WAft DEPAR1'1"IEN"r

OfFICE 01' TRI (:.HJ.R, SmNAI" OrnCRB

" ASRJ~G·J'()!\II

~IILI'l~RY CRYP'fANALYSIS

PART III
Restl ictt:tl

WAR DEPARTMENT

OFFICE OF THE CHIEF SIGNAL OFFICER

WASHINGTON

MILITARY CRYPTANALYSIS

Part III

SIMPLER VARIETIES

OF APERIODIC SUBSTITUTION SYSTEMS

By

WILLIAM F. FRIEDMAN

Principal Cryptanalyst

Signal Intelligence Ser oice

PREPARED UNDER THE DIRI;CTION OF THE

CHn::F SIGNAL OFFICEl~

UNITED STATES

GOVERNMENT PRINTING OFFICE

WASHINGTON 1939
MILITARY CRYPTANALYSIS. PART III. SIMPLER VARIETIES OF

APERIODIC SUBSTITUTION SYSTEMS

CONTENTS

section Paragraphs Pages I In troductory 1-4 1-4

II Solution of systems USIng constant-length keymg umts to encipher variable-length plaintext groupings, 1____________________________________________________________________________________________ 5-9 5-7

III Solution of systems USIng constant-length keying umts to encipher varrable-length plaintext groupings, 11.__________________________________________________________________________________________ 10--13 8-13

IV Solution of systems using constant-length keying umts to encipher variable-length plaintext groupings, 111._____________________________________________________________________________ 14--16 14-18

V Solutron of systems USIng variable-length keymg units to encipher constant-length plaintext groupIngs__________________________________________________ 17-22 19-27

VI Review of auto-key systems_________________________________________________________________________________ 23 28-29

VII Solution of CIpher-text auto-key systems 24--29 30--43

VIII Solubion of plain-text auto-key systems __ _ 30--33 45-49

IX Methods of lengthemng or extending the key __ 34--36 50-52

X General prmciples underlying solution of systems employing long or continuous keys 37-40 53-57

XI The "comcidenee" or "Ie test" 41-44 58-72

XII The "cross-product" or "x test" 45-48 73-78

XIII Applying the cross-product or x test 49-51 79-93

XIV The "monoalphabetieity" or "«I> test" 52-53 94-96

XV Concluding remarks, 54--55 97

Appendix 1 AddItIOnal notes on methods for solving plain-text auto-keyed ciphers__________________ 1-7 98-116

Index_______________________________________________ __ 117-118

Analytical key for Part 111.__________________________________________________________________________________________________ 119

(m)
SECTION I

INTRODUCTORY

l'aragrapb Prehmmary remarks __ __ 1

General remarks upon the nature of cryptographic periodicity_ _ __ 2

Effects of varying the length of the plain-ten. groupIngs________ _ 3

Primary and secondary periods, resultant periods __ 4

1 Prehmmary remarks -a The text immediately preceding this devoted Itself almost

exclusively to polyalphabetic substrtution systems of the type called repeatmg-key CIphers

It was seen how a regulanty m the employment of a lnmted number of alphabets results In the

mamfestataon of periodicity or cyclic phenomena m the cryptogram, by means of which the

latter may be solved The difficulty In solution IS directly correlated wrth the type and number

of CIpher alphabets employed In specific examples

b Two p.ore.Iures suggest themselves Ioi consi.Iei ation when the student cryptanalyst

realizes the foregoing cucumstances and thinks of methods to elu.nnate the weaknesses inherent

In this cryptographic system FIrst, noting that the d.fficulties in solution increase as the

length of the key mcreasee, he may study the effects of employing much longer keys to see If

one would be warranted m placing much trust m that method of mcreesmg the security of the

messages Upon second thought, hoi ever, rei .en.Lermg il at as a general rule the first step

m the solution consists m ascertammg the number of alphabets employed, It seems to him that

the most logical thing to do would be to use a procedure which ",ill avo.d penodicity altogether,

will thus ehmmate the cyclic phenome-ia tl.at are normally mamfested in cryptograms of a

periodic construction, and thus prevent aa enemy cryptanalyst from taking even a first step

toward solution In other WOIJS, he "'111111\ estigate the pOSSIbIlItIes of aperiodnc systems first

and If the results are unsatisfactory, he will then see what he can do WIth systems usmg lengthy

keys

c Accordingly, the first part of tlns te...t will Le devoted to an exammataon of certain of the

very simple vanenes of aperiodic, polyalphabeuc subsntunon systems, after this, methods of

extendmg or lengthenmg short mnemoruc keys, and systems using lengthy keys will be studied

2 General remarks upon the nature of cryptograpluc peIlod1clty -a When the thoughtful

student considers the matter of periodicity m polyalphabeuc substrtution systems and tnes to

aseertam Its real nature, he notes, WIth some degree of mterest and surprise perhaps that It IS

composed of two fundamental factors, because there are m realIty two elements involved m Its

production He has, of course, become quite familiar WIth the Idea that penodrcity neeessrtates

the use of a keymg element and that the latter must be employed m a cyclic manner But he

now begms to realise that there IS another element involved, the sigruficance of which he has

perhaps not fully appreciated, V1,Z, that unless the key IS applied to constant-length plam-text

groups no penodicity will be manifested externally by the cryptogram, despite the repetinve or

cyclic use of a constant-length key Tlns reahzataon ISquickly followed by the Idea that possibly

all penodicity may be avoided or suppressed by either or both of two ways (1) By using constantlength keymg umts to encipher variable-length pi am-text groupings or (2) by using variablelength keymg umts to encipher constant-length plam-text groupings

b The student at once realizes also that the penodicity exlubited by repeating-key CIphers

of the type studied m the preceding text ISof a very simple character There, successive letters

of the repetitive key were applied to successive letters of the text In respect to the employment

of the key, the cryptograplnc or keymg process may be said to be constant or fixed in character

This termmology remams true even If a single keymg unit serves to encipher two or more letters

(1)
2

at a time, provided only that the groupings of plain-text letters are constant m length For

example, a smgle key letter may serve to encipher two successrve piam-text letters, If the key IS

repeunve m character and the message IS sufficient m length, penodicity will still be mamfested

by the cryptogram and the latter can be solved by the methods mdicated in the preceding text 1

Naturally, those methods would have to be modified in accordance WIth the specific type of

grouping Involved In this case the factoring process would disclose an apparent key length

twice that of the real length But study of the frequency distributrons would soon show that

the 1st and 2d drstnbutions were smnlar, the 3d and 4th, the 5th and 6th, and so on, depending

upon the length of the key The logical step IS therefore to combine the distnbutaons in proper pairs and proceed as usual

c In all such cases of encrpharmsnt by constant-length groupings, the apparent length of

the penod (as found by applymg the factormg process to the cryptogram) 18 a multiple of the

real length and the multrpls corresponds to the length of the groupmgs, that IS, the number of

piam-text letters enciphered by the same key letter

d The point to be noted, however, IS that all these cases are still periodic m character

because both the keymg units and the plain-text groupmgs are constant m length '

3 Effects of varyIng the length of the plain-text groupings -a But now consider the effects

of making one or the other of these two elements oaruible in length Suppose that the plain-text

groupings are made variable m length and that the keymg units are kept constant m length

Then, even though the key may be cyclic m character and may repeat Itself many times m the

course of enciphermont, external penodierty IS suppressed, unless the law govermng the taruinon.

~n plaam-tezi groupwgs ~s ~tself cyclw ~n character) and the length oj the message ~s at least two Or

more tunes that oj the cycle apphcable to ths oariable group'/,ng

b (1) For example, suppose the correspondents agree to use reversed standard crpher

alphabets with the key word SIGNAL, to encipher a message, the latter being divided up into

groups as shown below

S I G N A L S I G N A L S I G 1 12 123 1234 12345 1 12 123 1234 12345 1 12 123 1234 12345 C OM MAN DING GENER A LF IRS TARM YHASI S SU EDO RDER SEFFE s UW UGT KFAH UWNWJ L HN ARQ NGPU PGNVF I TR OPE RFER OCBBC

N A L S I G N A L S I G N A L 1 12 123 1234 12345 1 12 123 1234 12345 1 12 123 1234 12345 C TI VET WENT YFIRS T AT NOO NDIR ECTIN G TH ATT ELEP HONES L HS QHS WOFZ KDARQ N NU NMM YIDU OQZKF C NZ NUU WPWL EXYHT

S I G N A L S I 1 12 123 1234 12345 1 12 123 C OM MAS WITC HBOAR D SC OMM

g UW UGO RFUL TZMAJ I AQ UWW

CRYPTOGRAM

QUWUG TKFAH UWNWJ LHNAR QNGPU PGNVF ITROP ERFER OCBBC LHSQH SWOFZ KDARQ NNUNM MYIDU OQZKF CNZNU UWPWL EXYHT QUWUG ORFUL TZMAJ IAQUW W

J'IOUBII: 1

I In this connection, see Seetion lIt, Mduarll CryptanalysIs, Part H;

~--~----- - - - - - - -

3

(2) The CIpher text In this example (FIg 1) shows a tetragraplnc and a pentagraphic

repetinon The two occurrences of QUWUG (=COMMA) are separated by an Interval of 90

letters, the two occurrences of ARQN (=IRST) by 39 letters The former repeunon (QUWUG) , It WIll be noted, IS a true periodic repetition, since the plain-text letters, their grouping, and

the key letters are identical The interval m this case, If counted In terms of letters, IS the

product of the keymg cycle, 6, by the grouping cycle, 15 The latter repetitaon (ARQN) IS not

a true periodic repetmon in the sense that both cycles have been completed at the same POInt,

as IS the case m the former repetmon It IS true that the CIpher letters ARQN, representing

IRST both times, are produced by the same key letters, I and G, but the enciphering points In

the grouping cycle are different in the two cases Repetitions of tills type may be termed

partwlly periodic repetmons, to distinguish them from those of the completely penodtc type

c When the Intervals between the two repetrtions noted above are more carefully studied,

especially from the point of VIew of the mteractmg cycles which brought them about, It WIll be

seen that counting according to group~ngs and not according to single letters, the two pentagraphs

QUNUG are separated by an interval of 30 groupmgs Or, If one prefers to look at the matter In

the light of the keying cycle, the two occurrences of QUWUG are separated by 30 key letters

Since the key IS but 6 letters m length, this means that the key has gone through 5 cycles Thus,

the number 30 IS the product of the number of letters in the keying cycle (6) by the number

of different-length groupings In the grouping cycle (5) The mteraction of these two cycles

may be conceived of as pal takmg of the nature of two gears which are in mesh, one driven by

the other One of these gears has 6 teeth, the other 5, and the teeth are numbered If the

two gears are adjusted so that the "number 1 teeth" ,11e adjacent to each other, and the gears

are caused to revolve, these two teeth WIll not come together again until the larger gear has

made 5 revolutions and the smaller one 6 During this tune, a total of 30 meshmgs of individual

teeth WIll have occurred But since one revolution of the smaller gear (=the groupmg cycle)

represents the encipherment of 15 letters, when translated in terms of letters, the 6 complete

revolutions of this gear mean the encipherment of 90 letters This accounts for the period of

90, when stated In terms of letters

d The two occurrences of the other repetition, ARQN, are at an interval of 39 letters, but

In terms of the number of intervening groupmgs, the Interval IS 12, which IS obviously two

times the length of the keymg cycle In other words, the key has m th'/,s case passed through 2

cycles

e In a long message enciphered according to such a scheme as the foregomg there would

be many repetrtions of both types discussed above (the completely penodic and the partially

penodic) so that the cryptanalyst might encounter some difficulty In ills attempts to reach a

solution, especially If he had no information as to the baSIC system It IS to be noted In this

connection that If anyone of the groupings exceeds say 5, 6, or 7 letters in length, the scheme

may give Itself away rather easily, since It IS clear that wtth'/,n each group'/,ng the encuphermeni '/,s

strwtly monoalphabetic Therefore, m the event of groupings of more than 5 or 6 letters, the

monoalphabetic equivalents of tell-tale words such as ATTACK, BATTALION, DIVISION,

etc, would stand out The system IS most efficacious, therefore, WIth short groupmgs

j It should also be noted that there IS nothing about the scheme which requires a regulanty

In the grouping cycle such as that embodied in the example A lengthy groupmg cycle such as

the one shown below may Just as easily be employed, It being guided by a key of ItS own, for

example, the number of dots and dashes contained m the Intemanonal Morse SIgnals for the

letters composing the phrase DECLARATION OF INDEPENDENCE might be used Thus, A ( -)

has 2, B (_ •••) has 4, and so on Hence

DEC L A RAT ION 0 FIN D E PEN DEN C E

3 1 • • 2 321 2 3 2 3 • 223 1 • 123 12' 1
4

The grouping cycle IS 3+1+4+4+2 , or 60 letters in length Suppose the same phrase

IS used as an enciphering key for determmmg the selection of cipher alphabets Since the

phrase contams 25 letters, the complete period of the system would be the least common multiple

of 25 and 60 or 300 letters Tlus system might appear to YIeld a very lugh degree of cryptographic seounty But the student will sec as he progresses that the seounty IS not so high /10;

he may at first glance suppose It to be

4. PrImary and secondary penods , resultant penods -a It has been noted that the length

of the complete penod in a system such as the foregoing IS the least common multiple of the

length of the two component or interacnng penods In a way, therefore, since the component

periods constitute the basteelement ot the scheme, they rna} be designated as the basic or p1"LmaT?j

periods These are also htdden or latent periods The apparent or patent penod, that IS, the

complete penod, may be designated as the secondary or resultant penod In certam types of

CIpher maohmes there may be more than two pnmary periods which mteract to produce a

resultant penod, also, there are cases in ,..hich the latter may mteract WIth another pnm-rry

penod to produce a tertIary penod , and so on The final, or resultant, or apparent penod IS the

one wluch ISusually ascertamed first as a result of the study of the mtervals between repetrnons

Thia mayor may not be broken down into Its component primary periods

b Although a solution may often be obtamed WIthout breakrng down a resultant penod

into ItS component pnmary periods, the reading 01 many messages pertanung to a WIdespread

system of secret commumcatlOn IS much facilitated when the analysis IS pushed to Its lowest

level, that IS, to the point where the final cryptogr.lpluc scheme has been reduced to Its SImplest

terms Tlus may illvolve the discovery of a m,dtIphcIty of SImple elements wlnoh mteract in

sueeessrve cryptographrc strata

j

SECTION II

SOLUTION OF SYSTEMS USING CONSTANT-LENGTH KEYING UNITS TO ENCIPHER

VARIABLE-LENGTH PLAIN-TEXT GROUPINGS, I

Introductory remnrks _ _ _ _

AperiodIc eneipherment produced by groupmg'! accordmg to word lengths _ __ __ __ __

Solution when direct standard CIpher alphabets an employed __ _ __ _ _ _ _ _ _ _ __ __ __ _

Solution when reversed standard cipher alphabets are employed _ • • Comments 011 fOlLg01Pg cac;ec __ _ __ _ _ _ _ _ • __ _

5. Introductory remarks -a The system described In pa. agraph 3 abov e IS ob viously Dot

to be classified as aperiodic 11' nature, despite the IDJectIOn of a variable factor which m that

case was based upon megulautv In the length of one of the two clements rnvolvod ill polyalphabetic aubstrtutaon The vanuble factor WJ,S there subject to a law wlnch In Itself was penodic

In character

b To make such a system tlUly npenodie In character, by claborutmg upon the basic

scheme for producn-g vuuablo-length plain-text groupings, would be possible, but unpracucal

For example, using the same method as IS f,Iven III paragraph 3} fOI determmmg the lengths of

the groupmgs, one might employ the text of a Look, and If tl.p l-itter IS longer than the message

to be enciphered, the crvptogram would certainly show no periodicity as regards the intervals

between repennons, which would be plentiful However, as already indicated, such a scheme

would not be very practical for regular commurucanon between a large number of correspondents,

for reasons which are no doubt apparent The book would have to be safeguarded as would a

code, enciphenng and deciphering would be quite slow, cumbersome, and subject to erroi ,

and, unless the same key text were used for all messages, methods or indicators would have to

be adopted to show exactly where encipheiment begins ill each message A SImpler method

for producing constantly cl.angmg, aperiodic piam-text groupings therefore, IS to be sought

6 AperiodIc eneipherment produced by groupings according to word lengths -a The

SImplest method for producing aperiodic plain-text groupmgs IS one which has doubtless long

ago presented Itself to the o;t ident, me , oncrpherment according to the actual word lengths of

the message to be enciphered

b Although the average number of letters composing the words of any alphabetical language

IS fall'ly constant, SUCCfSS1ve words comprismg plain text vary a great deal in this respect, and

this variation IS subject to 1]0 law 1 In telegraphic English, for example, t1e moan length of

words IS 52 letters, the words may contain from 1 to 15 or more letters, but the SUC(,OSSIve

words vary ill length In an extremely Irregular manner, no matter how long the text may be

e As a consequence, the use of word lengths for determuung the number of letters to be

enciphered by each key letter of a repetrtrve key commends Itself to the mexpenenced cryptographer as soon R"! he ('OID('o; to understand the way in which repeatmg-key CIphers are solved

