposition checkerboard is a relatively simple

matter.
tl

Ie

cr

i

-

21

2B

IB

ID

lL

2D

II

2F

IG

IH

1 2 3 4 Ii II 7' 8 II 10 11 12 13 14 15 III 17 18 III 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

EWVRVSDDTW

DWVRVSDDTI

RWVRVSDDTNULQDUB

GUHKIRXYIRNGTIWAUUIAAQCWN

PWVRVSDDTNULQDUHKIRXYIRNGTIWAUUIAAQCQDTQ

XWVRVSDDTNULQDUHKIRXYIRNB

LKIRXYIRNGTIWAUUIAAQCQDTV

KIRNGSTLBDDTI

NIRNGSTLBDDTW

TWAUUIAAQD

..". ~~.. ..

. ~:- f

.---------------.--------------------------------------------------------------r.,--Q-i'--T-i-r;-w--y-i--W--i-N--i-N-"B-D-i-Q--------IH----~-----

WSAVI U

Q S A V N I I U H Q D T X W 1 IE

T A V N N 1 IF

Q A V NIl U H Q D T X D WY 1 WX N 1 N B D R W 2G

LQDTXCWSCIVDTNILVN

D L Q D T X WS C L P lK

C Q 0 T Z IJ

NIL V NOD NUL Q DUB G 21

R WV R V S DDT NUL Q DUB I IB

XWVRVSDDTNULQDUHK

'>:J, L L Q D U K 2C

-. ~";~-----------------------------------------------------------------T--i-T--i--N-i-ti-D--C-U--W--W--O--C--------------------------------lC----------

.:.•,;~ ..------------------------------------------~--~-~-~--~-~-~-~--~-~-~-~-~-~-~-~-------------------------:~--------- .; ~.; «». D N B A X lA

.;. t"0.\ . R N BAY 1 I 1 2E , ..'1':' . T E WAY 1 I L 2E

,;:1:., 1 E WAY U L Q IE

t-'------------------------------------------------------------------------------------------------------------------------------------------------------------------ ,.'f ' Y I 1 I GTE WAY I 2E

. '~,' B I E WAY U IE ..'! Q V E W C W S II

lISD C Y I WV E WD N B IA

. . B GTE WV R 21

T X D WY I WX N I N IH

~--------------- -------------------------------------------------------------_......------------_..-----..-----------------------_...----_...------------_...----_...-------_.....--- A I N B

KIN D

W A X L

B A X W

IB

2A

2A

2A

FIGURE 81.

1 2 3 4 5 6 7 8 9 ill 11 a n 14 W U ill 23 24 $ 28 29 30 M 33 U 35 38 40

E WV R V S DDT W 21

DWVRVSDDTI

R WV R V S DDT NUL Q DUB IB

G U H K I R X Y 1 R N G T I WA U U I A A Q C WN ID

P WV R V S DDT NUL Q D U H K 1 R X Y 1 R N G T I WA U U I A A Q C Q 0 T Q lL

X WV R V S DDT NUL Q D U H K 1 R X Y 1 R N B 2D

L K 1 R X Y I R N G T I WA U U 1 A A Q C Q D T V II

K 1 R N G S T L B DDT I 2F

N I R N G S T L B DDT W IG

TWAUUIAAQD IH
151

47. Example of solution.-a. Suppose the two following cryptograms suspected of being in

the same key are at hand:

No.1

Line

A I S Dey I Vi V E Vi D N B A X Vi S A V I Vi I L T K

B X L Y I Vi D A I N B D R Vi V R V S DDT NUL Q D

C UBI N R K V L Q D N L Q D T V TIN I N D C U Vi

D Vi D C V S ODe G S ISS G U H K I R X Y I R N G

E T I Vi A U U I A A Q C Vi N B I E Vi A Y U L Q S A V

F N I I U H Q D T X W I T A V N N I N D C U WVi C G

G T L G Vi W A L Vi D S N S I L N N I R N G S T L B D

H D TWA U U I A A Q D GTE L Q D T X D Vi Y I Vi X

I N I N B D R Q T Q V E Vi C Vi S C L PIT L K I R X

J Y I R N G T I Vi A U U I A A Q C Q D T Z I I Vi V T

K I N I N D C U Vi Vi D S NIL V NOD L Q D T X Vi S

L C L P WV R V S D D T NUL Q D U H K I R X Y I R

M N G T I Vi A U U I A A Q C Q D T V

No.2

Line

A I WI L T G S I H W Vi A Vi K I N D C U W WA X L X

B D I Vi I R C V NOD N G S L N GIG WL V F D WV

C R V S D D TIL L Q D U K D Vi S S H X S ENe Q D

D T Q GTE U D V Q C o I Vi T X Vi V R V S DDT N U

E L Q D U H K I R X Y I R N B A Y I I I G T E Vi A Y

F I I L WN K I R N G S T L B D D TIT I L U D V L

G V T T A Q A V N I I U H Q D T X D WY I WX N I N

H B D R Vi S C L P L W A H N T L Q D T X C Vi SCI V

I D T NIL V NOD N U L Q D U B GTE W V R V S D

J D T Vi

b. A careful and detailed listing of significant repetitions is made, these to show the singleletter prefix and suffix in each case. A partial list of the many repetitions present in the two

cryptograms is given in figure 81.

c. Consider the first set of repetitions listed in figure 81, as extracted and shown in figure 82.
152

According to the principles elucidated in the preceding paragraph, it would seem that the

following tentative deductions may be made from the data contained in the columns of figure 82:

(1) From column 1: E, D, R, P, X belong in the same column of the checkerboard.

(2) From column 10: W, I, N belong in the same row.

(3) From column 14: D and G belong in the same column.

(4) From column 16: Band H belong in the same row.

(5) From column 16: Hand L belong in the same column.

(6) From column 21: Y, K, N belong in the same column.

(7) From column 25: G and B belong in the same row.

(8) From column 27: I and T belong in the same column.

(9) From column 33: I and Wbelong in the same row.

(10) From column 36: C and D belong in the same row.

(11) From column 37: Wand Qbelong in the same row.

(12) From column 40: Q and V belong in the same row.

It would be most fortunate and unusual for all these tentative deductions to be correct, for the

disturbing effects of accidental adventitious repetitions have not been taken into account as

yet. But let an attempt be made to assemble the data deduced thus far, to see if they can all

be reconciled.

d.Tentative deduction (1) indicates that E, D, R, P, and X belong in the same column of

the recomposition checkerboard. If correct, the complete set of 5 letters of one column is at

hand. But tentative deduction (3) indicates that D and G belong in the same column and this

would mean that the column has 6 letters, which is impossible. Further evidence will be required to corroborate the hypothesis that E, D, R, P, and X are all actually in the same column,

or that Dand G are actually in the same column. For this purpose, further study must be made,

and it is convenient to compile an II association table" showing how often certain letters are

associated among themselves as prefixes to the repetitions. A similar association table is made

for the suffixes. The tables may be combined in a manner similar to that shown in figure 83",

where the prefixes to repetitions appear at the left of the central alphabet, the suffixes to thc

right.

Take column 1 of figure 82, having D, E, P, R, and Xas prefixes to along repetition. A stroke

is placed in the E, P, R, and X cells of row D; a stroke"is placed in the P, R, and X cells of row E;

a stroke is placed in the R and Xcells of row P; and finally a stroke is placed in the X cell of row R.

Again, take column 16 of figure 82, reading B H H H L. The B need not be considered, since it is

not a prefix to the repetition beginning K I R X Y ..., but the H and L may be considered.

In the L cell of row H three strokes are inserted to indicate that Hand L are associated that

many times. Each time a datum is obtained, it is added to this table. Figure 83 shows the

appearance of the table after all the data obtainable from the repetitions listed in subparagraph b

have been inserted. From even this small amount of material a few deductions can be made.

For example, it is seen that the B line of the table for prefixes shows 5 strokes at Gand 3 strokes

at W, from which it would appear that B, G, and Wmay be in the same column. The letters

C and L likewise seem to be in the same column, as do Hand L, making C, H, and L appear to

be in the same column. Studying the table of suffixes, it would appear that B and H are in the

same row; I and N are in a row. After the entire text has been examined and the prefixes and

suffixes distributed in this way, the whole table is studied carefully with a view to eliminating

the effects of the accidental or pseudo-repetitious letters, trying to locate those letters which

represent the prefixes and suffixes of true repetitions.
F,011BII83.

3~4155---41 (~"I(!c I', 1(2)

--------------------------------------------------------------

I

K

E

F

A. BCD E F G H I K L M N 0 P Q R STU V W X y Z

------------------------1- III

----------~---------------------- III

~-------------------------

~--------------------------------

I I

1------------------------------

I

1--------------------------1-

1---------------------------------

1-------------------------------

1-------------------------------1- if

1-------------------------1-

(Letters ill same row)

Q I---------~------- --------1-

SUl"FIXES

o

A. BCD E F G H I K L M N 0 P Q R STU V W X y Z

y 1-----------------------------1-

X

I

L 1---====================1 =-=1= L

A. ~I---___ _- -'_I__I I_!_.I_ A.

: -- I lfjJ-7/-_ __1--1- -L-H- :

D ~--I- - ---1-1 - ----1-1- D

~- - ----- -----1- E

1--------------__- _ F

U

V 1----------'-------------------------

W

R

G ---------1------------,--,-----1- G

H : -I__- ==1==11= H

I 'fJ I II I

----------------

A. BCD E F G H I K L M N 0 P Q R STU V W X Y Z

------------------------1-

~------------------------I-

~---------------------------

-------------------------1- I I I

(Letters in same eolumn)

PREl"IX....:S

-------------------------1-

~-----------------------IM

~-----------------------IIII 1- N

------------------------1-

-----------------,-----------/ --P

~-----------------------I-

" I I

1---------------------------1-

1---------------------------

M

N

o

P

Q

R

S

T

U

V

W

X

y

L-..:._~~_I._..:.__!_~_I._.:..._!_~_I._.:.......:...__:._:.._.:.......:...~_:.._~~......:._:.._IZL......J_.._l.___:._J_..:._...l___.Io ...:.___:..._l._..!._I.-.:.......:...-.!.-~...!-....J...--!. L-..L...-l.---!.---J

1-------------------------- '&It~ - ~I 7/

~------------I---------------------IIIIIK

~------m-----------m----I-

-------- --------------------1-

~------------------------ "

1/ S

1----------------------,---1-

T ------------------------1-

A. BCD E F G H I K L M N 0 P Q R STU V W X y Z

II

------~--------------m--­

~-----------------------I- 11/ 1/ I I

------------------------1- I III I I II III I

A.

B

C

D

E

F

G

!.. H s

-~, I

K ~. ":

L

M

N

0

p

Q

R

S

T

U

V

W

X

Y

Z

.. i,t
153

e. Suppose the data have been reduced to the following:

J. Only 6 letters remain to be placed in the checkerboard. But there are enough letters

already placed to warrant an immediate attempt at decipherment. For example, take the

first few groups of message No.2 and replace the letters by their bipartite equivalents:

3 4 5

FIoURB 84.

21

W I L N

I---------- T U

r--- -------- 5 D C A f----------- B G H K

",---------- 5 Q V X Y Z

1

';; 2

! I· s. . El 3

8

Letters belongingIn same columns Letters belongingIn same rows

( 1) D, G, U ( 1) G, B, H, K

(2) H, L, C (2 ) I, W, N, L

(3-) Y, K, N (3 ) D, C, A, 5

(4) W, Q, 5, T, B (4) Q, V, X, Y, Z

( 5) T, U

I W I L T G 5 I H W W A W K I N D 12 11 12 13 21 42 31 12 43 11 11 34 11 44 12 14 32

Recombining the bifid elements:

.1 21 11 21 32 14 23 11 24 31 11 13 41 14 41 21 43 2.

Substituting by means of figure 84:

.1 21 11 21 32 14 23 11 24 31 11 13 41 14 41 21 43 2.

T W T D N '1 W '1 5 W L B N B T H

The presumption that Q, V, X, Y, and Z are all in the same row leads to the assumption that

the mixing of the checkerboard is based upon a key word or key phrase. Following up this

hypothesis, the data are assembled in the following manner:

2d component

Obviously the decomposition and recomposition checkerboards are different. But the reconstruction of the former is not at all difficult, since the text is now in monoalphabetic form. The

message hegins with a group showing a repeated letter in the first and third positions: is the

1st word ENE M Y? Probably it is, for message No.1 also contains the sequence W I L T.

At any rate, a transcription of the cryptograms into the bifid equivalents given by the nearly

complete recomposition checkerboard (fig. 84) soon yields sufficient monoalphabetic text to

permit of the complete reconstruction of both checkerboards:
155

No.1

ISO C Y I WV E WON B A X WS A V I WI L T K

12 31 32 33 54 12 11 52 24 11 32 14 41 34 63 11 31 M 52 12 11 12 13 21 44

I TIS REP 0 R TED T HAT THE ENE MY H

X L Y I WD A I N B D R WV R V S DDT NUL Q 0

63 13 54 12 11 32 34 12 14 41 32 23 11 52 23 52 31 32 32 21 14 22 13 51 32

A S'R E T IRE D T 0 A P 0 SIT ION WEST 0

UBI N R K V L Q D N L Q D T V TIN I N D C U W

22 41 12 14 23 44 52 13 51 32 14 13 61 32 21 62 21 12 14 12 14 32 33 22 11

F NEW C H EST E R S TOP 0 N ERE G I MEN

WD C V SOD C G SIS S G U H K I R X Y I R N G

11 32 33 52 31 16 32 33 42 31 12 31 31 42 22 43 44 12 23 53 54 12 23 14 42

TIS I N V I C I NIT Y 0 FeR 0 S S R 0 ADO

T I WA U U I A A Q C WN B lEW A Y U L Q S A V

21 12 11 34 22 22 12 M M 61 33 11 14 41 12 24 11 M 54 22 13 61 31 34 52

NETWOEIGHTANDNORTHWESTTHE

N I I U H Q D T X WIT A V N N I N 0 C U WWC G

14 12 12 22 43 51 32 21 63 11 12 21 M 52 14 14 12 14 32 33 22 11 11 33 42

REO F S TOP A NOT HER REG I MEN Teo

T L G WWA L WD S N S I L N N I R N GS T LBO

42 11 11 34 11 32 m 14 m 14 14 23 14 42 m 41 32

NeE N T RAT I N G N EAR R 0 A D J U NeT I

D TWA U U I A A Q D GTE L Q D T X D WY I WX

32 21 11 34 22 22 12 34 34 61 32 42 21 24 13 61 32 21 63 32 11 54 12 11 63

o N TWO E I G H T F 0 U R S TOP B E PRE P A

N I N B D R Q T Q V Ewe WS C L PIT L K I R X

14 12 14 41 32 23 61 21 61 52 24 11 33 11 31 33 13 46 12 21 13 44 12 23 63

RED T 0 SUP P 0 R TAT T A C K 0 NCR 0 S S

Y I R N G T I WA U U I A A Q C Q D T Z I I WV T

54 12 23 14 42 21 12 11 M 22 22 12 114 34 61 33 61 32 21 65 12 12 11 52 21

R 0 ADO NET WOE I G H T S TOP K E E P 0 N

I N I N 0 C U WWD S NIL V NOD L Q D T X WS

12 14 12 14 32 33 22 11 11 32 31 14 12 13 62 14 16 32 13 61 32 63 11 31

EREGIMENTINRESERVESTOPATT

CLPWVRVSDDTNULQDUHKIRXYIR

33~46115223li2m3232~1422~M32224344n2363Ma23

A C K P 0 SIT ION WEST 0 FeR 0 S S R 0 A

N G T I WA U U I A A Q C Q D T V

1442~nll1142222nll4ll4M33M32~li2

DON E TWO E I G H T S TOP

h. The two cryptograms may now be deciphered directly from the checkerboards. The

plain-texts are as follows:

~.

l :.

'J

.~

2d component

B

(Recomposition)

1 2 3 4 5

W I L N 0

I--- - - IT U R E M - - - - - S 0 C A F - - - - - B G H K P - - - - -

Q V X Y Z

1

154

FIOURB 85.

2d component

A

(Decomposition)

1 2 3 4 5

N U T Y P

I-- - - IE 0 I F L

- - - - - A M B C S - - - - - R W G 0 H - - - - - 5 K Q v x z

g. Speculating upon the key words used to produce the mixed sequences in these checkerboards, the trade-name NUT Y P E (a typewriter cleaning fluid) suggests looking at the

label on the box containing 8. bottle of this chemical. It reads: NUT Y PEN 0 N _

I NFL A M MA B LET Y PEe LEA N S E R, prepared by WA L T E R

G. G I E S. This yields the sequence for the decomposition checkerboard. The legend

on the box also reads: WILL NOT I N J U REM 0 S TOE LIe ATE

F A B RIC SAN 0 FUR NIT U R E, which yields the sequence for the recomposition checkerboard.

Ii!

f

II;i';

iIii i
156

No.2

I WI LTG S I H WWA WKIN D C U WWA X L X 12 11 12 13 21 42 31 12 43 11 11 34 11 44 12 14 32 33 22 11 11 34 53 13 53

ENE MYIN FAN TRY REG I MEN T HAS B

D I WIRe V NOD N G S LNG I G WL V F D WV 32 12 11 12 23 33 52 14 15 32 14 42 31 13 14 42 12 42 11 13 52 35 32 11 52

E E NOB S E R V E DIN A D E FEN S I V E P 0

R V S DDT ILL Q D U K D WS S H X SEN C Q D 23 52 31 32 32 21 12 13 13 51 32 22 44 32 11 31 31 43 53 31 24 14 33 51 32

SIT ION E A S T 0 F GET T Y S BUR G S T 0

T Q GTE U D V Q COl WT X WV R V S DDT N U 21 51 42 21 24 22 32 52 51 33 15 12 11 21 53 11 52 23 52 31 32 32 21 14 22

P Y 0 UW ILL T A K E U PAP OS I T ION WE

L Q D U H K I R X Y I R N BAY I I I GTE WAY 13 51 32 22 43 44 12 23 53 54 12 23 14 41 34 54 12 12 12 42 21 24 11 34 54

S T 0 FeR 0 S S R 0 A D T H R E E F 0 U R T H R

I I L W N K I R N G S T L B DDT I TIL U D V L

g 11 14 44 23 14 42 M 21 g 0 32 32 21 U 21 U g 22 32 52 g

E E AND R 0 A D J U NeT ION 0 N E MIL E S

V T T A Q A V N I I U H Q D T X D WY I WX N I N 52 21 21 34 51 34 52 14 12 12 22 43 51 32 21 53 32 11 54 12 11 53 14 12 14

OUT H THE REO F S TOP B E PRE PAR E D

B D R WS C L P L WAH N T L Q D T X C WSCI V 41 32 23 11 31 33 13 45 13 11 34 13 24 11 53 51 32 21 53 33 11 31 33 12 52

T 0 A T T A C KAT D AWN S TOP BAT TAL I

D T NIL V NOD NUL Q DUB GTE WV R V S D 32 21 14 12 13 52 14 15 32 14 22 13 51 32 22 41 42 21 24 11 52 23 52 31 32

o N RES E R V EWE S T 0 F YOU R P 0 SIT I

D T W 32 21 11

o N

48. Special solution.-a. The preceding example of solution constitutes the general solution

for this system, since no special conditions are prerequisite to the procedure set forth. An

interesting solution, however, is that wherein the same message has been cryptographed by two

different sets of checkerboards.

b. Suppose, for instance, that in this system two cryptograms of identical lengths and plain

texts but different cryptographic texts are available for examination. They are superimposed

and appear as follows:

No.1. G COD M G C E G B W I L WG M 0 N G B S X 0 P C N G E S F L N I

No.2. WI LTG S I H WWA WKIN D C U WWA X L X D I WI R C V N 0

No.1. WT MGET L N C G F M D WG X H MGAT AC TOM S WB L G A I

No.2. D N G S LNG I G WL V F D WV R V S DDT ILL Q D U K D WS S

No.1. Q P F U A Q M S A Z P H Z G N L MSOW 0 V X G X H MGAT A K N

No.2. H X SEN C Q D T Q GTE U D V Q COl WT X WV R V S DDT N U

No.1. 0 M S WC U S H Q L SST M S U WNNE H U A S U WN T GEL S S

No.2. L Q D U H K I R X Y I R N BAY I I I GTE WAY I I L WN K I R

No.1. T M 0 V C V A T A E A COG N LOP H V S V SUN WT WF M S A X

No.2. N G S T L B DDT IT I L U D V L V T Q A Q A V N I I U H Q D T X
y z

TtE.

llII

0

!iI!l

t:I

-- 8

II:

-- C!

!iI!l

l!!I

!iI!l

;i

LtP.

0

!:

"II

Q

II:

:x:

" UT v

I0.01

---1---1---1

p Q R s

-·BA-------

L .. N o

C.J,... CIO. AtH. ItR. R.N. A.T. A.Q. o.U1 AJ..

c.I. D.R. A.V.

MIG. MIG. t.L. I.U.

M.D.

V,H. ICeI. T.I.

- QaA. T.J:.

o.Nl -- III.

I.N•

P.L.

QA

J'Je1lAII. I

K

[t'IRS'!' COMPONEN'l'S OF ClI.YP1'OGKAM No.1

B C D E F G H I

lIlIIUi1--41 (1'IIlI p. 11'1)

A

... --- - .. ------1----1------ ------·1---1-__1-__+__-1-__1.__-1-__1 _

y

z

F

D

I----I---t---I-------...'.'-----I---I---+--t-=-:::--I·-----+-----··----··--I----,---I-:;::-=-t--=-=:--t----t----I---I--=-:=-t H

R.C. R.I. ItR.

Ltl.

T OtT. ---------- Ltl. --

.... t---I------------_·· ..---.__. ----r--------~·-I--~-- 1-:::-::--1---~---I--_+_-_t---I--::::_:'--1---

~I

K ----..-.-------~~----- Y,I,

L t---t_--!.-- __~o.l. _ ..._1. ._~_._ _ -I-=VI"""'Q-.-~~"""'~~,~=~-I-=V"""''l.-.-I-.-- _-..~_ ,...-._-_-_-_t-~-:_:::ICe:;I~.~+-I_-~~t-t_=.==:~~~~~I_-~=--~~-·t~--~--:t--~-_-_-I-- ... GtS. i OtC. Q.D. V.D.

i:--.--. ---IIG. -- I,G,. :: N;il,_1 -'D;v, r.V. 101, -: --·1---+--- ~; -I-.J,..-.-------I-'-N,-I.-I--·--~;-;;::--I·-- Z

=0 t---..-.---- t.T. t.U. .--..-- t.V. LtQ. CIU. -----l---t-----WI

-

T.- ra;i:=-.- t-- - t- -- ;- - --1

f

p '--I---t---I_---t-----t--;-----t

u t---t---l---t---1---+---I--I·-------I---=="""""'-I-=-=~~--·I_--I_=::__I--+_-_+---11---+---I---t---1----J---+----1

~Q

g t---I---------------t----ii---:---t---·t---t---t--·t----I---1--+---I---I~-+---t---t----t---~--.I_-_1 ili3R r&l
157

No.1. C G U W G X N W T M 5 5 G A 5 N Y 5 G 5 P D G F M 5 A X EGA 5 N

No.2. D WY I WX N I N B DR W 5 C L P L WAH N T L Q D T X C W 5 C I

No.1. M T A CWO L N I W D NOM 5 W K P H U A X H M GAT A C

No.2. V D T NIL V NOD NUL Q DUB GTE WV R V 5 DDT I

c. Now consider the first few superimposed letters in these two cryptograms:

No. L G COD M G C E G . . .

No. 2 W I LTG 5 I H W . . .

Take the pair of superimposed letters GW. The G is the cipher resultant of the recombination of

two bipartite numerical components that apply to the recomposition checkerboard. The actual

identities of these numerical components are not known, but, whatever they be, the first of

them determines the first half of Ge, the second determines the second half of Ge• Therefore, for

cryptanalytic purposes, the actual, but unknown; numerical components may be represented

by the symbols GI and G2, the former referring to the row coordinate of the recomposition checkerboard, the latter to the column coordinate. What has been said of the letter G applies also to

the letter W, the equivalent of G in another checkerboard. It will be found that this manner of

designating bipartite components by means of subscripts to the letters themselves is a very

useful method of handling the letters.

d. Let the first few letters of the two cryptograms be replaced by these same cipher letters

with their subscripts to indicate components. Thus:

No. L____________C G COD M G C E

Components CIC2 GIG2 CIC2 0102 DID2 MI~ GiGs CIC2 EIEz

No. 2______________ I W I LTG S I H

Components 1112 WIW2 1112 LIL2 TIT2 GiGs 5152 1112 HIHs

Now from the method of encipherment it is clear that C2QI and I 2WI represent the same plain-text

letter, since both messages are assumed to contain identical plain texts. That is, C2GI of cryptogram No. 1=I2WI of cryptogram No.2. Likewise G2C1=W2I2; C201= I 2L1 ; 02Dl=L2TI; and so on.

e. Let all the component pairs of the cryptograms be equated in this manner and let these

pairs be distributed in a table, such as that shown iIi figure 86. It will be seen in figure 86 that,

for example, A2C1 of cryptogram No. 1=T2I1 and T2NI of cryptogram No.2. This means that

II and NI must represent the same row coordinate of the recomposition checkerboard for cryptogram No.2; in other words I and N must be in the same row in that checkerboard. Again, in figure

86, it is seen that C2G1=G2WI and D2WI, which means that G and Dmust be in the same column in

that checkerboard. Again, A25i=W2AI=52Cl; this means that A and C are in the same row, W

and 5, in the same column, in the recomposition checkerboard for cryptogram No.2. All these

data in figure 86 are studied with the following results:

In same row: In same column:

(1) I, N, L, W (I) (2) (3) (4) (5)

~) A, C, 5, D THY Q U

(3) Q, V, X, Y W C K B I

~) B, G 5 L D

R G

V

324155--41----11
2d Component

12345

W I L N

0

-

-

-

-

-

T

U

R E M

I-

-

-

-

-

S

D

CA

F

-

-

-

- 1-

B

G

HKP

-

-

-

- 1-

5

Q

V X Y

Z

1

2d Component

1 2 3 4 5 N U T Y P

- - -

- IE 0 I F L

I--

- - - 1-

A

MBC

S - - - - 1- R W G D H - - - - 1-

5

K

Q

VXZ

1

159

WI LTG S I H WWA WKIN D C U WWA X L X D I WI R C

11 12U 21 42 31 12 48 11 11 84 11 44 12 14 32 33 22 11 11 34 08 13 58 32 12 11 12 28 88

ENEMYINFANTRYREGIMENTHASBEENOB V NOD N G S LNG I G WL V F D WV R V S DDT ILL Q D U14U321442MU1442n4211~U863211U28UM3232un~~5132

SERVEDINADEFENSIVEPOSITIONEAST

U K D WS S H X SEN C Q D T Q C T E U D V Q C 0 I WT X W

22 44 32 11 41 31 48 58 31 24 14 33 51 32 21 51 42 21 24 22 32 52 51 88 15 12 II 21 58 II o F GET T Y S BUR G ST 0 P YOU WILL T A K E U P A

VRVSDDTNULQDUHKIRXYIRNBAYIIIGT

U28UM3232~1422~M32224844U2858Mn28144134MnUU42U

P 0 SIT IONWEST 0 F C R 0 S S R 0 A D T H R E E F 0

E WAY I I L WN K I R N G S T L B DDT

I TIL U D V L V

24 11 84M 12 12 13 11 14 44 12 28 14 42 81 21 18 41 32 82 21 12 21 12 13 22 82 52 18U

URTHREEANDROADJUNCTIONONEMILES

TTAQAVNIIUHQDTXDWYIWXNINBDRWSC

UU84M34U14nn22485132~583211Mnll5814n1441322811~33

OUTH THE REO F S TOP B E PREP A. RED T 0 ATT

LPLWAHNTLQDTXCWSCIVDTNILVNODNU

13 45 13 II 34 18 24 II 58 51 82 21 58 33 11 81 33 12 52 82 21 14 12 18U 14U 33 14 22

AC KAT DAWNS TOP BAT TAL ION RES E R V E W .

LQDUBGTEWVRVSDDTW.

~M32224142~2411U28UM3232Ull

EST 0 F YOU R P 0 SIT ION

UASUWNTGELSSTMOVCVATAEACOGNLOP

51 12 18 51 11 21 28 22 38 41 18 18 28 42 24 52 81 52 12 28 12 38 12 81 24 22 21 41 24 48

URTHREEANDROADJUNCTIONONEMILES

HVSVSUNWTWFMSAXCGUWGXNWTMSSGAS

14 52 13 52 13 51 21 11 28 11 84 42 18 12 58 31 22 51 11 22 58 21 11 28 42 13 18 22 12 18

OUTHTHEREOFSTOPBEPREPAREDTOATT

NYSGSPDGFMSAXEGASNMTACWOLNIWDN

~MU22U4821122U42U~583822nU~4228n~l12441~Ul125~

A C KAT D AWN S TOP BAT TAL ION RES E R V E W

OMSWKPHUAXHMGATAC

24 42 13 11 35 48 14 51 12 08 14 42 22 12 28 12 31

EST 0 F YOU R P 0 SIT ION

No.2

.-:..

...

•••<

.~.

.!;

J' ,;

j. .;

2d Component

1 2 3 4 5

WAS H I

----IN G T 0 D

----1-

C B E F K

1-----1-

L M P Q R

1-----1-

5 U V X Y Z 1

No.1

U K?R

T K?

I--

- - - II N L W K?

-

-

- --

-

D A C S K?

-

-

-

- --

G K? H B K?

-

-

-

-

-

V Y? X Q Y?

2d Component

1 2345

R ~I~'~

C I--T I N G P

I--

-

-

-

-

0

A

B

D

H I--- - - - K M Q S U - -

Xfy

-

5

VW

Z

1

i23

!4

FIOUBE86a.

AB

(Decomposition) (Recomposition)

G COD MG C E G B WI L WG M 0 N G B S X 0 P C N G E S F

22 81 24 215 42 22 81 88 22 82 11 15 41 11 22 42 24 21 22 82 13 58 24 48 81 21 22 38 18 84

ENEMYINFANTRYREGIMENTHASBEENOB

LNIWTMGETLNCGFMDWGXHMGATACTOMS

41 21 15 11 28 42 22 38 28 41 21 81 22 84 42 25 11 22 58 14 42 22 12 28 12 31 28 24 42 13

SERVEDINADEFENSIVEPOSITIONEAST

WB L G A I Q P F U A Q MS A Z P H Z G N L MSOW 0 V X0

11 82 41 22 12 15 44 48 84 51 12 44 42 18 12 55 48 14 55 22 21 41 42 18 24 11 24 52 58 22 o F GET T Y S BUR G S TOP YOU WILL T A K E U P A

XHMGATAKNOMSWCUSHQLSSTMSUWNNEH

58 14 42 21 12 28 12 85 21 24 42 18 11 81 51 18 14 44 41 18 18 28 42 18 51 11 21 21 88 14

P 0 SIT IONWEST 0 F C R 0 S S R 0 A D T H R E E F 0

158

An attempt is now made to bring together these results to reconstruct the recomposition checkerboard for message No.2. This yields the following:

2d Component

Compare this with the rocomposition checkerboard shown in figure 85 (B). Enough has been

shown to illustrate the procedure. If there wore just

a little more text, probably all 25 letters

of the checkerboard could be definitely placed.

}. By making

a reciprocal table for equivalencies between component pairs in cryptogram

No.2, the data obtained would permit of reconstructing the rocomposition checkerboard for

cryptogram No. 1. Having these checkerboards completely or at least partially reconstructed,

the reconstruction of the decomposition checkerboards is a relatively easy matter and follows

the procedure described in paragraph 47}.

.

g. The complete solution of the two cryptograms, including the decomposition and recomposition matrices, is as follows:

:!

:i:
FIOURE 87.