If there IS no penodicrty 1Il the cryptograms, how can the letters of the CIpher text, wntten ill

1 It IS true, of course, that the differences betwr on two VIntcrs III respect to the lengths and characters of

the words eontamod in their personal vocabnlanos arc ofton m-irkod and (,'1n be measure d ThE'sL d fIerenccs

may be subject to certam l<tVlS, but the latter arc not of thL t)'pp 1I1 whIChl\e ar(' lIltCIe'ltLd, bemp; p'lycho10g1cal

rather th'1n mathematICal In character See RIckert, E, New Methods for the Study of Lderature, Umverslty of

ChIcago Press, ChIcago, 1927

(5)
FIQUll1I:2

6 7

8. Solution when reversed standard Cipher alphabets are employed -Itshould by this time

hardly be necessary to indicate that the only change m the procedure set forth m paragraph

7c d m the case of reversed standard Cipher alphabets IS that the letters of the cryptogram must

be converted into their plain-component (direct standard) equivalents before the completion

sequence IS applied to the message

9. Comments on foregomg cases -a The foregoing cases are so simple in nature that the

detailed treatment accorded them would seem hardly to be warranted at tills stage of study

However, they are necessary and valuable as an introduction to the more complicated cases to

follow

b Throughout tills text, whenever encrpherment processes are under diSCUSSIOn, the pair

of oncrphenng equations commonly referred to as charactenzmg the so-called Vigenere method

Will be understood, unless otherwise indicated Tills method mvolves the pair of enciphenng

equations 81/1=(\/2, 8 p /I=8C!2, that IS, the index letter, which IS usually the imtaal Ietter of the

plain component, IS set opposite the key letter on the Cipher component, the plain-text letter

to be enciphered IS sought on the plam component and ItS equivalent IS the letter opposite It

on the Cipher component 3

c The soluuon of messages prepared accordmg to the two preceding methods IS particularly

easy, for the reason that standard Cipher alphabets are employed and these, of course, are derived

from known components The significance of tills statement should by tills nme be qurte

obVIOUS to the student But what If mixed alphabets are employed, so that one or both of the

components upon which the Cipher alphabets are based are unknown sequences? The simple

procedure of completing the plain component obviously cannot be used Since the messages

are polyalphabetic m character, and since the process of factormg cannot be applied, It would

seem that the solution of messages enciphered m different alphabets and according to word

lengths would be a rather difficult matter However, It Will soon be made clear that the solution

IS not nearly so difficult as first unpression might lead the student to imagine

I See In tlus eonneetion, Mdttary Cryptanaly8t8, Part II. Section II, and Appendix 1

T R E C S Y GET I

U S F D T Z H F U J

V T G E U A I G V K

WUHFVBJHWL

X V I G WC K I X M

YWJHXDLJYN

Z X K lYE M K Z 0

AYLJZFNLAP

B Z M K AGO M B Q

CAN L B H P NCR

D B 0 M C I Q 0 D S

ECPNDJRPET

FDQOEKSQFU

GERPFLTRGV

HFSQGMUSHW

IGTRHNVTIX

J H U S lOW U J Y

K I V T J P X V K Z

LJWUKQYWLA

MKXVLRZXMB

NLYWMSAYNC

o MZ X N T B Z 0 D

P N A YOU CAP E

Q 0 B Z P V D B Q F

R P C A Q WE C R G

I Mdttary CryptanalY8t8, Part I, Par 20 SQDBRXFDSH

,t:;-letter groups, be distributed mto their respective mono alphabets? And If this very first step

IS impossible, how can the cryptograms be solved?

7 Solution when direct standard cipher alphabets are employed - a Despite the foregomg

rhetorical quesuons, the solution of this case IS really quite simple It merely mvolves a modification of the method given in a previous text,2 wherein solution of a monoalphabetic Cipher

employmg a direct standard alphabet IS accomplished by completmg the plam-component

sequence There, all the words of the entire message corne out on a single generatrix of the

completion diagram In the present case, since the mdrvtdual, separate words of a message

are enciphered by different key letters, these words 'I1J11l reappear on differens generatnces oj the

dnaqrani All the cryptanalyst has to do IS to pick them out He can do tills once he has found

a good starting point, by usmg a httle imagmanon and following clues afforded by the context

b An example will make the method clear The following message (note ItS brevity) has

been intercepted

T R E C S Y GET I L U V W V I K M Q I R X S P J

SVAGR XUXPW VMTUC SYXGX VHFFB LLBHG

c Subrmtting the message to routrne study, the first step IS to use normal alphabet straps

and try out the possibihty of direct standard alphabets having been used The complenon

diagram for the first 10 letters of the message IS shown m figure 2

d Despite the fact that the text does not all reappear on the

same generatnx, the solution IS a very simple matter because the

first three words of the message are easily found CAN YOU GET

The key letters may be sought m the usual manner and are found

to be REA One may proceed to set up the remammg letters of

the message on shdrng normal alphabets, or one may assume

various keywords such as READ, REAL, REAM, etc, and try to

contmue the decipherment m that way The former method IS

easier The completed solution IS as follows

REA D E R S

CAN YOU GET FIRST REGIMENT BY RADIO

TRE CSY GET ILUVW VIKMQIRX SP JSVAG

DIG EST

OUR PHONE NOW OUT OF COMMISSION

RXU XPWVM TUC SYX GX VHFFBLLBHG

e Note the key m the foregoing case It IS composed of the

successive key letters of the phrase READERS DIGEST

j The only difficult part of such a solutaon IS that of making

the first step and getting a start on a word If the words are

short It IS rather easy to overlook good possibihues and thus

spend some time m fruitless searching However, solution must

come, rl nothmg good appears at the begmnmg of the message,

search should be made m the intenor of the cryptogram or at

the end
MESSAGE

Sl,CTION III

IDIoMORPHIC 81< QUENCES

A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z

1= - 1= - 1-=1= - - 1= - - - 1= - --- - - - - - 1-=1= - - -

) 0 p W Z H D R I E

- - - - - - - 1-- --- - - --- - - - - - - - - - 1--

) R A F K N 0 T V

- - - - - - - 1-- - - - - - - - - - - - - - - i-- I-

) S X D U F J P

A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z

- - - - - - - - - - - ---i-- - - - - t--- - - '--f-- - -

) N 0 P S T V W X Z H D R A U I E F J K

- - - - - 1- - - - - --- - - f-- - -

) R A F K N 0 T V

- 1-- 1- - - - --- - - - - - - - - -

) S X D U F J P

FIGUR.3a

l!IGUPE 3b

(1

(2

(3

f The key word upon which the mixed component IS based IS now not difficult to find

HYDRAULIC

9 (1) To decipher the entIre message, the srmplest procedure IS to convert the cipher

letters mto their plain-component equrvalents (settmg the HYDRAULIC Z sequence agamst

the normal alphabet at any pomt of comcidence) and then completing the plain-component

sequence, as usual The words of the message will then reappear on different generatnces The

9

e Noting that the mtorval between 0 and R III the first and second alphabets IS the same,

direct symmetry of position IS assumed In a few moments the first alphabet m the skeleton

becomes as follows

Artillery (3

Battalion (2

DIVISIOn,

o'clock (1

d WIth these assumed equrvalents a reoonstruction skeleton or diagram of cipher alphabets

(Iormmg a portion of a quadnculnr table) IS established, on the h) pothesis that the cipher

alphabets have been deuved from the slidmg of a nnxed component agamst the normal sequence FIrst It IS noted that since OIl=Rc both in the word DIVISION and 1Il the word OCLOCl{

their cipher equrvalents must be in the same alphabet The reconsnucuon skeleton 18 then as

follows

(3) S EJ D U U X E P

'-

(4) ROHROZ

o C L 0 C K -'-----'" -

(3) S F J D U U X F P

ART ILL E R Y -...... --./

(2) A R V••V R K F 0 N T

'---"

(1) P WE WI WR D

D I V I S ION ----.7---.7

( 1)

(4)

(2) A R V V R K F 0 N T

B A T••T A L ION S

'---"

IMdttary CryptanalY8~8, Part I, Par 33 (J,-d, mCIUl>lVC

(8)

SOLUTION OF SYSTEl\iIS USING CONSTANT-LENGTH KEYING UNITS TO ENCIPHER

VARIABLE-LENGTH PLAIN-TEXT GROUPINGS, II

Paragraph Solution" hen the ongtnal WOI d lengths are retained In the cryptogram __ _ __ _ _ .______ 10

Boluuon when other types of alphabets ale employed -______ __ __ __ 11

Isomorphism and rts ImpOl tance 1ll eryptanaly ilLS -- -- __ _ __ __ __ 1l

Illustratron of the apphcation of phenomena of isomorphism 1Il solvmg a cryptogram _ _ __ __ 13

XIXLP EQVIB VEFHAPFVT RT XWK PWEWIWRD XM

NTJCTYZL OAS XYQ ARVVRKFONT BH 2..L..4DUUXFP

OUVIGJPF ULBFZ RV DKUKW ROHROZ

10 SolutIon when the ongmal word lengths are retamed m the cryptogram -a This case

will be discussed not because It IS encountered m practical military cryptography but because It

affords a good mtroduction to the case in which the ongmal WOlU lengths are no longer m eVIdence m the cryptogram, the latter appearing m the usual5-letter groups

b Reference IS made at this pomt to the phenomenon called rdromorphism, and ItS value m

connection WIth the application of the prmcrples of solution by the "probable-word" method,

as explained m a previous te"{t I When the ongmal word lengths of a message are retained in

the cryptogram, there IS no difficulty 1'1 searching for and locanng idiomorphs and then making

eomparisons between these idiornorplne sequences m the message and special word patterns

set forth m hsts man tamed for the purpose For example, m the following message note the

underlined groups and study the letters within these groups

PWEWIWRD

~'---"-

R 0 H R 0 Z -"'----'

e Reference to lists of words commonly found III nuhtary text and arranged according to

their idiomorplnc patterns or formulae soon grves suggestions for these cipher groups Thus
10

key letters may then be ascertained and the solution completed Th Z h fi

h d us, ror t erst three words t e iagram IS as follows '

Plam_________________ ABC D E F G H I J K L MN 0 P Q R STU V WX Y Z

Oipher H Y D R A U L I C B E F G J K M N 0 P Q S T V W X Z

J X I

E V Z Z

L PRO

CRYPTOGRAM

11

V C L L KID V S J D C lOR K D C F S T V I X H M P P F X U

F K N A K FOR A D K 0 MPIS E C S P P H Q K C L Z K S Q

J Z WB C X H 0 Q C F F A 0 X ROY X A N 0 E MDMZ MT S

T Z F VUE A 0 R S L A U PAD D E R X P N B X A RIG H F X

11 Solution when other types of alphabets are employed -a The foregoing examples

Involve the use either of standard CIpher alphabets or of mixed CIpher alphabets produced by

the sliding of a mixed component against the normal sequence There IS, however, nothmg

about the general cryptographic scheme which prevents the use of other types of derrved,

mterrelated, or secondary mixed alphabets CIpher alphabets produced by the shdmg of a

mixed component against Itself (either direct or reversed) or by the shdmg of two different

mixed components are very commonly encountered in these cases

b The solution of such cases involves only slight modifications in procedure, namely, those

connected With the reconstruction of the primary components The student should be 1Il a

pOSItIOn to employ to good advantage and Without difficulty what he has learned about the

pnnciples of mdirect symmetry of pOSItIOn in the solution of cases of the kmd described

c The solution of a message prepared WIth mixed alphabets derived as indicated In subparagraph b, may be a difficult matter, depending upon the length of the message In question

It might, of course, be almost impossible If the message IS short and there IS no background for

the apphcation of the probable-word method But If the message IS quite long, or, what IS

more probable With respect to mihtary commurucatrons, should the system be used for regular

traffic, so that there are available for study several messages enciphered by the same set of

alphabets, then the problem becomes much easier In addition to the usual steps In solution

by the probable-word method, guided by a search for and rdennfication of rdiomorphs, there IS

the help that can be obtained from the use of the phenomena of isomorphssm, a study of which

forms the subject of dISCUSSIon in the next paragraph

12. IsomorphIsm and Its Importance In cryptanalytlcs.-a The term idiomorphism IS

famihar to the student It designates the phenomena ansmg from the presence and positions

of repeated letters In plain-text words, as a result of which such words may be classified according

to their compoeuums, "patterns," or formulae The term isomorphnsm. (from the Greek "I80S"

meaning "equal" and "morphe" meaning "form") designates the phenomena ansmg from the

existence of two or more idiomorphs With identical formulae Two or more sequences which

possess identical formulae are said to be tsomorphnc

b Isomorphism may exist In plain text or m CIpher text For example, the three words

WARRANT, LETTERS, and MISSION are isomorpluc If enciphered monoalphabetically, their

CIpher equivalents would also be Isomorphic In general, isomorphism IS a phenomenon of

monoalphabetacity (either plain or cipher), but there are mstances wherein It IS latent and can

be made patent In polyalphabetic cryptograms

c In practical cryptanalysis the phenomena of rsomorphism afford a constantly astonishmg

source of clues and aids In solution The alert cryptanalyst IS always on the lookout for srtuations

In which he can take advantage of these phenomena, for they are among the most mteresting

and most Important m cryptanalyncs

13. Illustration of the use of isomorphism -a Let us consider the case discussed under

paragraph 10, wherein a message was enciphered With a set of mixed CIpher alphabets denved

from shdmg the key word-mixed primary component HYDRAULIC XZ against the normal

sequence Suppose the message to be as follows (for simplicity, original word lengths are

retaIned)

U

TWO

XYQ

VEFHAPFVT

WKLAESLWV

XLMBFTMXW

YMNCGUNYX

Z NOD H V 0 Z Y

A 0 PEl WPAZ

B P Q F J X Q B A

C Q R G K Y R C B

DRSHLZSDC

EST I MAT E D

Ap=Po

E Q V I B

K T W H J

LUX I K

M V Y J L

N W Z K M

o X A L N

P Y B M 0

Q Z C N P

R ADO Q

S B E P R

T C F Q S

U D G R T

V E H S U

W FIT V

X G J U W

YHKVX

Z I L WY

A J M X Z

B K N Y A

C L 0 Z B

D MPAC

E N Q B D

FOR C E

Ap=Uo

FIGURE 4

X I X L P

Y H Y G S

Z I Z H T

A J A I U

B K B J V

C L C K W

DMDLX

ENE MY

Ap=So

(2) The key for the message IS found to be SUPREME COURT and the complete m as follows essage IS

SOLUTION

SUp REM E C 0

ENEMY FORCE ESTIMATED AS ONE DIVISION OF INFANTRY AND

XIXLP EQVIB VEFHAPFVT RT XWK PWEWIWRD XM NTJCTYZL OAS

R T SUp REM

BATTALIONS OF ARTILLERY MARCHING NORTH AT SEVEN OCLOCK

ARVVRKFONT BH SFJDUUXFP OUVIGJPF ULBFZ RV DKUKW ROHROZ

a In case the plam component IS the reversed normal sequence, the procedure ISno different

f~om the foregomg, except that m the eompletion diagram the reversed sequence IS employed

a ter the CIpher letters have been converted mto their pIam-component equivalents

No doubt the student realizes from his preViOUS work that once the primary mixed

component has been recovered the latter becomes a knoum. sequence and that the soluuon of

subsequent messages employmg the same set of derived alphabets, even though the keys to

mdrvidual messages are different, then becomes a SImple matter
12

V=C-P, CoA, LOD. KOE, lOR, D=C-X, SoON, JOB,

K

W ILL

EVZZ

E

WIT H

LPRO

[Key STRIKE WHILE THE IRON IS (HOT?)]

13

1 23" 6 8 7 8 9 W U " U U W U U m u z z

HYDRAULICBEFGJKMNOPQSTVWXZ

(4) From rdiomorphs (2) (a) and (2) (b), the interval between H and I IS 7, It IS the same

for 0 and X. Qand H. Cand M. etc From idiomorphs (3) (a) and (3) (b) the interval between

Rand NIS13, It IS the same for 0 and A. Yand K. etc

d The message may now be solved quite readily, by the usual process of converting the

Cipher-text letters into then plain-component equrvalents and then completIng the plain component sequences The solution IS as follows

S T R I

COMMUNICATION WITH FIRST ARTILLERY

VCLLKIDVSJDCI ORKD CFSTV IXHMPPFXU

E W H I L

BE THROUGH CORPS AND COMMUNICATION

FK NAKFORA DKOMP ISE CSPPHQKCLZKSQ

THE I

SECOND ARTILLERY THROUGH DIVISION

JZWBCX HOQCFFAOX ROYXANO EMDMZMTS

RON I S

SWITCHBOARD NO COMMUNICATION AFTER TEN

TZFVUEAORSL AU PADDERXPNBXAR IGHFX JXI

e (1) In the foregomg illustration the steps are particularly simple because of the followmg

circumstaneee

(a) The actual word lengths are shown

(b) The words are enciphered monoalphabetically by dIfferent alphabets belongmg to a

set of secondary alphabets

(c) Repetitions of plain-text words, enciphered by different alphabets, produce ISOmorphs

and the lengths of the ISomorphs are definitely known as a result of circumstance (a)

(2) Of these facts, the last IS of most interest in the present connection But what If the

actual word lengths are now shown, that IS, what If the text to be solved IS mtercepted ill the

usual 5-letter-group form?

lS1H122-89--2

123 " 6 8 7 8 9 W U " U U U " U U m u z z

E JK N PQS V XZH DRA LICB

(3) The sequence H D R A L I C soon suggests HYDRAULIC as the key word When

the mixed sequence IS then developed in full, complete corroboration Will be found from the data

of Isomorphs 2 (a) (b) and 3 (a) (b) Thus

which gives the sequence the appearance of being the latter half of a keyword-rmxed sequence

runnmg m the reversed direction, let the half-cham be reversed and extended to 26 places, as

follows

1 23" 6 8 7 8 9 W U " U " u u m u z z

E K N P S V X H D A L C

(2) The data from the two partial chams (JZ Band IQ R) may now be used,and the

letters mserted into their proper posraons Thus

l~HMffF~U

HQQCEEAQX

I -- J

NAKFORA

ROYXANO

-, .,,-

1

(8)

(b)

I

(a)

(b) (3)

(2)

(l){~ 2 3

" 6 6 7 8 9 10 11 12 13

C S L P A N D K H X E

(2){ 2 3

" 5

Q R

(3){~ 2 3

" 6

Z B

!

(a)

(b)

(C')

(1)

(e) CPD (f) SA (g) HE (h) QR (1) KX (]) LN (k) ZB

From Isomorphs (1) (a) and (1) (c)

COP. SOA, POD, HOE. QOR, K-<:>X. LON, Z-<>B,

c (1) The fact that the longest of these chams consists of exactly 13 letters and that no

addrtaons can be made from the other two cases of Isomorphism, leads to the assumption that a

"half-cham" IS here disclosed and that the latter represents a decnnation of the original pnmary

1 2 3 " 5 8 789

component at an even mterval Notmg the placement of the letters V S P N K,

I The symbol ¢o IS to be read "IS equivalent to "

(a) VCSLP (b) DKH (c) IQ (d) JZ

From isomorphs (1) (b) and (1) (c)

b (1) Only a few mmutes mspection discloses the followmg three sets of isomorphs

V-<>C, COS, LOP, K=c-H, IoQ. D=c-K, S=C-L. JOZ.

(1) LDX (m) VP (n) CA (0) KE (p) lR (q) SN (r) JB

Notmg that the data from the three Isomorphs of this set may be combined (VCSLP and CPD

make VCSLP D, the latter and LDX make VCSLP D X), the followmg sequences are

estabhshed

from which the followmg partial sequences are constructed

from WhICh the followmg parual sequences arc constructed

from which the followmg partaal sequences are constructed

(2) WIthout stopping to refer to word-pattern lists m au attempt to rdentify the very

stnkmg idromorphs of the first set, let the student proceed to build up partial sequences of

equivalents, as though he were dealing with a (,c1SC of indirect symmetry of posinon Thus 2

From isomorphs (1) (a) and (1) (b)
M P P F X

PHQKC

OYXAN

DERXP

SECTION IV

SOLU'1'ION or SY:1~~~~~':~~:=~~=:gs~~TS TO ENCIPHER

General remarks __ _ _ Paragraph

Word separators.. _ - ------ - . -- -. __ _ _ 14

V~JatlOns and concludmg re~~;k; ~~-f~;g~lng ~y~if'ms - - - --- - - --- --- -. _•• 1')

---- -- - -- - - ._--.- -----••--.-------- -- -__ 16

14. General remarks -a The cases described th f

the cryptanalyst has before hun th I us al ale pal tlculaI1y easy to solv-e because

nuhtary cryptography this IS seldon: :~:~~~St~ t ieir true or ol'lgmal word lengths But In

what more difficult by reason of the fact that tltc;e~::~ot~eproblem IS therefore made someenClpherment by suceessrvs keyletters However th 1 g to lIldicate defillltely the Imuts of

pe.runentabon In tlus case than in the pre d 'Th e so uuon merely neceSSItates more exrepetItIons which may serve to "block out"c:r ~;luDlt e c:Jptanalyst must take careful note of

will be able to fwd and IdentIfy certain h wor s, and hope that when tlus IS done he

terns, such as those noted above Ifther:~q;;mc:s f~VIng fanulIaJ' IdlOmoIpmc features or patto permIt of emp]oymg this entermg wedge en yo ext, repetition., WlII be suffiCIent ill number

b Of course, If any sort of stereotypIC pluas 1 1

or endings of the messages, the mattez of assum eo og) IS emp oyed, espcClally at the begmnmgs

and affords a quick solution For example su mg v~ues for sequences of cipher letters IS easy,

found that many messages begm with t" ppose at 8.S 8. result of previous work It has been

Having several messages for study, the n:el:~~I~~m:: o~ERRING TO YOUR NUMBER

IdlOlllOrplusm as that given by the word REFER e wluch begins with such a common

found the word REFERRING If with a f d R1iGIS 8. relatIvely snnpls matter, and having

NUMBER, the solutron IS probably well u::er ~:;e 0 certamtyone can ndd the words TO YOUR

e (1) Take the case discussed m para a h 13 b

mmcated because the message IS transm~e: 'thut ass~melthl1t word lengths are no longer

ascertammg the exact length of sequen h mh e usu 5- etter groups The process of

te d "bl ces W tc are isomorphn- or th rme, ockmg out Isomorphs" b ' , as e process 18 bnefly

rather tenuous threads of reaaoningeco;es a more dIfficult matter and must often rest upon

Wlthand letIt be assumed that It was arran;::I~f~:~~~~:u~~e illustratIve message Just dealt

VCLLK IDVSJ DCIOR KDCFS

UEVZZ FKNAK FORAD KOMPI TVIXH

LZKSQ LPROJ ZWBCX HOQCF SECSP

OEMDM ZMTST ZFVUE AORSL FAOXR

NBXAR IGHFX JXI AUPAD

(2) The detectIOn of IsomorphIsms n b

special trouble ill PICkmg out the foll °tWh ecomes a more dIfficult matter There IS no

owmg I ee IsomorphIc sequences

(I) V C L L KID V S J 0 C I

(g) C S P P H Q K C L Z K S Q (~) PAD D E R X P N B X A R

(14)

lei

smce the first one happens to be at the begmmng of the message and Its left-hand boundary, or

"head," IS marked by (or rather, comcides WIth) the begmnmg of the message By a fortunate

circumstance, the right-hand boundary, or "tall," can be fixed Just as accurately That the

repetmon extends as far as indicated above IS certam for we have a check on the last column

I, Q, R If an additional column were added, the letters would be 0, L, I Since the second

letter has previously appeared wlnle the first and thud have not, a contradictaon results and the

new column may not be included

If, however, none of the three letters 0, L, I had previously appeared, so that there could

be no means of gettmg a check on theu correctness, It would not be possible to block out or

ascertain the extent of the isomorphism in such a case All that could be said would be that

It seems to include the first 13 letters, but ~t m~ght cont~nue further

d (1) However, the difficulty or even the unpossibihty of blocking out the ISomorphs to

the~r full extentIS not usually a senous matter After all, the cryptanalyst uses the phenomenon

not to Identify words but to obtain cryptanalvtic data for reconstructmg cipher alphabets

For example, how many data are lost when the illustratrve message of subparagraph 13a IS

rewntten in 5-letter groups as m subparagraph 14c (1)'" Suppose the latter form of message

be studied for isomorphs

VCLLK IOVSJ OCIOR KOCFS TVIXH MPPFX UEVZZ

FKNAK FORAD KOMPI SECSP PHQKC LZKSg LPROJ

ZWBCX HOQCF FAOXR OYXAN OEMDM ZMTST ZFVUE

AORSL AUPAD OERXP NBXAR IGHFX JXI

(2) If the underscored sequences are compared with those III the message in subparagraph

13a, It will be found that only a relatively small amount of mformataon has beenlost Certamly

not enough to cause any dlfht ulty have been lost in tills Lase, for all the data necessary for the

reconstruction of tile mixed CIpher component came from the first set of Isomorphs, and the

latter are identical ill length in both case"! Only the head and tail letters of the second p8.1!

of tsomorphic sequences are not included m the underscored sequences m the 5-letter version

of the message The thud pair of isomorphic sequences shown ill paragraph 13b does not appca.r

m the 5-letter version since there 18 only one repeated letter m tlus case In long messages or

when there are many short messages, a study or isomorphism will disclose a aufflcient number of

partial Isomorphs to give data usually sufflcient for purposes of alphabet reconstruction

e It should be noted that there IS nothmg about the phenomenon of isomorplusm winch

restricts Its use to ceses m which the cipher alphabets are secondary alphabets resultmg from

the shdmg of a mixed component agamst the normal It can be useful In all cases of Interrelated

secondary alphabets no matter what the baSIS of their denvation may be

J In subsequent studies the rmportant role which the phenomenon of isomorplnsm plays

In cryptanalytics will become more apparent When the traffic 18 stereo typic m character,

even to 0. slight degree, so that isomorplnsm may extend over several words or phrases, the

phenomenon becomes of highest, unportanee to the cryptanalyst and an extremely valuable tool

m Ins hands

15 Word seprrators --a One of the prcctical dtfflculuesill employmg systems In wluch the

keymg process sluft'! according to word lengths IS that in handhng such a message the decryptographIng clerk IS often not certam exactly when the termmatlon of a word has been reached,

and thus tIme IS lost by hun For m<,tance, wlule decryptographmg a word such as INFORM

the clerk would not know whether he now has the complete word and should slnft to the next

key letter or not The word Ill1ghtbe INFORMS, INFORMED. INFORMING, INFORMAL, INFOR-
16

MATION. etc The past tense of verbs, the plural of nouns, and termmatlons of vanous sorts

capable of bemg added to word roots would gIve rIOje to difficulnea, and the latter would be

especIally troublesome u the messages contamed a few telegrapmc enol'S Consequently, a

scheme wluch IS often adopted to Circumvent thle source of trouble Is to indicate the end of a

word by an mfrequent letter such as Q or X, and eneiphenng the letta- In such usage these

letters are called word separat01'8

11 When word separators are employed and tlns fact IS once discovered, their presence 18

of as much IUd to the cryptanalyst m hrs solution as It IS to the clerks who are to decryptograph

the messages Sometunes the presence of these word separators, even when enciphered, aids

or makes possible the blocking out of Isomorphs

16 VarIations and concludmg remarks on foregomg systems -a The systems thus far

descnbed are all based upon word-length encipherment using dIfferent cipher alphabets Words

are markedly Irregular in regard to tlus feature of theIr constructson, and thus apenodicaty 18

Wlparted to such cryptograms But V8Z'latzons m the method, aimed at making the latter

somewhat more secure, are possible Some of these vansuons will now be discussed

11 Instead of enciphenng according to natural word lengths, the Irregular groupings of the

text may be regulated by other agreements For evample, suppose that the numeneal value

(m the normal sequence) of eaeh key letter be used to control the number of letters enciphered

by the successive CIpher alphabets Depending then upon the eomposraon of the key word or

key phrase, there would be a varymg number of letters enciphered m each alphabet If the

key word were PREPARE. lor mstance, then the first CIpher alphabet would be used for 16

(p=16) letters, the second CIpher alphabet, for 18 (=R) letters, and so on Monoalphabetac

8llClpherment would therefore allow plenty of opportunity for tell-tale word patterns to manifest

themselves In the CIpher text Once an entenng wedge IS found In tlus manner, solution would

be achieved rather rapIdly Of course, all types of CIpher alphabets may be employed in this

and the somewhat smular schemes descnbed

c H the key IS short, and the message IS long, penodicrty will be msmfested m the cryptogram, 80 that It would be possible to ascertarn the length of the basic cycle (m this case thelength

of the key) despzte the Irregular groupings m enoipherment The determmanon of the length

of the cycle might, however, present dlfficultzes In some cases, since the basso or fundamental

penod would not be clearly eVIdent because of the presence of repetaticns which are not periodic

m theu- Ol'lgID For example, suppose the word PREPARE were used as a key, each koy letter

bemg employed to enclph.er a number of letters correspondmg to Its numerical value In the

normal sequence It ts clear that the length of the basic penod, m terms of letters, would here

be the sum of the numencal values of P (=16)+R (=18) + E (=1]), and so on, totalhng 79

letters But because the key Itself contams repeated letters and because encrpherment by each

key letter IS monoalphabenc there would be plenty of cases In whreh the first letter P would

enCIpher the same or part of the same word as the second letter P, producing repenuons In the

cryptogram The same would be true as regards encrphermenta by the two R's and the two

E', m thIs key word Consequently, the baSIC penod of 79 would be dIstorted or masked by

apenodIc repetItIons, the mtervals between wluch would not be It functIOn of, nor bear any

reIatron to, the length of the key 'The student WIll encounter more cases of tlus lond, m whIch

a. fundamental pel'lod.tCIty IS masked or obscured by the presence of cIpher-text repetItIons not

attributable to the fundamental cycle The dxpenenced cryptanalyst 18 on the lookout for

phenomena of tlns type, when he finds m a polyalphabetIc CIpher plenty of repetitions but With

no factorable constancy wluch leads to the dlbclosure of a short perIod He may conclude, then,

e1tber that the cryptogram Involves severnl pnmary pel'lods whIch. mteract to produce a long

resultant penod, or that It lllvolves a fEUrly long fundamental cycle Wltlun wluch repetItIons of a

l

•

I

17

.J. ....e present and ob~ure the phenomena mamfested by Npetltlons of a penodIc

nonpenowc ongID .....

ongm f 1 al habetIc enclphermsnt of v81'1abla-length d (1) A 10glcal extenSIon of the pnncIple 0 r~-t:xt groupmgs rarely exceed 4 letters, so

plam-text groUplDgs 15 the case m wluch these p sb rt time thus breakmg up what nught

that a gIven cIpher alphabet IS m play for onl~: :leZer t~xt F~r example, suppose the letters

otherwise appear as fall'ly long repet1tI~_ order were Qet Qft mto four groups, as

of the alpbabet, arranged m thm normai- requen ,

follows H F U P M Y G W V B X K Q J Z

ETRIN OASDLC GroupS Group 4

Group 1 Group2 hat one letter will be enclpha-ed, 8. letter m

(2) Suppose that a letter 1D group 1 means t S ose next that a rather lengthy

group 2, that two letters will be enCIphered, a~~ o~d'P~ 'OIRECTION OF THE CHIEF

phrs.se were used as a key, for example, PREP ION COURSES Suppose, finally, that each

SIGNAL OFFICER FOR use WITH ARMY EXTENS tI~ular Clpher alphabet to be used, but also

letta- of the key were used not only t~ select ~:~arbY the selected alphabet, o.coordmg to the

to control the number of letters to e enClp b the H'lDPAULIC XZ prunary

scheme outhned above Such an enCIphe~Be=e~=nent) would yleld the follo'Wlng

Clpher component shdmg agamst the no P

grOUpIngs 1 1 3 1 2

311321123121

Groupmg-------------------- REP ARE DUN D :E R THE D

Key--------------------------- PR S T nIV IS I 0 NW ILL A DV A N C EAT F IV

PlaID_________________________ FI T R THJ GV F X MX JNN N UW E N WAHQ \\ EW

CJ.pher------------------"---- WHB 2 3 1

111211212:3 13 1

GroupIDg-------------------- R E C T ION 0 F THE CHI

Key--------------------------- I FT E E NA M AS SEC 0 NOD I VI SIO N

PlaID__________________________ E JY Z F AO D OB RMJ B JRR P RN PCK 5

Cipher------------------------ F f the formataon of lengthy repetItions would

(3) Bere It will be seen that any tend:cyUl~~ Shlftmg of alphabets The fust tune the

be counteracted by the short grOUpIngs ~3vFXM the second tnne It OCC'UNIt 18 enCIphered

word DIVISIONoccurs It IS enCIphered as 'h red by exactly the same sequence of key

as RPRNPCKS Before DIVISIONcan be tWIce en~p e between the two occurrences of the

letters an mterval of at lenst \4:0 letters must 11\ ene: -140) and then the chances that

word (the sum of the values of the letters of thef~7vP ea~:-; one:.n three Only one of these

the key letter P would begm the enmpherm~~0 the sa~e sequence of clpha- eqUlvalents the

three pOSSIble enClpherments wul yIeld exaFY Ie If the text" ere such as to place two

second tnne as was obtamed the first time or e"{aIDt, below thell' enclpherments would

occurrences of the word DIVISION 1D the pOl>ltJ.ons s own ,

be as follows 3 1 1 I '1 1 2 I 1

8113211231 PREP ARED UN

PRE PAR E DUN OI VI S I ON •• •

FIR S T DIV IS ION TIl ZG T P NM .'. • THJ GV F X M
SECTION V

Paragla1lll _. .___ 17

____ _ •__ •• ._ 18 _ _ __ _ __ __. _.__.___ 19

_ _ _ _ • •__• 2().