M A N U F - ----Ie T R I G ._----_..._- _.._.- -.-

B D E H K - --_...• --"-- -- --- L 0 P Q S

I--- --- IV W X y Z

I--- - - 1-

M C B L V

I--------IA T D 0 W

I--- ----IN R E P X

I--------- U I H Q y

- -------

F G K S Z

12 34 Ii 12 34 Ii 12 34 Ii 12 34 5 12 34 II I 2 34 II I 2 34 II

ON EP L ON TH E ON CR U PR ON G CO NT I PO NG I AT I.QJf

TI 34 4 rr 23 3 IT 22 I 42 "iT 2 2"il2 2 4T12 2 1 2 24 1

23 33 1 23 24 3 23 13 4 33 23 5 12 32 4 32 35 4 22 42 3

!JI OE B I!R DD P I!T AB H Ol! RD K IA CR I QA RR Y AI AI B

(1) (2) (3) (4) (5) (6) (7)

c. The foregoing examples fall into two classes. In, the first, where the 0 of ONp falls in an

odd position in the period, the first letter of the trigraphic cipher equivalent must be an Lo, the

second must be one of the 5 letters in the second column of the substitution checkerboard, the

third must be one of the 5 letters in the third row of the checkerboard. Therefore, Le may

combine with 5X 5 or 25 pairs of letters to form the second and third letters of the 3-letter equivalent of ONp. In the other class, where the 0 of ONp falls in an even position in the period, the

first letter of the equivalent must he one of the 5 letters in the fourth column of the checkerboard,

the second must be one of the 5 letters in the first row, and the third letter must be Re. Therefore, Ro may combine with 5X5 or 25 pairs of letters to form the first and second letters of the

3-letter equivalent of ONp in this position in the period. Hence, ONp may be represented by 50

trigraphio combinations; the same is true of all other plain-text digraphs. Now if the system

based upon even periods is considered as a simple digraphie substitution, the foregoing remarks

lead to characterizing the system based upon odd periods as a special type of digraphic substitution with variants, in which 3 letters represent 2 plain-text letters.

• An example of the solution of a cryptogram of this type was given in Military CryptanalyBia, PaTtI,

sec. IX.

161

Now if each 6-letter cipher group is split in the middle into two sections and the letters are taken

alternately from each section (Ex. L H L R E A=L R H E L A) the results are exactly the

same as would be obtained in case a simple digraphic enciphermentwere

to be employed with the 2-square checkerboard shown in figure 88.

For example, ONp=LRe ; EPp=HEel and so on. Encipherment of this

sort brings about a fixed relationship between the plain-text digraphs

and their cipher equivalents, so that the solution of a message of this

type falls under the category of the crypte.nalysis of It ease of simple

digraphie substitution, once the length of the period has been established," The latter step can readily be accomplished, as will be seen

presently. In brief, then, it may be said that in this system when

encipherment is based upon even periods the cipher text is purely

and simply digraphio in character, each plain-text digraph having

one and only one cipher-text digraph as its equivalent.

b. But the latter statement is no longer true in the case of odd

periods. Note, in the example under paragraph 49a, that the cipher

equivalent of the first plain-text digraph of the first group, ON, is

composed of the initial and final components of the letter Lo, the

final component of the letter Oe, and the initial component of the

letter Le• That is, three different plain-text letters, L, 0, and E, are

ON EP L'A NE involved in the composition of the cipher equivalent of one plain-text

digraph, ON. Observe now, in the following examples, that variants L R H E LAN E FIOUEB 88.

may be produced for the digraph ONp •

~.

M A N U F

I---- - - - 1-

C T R I G - - --- B D E H K - - - - - L 0 P Q S - r-r-rr-« - ,-

5 V W X Y Z

160

ONEPL ANERE PORTE DLOST ATSEA

41344113234422334442 12431

2333123333323232125222632

Recombinations are effected horizontally within the periods, by joining components in pairs,

the first period yielding the pairs 41, 34, 42, 33, 31. These pairs are then replaced by letters

from the original checkerboard, yielding the following:

ONE P LAN ERE P 0 R TED LOS TAT SEA

41344113234422334442 12431

2333123333323232125222532

LHOEB MDDEE QTERR HQTAW APAGD

b. A different checkerboard may, of course, be employed for the recomposition process.

Also, periods of any convenient length may be employed; or, in a complicated case, periods of

varying lengths may be employed in the same cryptogram,' according to some prearranged key.

60. General principles underlying the solution.-a. It will be noted that the periods in the

foregoing example contain an odd number of letters. The result of adopting odd-length periods

is to impart a much greater degree of cryptographic security to the system than is the case when

even-length periods are involved. This point is worth while elaborating upon to make its crypt.

analytic significance perfectly clear. Note what happens when an even period is employed:

ONEPLA NEREPO RTEDLO

413441 132344 223344

233312 333332 323212

LHLREA NRQEED TEQDDA

1

h. It is seen that the principles elucidated permit of solving this fairly good cipher system

without recourse to frequency studies and detailed, difficult analytical research. What can be

done with complete messages of identical texts will give the student a clue to what might be done

when fairly lengthy sequences of identical plain texts (but not complete messages) are available

for study. Messages with similar beginnings, or similar endings will afford data for such

reconstruction.

49. Periodic fractionating systems.-a. Another type of combined substitution-transposition

system involving fractionation is that in which the processes involved are applied to groupings

of fixed length, so that the system gives external evidence of periodicity. One such system,

commonly attributed to the French cryptographer Dclastelle, is exemplified below. Lct the

bipartite alphabet be based upon the 25-cell substitution checkerboard shown in figure 80.

Let the message to be enciphered be ONE PLANE REPORTED LOST AT SEA. Let it also be

assumed that by preagreement between correspondents, periods of 5 letters will constitute the

units of encipherment. The bipartite equivalents of the plain-text letters are set down vertically

below the letters. Thus:

2d component

1 2 3 4 5

j:

I,

I

i

11

;

1:

r:

:

.i

:1

j

I

I

, \
163

ing a given plain-text letter are of two classes: ala2and allah and the two must be kept separate

in cryptanalysis.

g. Now consider the equivalent of 0D in the first period. It is composed of ~I' This is , 2

only one of a number of equivalents for OD in an odd position in the period. The row of the sub-

. stitution checkerboard indicated by LI may be represented by 4 other components, since that

row contains 5 letters. Therefore the' upper component of the :: equivalent of Op may he any

one of 5 letters. The same is true of the lower component. Hence, 0D in an odd position in the

period may be represented by anyone of 5X5=25 combinations of vertical components in the

sequence al~a2' OD in an even position in the period may be represented by anyone of a similar

number of combinations of vertical components in the reverse sequence, ell~al' Thus, disregarding the position in the period, this system may be described as a monoalphabetic substitution with variants, in which every plain-text letter may be represented by any one of 50

different component-pairs. But in studying an actual cryptogram in this system, since the

position (odd or even) occupied by a cipher letter in the period is obvious after the length of the

period has been established, a proper segregation of the cipher letters will permit of handling the

cipher letters in the two classes referred to above, in which case one has to deal with only 25

variants for each plain-text letter. Obviously, the 25 variants are related to one another by

virtue of their having been produced from a single enciphering matrix of but 25 letters. This

relationship can be used to good advantage in reconstructing the matrix in the COUrBl' 'of the

solution and the relationship will be discussed in its proper place.

h. Now if the foregoing encipherment is studied intently several important phenomena may

be observed. Note, for instance, how many times either the a 1 or the all component coincides

with the plain-text letter of which it is a part. In the very first period the 0D has an Oll under it;

in the same period the Ep has an E2 under it. The same phenomenon is observed in columns

3 and 5 of the second period, in column 3 of the third period, and in column 1 of the fifth period.

In column .5 of the third, fourth, and fifth periods the al components coincide with the respective plain-text letters involved. There are, in this short example, 9 cases of this sort, giving

rise to instances of what seems to be a sort of self-encipherment of plain-text letters. How does

this come about? And is it an accident that all these cases involve plain-text letters in odd

positions in the periods? i. If the periods in the foregoing example in subparagraph 6 are studied closely, the following

observations may be made. Because of the mechanics of encipherment in this system the first

cipher letter and the first plain-text letter in each period must come from the same row in the

substitution checkerboard. Since there are only 5 letters in a row in the checkerboard the probability that the two letters referred to will be identical is 1/5. (The identity will occur every time

that the coordinate of the row in which the second plain-text letter stands in the checkerboard is

the same as the coordinate of the column in which the first plain-text letter stands.) The same

general remark applies to the second cipher letter and the third plain-text letter; as well as to

the third cipher letter and the fifth plain-text letter: In these cases the two letters must come

from the same row in the checkerboard and the probability that they will be identical is likewise

1/5. (The identity in the former case will occur every time that the coordinate of the row in

which the fourth plain-text letter stands in the checkerboard is the same as that of the column

in which the third plain-text letter stands; in the latter case the identity will occur every time

that the coordinate of the column in which the first plain-text letter stands is the same 8S that

of the column in which the fifth plain-text letter stands.) The last of the foregoing sources of

identity is exemplified in only 4 of the 9 cases mentioned in subparagraph h above. These

''"-.;

-1'. :.,

162

d. However, further study of the odd-period system may show that there is no necessity for

trying to handle it as a digraphic system with variants, which would be a rather complex affair.

Perhaps the matter can be simplified. Referring again to the example of encipherment in

paragraph 49 a:

ONE P LAN ERE P 0 R TED LOS TAT SEA

4.134.4. 11323 4.4.223 34.4.4.2 124.31

23331 23333 32323 21252 22532

LHOEB MDDEE QTERR HQTAW APAGD

Now suppose that only the cipher letters are at hand, and that the period is known. The first

cipher letter is L, and it is composed of two numerical bifid components that come from the first

and second positions in the upper row of components in the period. These components are not

known, but whatever they are the first of them is the first component of L the second of them

is the ~econd component of L. Therefore, just as in paragraph 48c, the actual but unknown,

numerical components may be represented by the symbols L1 and L2, the former referring to the

row coordinate of the substitution checkerboard, the latter to the column coordinate. The

same thing may be done with the components of the second cipher letter, the third, fourth, and

fifth, the respective components being placed into their proper positions in the period. Thus:

Cipher L HOE B

Components.. {L 1 L 2 H 1 H20 1

02E 1E 2B 1B 2

Now let the actual plain-text letters be set into position, as shown at the right in the two diagrams below.

Plain text___________________ 0 N E P LON E P L

Components {: ; iLl L II HI HII 0 1

. 01lE 1E llB 1B ll

Cipher_______________________ L HOE B L HOE B

By comparing the two diagrams it becomes obvious that Lh Hll, and 01 all represent the coordinate

4; HI, Eh E2, and B1 all represent the coordinate 3, and so on. If this equivalency were known

for all the 50 combinations of the 25 letters with subscript 1 or 2 there would be no problem,

for the text of a cryptogram could be reduced to 25 pairs of digits representing monoslphabetic

encipherment. But this equivalency is not known in the case of a cryptogram that is to be

solved; basically the problem is to establish the equivalency.

6. It is obvious that the vertical pair of components L1 represents 0D' the vertical pair Lll

O2 E1

represents ND, and so on. The complete example therefore becomes:

Plain O N E P LAN ERE P 0 R TED LOS TAT SEA

Components {LI Ls HI H2 01 MI Mll DI Dll DI Ql TI T2 EI HI H2QI Q2 TI Al A2PI PI s; --------- O2E1 EtBIBt DtEI E2EI Et Ell RI R2R1 R2 T2AlAll WI W2 All G1 DI Dll

Cipher • L HOE B M D DEE Q T ERR H Q TAW A P A G D

f. -Note that a plain-text letterin an odd position in the period has its components in the order

ala2; in an even position in the period the components of a plain-text letter are in the order a2al.

For example, note the OD in the first period ( =~~) and the OD in the -third period (=~:} This

distinction must be retained since the component indicators for rows and columns are not interchangeable in this system. From this it follows that the vertical pairs of components represent- i

Ii

! '

j::,

Ij:;

!. :

) ')

i ;

i"j

L"

II

ii'i

i

!

i

I

I

I

I !

i ,

!

I I

Ii

I:

1

I

!

:1

i,.

""]1

iiI

II

I

I

!

I

I j

,

,I

I

Ii

u I

Ii

Ii
I i"

I !

I"i'

164 165

n. All of the foregoing phenomena will be useful when the solution of an example is undertaken. But before coming to such an example it is necessary to explain how to ascertain the

period of a cryptogram to be solved.

51. Ascertaining the length of th~ period.-a. There are several methods available for

ascertaining the length of the period. The simplest, of course, is to look for repetitions of the

ordinary sort. If the period is a short one, say 3,5, 7 letters, and if the message is fairly long, the

chances arc good that a polygraph which occurs several times within the message will fall in

homologous positions within two different periods and therefore will be identically enciphered

both times. There will not be many such repetitions, it is true, but factoring the intervals

between such as do occur will at least give some clue, if it will not actually disclose the length of

the period. For example, suppose that a 7-1etter repetition is found, the two occurrences being

separated by an interval of 119. The factors of 119 are 7 and 17; the latter is unlikely to be the

length of the period, the former, quite likely.

b. If a polygraph is repeated but its two occurrences do not fall in homologous positions in

two periods, there will still be manifestations of the presence of repetition but the repeated letters

will be separated by one or more intervals in the periods involved. The number of repeated

letters will be a function of the length of the polygraph and the length of the period; the interval

between the letters constituting the repetition will be a function of the length of the period and

the position of the repeated polygraph in two periods in which the two polygraphs occur. Note

what happens i.n the following example:

PNRGE TPENN PBETV IBDDR DLBDT XDLOT LDTDT

Here the plain text contains the trigraph END 4 times. The ENDp in the first period gives rise to

1234567

the cipher letters . N . . E . .; in the second period this trigraph also produces

1234567 .' • . . N . . E . The interval between the No and the Eo is 3 ill both cases. Two tunes this

interval plus one gives the length of the period. In this case the initial letter of the repeated

trigraph falls in an even position in the period in both occurrences. The ENDp in the third period

123 4 6 6 7

gives rise to the cipher letters . . B . . . D; in the fourth period it also produces

1234667 '.. .

. B . . . D. The interval between the B, and the Do is 4 m both cases. Two times this

interval minus one gives the length of the period. In this case the initial letter of the repeated

trigraph falls in an odd position in the period in both occurrences.

c. The foregoing properties of repetitions in this system afford a means of ascertaining the

length of the period in an unknown example. First, it is evident that a repeated trigraph in the

plain text produces two different pairs of cipher equivalents according to whether the initial

letter of the trigruph occurs in an odd or an even position in the period. The two letters constituting the repetition in the cryptogram will not be sequent but will be separated by an interval

of 1, 2, 3, ... letters depending upon the length of the period. This interval, however, is half

of the period plus or minus one.' Conversely, if in a cryptogram there are repetitions of pairs of

• The student must remember that the text is here concerned only with cases in which the period is ~dd.

In the case of even periods the interval separating the 2 letters is liJways exactly half of the length of the period,

OTT R 0 A D

4 2 2 241 3

2 2 2 3 2 2 2

o T L D T D T

o FEN DIe

4 1 3 1 322

2 5 3 324 1

LBDTXDL -'---.JWNTOEND

5 1 243 1 3

2 3 2 2 3 3 2

V I B D D R D '"'\ /-

CRYPTOGRAM

EEMENDO

3 3 1 3 1 3 4

3313322

E N N P BET -"---/-

SENDTHR

'4313232

5332243

PNRGETP -"---/-

involve the fifth plain-text letter in the third, fourth, and fifth periods, and the first letter in the

fifth period, wherein it will be noted that the 81 component standing directly under the plaintext letter is identical with the latter in each case.

j. But how are the other 5 cases of identity brought about? Analysis along the same

lines as indicated above will be omitted. It will be sufficient to observe that in each of those

cases it is the 82 component which is identical with the plain-text letter involved, and again the

probability of the occurrence of the phenomenon in question is 1/5.

k. Since the probability of the occurrence of the event in question is 1/5 for 81 components

and 1/5 for 8 2 components, the total probability from either source of identity is 2/5. This

probability applies only to tho letters occupying odd positions in the period, and it may be said

that in 40 percent of all cases of letters in odd positions in the periods the one or the other of the

two cipher components will be identical with the plain-text letter.

l. As regards the plain-text letters in even positions, analysis will show why only in a very

few cases will either of the cipher components coincide with the plain-text letter to which they

apply, for the method of .finding equivalents in the substitution checkerboard is to take the

first component as the row coordinate indicator and the second component as the column indicator; a reversal of this order will give wholly different letters, except in those 5 cases in which

both components are identical. (The letters involved are those which occupy the 5 cells along

the diagonal from the upper left-hand corner to the lower right-hand corner of the checkerboard.)

Now in every case of a letter in an odd position in a period the two vertical components are in

the 8182 order, corresponding to the order in which they are normally taken in finding letter

equivalents in the checkerboard. But in every case of a letter in an even position in a period,

the two vertical components are in the order 82811 which is a reversal of the normal order. It

has been seen that in the case of letters in odd positions in the periods the probability that one

of the components will coincide with the plain-text letter is 40 percent. The reasoning which led

to this determination in the case of the odd letters is exactly the same as that in the case of letters

in even positions, except that in the final recomposition process, since the components in the

even positions are in the 8281 order, which is the reverse of the normal order, identity between

one of the components and the plain-text letter can occur in only 1/5 of the 40 = 8 percent of

the cases. It may be said then that in this system 48 percent of all the letters of the plain text

will be "self-enciphered" and represented by one or the other of the two components; in the

case of the letters in odd positions, the amount is 40 percent, in the case of letters in even positions, it is 8 percent.

m. Finally, what of the peculiar phenomenon to be observed in the case of the first column

of the fifth period of the example in subparagraph e? Here is a case wherein the plain-text

value of a pair of superimposed components is unmistakably indicated directly by the cipher

components themselves. Studying the cipher group concerned it is noted that it contains

2 Ao's separated by one letter, that is, the A's are 2 intervals apart. This situation is as though

the plain-text letter were entirely self-enciphered in this case. Now it is obvious that this

phenomenon will occur in the case of periods of 5 letters every time that within a period a cipher

letter is repeated at an interval of 2, for this will bring about the superimposition of a 81 and 82

with the same principal letter and therefore the plain-text letter is indicated directly. This

question may be pertinent: How many times may this be expected to happen? Analysis along

the lines already indicated will soon bring the answer that the phenomenon in question may be

expected to happen 4 times out of 100 in the case of letters in odd positions and only 8 times out

of 1,000 in the case of letters in even positions. In the latter cases the letters involved are those

falling in the diagonal sloping from left to right in the substitution matrix.

II

I.

I

I
166

letters separated by an interval x, it is probable that these repetitions represent repetitions of

plain-text trigraphs which occupy homologous positions in the period. The interval x (between

the letters constituting the repetition in the cipher text) then gives a good clue to the length of

the period: p(length of period) =2x±1.

d. A special kind of index is prepared to facilitate the search for repetitions of the nature

indicated. If tabulating machinery is available, an alphabetically arranged index showing say

10 succeeding letters after each Ae, Be, Ce, . . . Ze is prepared for the cryptogram. Then this

index is studied to see how many coincidences occur at various intervals under each letter. For

example, under Ae one looks to see if there are 2 or more cases in which the same letter appears

2, 3, 4, ... intervals to the right of A, a record being kept of the number of such cases under

each interval. The same thing is done with reference to Be, Ce, and so on. The tallies representing coincidences may be amalgamated for all the letters A, B, C, ... Z, only the intervals being

kept segregated. When tabulating machinery is not available, the search for repetitions may be

made by transcribing the cryptogram on two long strips of cross-section paper, juxtaposing the

strips at A, B, C, ... Z, and noting the coincidences occurring 1, 2, 3, ... up to say 10 letters

beyond the juxtaposed letters. For example, beginning with Ac, the two strips are juxtaposed

with the first Aon one against the first A on the other. Note is made of any coincidences found

within 10 letters beyond the A's, and a record is kept of such coincidences according to intervals.

Keeping one strip in position the other is slid along to the second A, and again coincidences are

sought. All the A's are treated in this way, then the B's, C's ... Z's. The record made of the

coincidences may consist merely of a tally stroke written under the intervals 1, 2, 3, ... 10.

That interval which occurs more frequently than all the others is probably the correct one. This,

interval times 2, plus or minus 1 is the length of the period. There are, therefore, only two alternatives. A choice between the two alternatives may then be made by transcribing the text or

a portion of it according to each hypothesis. That transcription which will most often throw

the two members constituting a repetition into one and the same period is most likely to be

correct.

e. Finally, for ascertaining the period there is one method which is perhaps the most laborious but surest. It has been pointed out that this system reduces t,o one that may be described

as monoalphabetic substitution with variants. If the cipher text is transcribed into 8 f and 8 2

components according to various assumed periods, and then a frequency distribution is made of

the pairs of vertical components for each hypothesis, that period which gives the best approximation to the sort of distribution to be expected for a system of monoalphabetic substitution

with 25 variants for each letter may be taken to be correct. For in the case of an incorrect period

the resultant vertical bipartite components are not the equivalents of the actual plain-text

letters; hence such repetitions as occur are purely accidental and the number of such cases would

be rather small. But in the case of the correct period the resultant vertical pairs of componen ts

are the equivalents of the actual plain-text letters; hence repetitions are causal and fairly frequent. Were it not for variants, of course, the distribution would be perfectly monoalphabetic,
SECOND Co.> COMPONENTS

ABC DE F G HI K L II HOP Q R S T UV W X Y Z

LiELi i

..' ".

:j i

": .

: ::. .. : •• 'I.

-.

N 14

0 7 I

p 7 I

& I~

R 8 I

S 9 I

I

T 11 I

U 15

V 8

W 7

X 16

Y 14

Z 9

296

A 21

B 15

C 14

D 23

E 14

F 6

G 8

H 8

I 8

K 13

L 17 ..

..

II 16 .,

I

l .........,....

K LII HOP Q R STU V 'I X Y Z

II.' I II' •• 711 0 11117. t(Totll-.)

hlvu'"

ABC D E F G H I

II III II It 17 7 • 11 7

._'''!!!-! I j~-.i_._I.!I..J II~_ I A I

~I',I . I • I 1 II 1/'1' ' I II! ill, ."

-- I II /I / II: . / / / B / I '-ri,I--j--i-I/--.---TT-!-1i-

--1.- __ .____.._j_______

- --,-iIl1 I 111/ 1/ /II I c - /- I- i- r! - 11rr: -.-----------1----- --/I,--,-ll1i-I--111/ I r/- ,-I ;"1_/___ I~- -I ;--HL 11/1 D / - I -1-/---1 1-1-1!--/ -I /I E / 1---1-----1-

1

- .1

1/ ,- ~~--i/I -,-I-I-j--- / F I ---1---'1--1

- -----;-1--1-- .--I------._.~....

G . 11/ I ill!

1-------_·-

I I II / 1/ H --I=-q-rl~ 1_,== / / I I 1/ I I / . I

------ ,

11/1 I I /I K I ItI]-'I--=11 I -----------

/I / / / L 11/ 1/ s._1_1 I / ------1---

/ 1/ I I / / 1/1/ II· I I / / / - --- - - -----.-_.- - - - - - A B C D E F G H I K L II N 0 P Q R S T U V 'I X Y Z - - - - .-- --.•.- ---

-

/ - - -" / --- -

/ -

1/1/ !II H / I I - ~I I 0 I 1/ I I I / - 1- ---I-- '-

~-- - - - I / / I p I 1/ - I--- - - - II I I II II - - - --- '------ - r - 1/ I R 1/ I I I - - ----; - 11/ / S I 1/ I I

--l - - - - - 1·- - - 1/ I I I T 1/11 I ,..-- - - - - - /I 1/ / -.J/ 1/1/ ./ 1/ U I I - - - I I I I 11/ V I I I--- - - - -' II 'I 1/ / I 11/ - - - - I- i-- - - - I 1/ I I . I x 11/ I 1/11 I I - - - - ,-

1/ I /I 11/1 y 1/ / I

I 1/ - - - - - - 1- - 1----l-- -/1-- 1/1/ I z I /I i

_111-41 C.... p. 11'1) No. I

.A

B

'C

'D

E

F

G

H

I

K

.~ L

: II

liI!'i

2

::II

8 N

i 0

i p

,..

R

S

T

U

V

W

x

y

z
Q

R

S

T

U

V

W

X

Y

Z

A 20

B 10

C 10

D 18

E 9

F 5

G 6

H 4:

I 5

K 7

L 12

If 12

N 13

0 3

P 4

Q 7

R 5

S 7

T 9

U 15

V 6

W 3

X 10

Y 13

Z 8

221

NO P Q R S TU V WX Y Z

I 1. II • lID 8 11 0 • II 10 7 8 ('1'GU1-1Il)

"0 I

II 1. 11 10 12 II 7 • • 11 II •

FIRST (Sa) COMPONBNTS

ABC DE FG HI K L II NO P Q R S '1'U V WX y Z

ABC D E F G H I K L II

I I /I 11/ I /I /I /I A I I I I /I - - - ---- - - - - - - - -- I I 11/ B /I I I I - - r--- - - - - - I--- - r--- - - I--- - - I /I C I I I 11/ I

r--- - I---- '----- - r-- - 11/ /I /I /I I 11/ /I I D /I

I---- - I---- - - - - - - - - I I E I 11/ I I I

I------ I---- - - - - - - - - - - - - - - - - - - - f----

/I I F I I

I---- - - - - - - - - - - - r--- '---

I I I G /I I

I---- - - - - - - - - - - - - - I---- - - /I H I I - - - - - - - - - - - - - I I I I I I '---- - - - - I-- I-

/ I /I I K I / - - - I---- - - - - I--- - - I---

I II L III I II I I I - - - I---- - - - - - - I--- - r--

I I I( {I {{( {{( { I

I--- I---- I--- - - - - - - - - A B C D E F G H I K L II N 0 P Q oR S T U V W X Y Z

I---- - - - - - - - I--- - - - - /I /I I J I J I J J N I J

f---- - - - - - - - - r--- - /I 0 I

I---- - - - - - - - - - - - I--- - - II I P I I - - - - - - I---- - I---

I I III Q I I - - - - - - I---- - - - --- - I---- - R I /I /I

I s 11/ I I I - lI I /I T /I /II

I---- - - - I---- - - - - - - - - - - - II I /I I I I /I I U /I /I I - - - - I / V I 1/ I - - - - - - - - f--- - - - - - - - - - - I w I I - - - - - - I II X J J II II J - f-- - - r----

tHl III I I y I I I

f--- - - - - I---- - - - - - I J I 1/1/ z I

A

B

C

D

E

F

G

H

I

K
167

52. nIustration of solution.-a. With the foregoing principles in mind, the following cryptogram will be studied:

K Z F B E I L Y Y M o C B R B L Z DOT G B L P K Y W C U C C E P Q L

AMEYL Z Q X W H L R W Q Y D R W B M T I Z E B E LAY E 5 0 B R Y

Q V B B L Y X NAB Q B D 0 Y M Q D L W L N A C 0 X C R R G A 5 W Q B

F DDT E BAM F D E TEN A K G D F 0 Q DUB N D C L Y D V W B A X

C AUG G X 0 ART X X T 5 D A Y X H K o L 5 X A B R K R P U Z WHO

M T D H T 5 G M L 5 L Q P 0 U N H C I C K K A Q B D 0 F L E K APR G

5 X U P 0 W A L M A V Q H L M L A X K P W 5 T M C X K Q V H 5 I X 5 L

L W XL X R 5 G ZD F K L N Y B X M R B N A D K T T B A E 0 BHWVL

Y 5 X M B o W P G X K 0 R Z I U C E A D Y I D B L Z MIT A N H C A I

D N C I D D 0 Y I B C N 0 L Y U U M C E POT D M G B FUN A H L B D

WXNXK K C 5 C T o X T 5 D AYXHK C N L D K RRFAY A P M H C

ANMBV G R E Z Q A T C Y I M N D L R L GMT W E T R C V V K TED

U F DEL X H E Q V C B L Y U DUG Y A F H N Q L K F R U C NVDLJj

L Z D R E L K X K U P 5 E M C T N K T K EBOEE P G V Q T GWERJj

L ZD R E L K F A X I Y D A K Z L X X 0 R R PER R R R N C I E

b. The long repetitions noted in the text (interva.ls=210 and 35) indicate a period of either

5 or 7. By transcribing several lines of text into their 9 1 and 9 2 components according to both

of these alternatives and distributing the vertically superimposed pairs, it is soon found that a

period of 7 produces many more repetitions than does a period of 5. The entire text is then

transcribed into its 9 1 and 9 1 components according to a period of 7 (see fig. 89) and complete

distributions of 9 192 and 9 29i vertical pairs are made, the distributions being, of course, kept

separate. They are shown in figures 90 and 91. The individual distributions show many

repetitions and the distributions as a whole are very favorable for It period of 7.

1 2 3 4 5

K Z F B E I L YYMOCBR B L Z DOT G B L P K Y W C U C C E P Q L

K1x, z,ZI F1FI B1 Y1YzY1YzM1Mz 01 B1BzL1LzZl ZI D1 B1BzL1Lz PI Pz K1 U1Uz C1c,C1CzE1

BzE1Ez II I zL1Lz o, C1CzB1BzR1Rz Dz 0101 T1TzG1Gz KzY1Yz WI WI C1Cz Ez PI Pz Q1 Qz L1Lz

6 7 8 9 10

AMEYLZQ XWHLRWQ YDRWBMT I Z E BEL A YE50BRY

Al AzM1MzE1EzY1 x, x, WI WzHI Hz L1 Y1YzD1DzR1Rz WI II r, z, z, E1EzB1 Y1YzE1E2 51 s, 01

s, L1LI z, z, Q1 Qz Lz R1Rz WI Wz Q1 Qz WzB1s, M1MI T1Tz BzE1Ez L1Lz AlAz 01 B1BzR1a, Y1Yz

11 12 13 14 15

QVBBLYX NAB Q B D 0 YMQDLWL N A COX C R RGA5WQB

Q1 Qz VI v, B1BzB1 N1NzAlAzB1BI Q1 Y1YzM1Mz Q1 Qz D1 N1NzAlAzC1c, 01 R1Rz G1Gz AlAz51

BzL1t, Y1YI x, Xz Qz B1BzD1Dz 01o, Os L1Lz WI WI L1Lz o, x, Is C1CzR1Rz 5zWI Wz Q1 QI B1Bz

16 17 18 19 20

FDDTEBA MFDETEN AKGDFOQ DUBNDCL YDVWBAX

F1FzD1Os D1Os T1 M1MzF1FI D1Os E1 AlAzK1KI G1Gz D1 D1DzU1UzB1Bz N1 Y1Yz D1Dz VI VI WI

TI E1EzB1BI s; Az EzT1TzE1EzN1Nz Os F1Fz 01 OZ Q1 Qz NzD1Os C1c, L1i, WzB1BzAl Azx, x, FIOl1BB 89.
FIOURE 9:1.

169

A M M A N F F U U F M M N A N U N F A U M A N U F I-- I0 B B 0 E K K H H K B B E 0 E H E K 0 H B 0 E H K

IfC C T R G G I I G C C R T R T R G T I C T R I Ie.; -

0 B B 0 E K K H H K B B E 0 E H E K 0 H B 0 E H K

>-- 0 B B 0 E K K H H K B B E 0 E H E K 0 H B 0 E H K

"A M M A N F F U U F M M N A N U N F A U Pi A N U IF

1-

C C T R G G I I G C C R T R I R G T I C T R I G

I--

E K K H H K B B E 0 E H E K 0 H B 0 E H 'I{ 0 B B 0

C C T R G G I I G C C R T R I R G T I C T R I 'e.; I--

0 B B 0 E K K H H Ifa- B E 0 E H E K 0 H B 0 E H K

"0 L L 0 P S 5 Q Q 5 L L P 0 P Q p 5 0 Q L 0 P Q 5

rr M M A N F F U U F M M N A N U N F T IfIi"T N U IF

1- -

A M M A N F F U U F M M N T N U N F A U M A N U F

0 L L 0 P 5 5 Q Q 5 L L P 0 p Q p 5 0 Q L 0 P Q S

1> L L 0 P 5 5 Q Q 5 L L P 0 p Q p 5 0 Q L 0 p Q s I-- L P Q -

0 L L 0 P 5 5 Q Q 5 L P 0 P 5 0 Q L 0 p Q 5

"T C C T R G G I I G C C R T R I R G T I C T If I G

0 L L 0 P 5 5 Q Q 5 L L P 0 p Q p 5 0 Q L 0 P Q'S

>--

T C C T R G G I I G C C R T R T R G T I C T R I G

"A M M A N F F U If F M M N A N U N F A U M A N UIF

V V W X Z Z Y Y Z V V X W X Y X Z W Y V W X Y Z I--

W V V W X Z Z Y Y Z V V- X W X Y X Z W Y V W X Y Z

1--

V V W X Z Z Y Y Z V- V X W X Y X Z W Y V W X Y

I

W Z I--

W V V W X Z Z Y Y Z V V X W X Y X Z W Y V W X Y Z

"w V V- W X Z Z Y Y Z V V X WX- l X zTw y V WX y Z

1 A

3B

2 C

3 0

3 E

1 F

2 G

3 H

2 I

3 K

4 L

1 M

1 N

4 0

4 P

4 Q

2 R

4 5

2 T

1 U

5 V

5 W

5 X

5 Y

5 Z

c. The text now being transcribed into periods of 7, with the 8 1 and 82 components indicated

by the cipher letters in each period, the vertical p8.~ of components are ex~mine~ to locate

cases in which the basic letters of the 8 1 and 8 2 superimposed components are identical, whereupon the plain-text letters indicated are at once inserted into position. In this example 10

such cases are found, one each in periods 14, 22, 26, 35, 36, 52, 59, 68, and two in period 74.