_ _._ __ __ _ .__ _•• 21

....-...- .....-- ----.. ...-- _ __ __ _ __ _.______ ___• • 22

17 Va.rlable-Iength groupmgs of the kepng sequence -The precedmg cases deal With

simple ll'ethods of chmmatang or avoiding peIlodlclty by t'\\<.'\ph.erm~ vaflfl,ble-Iength groupings

of the plam text, n-ang conc;tttnt-length hpymg umts In p·trttgraph 2a, however, It was pointed

out that pcnodn ity can also be suppressed by 'lpplymg varzable-Iength key groupings to constant-length plnm-tcvt groups One such method conc;lsts 11\ trregularly ",nte1TlJ,ptvng the keymg

seq,uen<.'f:', If the latter IS of n Imnted or fiwd len~tl\, and re(,ommI'11C'lllg It (from Its mrtial pomt)

after such mterruption, c;o thJ,t the keying sequence becomes oqurvalent to a series of keys of

dIfferent lengths Thus, the key plnaloe BUSINESS MACHINES may be expanded to a senes of

lfregulo.r-Iength keylllg sequences, such as BUSI/BUSINE/BU/BUSINESSM/BUSlNESSMAC, etc

Vanous schemes or prearrangements for mdlCl1tmg or determullng the mterruptIOns may be

adopted 'I'l.ree methods will be mennoned III the next 'Paragraph

18 Methods of mterruptmg a. cyclic kepng sequence -a. Tbete ale many methods of

mterruptmg a keymg sequence wLJ.ch 18 ba.s1caUy cyc!lc, and wlnch therefore would grve rise

to penodicity Ii not mterlered W1.th m some way These methods may, howevor, be classified

mto three categones as regards what happens after the mten uptron occurs

(1) The keymg sequence merely stops and begms agsan at the mrnsl pomt of the cycle

(2) One or more of the elements m the keying Sl"quenceml1Y be omitted from time to tune

rrregul80rly (3) The keymg sequence lrregulally alternate", 1U Its direction of progreStnon, With or

WIthout omission of some of Its elements

b These methods may, for clarIty, be represented graplucolly as follows Suppose the

key consists 01 a cyclic sequence (f 10 elements rt>presE'uted s, mbohc81ly by the senes of numbers

1,2,3, ,10 Usmg an astensk to indicate D,lllllterruptlOu, the following may then represent

the relatlon Letween the letter number of the message and the element number of the keying

sequences m the three types mentIoned above

{

Letter No . 1 2 3 4. 5 6 7 8 9 10 11 12 13 14. 15 16 17 18 19 20

(I) Key element No_________ 1-2-3--4.-* -1-2-3-4-5- 6-"'- 1- 2- 3-0\<- 1- 2- 3- 4- 5- 6- 7-*

Letter No------------------ 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35

Key element No_._-_ 1- 2- 3- 4- 5- 6- 7- 8- 9-10-"'- 1- 2- 3-*- 1- 2- etc

{

Letter No-_____ 1 2 3 4. 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

~2) Key element No_________ 1-2-3-*-7-8-9-10-1-2-"'- 4- 5- 6-*- 3- 4- 5- 6- 7- 8- 9-10-

Letter No- 21 22 23 24 25 26 27 28 29 30 31 32 3'3 34 35

Key element No- . 1-*- 8- 9-10- 1- 2-"'- 5- 6- 7-*- 9-10- 1-*- 5- 6- 7- etc

(19)

Varlable-lel'gth groupmgs of the I.eymg sequence, - - -- ---

Methods of mte riuptmg a cycll(~ keying sequencc__

Interruptor IS a plam-text letter -- --

SolutiOn by superimposItion -- - - ---- - ---- - --

Interruptor IS a CIpher-text letter - -

Concludmg remarks -- -••--- - -- ---- --

SOLUTION OF SYSTEMS USING VARIABLE-LENGTH KEYING UNITS TO ENCIPHEB.

CONSTANT-LENGTH PLAIN-TEXT GROUPINGS

18

Although the word DIVIS!ON, on Its second a where It begins on Its first appearance th ppesrence, begins but one letter beyond the place

lette1'8, the fourth, and the last letters ;h~;her equwalents now agree only m the first two

D I V I S ION

(1) .I....H J 5J V F X M

(2) IJi Z ri T P N M

e AttentIon IS dzrected to the charactensncs f -

same word When they are supenm osed 0 the foregomg two oncipherments of the

two enoipherments, then there IS a !m 1 ' t~e first two cipher equivalents are the same m the

l

the next cipher equivalent JS the same ~:nn;o~rvalt~~f:'re the cipher equivalents are diflerent

ants tirtally th 1 t h ' 0'" nree Intervals with d I h ' , ,e as oip er eqUIvalent lS tb.e sam tssirm ar crp er equivaonly to one or two letters, longer repeunons e In bO::;- cases The repennons here extend

menta yIeld only oecastonal cmnculenc68 tha can occur 0 y exceptIonally 'TIle two enciphermoreover, the d't8mb'lfi'l,on of the comcId:nce tIS, p:ces where the cipher letters are rdentical

J Tins phenomenon of ~nterm~tt6nt co~:~Ul rrregular and of an mterInlttentcharacter'

ptW'S of letters, or short sequences (rarel nees, involving cOIDCIdences of single letters

lStICS of tills general class of polYalPhab~:;~~:~~~dmg pentagraphs) IS one of the character~ mamfest what appears to be a dlsturbed or distorted tion, ;herem the cryptograms commonly

9 From a. techmcal standpomt the peno ICIty

system IS based has much ment butfo ;Pt~grapillc pnnciple upon which the foregomg

to error However, If the enClphermen::rac ICB. husage It 18 entIrely too slow and too subject

key were quite lengthy, such B.system and meohani amaed by maclunery, and If the enClphenng

md.ehmes for accomphslnng this type of substat nism becomes of practlCaIlmportance CIpher ution will be treated In 0. subsequent text
Keymg element N0__ 1 METHOD (2)

Letter N0______ ___ ______ 1 2 3 4 5 6 7 8 9 10

Letter N0_________________ 8 2 3 I 4 5 6 7

Letter N0_________________ _ 9 1- 10 11 12/

Letter No_________________ 21 / _ _ - 13 14 15 16 17 18 19 20

Letter N0_________________ 25 26 1_ 22 23 24

Letter N0_________________ 32 / _ _ 27 28 29/- 30 31

33 34 35 etc

METHOD (3)

Keymg element No __ 1 2 3 4 5 6 7 8 9 10

Letter No 11~2ri3r-i4-5nl~~-.2-.!..~L

Letter No - -/7 6

Letter No, - ------------- - 8 9 10 11 12 13 14

Letter No 15' - -/19 18 17 16

Letter No 23 24 251- - _ 20 21

Letter No 27 26 _ _ _ -/30 22

Letter No 33 34 35 etc ~~ ~:

Obvioualy If one does not know when or ho h

sectIons of keymg elements cannot b w t e InterruptIons take place, then the SuccesSIve

d The t f e supenmposed as IndIcated above

In erruptIon 0 the cyclic keYing all

prearranged plan, and the three basic meth d se1uence usu y takes place according to some

a short mnemomc key as an example 0 s 0 Interruption will be taken up In turn, USIng

D J UPS

J D R 0 J

F Y X S X

o L Y R P

CRYPTOGRAM

J K X K J ~~~~---:Y~I Y D P

M J J V ~B-~=-.,,~:....:...-..::.....;=-....:.:....::::-=--.:..:K.....:.:X D G D

I X X X X

P J D R 0

A F A E N

J UPS Y

B 0 L Y R

YFXUR

XGUFD

I Also called at tImes an "m1Iuence" letter because It Influences or modIfies normal procedure In some

caBeB no Influence or interrupter letter IS used, the mterruption or break In the keymg sequence occumng after

a preVloUBly-agreed-upon number of letters has been enciphered

6 Suppose the correspondents agree that the Interruption In the keymg sequence will take

place after the occurrence of a specIfied letter called an tnterruptor,I which may be a letter of the

plain text, or one of the CIpher text, as agreed upon In advance Then, SInce In either case

there 18 nothing fixed about the time the mterruption will OCCUr-It will take place at no fixed

mtervals-not only does the mterruption become quite irregular, following no pattern, but also

the method never reverts to one having penodicity Methods of tins type Will now be discussed

In detail

19, Interruptor IS a plaIn-text letter -a Suppose the correspondents agree that the Interrupnon In the key will take place Immediately after a previously agreed-upon letter, say R,

occurs In the plam text The key would then be Interrupted as shown In the following example

(usmg the mnemonic key BUSINESS MACHINES and the HYDRAULIC XZ sequence)

Key BUS I N E SSM A CHI BUS BUS I BUS I N E

Plam_____________ A M M U NIT ION FOR FIR S TAR TIL L E R

Cipher----------- B 0 L Y R P J D R 0 J K X K J F Y X S X D J UPS Y

Key--____________ BUS I N E SSM A CHI N E S BUB U SIN E S·S MAC H I

Plam.____________ Y W ILL BEL 0 A D E D AFT ERA M M U NIT ION FOR

Cipher I Y D P Y F X U R A F A E N M J J V B 0 L Y R P J D R 0 J K X

Key BUS I BUS BUS I NEB U SIN

PlaIn_____________ T H I R DAR TIL L E R Y

Clpher___________ D G D X G U F D J UPS Y I

21

b Instead of employmg an ordmary plam-text letter as the mterruptor, one might reserve

the letter J for tlns purpose (and use the letter I whenever this letter appears as part of a plamtext word) ThIS IS a quite SImple vananon of the baSIC method The letter J acts merely

as though It were a plain-text letter, except that In tIns case It also serves as the mterruptor

The mterruptor 18 then Inserted at random, at the whim of the enciphenng clerk Thus

Key--------- BUS I NE SSM A C IBUS I NE SSM IBUS I NE SSM ACHI NE S BUS I N

Plam________ T ROO P S WILL J BE HAL TED J AT R 0 ADIU NC T ION F I VE S I X

c It IS obVIOUS that repennons would be plentiful in cryptograms of tlua constructIon,

regardless of whether a letter of high, medium, or low frequency IS selected as the SIgnalfor key

mterrupnon If a letter of high frequency IS chosen, repetrnons will occur quite often, not

only because that letter will certamly be a part of many common words, but also because It will

be followed by words that are frequently repeated, and SInce the key starts again With each

such mterrupnon, these frequently repeated words will be enciphered by the same sequence of

alphabets TIns IS the case In the first of the two foregoing examples It IS clear, for Instance,

that every time the word ARTILLERY appears In the cryptogram the Cipher equrvalents of

TILLERY must be the same If the mterruptor letter were Ap instead of Rp, the repetition

29 301

9 10 /

18 19 201

25 26 27 28

Keymg element No__ 1 Letter N0 -____________ 1

Letter N0_________________ 5

Letter N0_________________ 11

Letter No 14

Letter N0_________________ 21

Letter N0_________________ 31

Letter No 34

20

(3)~e~e~e~~t-N~~~~~~~~~~ :-:-:-1_:_*-1_~_*1_:_160 11 12 13 14 15 16 17 18 19 20

Letter N - 7- 8- 9-10- 1-*-10- 9- 8- 7-*- 8 K I 0 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35

eye ement No_________ 9-10- 1- 2- 3-*-2- 1-10- 9- 8-* 9 10 A - - - 1- 2- 3 etc

s regards the third method, winch Involves onl I

of the keymg sequence if there t y an a ternanon In the dIrection of progressIon

10-element keYIng seq~ence for:::r:::ol In e~uPtIons In the key It would mean merely that a

sequence and the matter co~ld then bePh~~~ dd b~btrea~ed as though It were an 18-element

method But 1f the PrInCIples of the seconde

an~ t~~g It were a special form of the second

the matter may become quite complex method are combmed In one system,

c If one kno?Ls when the Interruptions take la h

the basic keymg cycle In the thre b P ce In eac cycle, then successrvs seenon« of

e cases may e supenmposed Thus

METHOD (1)

2 3 4 5 6 7 8 9 10

2 3 4 "

6 7 8

12 13/

15 16 17

22 23 24

32 331

35 etc
22

would include the CIpher equivalents of RTILLERY, If It were Tp , ILLERY, and so on On the

other hand, Jf a letter of low frequency were selected as the mterrnptor letter, then the encipherment would tend to approxnnata that of normal repeatmg-key subsntunon, and repetauons

would be plentiful on that baSIS alone

d Of course, the lengths of the intervals between the repennons, m any of the foregoing

cases, would be irregular, so that penodu Ity would not be mamfested The student may

mquire, therefore, how one would proceed to solve such messages, for It IS ObVIOUS that an

attempt to allocate the letters of a single message into separate mono alphabetic distnbutions

cannot be successful unless the exact locataons of the mterruptions are known-and they do

not become known to the cryptanalyst until he has solved the message, or at least a part of It

ThusIt would appear as though the would-be solverIS here confronted With a more or lessinsoluble

dilemma Tlus sort of reasonmg, however, makes more of an appeal to the novice m cryptography than to the expeneneed cryptanalyst, who speciahaes m methods of solving cryptograpluc dilemmas

e (1) The problem here will be attac ked upon the usual two hypotheses, and the easier

one will be discussed first Suppose the system has been m use for some time, that an ongInal

solution has been reached by means to be discussed under the second hypothesis, and that the

CIpher alphabets are known There remams unknown only the specific key to messages Exammmg whatever repennons are found, an attack IS made on the basis of searclung for a probable

word Thus, talong the illustrativs message in subparagraph a, suppose tl,e presence of the

word ARTILLERY 18 suspected Attempts are made to locate this word, Lasmg; the search

upon the construcnon of an intelligible key Begmmng WIth the very first letter of the message,

the word ARTILLERY 18 Juxtaposed against the cipher text, and the key letters ascertained,

using the known alphabets, whn h we Will assume m this case are bused upon the HYDRAULIC

XZ sequence slIdmg agamst the normal Thus

CIpher -___ _ __ _ B 0 L Y R P J 0 R

Plam.c., --- --_____ ART ILL E R Y

"Key"------__ -- -__ B H J Q P I B F U

(2) Smce tlns "key" IScertamly not mtelhgible text, the assumed word IS moved one letter

to the nght and the test repeated, and so on until the followmg place In the test IS reached

Cipher.L.. _ S X 0 J UPS Y I

Plam____________________ ART ILL E R Y

Key- -- _ _ SIB U SIN E B

(~) The sequence BUSINE suggests BUSINESS, moreover, It IS noted that the key 1'3 mterrupted both tames by the letter Rp Now the key may be applIed to the begmnmg of the

message, to see If the whole key or only a portion of It has been recovered Thus

Key BUS I N E S S BUS

Ctpher B 0 L Y R P J D R 0 J

Plam A M M U NIT I U M T

(4) It IS ObVIOUS that BUSINESS IS only a paIt of the key But the deCIphered sequence

certaInly seems to be the word AMMUNITION When thIs IS tned, the key IS extended to

BUSINESS MA Enough has been shown to clanfy the procedure

23

f The foregoing solution IS predicated upon the hypothesis that the CIpher alphabets are

known But what If this IS not the eabe? What of the steps necessary to arnve at the first

solution, before even the presence of an mterruptor IS suspected? The answer to this question

leads to the presentation of a method of attack which ISone of the most Important and powerful

means the cryptanalyst has at Ius command for unravelmg many knotty problems It 18 called

solut~on by supeMmp08d~on, and warrants detailed treatment

20. SolutIon by snpenmncsrnon - a Bane pMnc~ples - (1) In solvmg an ordmary

repeatmg-key CIpher the first dpp, that of ascertammg the leng-th of the period, is of no sigmh-

( ance m Itself It merely paves the way for and makes possible the second step, wluch consists

in allocatmg the letters of the cryptogram mto mdrvidual monoalphabetrc distnbunons The

third step then consists In solving these distnbutrons Usually, the text of the message IS transcnbed into Its penons and IS wntten out m successive lines corresponding m length With that

of the period The diagram then consists of u serres of columns of letters and the letters m each

column belong to the same mono alphabet AnotllN w ay of loolang at the matter is to conceive

of the text as having thus been taanscnbed mto supcMmposed perwds in such case the letters In

each column have undergone the same kind of treatment by the same elements (plain and cipher

components of the CIpher alphabet)

(2) Suppose, however, that the repeutrve key IS very long and that the message ISshort, so

that there are only a very few cycles m the text Then the solution of the message becomes

difficult, If not impossible, because there 18 not a sufflcient number of supenznposable penods to

YIeld monoalphabetic distnbuuons which can be solved by frequency prmcrples But suppose

also that there are many short cryptograms all enciphered by the same key Then it IS clear

that If these messages are supenmposed

(a) The letters in the respective columns will all belong to mdrvidual alphabets, and

(b) If there IS a sufhctent number of 'lUI h supenn-posable ll'C''l'lages ('lay 2fi-~O, for F.I1~hsh),

then the frequency distnbutions applicable to the suer essive columns of text can be solved-

'lJJ'IJ00ut kno'/J)'/,ng the length of the key In other words, any difficultres that may have arisen on

account of failure or mabihty to ascertain the length of the penod have been circumvented

The second step in normal solution ISthus "by-passed"

(3) Furthermore, and this IS a very important pomt, in case an extremely long key IS employed 8J'd a senes of messages begmnmg at different nutial points are enciphered by such a key,

this method of solution by supenmposinon can be employed, provided the messages can be superImposed correctly, that IS, so that the letters which fall m one column really belong to one Cipher

alphabet Just how this can be done will be demonstrated in subsequent paragraphs, but a

clue has already been given in paragraph 1Sc At this point, however, a simple illustration of

the method will be given, usmg the subsntutaon system discussed m paragraph 19

b Example -(1) A set of 35 messages has been intercepted on the same day Presumably

they are all m the same key, and the presence of repetitIOns between rr.esc,ages corroborates tmb

assumptIOn But the mtervals between repetltJOn'3 WIthm the same message do not show any

common factor and the messages appear to be apeuodlc m nature The probable-word methorl

has been apphed, usmg standard alphabets, WIth no success The messages are then superImposed (FIg 5), the frequency dlstnbutlons for the first 10 columns are as shown m FIgure 6
25

b In the foregOIng example, there are no sigmficant repentaons Such as do occur comprise

only digraphs, one of which IS purely accidental But the absence of sigmficant, long repentaons

IS Itself purely accidental, for had the mterruptor letter been a letter other than Qo, then the

phrase AMMUNITION FOR, which occurs twice, might have been enciphered identically both

(2) The 1st and 2d distnbunons are certamly monoalphabane There are very marked

crests and troughs, and the number of blanks (14)IS more than satIsfactory in both cases (Let

the student at this point refer to Par 14 and Chart 5 of Military CryptanalySlS, Part I) But

the 3d, 4th, and remammg distnbunons appear no longer to be monoalphabetac Note parncularly the distnbunon for the 6th column From this fact the conclusion IS drawn that some

disturbance in penodicity has been mtroduced in the cryptograms In other words, although

they all start out WIth the same alphabet, some sort of mterruption takes place so as to suppress

penodicity

(3) However, a start on solution may be made by attacking the first two distnbunons,

frequency studies bemg aided by oonsiderataor-s based upon probable words In this case, SInce

the text comprises only the begmnmgs of messages, assumptions for probable words are more

eaSIly made than when words are sought in the mtenors of messages Such common mtroductory words as REQUEST, REFER, ENEMY, WHAT, WHEN, IN, SEND, etc, are good ones

to assume Furthermore, high-frequency digraphs used as the mmal digraphs of common

words will, of course, manifest themselves in the first two columns The greatest aid m this

processIS, as usual, a familianty WIth the "word habits" of the enemy

(4) Let the student try to solve the messages In so domg he will more or less qwckly find

the cause of the rapid fallmg offin monoalphabetacity as the columns progress to the nght from

the mitaal pomt of the messages

21 Interruptor IS a CIpher-text letter -a In the precedmg case a plam-text letter serves

as the mterruptor But now suppose the correspondents agree that the mterruptIon in the key

will take place immediately after a previously-agreed-upon letter, say Q, occurs In the CIpher

text The key would then be mterrupted as shown In the following example

Key BUS I N E SSM A CHI N E S BUS I N E SSM

Plam_________________ A M M U NIT ION FOR FIR S TAR TIL L E

CIpher B 0 L Y R P J D R 0 J K X T P F Y X S X B P U U Q

Key BUS I N E SSM A CHI N BUS I N E SSM A C H B U

PlaID_________________ R Y W ILL BEL 0 A D E D AFT ERA M M U NIT I 0

CIpher H R N M Y T T X H P C R F Q B E J FIE L LBO N Q 0' Q

Key BUS I N E SSM A C H BUS I N E

PlaID_________________ N FOR T H I R DAR TIL L E R Y

CIpher V E C X BOD F PAZ Q 0 N U F I C

HRNMY

C X BOD

BPUUQ

!LQ Q V E

FYXSX

L LBO N

-

CRYPTOGRAM:

JKXTP

E J FIE

CXXXX

P J DR 0

C R F Q B

QNUFI

B 0 L Y R

TTXHP

FPAZg

,

I

J

~~~~~~ - ~~ ~~~~ ~~~~~ 3. ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

::::: ~~~~~ ABCDEFGHIJKLMNOPQRSTUVWXYZ

~~ ~~ ~~ 2. ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

~~~~~ ~~~ ~~~ ABCDEFGHIJKLMNOPQRSTUVWXYZ

FIGUBlIlI

~~~~~~ ~~~~~~ ~~ 5. ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

~~~~~ ~~ ~~~ ~~~~~~~~ 6. ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

~~~ ~~~ ~~~~ ~~~~

8. ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

~~~~~ ~~~~~ ~~,~ ~~ ~~

9. ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

~~~~ ~~ ~~ ~~~ ~~~~ 7. ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

~~~ ~~ ~~~~~~ ~~~~~~

10 ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

24

1 ZCTPZWZPEPZQX ]9 A F E 0 J T D TIT 2 WTEQMXZSYSPRC 20 KPVFQWPKTEV 3 TCRWCXTBHH 21 ZABGRTXPUQX 4 EFKCSZRIHA 22 YHEOCUHMDT 5 YANCIHZNUW 23 C L C P Z I K 0 T H 6 VZIETIRRGX 24 AFLWWZQMDT 7 HCQICKGUON 25 ZCWAPMBSAWL 8 ZCFCLXRKQW 26 HFLMHRZNAPECE 9 HWWPTEWCIMJS 27 CLZGEMKZTO 10 E P D 0 Z C L I K S J 28 TPYFKOTIZUH 11 WTSSQZPZIET 29 ZCCPSNEOPHDYL 12 ZCGGYFCSBG 30 C I Y G I F T S Y T L E 13 CWZAOOEMHWTP 31 YTSVWVDGHPGUZ 14 C I Y G I F B D T V X 32 N 0 C A I F B J B L G H Y 15 EAQDRDNSRCAPDT 33 ZXXFLFEGJL 16 YFWCQQBZCWC 34 Z C T M M B Z J 0 0 17 WTEZQSKUHC 35 HCQIWSYSBPHCZV 18 ZCVXQZKZYDWLK

FIGUBlIlI
27

length and were sncrphered by a vanable-length key It IS possible, however, to combine both

pnnc iples and to apply a variable-length key to vanable-Iength groupings of the plain text

(2) Suppose the corre8pondents agree to encipher a message accordmg to word lengths, but

at Irregular intervals, to add at the end of a word an mteuuptor letter which will serve to interrupt the key Note the following, ill which the key IS BUSINESS MACHINES and the mterruptor

letter IS X

(3) The foregomg system IS only a nnnor modiflcanon of tne simple case of ordmary word

length enclpherment as explained m Section II If standard CIpher alphabets are used, the

spasmodic mterruptaon and the presence of the mterruptor letter would cause no difficulty

whatever, Slice the solution can be aclneved mechanically, by completmg the plam-component

sequen(,e If nuxed CIpher alphabets are used, and the primary components are unknown,

solution may be reached by following the procedure outlined in Sections II and III, WIth such

modificataons es are SUItable to the (,11&e

e It IS hardly necessary to point out that the foregoing types of aperiodic substitution are

rather unsuitable for practical military usage Enuphelment IS slow and subject to error In

some cases enopherment can be aecomphshed only by single-letter operation For If the

mterruptor IS a CIpherletter the key IS interrupted by a letter wluoh (annat be known m advance,

If the mterruptor IS a plam-text letter, while the mterruptIons can be indicated before encipherment IS begun, the IrlegulantIes occasioned by the mterrupnons III keymg cause confUSIon and

quite matenaUy retard the enciphenng process In deuphermg, the rate of speed would be

Just as slow m 6lther method It IS obVIOUS that one of the pnncipal dIsadvantages ill all these

methods IS that If an error in transmisaion IS made, If some letters are omitted, or If anythmg

happens to the mterruptor letter, the message becomes difficult or impossible to decryptograph

by the ordmary code clerk Flllally, the degree of cryptographIc secunty attaInable by most

of these methods IS not suffiCIentfor mIhtary purposes

etc

5 B

FIR S T X ART ILL E R Y etc

Z D F G JOB H DOS 5 J H I

FGJOB HDOSS JHI

CRYPrOGRAM:

U

FOR

E Q V

BTTRV o DOW V EQVZD

Key____ B

PlaIn_____ ___ A M M U NIT ION

CIpheL______ B T T R V 0 DOW V

tunes If a short key IS employed, repeutaons may be plentiful For example, note the following, m which 50 IS the mterruptor letter

26

Key BAN D 5 BAN D S BAN D 5 BAN D 5 BAN BAN D 5 BAN D 5 B

Plum FRO MF 0 U R F I VET 0 F 0 U R F 1FT E E N A MBA R RAG E

Cipher K T A K Z WX I I D A C B N Z WX I I D K W5 JON K T BTl D H J

C This last example gives a clue to one method of attacking this type of system There

will be repetinons witlnn short secticns, and the interval between tl-em wrll sometimes permit

of asce, taming tl.e length (Ifthe kev In sur h shr t t set tions, tl.e letters wlnch intervene between

the repeat~d sequences may be elumnated a'! possible interrupter letters Thus, the letters

A, C,B, ano Nruay be el.mmated, m the foregomg {'Aample, as mterruptor letters By extension

of tlus principle to the letters mtervemng between other repennons, one may more or less

qUI( kIy ascertain what letter serves as the mterruptor

d On....e the mterruptor letter has been found, the next step IS to break up the message

into "uninterrupted" sequences and then attempt a solution by supenmposiuon The pnnciples explumed in paragraph 20 neeJ only be modified In mmor respect'! In the first place 1ll

tlus case the columns of text formed by the supenmpositaon of umnterrupted sequences will

be purely r-ionoalpnabetic, whereas in the lase of the example m paragraph 20, only the very

first column IS purely monoalphabeuc, the monoalphabeticity fallmg off very rapidly WIth the

2d, 3d, columns Hence, in this case the analysis of the individual alphabets should be

an easier task But this would be counterbalanced by the fact that wl-ereas m the former case

the cryptanalyst IS dealing WIth the mrual words of messages, 1ll this case he IS dealing WIth

mtenor poi tions of tl,e text and has no way of know m~ where a word begms The latter remarks

naturally no not apply to the case where a whole set of messages ill this system, all in the same

key, can be subjected to simultaneous study In such a case the cryptanalyst would also have

the minal words to work upon

22 Concludmg remarks -a The preceding two parag.apbs both deal with the first ani'

simplest of the three basic cases referred to under paragraph 18 The second of those case..

involves considerably more work III soluuon for the reason that when the mterruption takes

place and the keymg sequence recommences, the latter IS not mvanably the mmal pomt of the

sequence, as m the first case

b In the second of those casee the mterruptor causes a break in the keying sequence and

a recommClllement at anyone of the 10 keymg elements Consequently, It IS ImpOSSIble now

merely to supernnpose sectIOns of the text by sluftmg them so t1at theIr lmtuu letters fall In

the same (olumn But a superunpositlOn IS nevertheless possIble provIded the InterruptIons

do not occur so frequently 2 that sectIOns of only a very few lette:S are enCIphered by sequent

keyletters In order to accomphsh a proper supcnmposItIOn m thIs case, a statIstical test

IS essential, and for thIs a good many letters are reqUIred The nature of thIs test wI be

explamed III Section XI

c The same thmg IS true of the last of the three <,ases mentIOned under paragraph 18

The solution of a case of tlus sort IS adIllittedly a rather dJ1ficultmatter whIch will be taken up

III Its proper place later

d (1) In the cases thus far studIed, eIther the piam-text groupmgs were vanable In length

and were enCIphered by a constant-length key, or the plam-te"{t groupmgs were constant m

2 When no mterruptor or "mflucnce letter" 1~ used, the InterruptIOn or break In the keymg sequence occurs

after the eUClphLrment of a definIte number of letters Once thIs number has bE-en J.scertamcd '30lutlOn of

subsequent messages IS very Simple '
SECTION VI

REVIEW OF AUTO-KEY SYSTEMS

Paragraph

The two basic methods of auto-key enclpherment___________________________________________________ 23

23 The two baste methods of auto-key eneipherment --a In auto-key encrpherment there

are two possible sources for successive key letters the plain text or the cipher text of the message

Itself In either case, the tmtwl key letter or key letters are supphed by preagreement between

the correspondents, after that the text letters that are to serve as the key are displaced 1,2,3,

mtervals to the right, depending upon the length of the prearranged key

b (1) An example of plain-text keymg WIll first be shown, to refresh the student's recollecnon Let the previously agreed upon key consist of a single letter, say X, and let the cipher

alphabets be direct standard alphabets

Key X NOT I F Y QUA R T E R MAS T E R

Plam NOT I F Y QUA R T E R MAS T E R

Clpher__________________ K B H B N D 0 K U R K X V D M S L X V

(2) Instead of having a single letter serve as the imtial key, a word or even a long phrase

may be used Thus (usmg TYPEWRITER as the mitral key)

Key T Y PEW R I T E RI NOT I F Y QUA R

Plain -- NOT I F Y QUA R T E R MAS T E R

Clpher__________________ G M I M B P Y N E I G SKU F Q J Y R

c (1) In cipher text auto keymg the procedure 18 quite snmlar If a SInglemiual key letter

18 used

Key ~I K Y R Z E C S M M D WAR D D V 0 S

Plam NOT I F Y QUA R T E R MAS T E R

Clpher..________________ K Y R Z E C S M M D WAR D D V 0 S J

(2) If a key word IS used

Key m______________ T Y PEW R I T E RI G M I M B P Y N E I

Plam NOT I F Y QUA R T E R MAS T E R

CIpher G M I M B P Y N E I Z Q Z Y B H R R V

(3) SometImes only the last cipher letter resultmg from the use of the prearranged key

word 18 used as the key letter for enciphenng the auto-keyed portion of the text Thus, m the

last example, the plain text begmmng TERMASTER would be enciphered as follows

Key T Y PEW R I T E RI I B F W I I A T X

Plam NOT I F Y QUA R T E R MAS T E R

CIpher__________________ G M I M B P Y N E I B F W I I A T X 0

(28)

29

d In the foregomg examples, direct standard alphabets are employed, but mixed alphabets,

either mterrelated or mdependent, may be used Just as readily Also, instead of the ordmary

type of CIpher alphabets, one may employ a mathemancal process of addition (see par 40} of

Special Text No 166, Advanced Mthtary Oryptography) but the difference between the latter

process and the ordinary one using sliding alphabets 18 more apparent than real

e Smce the analyara of the case m which the CIpher text constItutes the auto key 18 usually

easier than that ill which the plain text serves this function, the former will be the first to be

discussed

1811922-89--8
31

FIGUBlI: 7

b If as a. result of the analySIS of several messages (as descnbed m par 25), mixed

pnmary ~omponents have been reconstructed, the solution of subsequent messages may rea~y be accomplished by followmg the procedure outlined in a above, since In that case the eap er

alphabets have become known alphabets b

25 General pnnerplea underlyIng solution of Cipher-text auto-keyed cryptograms '1

freque~cy analysIs -a FIrst of all, It IS to be noted In connection With Cipher-text auto-keymg

that repetitions will not be nearly as plentiful In the Cipher text as they are m the plam t~t,

because m tlus system before a repetinon can appear two thmga must happen SImultaneous y

FIrst of course the plam-text sequence must be repeated, and second, one or more Cipher-text

lette;s (depen~gupon the length of the Introductory key) Immediately before the second appear

ance of the pIron-text repetition must be Identical WIth one or more eapher-textletters unmedIate

I

Y

before the first appearance of the group ThIs can happen only as the result of chance n

the followmg example the mtroductory key IS a single letter, X, and direct standard components

are used In the usual Vigenere manner

AVHXTXNHO

BWIYUYOIP

CXJZVZPJQ

DYKAWAQKR

EZLBXBRLS

FAMCYCSMT

GBNDZDTNU

H C 0 E A E U 0 V

IDPFBFVPW

J G C G WQ X

KFRHDHXRY

LGSIEIYSZ

MHTJFJZU

NIUKGKAUB

OJVLHLBVC

PKWMIMCWD

QLXNJNDXE

RMYOKOEYF

S N Z P L P F Z E

TOAQM...QGAH

UPBRNRHBI

V Q C S 0 SIC J

WRDTPTJDK

XSEUQUKEL

YTFVRVLFM

ZUGWSWMGN

KDKSJMDHNVHLY

THIRD REGIMENT

KDKSJMDHNVHLYR

Key X C K B T M D H N V H L Y

Plam_________________ FIR S T REG I MEN T

Cipher C K B T M D H N V H L Y R

(80)