All of these, of course, involve letters in odd positions in the periods. The plain-text letters

thus inserted may serve as clues for assuming probable words.

d. Now if only a few equivalencies can be established between a few of the 8 1 components,

or between a few of the 8 2 components, or between a few 8 1 and 8 2 components, a long step forward may be taken in the solution. Perhaps some information can be found by studying

figures 90 and 91. A consideration of fi.gure 90 will soon lead t? the ~rle.a tha~ each r~w .of ~requencics can indicate only 5 different plain-text letters, one of which coincides with the indicating

letter at the left of the row. Moreover, in this same figure, while there are 25 rows in all, there

are really only 5 different categorU8 of rows, each category corresponding to a row in the

substitution checkerboard.

e. To explain quite clearly what is meant and how the principle can be employed in this case,

assume that figure 90, instead of applying to an unknown checkerboard, applied to a. known

one, say that shown in figure 87. The bipartite coordinates and the letters which would occupy

the cells are as seen in figure 92:

2112355445113234352412345

ABC 0 E F G H I K L M N 0 P Q R 5 T U V W X Y Z

168

21 22 23 24 25

C AUG G X 0 ART X X T 5 OAYXHKO L5XABRK RPUZWHO

c.CI Al AI Ul UI G1 1\1 AI Rl RI Tl TI x, 0101 Al AI Yl Y2x, L1L251 52 x, X2Al Rl R2PI P2U1U2ZI

G2Gl G2Xl X201O2 X2x, X2T1T251 52 X2HI H2KI K201 O2 A2Bl B2Rl R2x, K2 Z2 WI WI HI HI 01O2

26 27 28 ~9 30

MTOHT5G M L 5 L Q P 0 U N H C I C K K A Q BOO F LEKAPRG

M1M2T1T201O2HI Ml M2Ll L251 52 Ll u, U2NI N2HI HI CI KI KI AI A2QI QI s, Ll L2El EI Kl K2Al

H2TI T251 52 G1 G2 LI Ql Q2 PI P201 0, C2II 12 Cl CI KI K, B201 O20101Fl F2 A2PI PI Rl R2GI G,

31 32 33 34 35

5 X U POW A LMAVQHL MLAXKPW 5 T M C X K Q V H 5 I X 5 L

5152XI X2u, U, PI LI LtMl M2s, AI VI Ml M2Ll LtAl A2x, 5152 Tl TI Ml M2c. VI V, HI H251 5, II

P201 01WI WI Al AI VI Ql Q2 HI H, LI L2 X2KI K2PI PI WI WI CI x, X2Kl K2QI QI 12 x, XI 51 52 Ll L2

36 37 38 39 40

LWXLXR5 GZOFKLN YBXMRBN AOKTTBA EOBHWVL

Ll Lt WI W2XI X2L1 Gl Gt ZI Z2 01O2Fl Yl YI a, BI x,X2M1 Al A20101Kl K, T1 El E20101Bl BI HI

t, x, X2Rl R251 52 F2Kl K2Ll L2Nl N2 MI Rl R2Bl BI Nl NI T2TI T2Bl B2Al A2 H2 WI W2VI V2 L! L2

41 42 43 44 45

Y5XMBOW PGXKORZ I U C E A 0 Y I 0 B L Z M I TAN H C A I

Y1Y251 52 x, X2M1 PI PI c. G2x, XI x, II II Ul U2CI C2EI II 1201Dt B1B2L1 Tl T2Al A2Nl N2HI

MI Bl B201O2WI W2 KI 01O2 R1R2 ZI Z2 E2 Al A201Dt Yl Y2 LI Zl Z2 Ml MI I I 12 H2Cl CI Al A2II 12

46 47 48 49 50

o N C I 000 Y I B C N 0 L Y U U M C E P o TOM G B F UNAHLBO

01DtNl N2c, C2II YI YI II 12Bl BI c. Yl Y2Ul U2 Ul U2 Ml 01O2Tl TI 01O2Ml UI U2Nl N2Al A2HI

II 0101 01O201O2 C2Nl NI 01O2Ll L2 M2C1C2El E2PI P2 M2G1G2Bl B2F1F2 H2L1LtBl B2 01Dt

51 52 53 54 55

WXNXKKC 5 C T 0 X T 5 OAYXHKC NLOKRRF K YAP M H C

WI W2x, XI Nl NI x, 51 51 c. CI Tl T201 01O2Al A2Yl YI XI NI NI Ll Lt 01DtKl Kl KI Yl Y2Al AI PI

X2Kl K2Kl KI c.C2 01x, XI Tl TI 5152 XI HI H2Kl KI C1CI KI Rl RI Rl R2Fl FI P2Ml M2HI H2CI C2

56 57 58 59 60

ANMBVGR E Z QAT C Y IMNOLRL GMTWETR C V V K TEO

Al AI Nl N2Ml MI a, El EI z, z, Ql Al II 12Ml M2 Nl NI 01 Gl Gt Ml MI Tl TI WI c.CI VI VI VI VI KI

BI VI VI Gl Gt Rl RI AI Tl TI c, C2Yl Y2 01Ll LI Rl RI Ll LI WI El EI r, TI a, RI KI Tl TI El EI 01Dt

61 62 63 64 65

UFOELXH E Q V C B L Y UOUGYAF HNQLKFR UCNVOLH

u, U2Fl FI 01O2s, El EI Ql VI V2 C1 Ul U201O2Ul U2Gl HI H2Nl NI Ql L1 Ul U2e.C2Nl N2VI

EI Ll LI x, XI HIH2 C2s, BI Ll 4 Yl Y2 Gt Yl Y2AlA2Fl FI LtKl K2Fl FI Rl RI VIOl DtLl t, HI H2

66 67 68 69 70

LZORELK XKUP5EM C T N K T K E B 0 E E P G V QTGWERH

Ll L2z,z, 01o, Rl x, XI Kl K2Ul UI PI c, CI Tl T2Nl N2KI Bl BIOI 01 El EI El Ql Tl T2Gl G2WI

R2El E2Ll LI KI K2 P251 52 El E2Ml tl2 K2Tl T2Kl K2El EI E2PI PI c.G2VI V2 W2El E2Rl RI HI HI

71 72 73 74 75

LZORELK F A X I Y 0 A KZLXXOR RPERRRR N C I E

Ll LtZI Zt 01DtRI Fl FI AlAI Xl XI II Kl K2Zl ZtLl LtXl Rl Rt PI PI El Et Rl Nl N2CI CI

R, El EI Ll Lt Kl KI II Yl Yt 01Dt Al At Xt XlXt 01Ot Rl RI Rt Rl Rt Rl RI Rl RI II II El EI

Flouu 89--0ontlnued.

:I

:

. l

,
Total= .0004

Average= . 00007

Total=.0575

Average= .0072

Total= .0088

Average=.0008

Since each row of figure 90 contains 25 letters, composed of 5 different letters each appearing 5

times, and it is assumed that each row of the checkerboard contains 2 high-frequency letters, 2

medium-frequency letters, and 1 low-frequency letter, the rows in figure 90 will be composed of

10 high-frequency letters, 10 medium-frequency letters, and 5 low-frequency letters. Therefore,

the sum of the squares of the average probabilities of the letters occurring in each row of figure

90 is as follows:

171

This, then, is the constant that should be applied in the x-test for the problem under consideration. Suppose, for convenience, the approximation .05 is used. This is considerably less than

the normal constant .0667 and means that in the case of this problem two distributions can be

considered to "match" even if the number of coincidences (value of x) is considerably less than

what would be expected in the case of the normal type of frequency distribution. However, it

must be remembered that even if two distributions give an observed value for x that is close to

or even greater than the expected, one can still not be certain that the two distributions apply to

identical rows of letters and indicate two letters in the same row in the checkerboard, since it

may happen that the composition of the checkerboard is such that two rows have letters of about

the same frequency values, as pointed out above.

h. With this reservation in mind, let figure 90 be examined. Take rows D and M, which on

casual examination look a good deal alike, as seen in figure 93.

I As given in the table on p. 114 of Military Cryptanalysis, Part I, Appendix 2, par. 2e (1).

Total=.0484

5 X .0072= .0360

15X.0008=.0120

5 X .00007= .0004

that there will be 1 high-frequency letter, 3 medium-frequency letters, and 1 low-frequency

letter in each row and in each column of the checkerboard. Suppose the letters in each category

be as follows: .

High frequency A E I NOR S T·

Medium frequency BCD F G H L M P U y

Low frequency K Q V W X Z

Adding the squares of the probabilities for separate occurrence 5 of the letters in each category:

A .0054 B .0001 K .0000

E .0169 C .0009 Q .0000

I .0054 D .0018 V .0002

N .0063 F .0008 W .0002

o .0057 G .0003 X .0000

R .0057 H .0012 Z .0000

S .0037 L .0013

T .0084 M .0006

P .0007

U .0007

Y .0004

.~..,

170

Now consider the A row and the F row. The 25 letters in both rows of cells ere, from the very

nature of the system, identical in their sequence and there are only 5 different letters involved,

each appearing 5 times. Therefore it would seem that frequency distributions corresponding to

these rows should show definite eharacteristies by means of which they could be compared

statistically. Furthermore, the 9 1 coordinates applying to these two rows, Al and Fl , indicate

that A and F are in the same row in the checkerboard. What has been said of the A and F rows

also applies to the M, N, and Urows, for the letters A, F, M, N, and Uare all in the same row in the

checkerboard (fig. 87). Perhaps a statistical test can be applied to ascertain which rows of

distributions in figure 90 are similar and this in turn may give clues to the letters which fall in

the same row in the checkerboard applicable to the problem in hand.

j. Again, consider the columns in figure 90. What has been said of the rows applies equally

to the columns, and therefore the same sort of test may also be applied to the columns of figure

90 for clues as to the composition of the columns of the checkerboard applicable to the problem

under consideration. If there Were sufficient text much of the labor of solving such cases would

be reduced to a matter of statistical anulysis. But what sort of statistical test should be used?

Obviously it should be one based upon "matching" the distributions of figure 90, but specifically

what should it be? Note the distributions in rows D and M; they appear to be similar. Is it

correct to apply the usual x-test for matching two frequency distributions? Consider the composition of the rows of figure 90, and specifically consider the Aand F rows, composed as follows:

A .__________ A M MAN F F U U F M M NAN U N F A U MAN U F

F_ A M MAN F F U U F M M NAN U N F A U MAN U F

Here the letters in opposite cells are identical and there are only 5 different letters involved:

A,M, N, F, and U. Of these only 3 arc high-frequency letters in normal plain text; 2 are of medium

to low frequency. But the high-frequency letters in the A row match those in the F row, the

low-frequency letters in the A row also match the low-frequency letters in the F row. Hence,

if frequency distributions corresponding to these rows are tested statistically, they should yield

a fairly high index of coincidence. But should the constant .0667 (probability of monographic

coincidence in normal English text) be used in the test? Obviously not, for this constant is derived

from statistics based upon the normal frequencies of all 26 letters of the alphabet, whereas here

only 5 letters are involved and the exact 5 involved in any example is determined by the composition of the checkerboard. Again, consider the A and C rows of figure 90, composed as follows:

A................ A M MAN F F U U F M M NAN U N F A U MAN U F

C .___________ T C C T R G G I I G C CRT R I R G TIC T RIG

Here is a case where, by chance, high-frequency letters stand opposite high-frequency letters

(A and T, Nand R); medium-frequency letters stand opposite medium-frequency letters (M and

C, F and G). The only case of fairly marked difference is in that of the pairing of U and I.

Hence, a statistical matching of frequency distributions applying to these two rows would be

apt to yield a high index of coincidence. Yet, these two rows do not belong together and to

assume the t the letters A and C belong in the same row in the checkerboard would block or at

least retard solution. In spite of the foregoing reasoning, there nevertheless remains the feeling

that a statistical matching of the rows should be possible or should 8t least offer some clues as

to the composition of the checkerboard.

g. In applying the usual x-test for matching two distributions use is made of the important

constant .0667, the probability of monographic coincidence for normal English text. This

constant may be modified to meet the special conditions of the present problem. Ifit be assumed

that the mixing of the letters in the checkerboard is fairly good, in normal cases it may be assumed

:1

I' 1

'I

i

"

. ,

,

1

I

; i

.j!i

I '

.,i .

. :.': I . !

! 'I

: iI , 'i

i i

I'

I' .j i

I:il! I

I

i

J:l In

Iii .;.! :i J!

!
N=21

N=21

57

72

63

14

61

15

18

32

Period 33

48

Expected for plain text: .05 (39X21)=41

Expected for random text: .038 (39X21)=31

Observed =39

From the foregoing calculations it appears that Al ma.y be similar the Dl and. the M1 distributions for the observed values, while not as great as expected for plain text, are higher than those

(',xpe~ted for random text. Perhaps more conclusive evidence may be found if a search were

made through the text to see if any equivalences between AI, DlI and Mil appear.

Note the following cases:

Period 8 Y2 BI AlB2 As MI

12 NzB1 AlBI AzD1

50 NI BI AI B, AID1

16 01 BIOI B2 01 Al

20 YI B1 Dl BI O2 Al

49 TzBIOI B2 Oz F1

2 YI BI MI BI MzRI

21 CzGl Al A2x,

30 Ks G1 AlGI 51Pz

3 z, G1 01 Gz Bl Kz

56 NzG1 M1Gz MzR1

24 Xz K1 AlKs RI Z2

34 T2 K1 M1 K, Ms Ql

It certainly seems as though Al=DI=Mll and that these letters are in the same row in the checkerboard. This tentatively will be assumed to be correct.

Expected for plain text: .05 (23X21)=24

Expected for random text: .038 (23X21)=18

Observed =26

324151l--41-12

A BC D E F G H I K L M N 0 P Q R 5 T U V W X Y Z -.. ~--~ -~ -. -- -- '::::: N=16

ABCOEFGHIKLMNOPQR5TUVWXYZ

§ -. ::::: - -.. ....... ::: -.:::: -. -. -. - -........ N=39

:::: '>

Expected for plain text: .05 (16X21)=17

Expected for random text: .038 (l6X21)=13

Observed =14

173

N=24

N=23

N=16

::: -.::::::

A B C D E F G H I K L M N 0 P Q R 5 T U VIW x Y Z ..... ::::: ..... ..... ..... ..... ..... ..... ..... ::::: ..... .....

f-- - - - - - - - - - - - - - - - - - - - - - - --)- ..... :::: ..... ..... ..... ..... ..... ..... .....

J'IGUBJ: 113.

Applying the x-test, the observed value of x=34, the expected value is .05 (23X16)=18. An

excellent match is obtained, and the hypothesis that D and Mare in the same row in the checkerboard seems promising. Can any confirmation be found in the cryptogram itself?

i. It has already been pointed out that this system reduces to monoalphabetic substitution

with variants. This being the case it should be possible to find manifestations of equivalency

between some of the variant forms of:: vertical pairsin the cryptogram. Ifthe student will think

over the matter he will quickly see that, this manifestation of equivalency is but a reflection of

the principle elucidated in paragraph 46, expressed in a little different way. In other words,

establishing equivalence between two 8 1 components means that the two base letters involved

belong in the same row of the checkerboard; establishing equivalence betweeen two 8 2 components means that the two base letters involved belong in the same column of the checkerboard.