CRYPTOGRAM:

P8lllll'llph Solution of cipher-text auto-keyed cryptograms when known alphabets are employed_____________________________ 24

General prmeiples underlying solution of cipher-text auto-keyed cryptograms by frequency analysls__________ 25

Frequency distnbutrone required for solution --------------------__________________________________________________________ 26

Example of solution by frequency analyslll________________________________________________________________________________ 27

Example of solution by analysrs of Isomorphisms -- ----____________________________________________________________________ 28

Bpeclal case of solution of cipher-text autO-keyed cryptograms ._____ 29

24 SolutIon of cIpher-text auto-keyed cryptograms when known alphabets are employed _

a (1) Flrst of all It IS to be noted that If the cryptanalyst knows the CIpher alphabets which

were employed in encipherment, the solunon presents hardly any problem at all It IS only

necessary to decipher the message beyond the key letter or key-word pornon and the mraal part

of the plain text enciphered by tlus key letter or key word can be filled In from the context

An example, using standard Cipher alphabets, follows hereWIth

SOLUTION OF CIPHER-TEXT AUTO-KEY SYSTEMS

SECTION VII

WSGQV OHVMQ WEQUH AALNB NZZMP ESKD

(2) Wntmg the Cipher text as key letters (displaced one interval to the right) and declphenng

by direct standard alphabets yields the followmg

Key-------------- W S G Q V 0 H V M Q W E Q U H A A L N B N Z Z M PES K

CIpher___________ W S G Q V 0 H V M Q W E Q U H A A L N B N Z Z M PES K D

Plam_____________ WOK F T TOR E G I MEN TAL COM MAN D P 0 S T

(3) 1'11al of the word REPORT as the imtral word of the message YIelds an mtelhgible word

as the mmal key FORCE, so that the message reads

Key_____________________ FOR C E V 0 H V M Q

Clpher__________________ W S G Q V 0 H V M Q

Plam____________________ REP 0 R T TOR E •

(4) A sermautomanr, method of solvmg such a message IS to use sliding normal alphabets

and align the atnps so that, as one progresses from left to right, each Cipher letter ISset opposite

the letter A on the preceding strip Takmg the letters VMQWEQUHA in the foregomg example,

note In Figure 7 the senes of placements of the successive stnps Then note how the SUCCesSIve

plam-text letters of the word REGIMENT reappear to the left of the successive CIpher letters

MQWEQUHA
32

The repeated plain-text word, REGIMENT, has only 8 letters but the repeated CIpher-text group

contains 9, of which only the last 8 letters actually represent the plam-text repention In

order that the word REGIMENT be enciphered by D H N V H L Y R the second time this

word appeared in the text It was necessary that the key letter for Its first letter, R, be Mboth

times, no other key letter will produce the same CIpher sequence for the word REGIMENT in tills

case Each different key letter for enciphermg the first letter of REGIMENT WIll produce a

different encipherment for the word, so that the chances I for a repetrtaon in tills case are roughly

about 1 in 26 ThIS IS the principal cause for the reduction in repetrtrons in tills system If

an mtroductory key of two letters were used, It would be necessary that the two Cipher letters

immediately before the second appearance of the repeated word REGIMENT be rdentrcal With

the two CIpher letters immediately before the first appearance of the word In general, then,

an n-letter repetition in the CIpher text, m tills case, represents an (n-k)-letter repetiuon m the

plain text, where n IS the length of the CIpher-text repetttion and k IS the length of the introductory

key

b There IS a second phenomenon of mterest in connection WIth the Cipher-text auto-key

method Let the letter opposite which the key letter IS placed (when using slrdmg components

for encipherment) be termed, for convenience in reference, "the base letter" Normally the

base letter IS the miual Ietter of the plain component, but It has been seen in precedmg texts

that this IS only a convention Now when the introductory key IS a single letter, If the base

letter occurs as a plain-text letter ItS CIpher equivalent IS Identical WIth the irnrnedtately precedmg Cipher letter, that IS, there IS produced a double letter m the CIpher text, no matter what

the CIpher component IS and no matter what the key letter happens to be for that encipherment

For example, using the H Y D R A U L I C X Z sequence for both primary components, WIth H, the mitral letter of the plain component as the base letter, and using the

introductory key letter X, the following encipherment IS produced

Key X J 0 I I FLY U T T D K K Y C X G

Plam______________________ MAN HAT TAN H I G H J INK S

CIpher J 0 I I FLY U T T D K K Y C X G L

Note the doublets II, TT, KK Each time such a doublet occurs It means that the second letter

represents HIl , which IS the base letter in this case (rmtial Ietter of plum component) Now If

the base letter happens to be a high-frequency letter m normal plam text, for example the letter

E, or T, then the CIpher text WIll show a large number of doublets, If It happens to be a low-frequency letter the CIpher text will show very few doublets In fact, the number of doublets

will be directly proportional to the frequency of the base letter m normal plain text Thus,

If the cryptogram contains 1,000 letters there should be about 72 occurrences of doublets If

the base letter IS A, since m 1,000 letters of plain text there should be about 72 A's Conversely,

If a cryptogram of 1,000 letters shows about 72 doublets, the base letter IS likely to be A, If It

shows about 90, It IS likely to be T, and so on Furthermore when a clue to the Identity of the

base letter has been obtamed m this manner, It IS possible Immediately to insert the corresponding

plain-text letter throughout the text of the message The drstribuuon of tills letter may not

only serve as a check (If no inconsistencies develop) but also may lead to the assumption of

values for other CIpher letters

c When the mtroductory key IS 2 letters, then this same phenomenon will produce groups

of the formula ABA, where A and B may be any letters, but the first and third must be IdentIcal

The occurrence of patterns of tills type III tIns case mdlcates the enCIpherment of the base letter

1 If all the CIpher letters appeared WIth equal frequency the chances would be exactly 1 In 26 But certam

letters appear WIth greater frequency because some plam-text letters are much more frequent than others

33

d The phenomena noted above can be used to considerable advantage in the solution of

cryptograms of this type For instance, If It IS known that the ordinary Vigenere method of

oncipherment IS used (8k /2=81/1' 81>11=8./2) , then the imnal Ietter of the plain component IS

the base letter If, further, It IS known that the plain component IS the normal direct sequence,

then the base letter IS A and a word such as BATTALION WIll be enciphered by a group having

the formula AABCCDEFG If the plain component IS a mixed sequence and happens to start

WIth the lett;;-E~hen a word such as ENEMY would be enciphered by a sequence having the

formula AABBCD 2 Sequences such as these are, of course, rdiomorphic and If words yielding

such idiomorphisms are frequent III the text there Will be produced m the latter several or many

cases of Isomorplusm When these are analyzed by the princrples of mdirect symmetry of

posttion, a quick solution may follow

e A final principle underlying the solution of CIpher-text auto-keyed cryptograms remains

to be discussed It concerns the nature of the frequency distrIbutIOns required for the analysis

of such cryptograms Tills principle WIll be set forth m the next paragraph

26 Frequency distrIbutIOns required for solution -a Consider the message given in

paragraph 23c (1) It happens that the letter R. occurs twice III tills short message and, because

of the nature of the Cipher-text auto-keymg method, this letter must also appear twice m the

key Now It IS ObVIOUS that all plain-text letters snctphered by key letter Rk WIll be m the same

Cipher alphabet m other words If the key text IS "offset" one letter to the right of the Cipher

text then every 'c~pher letter wh~~h ~mmedwtely follow8 an R. ~n the cryptogram unll belong t\the

8am~ cipher alphabet and tills alphabet may be designated convemently as the R Cipher alpha et

Now If there were sufficient text, so that there were, say, 30 to 40 R.'s in It, then a frequency

distribution of the letters Immediately following the R.'s will oxhibrt monoalphabeucity

What has been said of the letters following the Rc's apphes equally well to the letters following

h tl A ' B' C' nd so on In short If 26 distnbutions all the other letters of the Clp er text, .ne c S, e S, c S, a , d

are made one for each letter of the alphabet, showing the Cipher letter immediately succee mg

each different letter of the Cipher text, then the text of the cryptogram can be allocated mto 26

unihteral, mono alphabetic frequency distnbutions WhICh can be solved by frequency analysis,

providing there are sufficient data for tlus purpose b The foregoing pnnciple has been descnbed as pertammg to the case when the introductory

key IS a single letter, that IS, when the key text IS "offset" or displaced but one interval to the

nght of the CIpher text But It applies equally to cases wherem the key text IS offset more than

one interval provided the frequency drstributions are based upon the proper interval, as determmed by the displacement due to the length of the introductory key For metance, suppose

the introductory key consists of two letters, as in the following example

Key text X ZI M R H F H G F N Q R X 0 M R M 6: E E

Plain text R ELI A B LEI N FOR MAT IE'

CIpher text M R H F H G F N Q R X 0 M R M V W E

The key text III this case IS offset two mtervals to the right of the Cipher text and, therefore, ~equency distribunons made by takmg the CIpher letters one interval to the right of a given Ct ed

letter each time that letter occurs, will not be monoalphabeuc because some letter not re ate

at all to the given Cipher letter IS the key letter for snoiphenng the letter one Illterv~htofi

the

nzht of the latter For example, note the three Re's III the foregomg IllustratIOn erst

Rto IS followed by H representmg the enCIpherment of L, by Mk , the second R. IS followed h

by x., c C, L. d R f 11 d b M representmg t e en- representmg the enCIpherment of Fil by Qk' the tlllr • IS 0 owe Y c, I ltd d d

cipherment of All by Mk The three CIpher letters H, X, and Mare here entIre y unre a e an 0

2 SIX letters are shown because the IdlOmorphlsm m thlil case extends over that many letters
34

not belong to the same cipher alphabet because they represent encipherments by three different

key letters On the other hand, the cipher letters two intervals to the right of the Ro's, VIZ,

F, 0, and V, are in the same Cipher alphabet because these Cipher letters are the results of enciphenng plain-text letters I, 0, and T, respectively, by the same key letter, R It IS ObVIOUS,

then, that when the mtroductory key consists of two letters and the key text IS displaced two

mtervals to the right of the CIpher text, the proper frequency dtstnbutrons for monoalphabsneujwill be based upon the letter at the second interval to the right of each CIpher letter Likewise,

rl the mtroductory key consists of three letters and the key text IS displaced three mtervals to

the right of the CIpher text, the distributions must be based upon the third mterval, and so on,

m each case the interval used corresponding to the amount of displacement between key text

and Cipher text

c Conversely, in solving a problem of thIs type, when the length of the mtroductory key

and therefore the amount of displacement are not known, the appearance of the frequency dIStnbutions based upon vanous mtervals after each different Cipher letter will disclose this unknown factor, since only one set of drstributions will exhibrt monoaiphabeticity and the interval

corresponding to that set will be the correct mterval

d Apphcation of these prmciplos will now be made, using a specific example

27. Example of solution by frequency analysis -a It WIll be assumed that previous studies

have disclosed that the enemy IS using the CIpher-text auto-key system descnbed It will be

further assumed that these studies have also disclosed that (1) the mtroductory key IS usually a

single letter, (2) the usual VIgenere method of employmg sliding primary components IS used,

(3) the plain component IS usually the normal direct sequence, the Cipher component a mixed

sequence which changes dally. The followmg cryptograms, all of the same date, have been

mtercepted

35

I A A B D

J U AWL

L Y Z K C

M X G S S

o V U Y E

KMXXX

N B T J G

C Z MJ E

G B 0 I W

R 0 V D I

K B J H Q

A J I E F

o N Due

SET WW

SUA 0 X

F K K M E

L V WT T

S PBS F

TUX N J

Q P U X M

N K A Z C

D H 0 0 V

I I V U U

P PDQ Z

MLAC Z

E S Joe

I B B 0 Z

N T Toe

D I X C E

E K A Q I

R X A L X

o V M R G

M X DID

V HID I

U U N M G

FOB H V

T Z 0 I D

MMVYM

L M W K Y

M T F H Z

N N D G I

J WK I E

B Q X X X

E C A Q Z

F DIP P

H X M 0 Z

MESSAGE V

MESSAGE VI

MESSAGE VII

MESSAGE IV

Q A A Z T

C J J G J

G G BOX

A R Y Y P

M M T T F

M W 0 H C

W Z H S T

F K I R H

WMEHH

U Q Z H Z

o Bee X

Y 0 0 V U

J L N Q M

L T Z K X

G R J P F

C S L G X

T B J P A

B D A Q Y

C E C Z M

GIS U H

X C T B S

HAG I E

P S F A J

W P V I B

MUZEL

FOR S A

X J J P M

T UTe V

SUM U J

T B J P A

S F T Q T

XUKTX

FXXXX

b A distnbution table of the type descnbed m paragraph 25e IS compiled and 18 shown as

F 8 below In making these distnbutions It IS SImple to insert a tally m the appropriate

c:IT~the pertment honzontal hne of the table, to indicate the Cipher letter wh1~h nnmet~a~l~ follows each occurrence of the letter to which that line applies Obviously, the est me 0 0

m ihng the data IS to handle the text digraphically, taking the first and second letters, the

second and third, the third and fourth, and so on, and distnbutmg the final letters of the digraphs

in a quadncular table The distnbution merely takes the form of tally marks, the fifth being a

diagonal stroke so as to totalize the occurrences visibly

D I WP P

GTe Z M

J J Q Q Y

F K SET

J X W K A

GXXXX

J C C X U

C S UHF

Z E Y G C

R R Q H Q

B Z ELM

I B R X D

U K N M V

D I V E Y

S G TAR

G Y F K R

K M K I X

D GET X

R M X A N

Y Y Z J U

U E Q E V

D G T T Z

G G K X X

JeD D Y

W V G R K

MESSAGE I

C N Q E T

N N J J I

G 0 I E Q

F Y TeD

R Q G G N

Y s c o I

WP C K K

N L M W K

PUR R S

TeE T P

L B weD

Z 0 K V U

C H 0 L M

T Q Y U X

MESSAGE II

MESSAGE III

E E C D A

H I F E L

R V CUR

M G LOY

K M L T U

T Z J 0 Q

Z W K X G

A K 0 B L

Q B ML T

B WN Y S

BUY N K

LTC J M

H Q V G X

K I R 0 Z

I J X WX

Q Z S X 0

E H H L M

CAR P H

T 0 I Q K

o K N T B

G R V R M

R T N J U

F H I J A

F F NFl

A 0 0 X D

R WK A 0

M WT Q 0

L A Q Y U
FIGURE 8

36

SECOND LETTER

ABCDEFGH I JKLMNO PQRSTVVWXYZ

Z M LAC Z

M LAC Z

Z M T F H

M T F H Z

V I C

V V N MG

A

Assumed Frequency

Alpha Approxr bet matron e. e. Expected Actual

M T V Low 2 Fair

T F I High 2 Fair

F U L Medium 1 Good

U N B Low 1 Good

N M L Medium 2 Fair

M G E HIgh 3 Fair

Message VI, hne 2 B D A Q Y M M T T F

A A

The assumption cannot be discarded Just yet Let the values derivable from the assumption

be inserted in their proper places m a cipher component, and, usmg the latter in conjunction

With a normal direct sequence as the plain component, let an attempt be made to find corroboration for these values The followmg placements may be made

Plam_________________ ABC D E F G H I J K L M N 0 P Q R S T V V W X Y Z

Cipher M F G V N T

The letter Me appears tWICe in the cipher sequence and when this partrally reconstructed cipher

component IS tested It IS found that the value Lp(Nt)=Me IS corroborated Having the letters

M, F, G, V, N, and T tentatively placed in the cipher component, It IS possible to msort certain

plam-text values ill the text For example, in the Malphabet, Fe==Dll , Ge=Ep, Ve=OIl' Ne=Pp,

Te=Vll In the F alphabet, Ge=Bll , Ve=Lll , Ne=Mll , TC=SIl' Mc=Xp The other letters yield

additional values ill the appropriate alphabets The plam-text values thus obtamable are

mserted m the CIpher text No moonsistencres appear and, moreover, certam "good" digraphs

are brought to light For instance, note what happens here

Key V Q Z H Z M T F H Z M LAC Z

Message V, hne 4 Cipher V Q Z H Z M T F H Z M LAC Z

Plam___________ V I

Now If the letter H can be placed in the CIpher component, several values might be added to this

partial decipherment Notmg that F and G are sequent m the CIpher component, suppose H

follows G therem Then the followmg IS obtamed

Key____________ V Q Z H

Message V, hne 4 Cipher V Q Z H Z

Plam _

sequence represents BATTALION does not appear to be warranted Similar attempts are made

at other points in the text, With the same or other probable words Some of these attempts

may have to be carried to the point where the placement of \ alues in the tentative CIpher component leads to serIOUS mconsistencies Finally, attention IS fixed upon the following sequence