Note the following instances of apparent equivalency between Dl and Ml:

172

Period 16 D2B1 DI B2 Period 18 ~QI D1Q,

20 Y,B1 Dl B2 32 LI Ql MI Qs

49 T2B1 DI B2 16 F2E1 n, E,

2 Y2B1 MI B2 17 F2El n, E2

i 3 Z2 G1 DI G2 59 G2 El Ml E2

l 56 N2Gl M1 G2 12 Al B2 AI D1 Bl D2 , 13 Q,L1 DI L2 AlB, AID1 HIDI .! 50

"i!

"

'r 37 Zz L1 D1LI 8 D1BI DIM1 R1Mz

l; 58 Nz L1 D1LI 19 D1N2 o, D1 U1 Dz

I;

66 Z2 L1 DI Lz 46 D1 I, DI D1 N1D,

71 Zz L1 D1LI 44 Dl Zz Dz M1 B1MI I ! , 6 A,L1 M1L, 43 U1AI UI D1 C1D,

13 Y2 LI MI LI 67 Ul E, UI M1 PIM, ' 'i 58 r, L1 M1 Lz

;\ It may be assumed Dl=M1 and the two distributions in figure 93 may be amalgamated. 'I

i 01 + MI ABCOEFGHIKLMNOPQRSTUVWXYZ

§§-:::::-.-- ...... ::::: -:::::::: ............. < ...... ;:::--- ::::: ::::

::::

The only other row in figure 90 which gives indications of being similar to this distribution is the

Arow. Applying the x-test individually to the Dl and MI distributions, and "then to the combined

01+M1 distribution:

01 ABCOEFGHIKLMNOPQR5TUVWXYZ

:::: :::: N=23 ..... ..... ..... ....... -.. ...... -.. .. ::::: ~--
36

15

S S R 0 ADS

RI R, GI G2 Al A,s,

S, WI W2QI Q2 BI B,

RGASWQB

L E

Period________________________________________ 14

Plain text__________________________________ C R 0

Components {~~ ~: ~~ ~: ~~ ~: ~~

Cipher text________________________________ N A COX C R

Take the first letter Rp, represented by C2RI.

Since Rp= C2Rh

Therefore, R1 R2=C2RI

Hence R1=C2 and R2=R1

Therefore, R1=R2=C,

OP=OI R,

But Op= 01 0,=01 R,

02=R,

Therefore, R1=R,=0,=C,

Period______________________________________ 35

Plain text________________________________ H 0 S T I

. {VIV, HIH2 SI S, II CIpher-text components____________ I, XI X2 SI S, Ll L,

. - {HI 01 SI TI II Plain-text components______________ H, 0, S2 T, I

2

Again, in the case of the first Op,

175

This word if correct, yields the following equivalencies: H,=X2=01;SI=0,; TI=S,; LI= T2; I 2=

~=EI; Xl ' E2. Again the text is examined for cases in which the plain-text letters may now be

directly inserted; but only one case is found, in period 44, where II L2= I I I2=~P' This is unfortunate, so that additional words will have to be assumed. The 14th period shows a Cp

and the components after it suggest that the word CROSSROADS may be present. Thus:

Period______________ 35 36

Plain text_________ S ~L~~_=__::::__::__::"_=-

{

V I V z HI H 2 SIS 2 I ILl L 2 WI W2 X I X 2 L I

Componenta.Lc, I 2 X I X 2 SIS, L I L, L, X I X, R I R 2 SIS I

Cipher text_______ V H S I X S L L W X L X R S

Two letters are quite definite, S. and L.. Suppose the possible plain-text letters be indicated.

Period______________ 35 36

Possible Plain-{V H S I L W X L

text letters____ I X L X R S

{

V I V 2 H I H 2 SIS 2 I I L I L 2 WI W2 X I X, L I

Components______ I, X I X 2 SIS I L I L, L, X I X, R 1 R, SIS'

Cipher text_______ V H S I X S L L W X L X R S

The word HOSTILE is suggested by the letters H . S . I L ., This word will be assumed to be

correct and it will be written out with its components under the cipher components. Thus:

"

,.

c.

'.:

Period 12

10

30 L2 PI EI P2 E2RI

33 L2 PI Al P2 A2WI

Al H2

43 C2 YI EI Y2 II t,

Al H2

57 ~YI Al Y2 II

E1 Hz

Al G2

Al GJ

DI G2

EI GJ

MI GJ

174

Here are indications that EI belongs to the same series, but not enough cases where Sl is interchangeable with A, D, E, or M can be found to be convincing. But perhaps it is best not to go

too fast in these early stages. Let it be assumed for the present that A, D, E, and Mare in the

same row of the substitution checkerboard. In period 16 there is the pair of vertical components DI E2• Since DI=EI this pair may be written EIE21whereupon the plain-text letter E is

immediately indicated. .All cases of this sort are sought in the text and the plain-text letters

are inserted in their proper places, there being 7 such instances in all, but these yield the important letters, A, D, and E.

k, In a similar manner, by an intensive search for cases in which components appear to be

equivalent because they occur in repetitions which are identical save for one or two components,

it is established that C, 0, M, and Ware in the same column in the checkerboard. Note the bracketing of these letters occurring as 9 2 components in the 4th column of the first list of sequences

in subparagraph i. Likewise, B, H, and N are established as being in the same row. Again

the text is examined for cases in which plain-text letters C, 0, M, W, B, H, and N may be inserted.

By carrying out this process to the full extent possible, the skeletons of words will soon begin

to appear.

l: Enough has been demonstrated to show this line of attack. Of course, if there is a large

volume of text at hand, the simplest procedure would be to construct frequency distributions

of the types shown in figures 90 and 91, and use the statistical method to match the individual

distributions. For this method to be reliable it would be necessary to have several hundred

letters of text, but this in actual practice would not be too much to expect.

m. There is, however, another line of attack, based upon the probable-word method. It

has been pointed out that, in the case of letters in odd positions in the periods, 40 percent of the

time the plain-text letter involved is indicated by either its 9 1 or 9 2 component. This property

affords a fair basis for assuming a probable word. For example, the cryptogram here studied

shows the following two periods:

Period 2 Y2 C1 Y1 C2 Y2B1 M1 B2 M2R1

8 L1 YI W2 Y2 B1 Al B2 A2MI

10 B1 A2 Y1 O2 Y2 B1 E1 B2 E2 RI

~~ ~~ L~ ~~ ~~

41 HI YI M2 Y2BI SI B2 S2 01

Note how MlJ AlJ ElJ DlJ and Sl all appear to be interchangeable. Are these the 5 letters which

belong in the same row? The probable equivalence among AlJ DlJ and MI has been established by

noting cases of equivalency in the text. A further search will be made to see if El and SI also

show equivalencies with AlJ DlJ and MI'

Note the following:

Period 21 C2G1

30 K2 G1

3 ~G1

69 O2 G1

56 N2 Gl

j. Among the most frequent combinations is the pair Y2 BlJ appearing in the following

sequences:

,

I

!

'I

I ;

i

Ii

II

I

I'

I

"

I::

'i
o. Since a row or a column can contain only 5 letters, it is obvious that A, 0, E, Mj B, H, N;

and G, R, Q, 5, fall in 3 different rows; C, 0, M, W, R and I, L, A, Q fall in different columns. A

start ma.y be made by an arbitrary placement of R in the position 1-1, and since RI=01l=C1=

00 AI BI CI O2 EI FI GI H2 12 K2 L2 M2 N2 O2 P2 Q2 R2 52 TI U2 V2 W2 XI Y2 Z2

Z

0 Al TI Mll XI 01 L LJ II C2 CI LJ CI Tl LI C2 H2 ...

Eo! 01 52 O2 HI H2 01 Al Al O2 M2 12 M2 WI M2 01

-<Z EI WI W2 NI X2 OI 01 W2 W2 Al O2 O2 ...

I:Q MI RI EI EI RI SI 01 W2 SI

)l II 51 MI MI 51 RI EI 51 Rl 0

0 LI RI A2 AI R2 R2 MI RI R2

i QI GI Q2 Q2 GI GI A2 GI GI

Ql QI QI QI QI

FIGUU 114

AD

G

H I

FlGURE96-C.

R 5

I-- - - 1-

C

I-- - - 1-

0 X L

I-- - - 1-

M E

I-- - - -

W T

X

AOE

GS

4

5

1

2

H I

X L

FIGURE G5-A.

R

I-- - - 1-

C

I-- - - 1-

0

I---- - -

M

- - - - -

W

AOE

G

5

1

H I FIGURE Gil-B.

R 5

I--- - - - 1-

C

I--- - - - 1-

0 X L

I--- - - - 1-

M

I-- - - 1-

W T

4

5

1

2

177

must be in row 4, H and Xmust be in column 3. This means that 9 1for A, 0, and E must be 4,

and that 92for H and Xmust be 3. And since M,=I2=L2, 92for I and L must be 4. Substituting in the text the coordinates for the known values, additional plain-text words soon become

evident. For example, taking the periods with the word H05TILE, it becomes possible to insert

Period____________ 35 ··oft -1 36

Plain text______ H 0 5 T I !j L~E;....__---

C {VI V2HI H251 52 II LI L2WI WI XI X2LI

omponents 12XI X251 52 LI L2 ' L2XI XI RI R251 52

Cipher text V H 5 I X 5 L: L W X L X R 5

the letters Rp and Op as the second and fourth letters after Ep, suggesting that the word after

HOSTILEis TROOP. This gives WI X2=Tp, which permits of placing T in position 5-3.. Since T in

HOSTILE=52Lh therefore 52=5 and L,=3. Since 5 is in row 1, and 51=5, 5 must go in position

1-5. Since ~=4 and LI=3, L must go in position 3-4. Since Op (the 1st 0 in TROOP)=X,R1

and it is known that Op=3-1, therefore Xmust be in position 3-3. The checkerboard is now as

shown in figure 95-B. From figure 94, X,=E1• Now XI=3, and since the E must be in row 4,

12345 12345

~=WI' this means that R, 0, C, M, and Wform one column in the substitution checkerboard, as

shown in figure 9s5-A. The data also indicate thatR, G, Q, and 5 must be in row 1, A, 0, and E

3dcomponent

1 234 5

BI=~

LI=TI

~=II=E,

XI=EI

176

The various equivalencies yielded are as follows:

CI=RI=01=51=~=GI =WI=QI

51=WI=BI=T,

HI=XI=O,=~

OI=QI

~=AI=O,

A study of the equivalencies indicates that--

(1) A, 0, E, M belong in the same row.

(2) B, H, N belong in the same row.

(3) G, R, 5, Q belong in the same row.

(4) R, C, 0, M, W belong in the same column.

(5) I, L, A, Q belong in the same column.

(6) X, H, G belong in the same column.

(7) The coordinates of R and A are identical and hence this letter occupies a cell along

a diagonal sloping from left to right in the matrix.

n. Let all the equivalencies found thus far from subparagraphs e,f, and h be collected in two

tables, as shown in :figure94, one for 9 19 2combinations, the other for 9 1 91combinations.