37

MMTTFVVNMG The word AVAILABLE IS assumed The appropriate frequency drstubuuons are consulted

to see how well the actual mdrvrdual frequencies correspond to the expected ones

III I II I III I I I 1111 iHll III - - - - - - - - --- - I II

I I III - - - - - - - - - - - - - - - - - - - - - - -

I --III

- - I I 1111 I I II III I II I

II II iHI III III I - - - - - - - - - - - - - II III I - - - - - - - - --- - II I I I III 111I

II I - - - - - - - - - - - - - II I iHI II iHIiHI I I - - I II - - - - - - - - --- II

11I1 I I III II I

- - - - - - - - - - - - - - - - - - - - - - - - --- --III II II iHI I I II - - - - - - I I I 1111 II I I 1111 I I II - - - I I - - - - - - - -- I

II I / I - - - - --- - - - - - - - - III III I I II I I III I III - - - - - - - - - - I II I

I I I - - - - - - - - - - - - II III II I II - - - - - - - - - --- - III I I I I II - - - - - I 1111 iHI iHI I I II I I II II - - - - - - --- - - I II III II

I - - - - - - - - - - - --- 111I I I I II 111I I III III 11I1 I - - - - - - - - - - - --- - III I II

1111 I I - - - - - - - - - - - - - - - - - - - - - - - --

iHI III I 11I1 II I II I I I II II

II I I - - - - - - - - - - - - - I - - - - - - - - - - - - --- iHI III 1111 I II II - - - - - - - - - - - - III III III I I I - - - - - - - - - - - - --- - 111I 1111 II II II II II iHll III II - - - - - - - - I I I 1111 III I II II - - - - II I - - - - - - - - -- I

III I - - - - - - - - - - - - - II II I - - - - II III I I - - - - - - - - -- iHI II III - - - - - - II I I III I I - - - - - - - - - - - - - - - - I III I I II II

II I II - I

- - --- - - - - - - - - - - - I I I - - - - II I I I I I I - - - - - - - --- - iHI 1111

I II I - - - - - - - - - - - - II I II II I II II II I II I II I

I I I II 1111 I - - - - - - - - - - - --- --- - - - - - - - - ----

I I I I II iHI I

I 1111 - - - - - - - - - iHll I II - - - - II I II III I - - - - - - - -- - iHI 1111 I II 1111

III III I - - - - --- - - - - II III III I - - - - - - - --- - - - - -- I I 1111 I II II II I

I II I III I - - - - - - - - - - - - - - - - - - - - - - - - - --

I - - I II I 1111 I I I

I iHll I

- - - - - - - - - - - - - - - - - - - - - - - -- I I I 1111 I II I I II I

II III 1111 II I 1111 I - - - - - - - - - - - - - - - II 111I II - - - - - -- II II

I I I II II

- - --- - - - - - - - - - - - - - - - - II I I II - - - - - - - - --- II I II I II - - - - - I I I 111I I - - - - - - - - - - II II II iHll I II I II I

A

B

C

D

E

F

G

H

I

J

P::K

L

tlM

~N

0

P::

P

Q

R

S

T

V

V

W

X

Y

Z

c The mdrvidual frequency distnbunons give every appearance of being monoalphabetic

which checks the assumption that the enemy IS still employing the same system The total

number of letters of text (excludmg the final X's) IS 680 If the base letter IS A then there should

be approximately 680X7 2%=49 cases of double letters m the text There are actually 52

such cases, which checks quite well With expectancy The letter A IS substituted throughout

the text for the second letter of each doublet

d The following sequence IS noted

Message V, lme L GIS V H W Z H S T T Z 0 I D D H 0 0 V N B T J G

A A A

Assume that the sequence DDHOOVNBT represents BATTALION Then the frequency of He in the

D cipher alphabet should be high, since He=Tp The H has only 2 occurrences LIkeWIse the

frequency of O, in the H alphabet (=Tp) should be hrgh , It If> also only 2 The frequency' of V

ill the 0 alphabet should be medium or low, smce It would equal Lp, It IS 5, which IS too high

The rest of the letters of the assumed word are similarly checked against the appropriate frequency distnbuuons, With the result that, on the whole, the assurnpuon that the DDHOOVNBT
38

Suppose the VIC IS the begmmng of VICINITY Tills assumption pemuts the placement of

A,C, L, and ZIn the CIphercomponent, as follows

Plam_________________ ABC D E F G H I J K L MN 0 P Q R STU V WX Y Z

CIpher M A F G H L Z U N T C

These addmonal values check In very mcely and presently the entire cipher component IS

reconstructed It IS found to be as follows

Plam_________________ ABC D E F G H I J K L MN 0 P Q R STU V WX Y Z

CIpher MA B F G H J K L Q S V X Z U N D E R W0 T Y PIC

The key phrase IS obviously UNDERWOOD TYPEWRITER COMPANY All the messages now may

be deciphered WIth ease The followmg gives the letter-for-Ietter decipherment of the first

three groups of each message

I (Introduotory key K)

QVVJL

A P G R S

P V F Z N

S C A A T

IXDMT

YKIPH

NK

NSF B a

D I X G Z

Y G S I J

S J T B V

N Q I C H

DMLEG

o A E 0 T

E 0 V A C

R S J Y L

F D B B Y

Y

MHCTY

YYBVK

I Q 0 V J

o Z E T Z

D Q G S U

Q L Z I X

F Q F N N

X ROC S

DEWRR

Y J J L K

BMMLB

1

MLEXR KVDBD

T X X B W ENAXM

L K Z E K U R C N I

EKKLR V R F R F

N D seD MP B B V

J L X T C V A 0 V E

P L Q G W UPVKU

W T H C Z R

2

H 0 U Z 0 LLZNA

o T G U Q Q F J 0 C

B 0 E P L Q I G N R

HOT J 0 C R I I X

3

MHCVB YUHAO

YBHAL ZOFHM

XLXGZ J P W U I

o 0 SEA ATKPB

GRXLG

KVBWK

KVKRO

RPEEW

T R X D I

MAMMa

N E V V J

X D D Q Q

Z R L F D

o U PIT

U V E V Y

XLODL

JRRVM

RFRFX

MCUNX

I T M L J

HAL 0 Z

KZEKU

XAGXD

BJNNB

U S Y P W

BEKVB

PM Y U C

T C V N I

E F A A G

AT N N B

NXQWH

TNKKU

B I I B F

X R SeT

K T T C F

JOEYM

39

c Frequency distnbunons are made, based upon the 2d letters of pairs, as In the preceding

example The result IS shown m the table m figure 9 The data in each distnbution are relatIvely scanty and It would appear that the solution IS going to be a rather dIfficult matter

e In the foregomg example the plam component was the normal direct sequence, so that

WIth the VIgen~re method of encipherment the base letter IS A If the plaan component IS a

mixed sequence, the base letter may no longer be A, but m accordance WIth the principle set

forth m paragraph 25b, the frequency of doublets in the cipher text WII1 correspond WIth the

frequency of the base letter as a letter of normal plain text If a good clue as to the identity

of tills letter IS afforded by the frequency of doublets in the cipher text, the insertion of the

correspondmg base letter In the plam text will lead to further clues The solution from there

on can be handled along the hnes indicated above

27 Example of solunon by analysIs of rsomerpbisms -a It was stated In paragraph 25d

that m cipher-text auto-keymg the production of ISomorphs IS a frequent phenomenon and

that analysis of these ISomorphs may YIeld a quick solution An example of this sort will now

be studied

b Suppose the following cryptograms have been mtercepted

MZDKV

Z D K V U

N D RED

A C N C Q

C N Q E T

Y QUI E

G W P C K

W P C K K

P E C I A

X E C A Q

E C A Q Z

F I C I E

T T Z 0 I

T Z 0 I D

ASH E S

TRXAL

RXALX

XUPHE

P V HID

V HID I

aUT S I

X E E C D

E E C D A

F A I R L

o LTC J

LTC J M

ONE H U

MZWKX

ZWKXG

N G 0 F S

HWZHS

W Z H S T

o U S F L

AARYY

A R Y Y P

ARE A B

M L T Z K

LTZKX

INS U F

AQAAZ

QAAZT

I SAM I

Key KI I J X W

CIpher T J X WX

Plam______________________ RIG H T

Key EI G R V R

CIpher G R V R M

Plam______________________ NOT H I

Key HI R W K A

CIpher____________________ R W K A 0

Plam______________________ ABO U T

IV (Introductory key J)

III (Introduotory key R)

VI (Introductory key B)

VII (Introduotory key B)

II (Introduotory key E)

Key X J J P

CIpher X J J P M

Plam______________________ G U A R D

V (Introductory key E)

Key GIS U

CIpher GIS U H

Plam______________________ N U MER

Key----___________________ mT B J P

CIpher____________________ T B J P A

Plam______________________ THE R E

Key mT B J P

CIpher T B J P A

Plam______________________ THE R E
FIGURE 9

40

OBOOQG§UN§FBOBEK

NEVVJLKZEKURCNIF

T N K K U X .b 0 D .b W T H C Z R I end of message

C R I I X 0 E T N K I end of message

CQVVJLKZEKURFRFX

A E I L . R.T Y

Plam______________ ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

CIpher H Y 0 R A U LIe B E F G J K M N 0 P Q S T V W X Z

These few letters are sufficient to indicate that the plain component IS probably the normal

direct sequence A few mmutes testmg proves this to be true The two components are therefore

With these two components at hand, the decipherment of the messages now becomes a relatively

SImple matter Assummg a single-letter mtroductory key, and trymg the first five groupa of

message 1 the results are as follows

41

The sequence IS obviously based on the keyword HYDRAULIC, and the complete primary CIpher

component 18 now available The plain component IS then to be reconstructed A word must

be assumed m the text

f A good probable word to assume for the lO-letter repetition found m messages 1 and 3

18 ARTILLERY Tlus single assumption 18 sufflcient to place 7 letters in the plsm component

Thus

1 28' a 8 7 89m u u M U U W n

TVWXZ •• OR ULI BEFGJK NO QS

1 2 8 4 a 8 7 8 9 10 U 12 18 M 15 18 17 18 19 n

1 2 8 4 a 8 7 89m u u M U U W n

TEZKR. IVF. Q WG. NUSBXJDOL

The only missing letters are A, C, H, M, P, and Y By use of the nearly complete sequence on the

text It will be possible to place these 6 letters m their posinons in the CIpher component Or, If a

keyword-mixed sequence IS suspected, then the sequence which was reconstructed may be merely

a decimataon of the ongmal pnmary sequence By testIng the partial sequence for vanous

intervals, when the seventh IS selected the following result 18 obtained

Key V V J L K Z E K U R

Plam_______________ ART ILL E R Y

Clpher • • V V J L K Z E K U R

Key '/ U S Y P W T R X 0 I M LEX R K V 0 BOO Q G S

Cipher U S Y P W T R S DIM LEX R K V D B D 0 Q G S U

Plam_______________ '/ P H R FYI V E FIR E 0 F L I G H TAR TIL

As for the end of the isomorphism, the fact that Isomorphs (2) and (5) are the same for 10 letters

seems to indicate that that IS the length of the isomorphism The fact that message 2 ends 2

letters after the last "tie-in" letter, Z, eorroborates this assumption It IS at least certain that

the isomorphism does not extend beyond 11 letters because the recurrence of R in Isomorph (5)

ISnot matched by the recurrence of R m Isomorph (2), nor by the recurrence of T in Isomorph (3)

Hence It may be assumed that the isomorplne sequence ISprobably 10 letters in length, possibly

11 But to be on safe ground It ISbest to proceed on the 10-letter basis

e Applymg the pnnciples of mdirect symmetry to the superimposed Isomorphs, partial

chams of equivalents may be constructed and It happens in this case that practically the entire

pnmary component may be established Let the student confirm the fact that the following

sequence may be denved from the data given

11/ I I /I /I /I /I I 11/ I

I-- - - - - - - - - - - - - - - 1-

/I I I I I /I I /I 1/1/ /II /I 11/

I I I /I I I I /I I 11/ I I

f--

/I /I I /I I 1/1/1 I /I I

I I I 1/1/ I /I I I

'-

/I /I I /I

I /I I I I I I I /I

1-

/I I

l- II /I /I /I I I I /II - - - - - - - - - - - - - - - - - - - II- - - - - 11/ 11/ I I /I - - - - - - - - - - - --- - - - - - - - - - - - - - I /I I I I I I I /1 fH.I

I 1/1/ I 1/1/ I I I

III

I II II I I I I

II 1111 II/I II

I I 1/ I I I III I III II I I II III

I II 11I1 III I I I /I I I

I-- - - - - - - - - - - - - - - -

t:III I I /1 II 11/ I I /I I

I 1/ 11/ I 11/ I I I I 111/ II 11/ II

II I I I I 1/ I /I 1/

1- - I II 1/ II I I II I I

I 11/1 1/ I I I II I II III 1/ II I-- - - - - - - - - - - - - - 1-

III I I I II I I I I

I /il I I II III I II I

II II I I

I I I I II II I II I I

II I

II III II 11/ I III /11 I I I II I

I I - - - - - - - - II I I II II - - - - - - - --- - - - - - - - - - - - - - I I fH.I 1/ 11/ I I I III I II I - - - - - - /I I I I I I 11/ I II I - - - - - - - - - - - - - - - - - - - - - - III I II 11/ II I II

SECOND LETTER

ABC 0 E F G H I J K L M N 0 P Q R STU V W X Y Z

A A

B B

C C

o 0

E E

F F

G G

H H

I I

J J

K K

L L

M M

..::l N 8 N

0 0

P P

Q Q

R R

S S

T T

U U

V V

W W

X X

Y Y

Z Z

ABC 0 E F G H I J K L M N 0 P Q R STU V W X Y Z

First, It IS necessary to delimit the length of the isomorphv Isomorph (2) shows that the 1"'0-

morplnsm begms With the doubled letters For there 1'3 an E before the V Vill that ease and also

an E witlun the I'lOmOIph, If the phenomenon included the E, then the letter immediately before

the D D in the case of Isomorph (1) would have to be an N, to match Its homolog, E, In Isomorph

(2), which It IS not Corroboratmg data are grven by Isomorphs (3), (4), and (5) m this respect

Hence, we may take It as estabhshed that the isomorphism begins With the doubled letters

d However, before beconung discouraged too quickly, a search IS made throughout the

text to see If any Isomorphs are present Fortunately there appear to be several of them

Note the followmg

Message L jg~

(3)

Message 2 (4)

Message 3 (5)
42

It 18 obvious that an mtroductory key of more than one letter was used, since the first few letters

YIeld unmtelhgible text, but It also appears that the last cipher letter of the mtroductory key

was used as the mtroductory key letter for eneiphenng the subsequent auto-keyed portion of

the text (see par 23c(3» However, assummg that the lYE before the word FIRE 18 the ending

of the first word of the plain text, and that this word IS INTENSIVE, the mtroductory key word

ISfound to be WICKER Thus

Key W I C K E RI T R X DIM LEX R K V D B D D Q G S •

Plam__________ I N TEN S I V E FIR E 0 F L I G H TAR TIL •

Cipher U S Y P W T R X DIM LEX R K V D B D D Q G S U •

The begmrungs of the other two messages are recoverable m the same way and are found to be

as follows

Key PRO MIS EI R X L G H 0 U Z 0

Plam_________________ R E QUE S T V I G 0 R 0 U S

Cipher B I I B F G R X L G H 0 U Z 0

Key C H A R G E DI R R V M M H C V B

Plam_________________ SEC 0 N DBA T TAL ION • Cipher HAL 0 Z J R R V M M H C V B

9 The example solved m the foregomg subparagraphs offers an Important lesson to the

student, insofar as It teaches him that he should not '/,mmedw,tely jeel dtscouraged when confronted

wtth a problem presenttng only a small quanttty oj text and therefore aJlordtng what seems at first

glance to bean tnsujfic1,ent quanttty oj datajor solutwn For in this example, wlule It 18 true that

there are msufflcient data for analysie by Simple pnncrples of frequency, It turned out that

solution was achieved wtthout any recourse to the prtnctples oj freg:uency oj occurrence Here,

then, 18 one of those mterestmg cases of substrtutaon ciphers of rather complex construction

which are solvable Without any study whatsoever of frequency distnbutrons Indeed, It WJ.11

be found to be true that m more than a few instances the solution of quite complicated cipher

systems may be accomplished not by the apphcation of the pnneiples of frequency, but by

recourse to mductrve and deductive reasomng based upon other considerataons, even though

the latter may often appear to be vpry tenuous and to rest upon quite fhmsy supports

29 SpecIal case of solution of Cipher-text auto-keyed cryptograms -a Two messages With

idenucal plam texts enciphered accordmg to the method of paragraph 23 c (3) by mitral key

words of different lengths and composinons can be solved very rapidly by reconstructmg the

pnmary components The cryptographtc texts oj such messages wtll be'/,somorphw after the '/,ntttal

key-word pottums Note the two followmg supenmposed messages, In which isomorphism between the two cryptograms IS obVIOUS after their 6th letters