00 Al BI CI 01 EI FI GI HI II KI LI MI NI 01 PI QI RI 51 TI UI VI WI XI YI ZI

~~~ ~~ ~~ ~~~~ ~~~& ~&

e.~ .~ ~~ ~~L .~~~~ & Z~~ ~~ ~~ .~~ ~~~~

iXl II 1111 WI II ~~WI

)l Ls Ls LJ RI LJ WI WI Rl

8~ ~~ ~~~ ~~ ~~ & ~~~

QI 51 QI QI
40

E P 0 SITI

8 1 14252

1545818

EOBHWVL

280

36

LET ROOP

1 3 541 1 1 3 1 1 444 5

LWXLXRS

2li2

48

ONWITHF

1 262 528

4243115

YUUMCEP

836

28

WN INC0N

6222212

4282442

UNHCICK

IIlG

44

IFF I C 'U L

238 2251

8

6 634 2 8

IDBLZMI8lB

24

LDSWOOD

1346113 3 2 5 4 442

LSXABRK

168

32

L.MA K E E V

1 3 34 3 35

8432113

LMAVQHL

224

20

o NFl VET 1 2 8 2 ,5 3 5

4 25 :3 3 1)

YDVWBAX

140

35

V E H 0 S T I

5 32 1 4 52

3 1 1 45 1 3

V H S I X S L

245

27

A R L EST0

34 13461

3431 514

ML S LQ P 0

189

47

o NNE C T I

122 3 252

42214 1 3

Y I B C N 0 L

329

31

S TOP W I L

4511 621

5 1454 3 3

SXUPOWA

217

39

EFENSIV

3 8 82425

15125 3 3

ADKTTBA

278

23

ENEMYHO

323 3 1 2 1

I 2 14 2 14

DAYXHKO

161

43

HAVINGD

2 362243

1 338 2 12

IUCEADY

301

19

DJ U N C T I

3 25 2 2 5 2

2 3 224 1 3

DUBNDCL

183

42

Y T ROO P S

1541114

2 1 44466

PGXKORZ

294

38

oC CUP Y D

1 225 1 1 3 4 4 4 2 6 2 2

YBXMRBN

266

26

EST0 F C H

346 1 3 2 2 1 6 1 4 641

MTDHTSG

182

34

RTTODRI

4561342 4 1 1 4 243

STMCXKQ

238

22

E E G S TOP

3344611

1115146

ARTXXTS

11;4

30

L E FOR C E

1831 428

3164441

LEKAPRG

210

179

46

A I N I N G C

3 2 2 2 242

3 3 2 3 2 14

D N C I D D 0322

18

DASHROA

3 3424 1 3

23·51443

A K G D F 0Q

126

33

E RYE F F0

34I 3331

·1 ,4 ·2 1564

MLAXKPW

231

29

SID ERAB

423 3432

6321,35

KAQBDOF203

37

SOUTAND 4 ·1 6 5 3 2 8

5421322

GZDFKLN

259

41

o N S TOPM

1246113 4 2 5 1 4 6 4

YSXMBOW

287

25

SSOUTHW

44165 2 5

5542114

RPUZWHO

175

45

TYMAINT 5 1 3 3 222 1 243 3 2 3

TAN H C A I

315

21

HREETHR

·2 4 3 36 2 4 141 1 114 C AUG G X 0

147

17

ESEVEND

·34853 ,23

1 513 122

M F D E TEN119

12

INFANTR 2 288 254 3 263 2 1 4

NABQBDO

34

8

ONFIRST

123 2445

4258451

YDRWBMT

1I8

FIGUBS 96-F. 4

NTYFOUR 2 6 1 3 1 6 4

2 1 25424

BLPKYWC

28

16

EVENFIV

3632326

1 3 125 3 3

FDDTEBA112

1 2 3 4 5 X Y L 0 P

- ------I- H N I C B - -------- E D A M F

I--------I- G K Q R S - ------I- T U V W Z

4512

7

LOWS COL

1 154 2 1 1

3446443

XWHLRWQ

49

15

SSROADS

4441 334

6644 3 25

RGASWQB

106

11

SEVENTH 4 3 6 3 262

513 1211

QVBBLYX

77

26 1 3663

2 1

45141

B L Z D 0 TG

21

FIGUBB 96-E.

3 2 4 1 5 G K Q R S - - -----

H NICB

- -------

X

YL0P

- -------

EDAMF '--- - ----,- T U V W Z

4512

14

CHEDCRO

2233 241

41 12444

NACOXCR98

1212341 4 2 4 2 5 '4 4

YYMOCBR

14

10

ONFORTY

1231461 4 '2 6 4 4 1 2

YESOBRY

70

6

D E A S F 0 L

8334311

2136 643

AMEYLZQ

42

FIGUBS 95-0.

13

YHASREA

1 2 344 3 3

2 1 '354 1 8

YMQDLWL

(11

4266362

5312313

KZFBEIL7 9

BATTALI

2 355 3 1 2

531 1 3 3 3

IZEBELA

'63

5

THBRIGA 5 2 2 4 243

1 1 543 1 3

U C C E PQL

36

1 23 4 5

RKG

Q

S

- ------

-

C N HIB

-

- ----

-

0

Y

XL

P

- ------i- M D E A F - - ----- W U T V Z

p. The completely

123

deciphered cryptogram is as follows:

SIT U A T ION0N FRO N T0 F T W E

178

4512

itis evident thatE must' occupy cell 4-3, as seen in 'figure 95-C. There are now only 2 possible

rows for H, either 1 or 2. It is deemed unnecessary to give further detail's of the process. Suffice

it to say that in a few minutes the entire checkerboard is found to be as shown in figure 95-D.

It will decipher the entire cryptogram as it stands, but speculating upon the presence of WUT VZ

in the last row, and assuming

a key-word mixed sequence has brought this about,a rearrangement of the columns of the checkerboard is made to give T U V WZ, as shown in figure 95-E.

The arrangement of the rows now becomes quite evident and the original checkerboard is found

to be 8S shown in figure 95-F. Itseems to be based upon the key phrase XYLOPHONIC BEDLAM.

"I"

'!'
!1.. The steps taken in recovering the original substitution checkerboard demonstrate that

cyclic permut~t~ons of a correct checkerboard will serve to decipher such a cryptogram just as

well as the original checkerboard. In other words, a cryptogram prepared according to this

method is decipherable by factorial 5 (5X4X3X2Xl=120) checkerboards all of which are

cyclica.lly equivalent. Even though the identities of the components will be different if the

same message is enciphered by two different cyclically-equivalent checkerboards, when these

components are recombined, they will yield identical cipher texts, and therefore so far as external

appearances are concerned different checkerboards yield identical cryptograms. The reason

; !

i·

. ;

I

i

f 1

I

. [-

,'t

·49

.o -R'T :Y:F I 'F

::I ::4 '~15 :1 '.3 -23

·4 41 '2 5 '3 5

OTDMGBF

343

53

ENEMYNO

3233121

1 2 1 4 2 2 '4

DAYXHKC

371

57

APTURED

3 1 15 5 4 3 3 • 15 1 2 4 1 2

E Z .Q A T C Y

3Il9

61

THATENE

·5 2 3 5 3 2 3

1 1 .3 1 1 2 1

UFDELXH

427

65

VINGINT

15 2 2 4 2 2 15

332 132 1

UCNVDLH

41115

69

HT-PREPA

2 6 1 • 3 1 3

1 1 15 4 1 15 3

B 0 E E P G V

483

73

GHTTOMO

42156131

111 1 4 4 4

KZLXXOR

611

180

50

T HI NF A'N

l5 '2 2 '2 3 3 2

113 2 5 3 2

UNAHLBD

350

54

NCOMMIS

2 2 1 3 324

2 4 4 4 4 3 5

NLDKRRF

378

58

NEARCHA

2334223

2 1 344 1 3

IMNDLRL

406

62

MYSEVEN

31431532

426 1 3 1 2

EQVCBLY

434

66

OAT T A C K

1 3 l5 15 3 2 4 431 184 2

LZDRELK

482

70

RATORYT

4 3 15 1 4 1 6

4 3 1 4 4 2 1

QTGWERH

490

74

RROWMOR

4 4 1153 1 4

4 4 4 4 4 4 4

RPERRRR

518

51

TR YO NN 0

6 1 1 221

1 4 2 4 224

WX'NXKKC

357

55

S ION E D 0

421 233 1

534 2 1 2 4

KYAPMHC

386

59

RLESTOW

4 1 346 1 6

4 3 1 5 144

GMTWETR

413

63

THDIVIS

623 2 5 2 4

1 123 3 3 6

UDUGYAF

441

67

P 0 S "I TI 0

1 I 4 2 6 2 1

6 4 6 3 1 3 j

XKUPSEM

46ll

71

OATTACK

1 3 .6 6 3 2 4

431 1 342

LZDRELK

497

75

N I N G

2 2 2 4

2 3 3 1

N C I E

522

52

R T H S ·T 0 P

4524611

4 '1 1 6 1 4 6

SCTOXTS

364

56

F F ICE R C

3 3 2 284 2

5534144

ANMBVGR392

60

NSTATES

2 4 5 3 534

2 6 1 3 1 1 5

CVVKTEP

420

64

ION ISM 0

2 1 224 3 1

3 4 2 3 544

HNQLKFR

.48

68

NSTONIG

2 4 6 .1 2 2 4

2 15 1 4 231

CTNKTKE

476

72

ATDAYLI

353 3 1 1 2

3 1 2 3 233

FAXIYDA

llO4

181

that there are only factorial 5 cyclically-equivalent checkerboards and not factorial 10, is that

whatever permutation is applied to the row coordinates must be the same as that applied to the

column coordinates in order that the aforesaid relationship hold true. If two checkerboards

have identical row coordinates but different column coordinates certain portions of the cryptographic text will decipher correctly, others incorrectly. For this reason, in working with cryptograms of this typc the cryptanalyst may successfully use a checkerboard which is incorrect in

part and correct it as he progresses with the solution. It may also be added that the actual

permutation of digits applied to the side and top of the checkerboard is of no consequence, so

long as the permutations are identical. In other words, the permutation 5-2-1-3-4 will work

just as well as 3-2-4-1-5, or 1-2-3-4-5, etc., so long as the same permutation is used for both

row and column coordinates. It is the order of the rows and columns in the checkerboard

which is the determining element in this system. Any arrangement (of the letters within the

checkerboard) which retains the original order as regards the letters within rows and columns

will work just as well as the original checkerboard.

r, A final remark may be worth adding. After all, the security of cryptograms enciphered

by the bifid fractionating method rests upon the secrecy inherent in a 25-cell matrix containing

a single mixed alphabet. In ordinary substitution, a single mixed alphabet hardly provides any

security at all. Why does the bifid system, which also uses only a single mixed alphabet, yield

so much higher a degree of security? Is it because of the transpositional features involved'?

Thinking about this point gives a negative answer, for after all, finding the length of the periods

and replacing the cryptographic text by components based upon the cipher letters is a relatively

easy matter. The transpositional features arc really insignificant. No, the answer to the

question lies in a different direction and may be summed up about as follows. In solving a

simple mixed-alphabet substitution cipher one can attack a few cipher letters (the ones of greatest

frequency) and find their equivalents, yielding fragments of good plain text here and there in

the cipher text. Once a few values have been established in this manner, say 6 values, the

remaining 20 values can be found almost from the context alone. And in establishing these 6

values, the letters involved are not so interrelated that all 6 have to be ascertained simultaneously. The cryptanalyst may establish thevalues one at a time. But in the case of the bifid system

the equivalents of the plain-text letters are so interrelated that the cryptanalyst is forced to

assume or establish the positions of several letters in the checkerboard simultaneously, not one

by one. In other words, to use an analogy which may be only partially justified, the solution

of a simple monoalphabetic substitution cipher is somewhat like forcing one's way into an inner

chamber which has a number of doors each having a single lock; the solution of a bifid fractionated cipher is somewhat like getting into a vault-s-there is only one door which is provided with

a complex 5-combination lock and all the tumblers of the lock must be positioned correctly

simultaneously before the releasing lever can drop into the slot and the door opened. Fundamentally, this principle is responsible for the very much greater security ofthe bifid system as

compared with that afforded by the simple monoalphabetic system. It is a principle well worth

remembering and speculating upon.

53. Special solutions for bifid systems.-a. The security of the bifid system is very considerably reduced ifthe situation in which it is employed happens to be such that two or more

messages with identical beginnings, endings, or internal portions can often be expected to occur.

For in this case it is possible to establish equivalencies between components and quickly reconstruct the substitution checkerboard. An example will be given to illustrate the steps in a

specific case.

b. Here are two cryptograms transmitted by two coordinate units to a superior headquarters at about the same time. They show certain identities, which have been underlined.
b. The equivalents may, of course, be arranged in a mixed order, and it is possible to use one

tripartite alphabet for decomposition and a wholly different one for recomposition. One disadvantage of such an alphabet is that it is a 27-element alphabet and therefore some subterfuge

must be adopted as regards the 27th element, such as that illustrated in the footnote to paragraph

57 of Special Text No. 166, Advanced Military Cryptography, wherein ZA stands for Z and ZB

for the 27th character.

1. SEVENTH INFANTRY IN POSITION TO ATTACK AT FOUR AM PLAN FOUR.

2. TENTH INFANTRY IN POSITION TO ATTACK AT FOUR AM PLAN THREEX.

j. The foregoing gives a clue to what would happen in the case of an extensive traffic in

which long phrases or entire sentences may be expected to occur repeatedly. By a proper

indexing of all the material, identical sequences would be uncovered and these, attacked along

the lines indicated, would soon result in reconstructing the checkerboard, whereupon all the

messages may be read with ease.

~4. Solution of trifid systems.-a. In the trifid fractionating system the cipher alphabet is

tripartite in nature, that is, the plain-text letters are represented by permutations of 3 components taken in groups of 3's, thus forming a set of 27 equivalents, such as that shown below:

QDWC

NXGX

S=311

T=312

U=313

V=321

W=322

X=323

Y=331

2=332

7=333

J=211

K=212

L=213

M=221

N=222

0=223

P=231

Q=232

R=233

A=111

B=112

C=113

0=121

E=122

F=123

G=131

H=132

I=133

182

No. 1. ~BL . X!NAB Q!mQY HOND.\L..YUYTE M!:!QZ!L..QTLKE ErlAPK ~LIP

No.2. VBNHY--XDABG BDOI!L-.QBNWV LYTFW H9.XQg VLKEW WAXD!L...§ABCA

c. Apparently these two cryptograms contain almost identical texts. In order to bring the

identities into the form of superimposed components, it is necessary to transcribe the texts into

periods of 7 and to superimpose the two messages as shown in figure 96.

d. The shifting of the second cryptogram 2 intervals to the right brings about the superimposition of the majority of 81 and 82components and it may be assumed that for the most part

the texts are identical. Allowing for slight differences at the beginnings and ends of the two

messages, suppose a table of equivalencies is drawn up, beginning with the eighth superimposed

pairs. Thus, ~=~:; hence N1=N2and ~=01' ~:=~:; hence N2=H1 and B1=02' Going through

the text in this manner and terminating with the 42d superimposed pairs, the results are tabulated

ItS shown in figure 97.

e. From these equivalencies it is possible to reconstruct, if not the complete substitution

matrix, then at least a portion of the matrix. For example, the data show that N, H, B, and I

belong in the same row; E and F belong in the same row; N, D, U, Y, and K belong in the same

column, and so OIl. Experimentation to make all the data fit one checkerboard would sooner or

later result in reconstructing the checkerboard shown in figure 95-F, and the two messages read

as follows:
1 2 3 4 .~ 1\ 7 II II 10 11 12 13 Ii 1.~ Il\ 17 1~ 19 :!O 21 :122=1 242526272l! 2\j 311 :11 32 :J:i 34 :t~ :iii 37 39 411 41 42 43 44 45 46 47 4~ 49

Q1 VI V2a, B2B1 N1N2Al A2B1B2Ql r, Y2HI H2 01 O2Nl Ul U2Yl Y2Tl T2El ZI Z2 DI D2QI Q2 T1 El E~ WI W2Al A2PI L I L2 II 12PI P2QI

B2LI L2YI Y2XI X2 Q2 BI B2DI D2 01 O2 N2DI D2WI W2VI V2 E2MI M2HI H2QI Q2 T2LI L2KI K2E, E2 P2KI K2 QI Q2 51 5 Q2 n,D2WI W2CI C2

No. L _______Q V B B L Y X N A B Q B D 0 YHONDWV 'UYTEM!!~ Z !LQ T L K E EUPKU LIP Q D W C

VI V2BI B2Nl N2HI Al A2 B1B2Gl G2s, HIH201 O2 BI B2Nl YI Y2TI T2Fl F2WI DI D2Ql Q2 VI V2LI WI W2Al A2XI X2DI s, B2 c, C2Al A2 Nl

H2Yl Y2x, X2DI D2 B2DI D2 01O2 II 12 N2WI W2VI V2Ll L2 W2HI H2Ql Q2 x, X2 L2KI K2EI E2WI W2 D2QI Q2 51 52 Al A2 N2XI X2 GI G2XI X2

No. 2_________V B N H Y X D A B G B D 0 I HOB N WV L Y T F W!LQ X !LQ V L K E W !....A X D 9.-§ A B CAN X G X

FIIlURE 00,

81 8 2 • . • Al Bl CI DI EI FI GI HI II KI LI MI NI 01 PI Ql RI 51 TI UI VI WI XI YI ZI

~~ ~~~~ •• ~~~. L~ ~~~~~~~

~~ L~~ ~~~L~~ ~~

DI N, Al Y2 Y2 DI U2

L2 N2 L2 NI NI Al D2

12 HI A2 Bl s, A2 Y2

MI K2 M, K, K2 I, K,

II II HI II

U2 U2 U2 HI

82 8 1 • • • A2 B2 C2 D2 E2 F2 G2 H, I 2 K2 L, M, N, O2 P2 Q, R2 52 T2 U2 V2 W2 X2 Y2 Z~

Al UI BI LI ZI r, DI D2 MI W2 NI WI DI XI Nl E1 M2 LI BI WI

~L ~~~~~ ~L ~~~~~~~

DI Y, s, Y2 DI II Al BI NI

~~~

I 2 HI A, N2 A2 U2 A2 HI U~

MI K2 MI HI I 2 D2 MI K2 HI

II II K2 II K2

U2 U2 Y2 Y2 II

324155--41 (Face p. 1~2)
KAQHO RRHWF LXIZA BFZBN ATNNN WROIZ

183

c. The various types of fractionation possible in bifid systems are also adaptable in trifid

systems. For example, using the alphabet shown above for recomposition as well as decomposition the encipherment of a message in periods of 7 is as follows:

OMORROW

222.222.3

22.233.22

3.133.332

NNWROIZ

GIMENTT

112.123.3

33.222.11

1.312.222

B F ? NAT N

CRYPTOGRAM

FYOURRE

132.322.1

23.213.32

3.133.332

HWFLXIZ

PlaiD tm:t R ELI E F 0

{

2 1 2. 1 1 1. 2

Components________________ 3 2. 1 3 2. 2 2

. 3.233.233

Cipher tllxt K A Q H 0 R R

d. The solution of a single cryptogram of this nature would be a quite difficult matter, especially if there were nothing upon which to make assumptions for probable words. But a whole

series of cryptograms could be solved, following in general the procedure outlined in the case of

the bifid system, although the solution is, admittedly, much more complicated. The first step

is to ascertain the length of the period, and when this has been done, transcribe the cipher text

into components, which in their vertical combinations then represent monoalphabetic equivalents, with, of course, many variants for each letter of the plain text. Then a study is made to

establish component equivalents, just as in the bifid system. If the text is replete with repetitions, or if a long word or a short phrase may be assumed to be present, a start may be made and

once this sort of entering wedge has been forced into the structure, its further disintegration and

ultimate complete demolition is only a matter of time and patience.

55. Concluding remarks on fractionating systems.-a. It goes without saying that the

basic principles of fractionation in the bifid and trifid systems are susceptible to a great deal of

variation and complication. For example, instead of having periods of fixed length through the

message it is possible to vary the length of the periods according to some simple or complex key

suitable for this purpose. Or the bifid and trifid systems may be combined into a single scheme,

enciphering a. text by the bifid method and then reenciphering the cipher text by the trifid

method and so on. Systems of this sort may become so complex as to defy analysis, especially

if the keys are constantly and frequently varied so that no great amount of traffic accumulates

in any single key. Fortunately for the cryptanalyst, however, such complex systems as these, if

introduced into actual usage, are attended by so many difficulties in practice that the enemy

cryptographic service would certainly break down and it would not be long before requests for

repetition, the transmission of the same cryptogram in different keys, and so on, would afford

clues to solution. Could such systems be employed successfully in field service there is no doubt

that from the standpoint of security, the cryptograms would be theoretically secure. But the

danger of error and the slowness with which they could be operated by the usual cryptographic

clerks are such that systems of this complexity can hardly be employed in the field, and therefore

the cryptanalyst may not expect to encounter them.

b. However, the simple bifid system, the ADFGVX system, and the like, are indeed practicable

for field use, have been used with success in the past, and may be expected to be in use in the

future. It is therefore advisable that the student become thoroughly familiar with the basic

principles of their solution and practice the application of these principles as frequently as possible. In this connection, the attention of the student is directed to the fact that there is theoretically no reason why the bipartite components of the ADFGVX system cannot be recombined

by means of the same or a different checkerboard, thus reducing the cryptographic text to a form

wherein i~ consists of 25 different letters, and at the same time cutting the length of the messages

•
i s! I ~= s ~:8

a ",'5l

1s' s.. -2 'Oi' t:e

lil .l.

...

... ~j 5 OQIJ ~'2

• ~~ lo~~:!

~~ ! ..........

t Ii

:gg, ~E' ... ",

~j fell ~cl. i .....

i~ .1. 5

-sill

=i 0 ...... ..... j;l'" - toE'Oi' iJ .2..... "'. .<l ....,Q 1 .$l'5lj ~.a~ "'s, g'" .. J. tlli .. "J~

* .g':;M~ j6".: !

! "~>T p:;~! :§ 0 ... -i~,,",e ~S; i

.e-8~ &ai

s !~.~ do • ~eIo .a

::l liE :!lC 0 w;(I:'" :=1: --a1l 6i :g .~IJ~ a" g~ ~1"'" ~j

Ii ~! ~l>~ ~j ~fi

~& ":l~ '8'5 I §i ~il8 e

a..g C

'0 S, t '8"" .c'5~ ....

°13 J ~g t:!.

s

j ~i ",e

.1," e~ :t & s "'i e

-J1 .. !

I I e

i 0", 2 o~ s 0

.1,.~

109, .. 1. .. 0

'i! -a '" II i- .1,

! "" . &l

sS § u- s

i:;; i ~- 0", i e

.!."" I lO5 ; e

8-

7 l!

l: !:';

• ...

(185)

i

!

SECTION XI

ANALYTICAL KEY

Paragraph

Analytical key------------------------------------------------------ .. ••_.. 57

57. Analytical key.-Continuing the scheme initiated in the first text of this series the

analytical key applicable to the subject matter and systems embraced in this text is given

below.

:>I-ool

asti.l :;>'

i

<1 :a Z .... <1 .S

E-! Pol G)

,Q

l3 0 I:l i i rll

i! s

f i

2 I-ool .a...

12

0 .!!l

:B..Cl

....

C1 !.

H .S • <1

0 .8

a:::s

......

Z

<1

•

184

in half. The matter is purely one of practicability: it adds one more step to the process; But it

must not be overlooked that this additional step would add a good deal of strength to the system,

for it would shorten, mask, distort, or entirely eliminate similar beginnings and similar endings-«

the two most fruitful sources of attack on this system.

56. Concluding remarks on transposition systems.-a. Simple transposition systems hardly

afford any security at all; complex ones may in the case of individual or single messages afford a

high degree of security. But just as soon as many cryptograms in the same key are transmitted

the chances of finding two or more cryptograms of identical length become quite good and the

general solution may be applied.

b. Contrary to the situation in the case of substitution, in that of transposition wherein the

letters of the plain-text itself are transposed (not code) the shorter the cryptogram the greater the

possibility of solution. For, in the case of a message of say only 25 or 30 letters, one might shift

the letters about and actually reconstruct the plain text as one does in the case of the game called

"anagrams." Of course, several different "solutions" may thus be obtained, but having such

"solutions" it may be possible to reconstruct the system upon which the transposition was based

and thus "prove" one of the solutions.

c. The text has confined itself almost entirely to cases of uniliteral transposition, in order to

demonstrate basic principles. But there is inherently no reason why transposition may not be

applied to digraphs, trigraphs, or tetragraphs. If longer sequences are used as the units of

transposition the security decreases very sharply, as in the case of the ordinary route ciphers of

the Civil War period.

d. Transposition designs, diagrams, or patterns are susceptible of yielding cryptograms of

good security, if they are at all irregular or provide for nulls and blank spaces. Such devices are

particularly difficult to solve if frequently changed.

e. Transpositions effected upon fixed-length sequences of plain text yield a low degree of

security but when a transposition is applied to the cipher text resulting from a good substitution

system or to the code text of cryptograms first encoded by means of an extensive code book the

increase in the cryptographic security of such cryptograms is quite notable. In fact, transposition methods and designs are frequently used to "superencipher" substitution text or code and

playa very important role in this field. Their great disadvantage is that inherent in all transposition methods: The addition or deletion of a single letter or two often makes the entire

cryptogram unreadable even with the correct key.

j. The clues afforded by messages with similar beginnings, endings, or internal portions,

and by repetitions of incorrectly enciphered messages without paraphrasing the original text

are often sufficient to make a solution possible or to facilitate a solution. For this reason the

cryptanalyst should note all cases wherein clues of this sort m~ be applicable and be prepared

to take full advantage of them.
! I

INDEX

Pap

ADFGVX system________________________________ _ __ __ __ __ 97-143

General solution_________ __ __ ____ __ __ _ __ ___ ___ ___ __ __ __ __ _ 124-143

Alternation of componen ts_____ __ ___ _ __ _____ ___ ___ _ __ _ 125-126

Basic principles________________________________________________________ 125-127, 130-131

Final eomponents, ___ ______ __ ____ __ __ ____ _ ___ __ ____ ______ ______ ___ ___ __ __ __ 125-126

Illustration of solution____________ _ ______ ______ ___ _ ____ 127-143

Initial components. __ __ __ __ ______ ___ ___ ___ 125-126

Minus alternation_______________________________________________________________________________________________________ 131

Plus alternatioIL______ _ __ ___ _ __ __ _ _ __ _ __ 131

Special solution_____________ _ ___ _ __ __ ___ ___ ___ ______ _ __ _ 98-124

Exact-factor method of solutdon__ ._________________ 123-124

Solution by means of identical beginnings 105-123

Solution by means of identical endings 98-105

Alternation of componenta_________ __ __ _______ __ __ _ _ _ 110, 131

Anagram sequence-________________________________________________________________________________________________________________ 33

Anagramming .______ ___ ___ _ __ ___ __ __ ___ _ 5, 51-53

Analytical key _ __ _ __ __ 185

Ascertaining period in bifid system_______________ 165-166

Bifid fractionating systems____________ __ ___ ___ ___ __ ___ __ ____ _ ___ _____ ____ 144-183

Ascertaining period__________ ___ _ 165-166

Basic steps of .___________________ 144-146-160-161

Bipartite equivalents oL ._ 144-147

Column coordinate .________ __ 146

Even-length periods___________ ___ __ ____ ______ ______ __ ______ ____ ___ ___ ___ __ ____ 161

General principles underlying solution 146-150, 160-165

Illustration of solution______________________________ __ _ __ 15{}--160, 166-181

Matching of distributions__________________________________ ___ 17{}--173

Odd-length periods__________________________________________ __ 161

Periods of fixed length .----------------__________________________ 160

Preparation of index_______________________ __ 151, 166

Probability of occurrence of even-poaitioned letters . 17{}--171

Probability of occurrence of odd-poaittoned letters 17{}--171

Probable-word method of attack . 174-176

Reconstruction of original substltution checkerboard.c.c..; __ 152-154, 175-178

Row coordinate.._______________________________________________ ___ ___ 146

Security of________________________________________________________ ___ __ 181, 183

Solution of __ ___ ___ _ ____ ___ __ __ ______ ___ _ ________ ___ __ __ 146-183

Special solution of .__ _ 156-160, 181-182

Vertical pairs of components_____________________________ _ . 144-145

Bipartite equivalents_________________________ __ _ _ _ 144. 162

~::e~~s~~~__:~~:~~~~~~~:~~~~~:~~~~~:~:~~~~~:~~~~~~~~~~~:~~~~~~~~~~_~_~~~~~~~~~~~~~~~:~~~~~~~~~~~~~~~~~~~~~~~~~~:~~~~:_-:_-_-_-::::: =3~~:: Break table ._ _ 36, 100

~~;::;.:pi;~-;~~~;~-;;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~_~~~~~~~~~~~~:~~::~~~~~~..~~~~.~~__~~__~~~:: -32. 55:7~ (186)

187

Pap Columnar transposition ciphers .________________________________ 3-79

Completely-tillcd rectangles oM 4-17

Column and row transposition - ~:::::::~~~~~:::::::~~: 17

Consonants and vowels, deviation of______________________________________________________________________________ 6-10

In variable digraph ---____________________________________________________ 14

Keyword reconstruction diagram___________________________________________________________________________________ 15

~:~:~_~~~~=_~~~~- ~:::~:~~~::::~~~~~~~~~~~:::~::~:~~~~~~~~~~~~~~~~~~~:~~~~~~~~:~~~~~~~~:::~~~~~:~~~~~:::~:::::~::~~~~ 1:

~~i~~::~~~~~~~~~~-:~~~~~::~~~:~~~~~~~:~~~::~:::~~~:::: :: ::~~ ::~~~~~~: ~:~~~~~ ~~~~: ~::~:~: ~::: 8°-E

Probable-word method of solution 13-14,37-39

Reconstruction of literal key----------------____________________________________________________________________ 15-17 25

General solution --_____________________________________ 18, 51":'53

Incompletely-filled rectangles 18-36

Alternative method of solution______________________________________________________________________________________ 25-31

Formula for calculating length and number of long and short columns__________________________________ 18

General principles undcrlying solution____________________________________________________________________________ 18-24

General solution____________________________________________________________________________________________________ 18, 51-53

Keyword reconstruction diagram___________________________________________________________________________________ 15, 25

~~:~ ~~~~:~: ~i.~~~~:~~~:~~:~~::~~~~~~:::~:~::::::~~~:~~~::~:~::::~: ::: : : ~ : : ~ ~ ~ ~ ~ ~ ~ : ::~ ~~ ~~ ~~ ~~ ~ ~ ~~ ~ ~: Sp~Ci:l solution of_____________________________________________________________________________________________ 37-38. 40-55

Spec~l~~l~ii~;;;.;-_-_~~~:~:~~:::::::~~~~::~~~:~~~~~:~:~~::~~~~::~::::~~~~~~~~:~~~~::~:~~~~~~~~~~~~~~:::~:~~~:~:~~~~~~--37-=38, 40-~: Cryptograms of identical length in same key 51-53

Interchanged pair of columns________________________________________________________________________________________ 43-44

Messages with similar beginnings 44-47

Messages with similar endings 47-49

Omitted column_________________________________________________________________________________________________________ 42

Single message containing a long repetition______________________________________________________________________ 49-50

Stereotyped phraseology----__________________________________________________________________________________________ 37-39

Com~ncd substitution-transposition systems 94-96

:~:: ~:~:~:~ii;b~:~~~~~:::~~:::::::::::::::::~~::::~::::::~::::~:::::~~~~~:::~~~~~~~::::::~~~~:::::::~::::~~:~~~::::~ 94-:

Using monoalphabetic subs titution______________________________________________________________________________________ 94-95

Using polyalphabetic Or polygraphic substitution____________________________________________________________________ 96

~~f::;;~~;~~~~;~~~~~;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ ~~ ~~ ~~~~~~~ ~~~ ~~~~~ ~~ ~~~~ :td

Cyclic permutation of transposition key ,__________________________ 35, 180

Double transposition ciphers • 51-79

Depth of rectangle a multiple of width_________________________________________________________________________________ 78-79

Enciphering rectangle a perfect square_________________________________________________________________________________ 76

Failure to execute double transposition properly 75-76

:::~:~t;:::~D:r:~~ti~~~~~~:::= : :~ :::~:~::~:~~:~~::~::::::~:~~:::::~~:~~:::::~:::~~~::~::~~~~~~~~~~~~~: ;t~: Width of rectangle a multiple of depth 76-78

Encipher sequence__________________________________________________________________________________________________________________ 33

Exact-factor method of solving ADFGVX cipher__________________________________________________________________________ 123-124
"Hat" diagraro.._. • •• • • .__ 20-21

Nulls (in matrix) - • A_OJ. ._________ _ __ __ __ _ _ 1. 31, 184

34

2

8

aa

32415~1----18

189

o

Single transposition. _

Solution by superimposition ----.---------------.---------~------__________________ Pap

Special solution -----------------.•-•.-.----------------------------------------------~~~~~~~~ ~~~~~~~~.~~~~~~~~~~~~~~ 51-5;

SUperi:rnpoBitioD:-;~i~ti~~-b;.~~~::~~~~:: ._ - -.:-_-_- .: ~- -.:-_- - -_-_-_------------------- 87-88, 40-55, 75-79

Term number -------------------------- - - - - 51-1\3

~~ ttlJ:°onn-..~::~:~~~~~~~~~~~~~:~~::~~~~~~~~~::::~----~-----.---------.-----.-------------------------------------------- - - - - - ------- ....-.u: ug - .. --..... -------------.. ----~--...- .. _

- .......--------... - ...

Columnar....._........ - - - - - -- ----...-

~~~~h~~~~==~:~~::::~~~:~:~~:~:::~:::~~::~~~::::~~~~~~~::~:: :::=:~~~::~~:~~ ~~~~~~~~~~~~~~:~~~.:~~~~~~~~~::~~ ~.__ ---- 55-7:

Polypha.se_•• -- ----.----------------------------------------- - ------------. 2

ftt~~~~~~~I~~:~E~~~i--:t:~~:tr.=..~~~~::~~~~~:::=:=~i~i·:· ::: 3-~ Trifid fractionating sy---~t;~--;~l-u--t-l;o-n----l-------------------------.--- ---------------------------.-----.------ 8-4 , 0 -.____________________________________ --------------------------------------- 3

---------------------------------------------- 182-183

Uniliteral transposition............_--_..-.....--_.. _------_..._--... _-_...._---------_... _----..

------_....._---------_...._-........ _-_.......__.........._-..-_.........._---- Vartiesl writing....--- _- - _-..- _---..-_ __ _----- -- ..__ _--- _----_ _-- _- _- __ ---.._---

"p sequence•••__•• ._••.••_•• •__• • ._.

---..-- .........-- .........._-_.._-..._-............._-...-----.._- .....-----..----- ..-

....

..:;:.

15

38

3

2

3,95

3-4

Rail-fence writing . _

Rescription. process ot.. - A - _ -. _ - - - • __._

Reversed writing • .-_. -_.__• .• • _

Route transposition.••_. • • • • • • .__._

Keyword reconstruction diagram • • _

"p sequence • •__._._._•• • •__• • •

Inscription .__•• ._. 2

Interchanged pair of columns . . • • • 43-44

Interval sequence. • • • • • • • li8

Invariable digraph •• •• .__• • 14:

Invariant relationship . . .___ 69

Inverse sequencEl-__• . .__ 32--38

Limited affinity• ._••_. - • • , . ._._•• 14

Literal key, reconstruetlon 01.••••_•••__••••__._. ._•••__••••__•••• •__ ••_••••••__•__._._•••••_._. ••••••__._••••_._ 15-17, 25

Loga.rithma of probabilities, use oL • . • - • • • 6, 12-13, 143

Obligatory sequences • . : • 14

Omitted column. ••• • • . • • 42

188

Marobing distributions • - . __ ___ ___ __ __ 170-1'13

Matrix • • • . __ . . . .____ 2, 4

Matrix reconstruction - . A ••_ 80-84

Monophase transposition- . . . . • • 2

Partial C-+P sequence._. • • ••__• '15

p ....C interval sequenc8- . • - .___ 58

P-+C sequence, •• • • .• 32, 55-'15

PUot letters • . • . - - . ._•• 14

Polyphase transposition. . .___ _ _____ _ .____ 2

Processes, reeerlptivex.; • , . .______ 2

Plain-Cipher sequence • , --___ 32, 5FJ,-'75

General solution._.__••_._._•• • 82, 37~38, 51-53, 124-125

Geometric designs • • .- - .______ 80-84

Grilles, indefinite or contin1I0US - ._____ 91-93

Grilles, revolving__• - ._______________ 85-91

Alpha. method • • 85-91

Beta method oJ • 85

Principle of exclusion ._. 89

Principle of sequence • •••• 89

Principle of symmetry - •__.__ 87

Pap Fractiona.ting systems_•• • •••_. 97-184

ADFGVL••••••- ••- - • - - • .••• 91-143

Bifid_••.••••_. • • • • 144--182

Trifid_. __•••__• . •••••_•• 182-183

"Frame"_•••••_. •• - - •__•__•• ._•••• 2,4