I I I I I ....-.... I

1 T S B J S K B N L 0 C FHA Z LWJAM BNFNS MVJRE

2 BKKMJ X Y C X B H R P V 0 XMUVI Y C ReG I K U T D

I I I I I '-' I • ....-.... ..- 1 HFPRX C P C R R EHFMU HRAXC NFDUB ATFQR

2 PRETN HEHTT D P R I W PTVNH CRSWY VJRFT

'-' .......,

43

StartIng WIth any pall' of superimposed letters (begmmng WIth the 7th pair), chams of equivalents are constructed

1 sa, & 8 7 8 9 W n " u u

1_________________ Z 0 B Y

2_________________ L X N C H P E D S G

3_________________ Q F R T J U WM I

4_________________ A V K

By Interpolation, these partial sequences may be united into the key-word sequence

HYDRAULICBEFGJKMNOPQSTVWXZ

b The mitaal key words and the plain texts may now be ascertamed quite easily by

deciphenng the messages, using tlus pnmary component slid agamst rtself It will be found that

the mraal key word for the 1st message IS PENCE, that for the 2d 18 LATERAL The reason that

the cryptograpluc texts are isomorphic beyond the mrtial key word portions IS, of course, that

since the text beyond the key word ISenciphered auto-key fashion by the preceding CIpherletter

the letters before the last letter of the key have no effect upon the encrphennent at all Hence

two messages of Identical text cannot be other than isomorphic after the mrtial key-word portions

c The foregomg solunon affords a clue to the solution of cases m which the texts of two

or more messages are not completely Identical but are m part Identical because they happen to

have sunilar begmmngs or endings, or contam nearly similar mformation or mstructions The

progress m such cases 18 not so rapid as m the case of messages WIthwholly idenncal texts because

much care must be exercised in blocking out the isomorphic sequences upon which the reconstructIon of the pnmary components will be based

d (1) In the foregoing cases, the pnmary components used to encipher the illustrative

messages were identrcsl mixed sequences If nomdenncal components are employed, the

cryptograms present an mterestmg case for the apphcation of a principle pomted out m a

preceding text t

(2) Suppose that the three messages of paragraph 27b had been enciphered by using a

plam component different from the mixed component The enoipherments of the word

ARTILLERY would still YIeld isomorphic sequences, from which, as has been noted, the reconstrucnon of the Cipher component can be accomplished

(3) Having reconstructed the Cipher component (or an equivalent) the latter may be

applied to the Cipher text and a "deCipherment" obtained In this process any sequence of 26

letters may be used as the plain component and even the normal sequence A Z may be

employed for tms purpose The word decipherment in the next to the last sentence 18 enclosed

by quotanon marks because the letters thus obtained would not YIeld plain text, smce the real

or an equivalent plain component has not yet been found Such "deciphered" text may be

termed sPUrtOUS plain text But the '/,mportant th'/,ng to notess that th'/,s text'/,8 now monoalphabet'/,c

and may be 80lved by the Stmple procedure usually employed '/,n solmng a monoalphabetw ctpher

produced by a mngle m'LXed alphabet Thus, a polyalphabeno Cipher may be converted to monoalphabene terms and the problem much simphfied In other words, here 18 another example

of the srtuations m wluch the principle of conversion mto monoalphabenc terms may be applied

WIth grat1f~ success It 18 also an example of the dictum that the use of two drlferently

mixed pnmary components does not really give much more secunty than does a mixed component

shdmg agamst Itself or &gamst the normal sequence

, MiluM1/ Cr1/ptaool1/A', PartII, par 4fifl
44

e (1) If the auto-key method shown In paragraph 23c (2) had been employed In enciphenng

the two Identical texts above, the solution would, of course, have been a bit more difficult To

illustrate such a case, let the two texts be enciphered by key words of the same lengths but

different composmons PENCE and LATER Thus

No 1

Key________ PEN C E T S B J S MMNRU L P U I H J B T X F INN R M

Plam_______ R E QUE S TIN F o R MAT ION 0 F SIT U A T ION I

Cipher_____ T S B J S MMNRU L P U I H J B T X F INN R M D W I Q V

Key________ D W I Q V P C K A 0 D PAZ 0 B C M R I A F N W 0 G L I H T

Plain_______ N F I F T EENTH I N FAN TRY S E C TOR A TON C E

Cipher_____ P C K A 0 D PAZ 0 B C M R I A F N W 0 G L I H T I WW C U

No 2

Key________ L ATE R BKKMJ R BTU X S G E B Q YRHHA T E T U C

Plam_______ REQUE S TIN F o R MAT ION 0 F SIT U A T ION I

Cipher_____ B K K M J R BTU X S G E B Q YRHHA T E T U C N 0 G T M

Key________ N 0 G T M L D Q L E N G BYE W D S U H PUT Z E HHGDK

Plain_______ N F I F T EENTH I N FAN TRYSE C TOR A TON C E

CIpher_____ L D Q L E N G BYE W D S U H PUT Z E HHGDK T 0 D E X

(2) Now let the two cryptograms be superimposed and Isomorphisms be sought Tbeyare

shown underhned below

1_____________ T S B J S MMNRU L P U I H J B T X F INN R M D W I Q V 2_____________ BKKMJ R B TUX S g E B Q YRHHA T E T U C NQgTM

1_____________ P C K A 0 D PAZ 0 B C M R I A F N W 0 G L I H T I W W C U 2_____________ L~QLJ1:i NgBY~ W~SYH PUIZ~ HHgDK TQDEX

It will be noted that the mtervals between Isomorphic supenmposed pairs show a constant

factor of 5, indicating a 5-letter mtial key word

(3) A reeonstrucnon diagram for the pairs beyond the first five letters IS estabhshed, based

upon this interval of 5, and IS as follows

ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

P W N H T Y D S R L I 0 F G - - - - - - - - - I-- - - - - - - - - I-- - - - - lX R D U H B E G W 0 P - - - - - - - - - - - - - - - - - - - - - - - - - IB K I N 0 G Q S T W X C H E D R - - - - - - - - - - - - - - - - - - - - - - - - - JL F E A D B N C P S T U W Z H Y - - - - - - - - - - - - - - - - - - - - - - - - - IW D T A U Q H I C B E F G K X M N 0

The equivalent sequence AWN B D T K I H Q G U X 0 E R V M C Y S J L Z P F IS

estabhshed by indirect symmetry, from this, by decimanon on the eleventh Interval, the

HYDRAULIC XZ component IS recovered

(4) It will be noted that the foregoing case, 10 which the mrnal key words for the two cryptograms are of the same length, IS only a special apphcataon of the method set forth m paragraph

44 of Mihtary Cryptanalysis, Part II But If the key words were of different lengths, the method

set forth in pard-graph 45 of the text referred to would be applicable No example IS deemed

necessary, since no new pnnciples are involved

SECTION VIII

SOLUTION OF PLAIN-TEXT AUTO-KEY SYSTEMS

PlII'8gI'8ph Prehmmary remarks on plain-text auto-keymg.i, _ ---______ 30

Solution of plain-text auto-keyed cryptograms when the mtroductory key IS a single letter, _ _ 31

Example of solution by the probable-word method __ _ -_ 32

Concluding remarks on the solunon of auto-key systems --- --______ 33

30 Prehmmary rema.rks on plam-text auto-keymg -a Ifthe cipher alphabets are unknown

sequences, plam-text auto-keymg gives me to cryptograms of more mtnoate character than

does CIpher-text auto-keying, as has already been stated As a cryptographic pnnciple It IS

very commonly encountered as a new and remarkable "invention" of tyros m the cryptographic

art It appa.rently gives me to the type of reasonmg to which attention has been directed

once before and which was then shown to be a popular delusion of the ummnated The novice

to whom the auto-key principle comes as a bnlhant flash of the imagmanon sees only the apparent

impossibihty of penetrating a secret which enfolds another secret II1s reasonmg runs about

88 follows "In order to read the cryptogram, the would-be solver must, of course, first know

the key, but the key does not become known to the would-be solver until he has read the cryptogram and has thus found the plain text SInce tlns IS reasonmg around a Circle, the system IS

mdecipherable " How unwarranted such reasonmg really IS m tlns case, and how readily the

problem IS solved, will be demonstrated m the next few paragraphs

b A eonsideranon of the mechamcs of the plain-text auto-key method discloses that a

repetition of n letters m the plain text will produce a repetition of (n-k) letters in the Cipher

text, where n represents the length of the repetition and k the length of the mtroductory key

Therefore, when the mtroductory key CODSlSts of a smgle letter there will be as many repetitions

in the Cipher text as there are in the plain text, except for true digrsplno repennons, which of

course disappear But on the other hand some "accidental" digraphic repetitions are to be

faIrly expected, since It can happen that two dIfferent plam-text pairs, enciphered by different

key letters, will produce Identical Cipher eqtuvalents Such accidental repetmons will happen

less frequently, of course, m the case of longer polygraphs, so that when repennons of 4 or more

letters are found in the Cipher text they may be taken to be true or causal repetations It IS

obVIOUS that m studying repetitions in a cryptogram of thia type, when the mtroductory key

IS a single letter, a 5-letter repetition m the Cipher text, for example, represents a 6-letter word,

or sequence repeated m the plam text When the mtroductory key IS k letters in length then

an n-letter repetition represents an (n+k)-letter repetition in the plam text

c The diSCUSSIon will, as usual, be divided into two pnneipal cases (1) when the Cipher

alphabets are known and (2) when they are unknown Under each case there may be an mtroductory key consistmg of a smgle letter, a word, or a short phrase The SIngle-letter imtaal

key will be treated first

31. SolutIon of plam-text auto-keyed oryptograms when the mtroductory key IS a smgle

letter -a Note the following plam-text auto-keyed enoipherment of such commonly encountered

plam-text words as COMMANDING. BATTALION. and DIVISION. usmg two identical pnmary

components, m this case direct standard alphabets

1311922-39---6 (45)
47

b (1) There are many repetitions, their mtervals show no common factor, and a umhteral

frequency distnbunon does not appear to be mono alphabetic Plam-text auto-keying IS SUBpected The Simplest assumption to make at the start IS that smgle-Ietter mtrodurtory keys

are bemg used, With the normal VIgen~re method of encipherment, and that the plam component

IS the normal sequence Attempts to solve any of the messages on the assumption that the

Cipher component 18 also the normal sequence bemg unsuccessful, It 18 next assumed that the

Cipher component IS a mixed sequence The 13-letter repetition J D R U W N G R Y S

K BLand the IO-Ietter repetition P D G 0 V V V K W U are studied intensively If a

VVVKW

NNE Z V

Q V U X N

RBHAK

FNRAK

RFKBV

J W V P K

C D Z C Y

X K C Q F

B H M V J

FFYUE

K C I F G

FVHAV

Y C P Z H

SUB R J

R F J P D

K C M P D

E Q 0 Y

I B F E J

Q H H F 0

RHWUN

N P P K P

V P D G 0

U A K V D

Y S K B L

L L P R V

G P S V S

XTWFM

B L

KQMVB

DNCUJ

o E Q Z V

A POE P

E Q Z B U

C F N R A

A P U F Z

VRQIJ

I V Z 0 Z

RZVQR

UWNGR

P P K G S

X A P Q Y

D K C W V

GRYSK

I V Z 0 Z

WFMRF

N D B D D

DRHWU

ALUPZ

RHVGP

Y Q C Y H

PEA M P

D S W J A

RPZVX

G J W Z H

T B S K C

MESSAGE II

MESSAGE III

o C Q J J

RZVXT

KWUHE

ENDBD

o C Q J J

UQHUM

A Y J D R

S V K Z P

Y U E Z Q

U V C C P

DRUWN

FKDEN

RHWUM

F Z P Q P

V C C E J

W K C V G

QYGPA

P D K C 0

KMYHS

THOFH

J U F I I

S P K T S

G 0 V V V

G 0 V Z S

H U F I I

UEWHU

G J P G H

PHD P R

WUAVW

C I F G Z

R 0 Q 0 J

F J UHF

EUBDD

RHUJU

T V H N S

UNMHH

ZQXAP

Z U V C C

XMHFF

UHCBM

d If reversed standard Cipher alphabets are used, the word BATTALION

WIll be enciphered by the sequence______________________________ BHATPDUB,

which also presents idiomorphic charaetenstace leading to the easy recogmtion of the word

e All the foregomg phenomena are based upon standard alphabets, but when mixed Cipher

components are used and these have been reconstructed, snmlar observations may be recorded

and the results employed m the solution of addrnonal messages enciphered by the same components

32 Example of solution by the probable-word method.--a The solutaon of messages

enciphered by unknown mixed components will now be discussed by example When the pnmary components are unknown, the observanons noted under the preceding subparagraphs are,

of course, not appheable , nevertheless solution ISnot difficult Given the following three eryptograms, all mtercepted on the same day, and therefore suspected of bemg related

MESSAGE I

46

j

Key text___________ BAT TAL ION Key text___________ D I V I S I 0 Nj

(1) Plam text BAT TAL ION Plain text D I V I S ION (2)

Clpher______________ B T M T L T W B Clpher______________ L D D A A W B

j

K ey text___________ COM MAN DIN G Key text___________ CAP T A I N

(3) Plain text__________ COM MAN DIN G Plam text__________ CAP T A I N

Clpher • Q A Y M N Q L V T CIpher______________ C PIT I V

These charactenetacs may be noted 1

(1) The cipher equivalent of Ap IS the plain-text letter which immediately precedes Ap

(See the two A's in BATTALION, m example 1 above)

(2) A plain-text sequence of the general formula ABA yields a doublet as the cipher equrvalent

of the final two letters (See IVI or lSI in DIVISION, example 2 above)

(3) Every plain-text tngraph havmg Ap as Its central letter Yields a cipher eqwvalent the

last two letters of which are idenncal With the mmal and final letters of the plam-text tngraph

(See MAN in COMMANDING, example 3 above)

(4) Every plam-text tetragraph havmg Ap as the nntaal and the final letter Yields a Cipher

equivalent the second and fourth letters of which are identical With the second and third letters

of the plam-text tetragraph, respectIvely (See APTA in CAPTAIN, example 4 above, also ATTA

in BATTALION, example 1 )

b (1) From the foregomg charaetensnca and the fact that a repetition of a sequence of n

plam-text letters will Yield, m the case of a I-letter mtroductory key, a repetmon of a sequence

of n-l Cipher letters, It 18 obVIOUS that the SImplest method of solvmg thIs type of CIpher IS

that of the probable word Indeed, If the system were used for regular traffic It would not be

long before the solution would COIlSlSt merely in refernng to hats of CIpher eqwvalents of commonly used words (as found from previous messages) and searchmg through the messages for

these Cipher eqwvalents

(2) Note how easily the followmg message can be solved

BECJI BTMTL TWBPQ AYMNQ HVNET WAALC

I "'-'''-'"' I

Seemg the sequence BTMTLTWB, which 18 on the hat of equrvalents in a above (see example 1),

tho word BATTALION IS inserted in proper position Thus

BECJI BTMTL TWBPQ

B ATTAL ION

With tlns as a start, the decipherment may proceed forward or backward With ease Thus

BECJI BTMTL TWBPQ AYMNQ HVNET WAALC

EACHB ATTAL IONCO MMAND ERWIL LPLAC

e The foregomg example 18 based upon the so-called VIgen&e method of eneipherment

(9J.:12=91/h 9p/l=9012) If m encipherment the plain-text letter 18 sought in the Cipher component, Its eqwvalent taken m the plsm component (9J.:12=9 1/h 9p/2=ge/l), the steps in solution

are identical, except that the list of Cipher equivalents of probable words must be modified

accordmgly For instance, BATTALION WIll now be enciphered by the sequence ZTAHLXGZ

1 The student IS cautioned that the charactenstIcs noted apply only to the case where two rdentieal com- ponents are used, WIth the base letter A
48

smgle-Ietter mtroduotory key 18 bemg used, then these repetitions mvolve 14-letter and ll-letter

plsm-text sequences or words, If the normal VIgenm-e method of encipherment 18 m effect

(911:12=9'ih 9 pl1=9012), then the base letter 18 A If the latter 18 true then a good word wluch

would fit the 13-letter repention 18

Key R E CON N A ISS A NeE

PI81n text R E CON N A I S~ A NeE •

CIpher_______________ J D R U \Vl.! G R K B L

and a good word which would fit the IO-Ietter repetrtion 18

Key 0 B S E R V A T ION

Plmn text...__________ 0 B S E Rl!.A T ION •

CIpher_________________ P D G 0 -Vl! V K W U •

(2) Insertmg, m a mixed component, the values given by these two essumpnons Yields

thefollowmg

Plmn ABC D E F G H I J K L II N 0 P Q R STU V W X y Z

CIpher {: S TIN G B C K LOp V W Y

(3) It 18 a SImple matter to combme these two partIal cipher components mto a single

sequence, and the two components are as follows

Plmn___________ ABC D E F G H I J K L II N 0 P Q R STU V WX y Z

CIpher REA D JUS TIN G B C F H K L II 0 P Q V W X y Z

(4) With the pnmary components at hand, solunon of the messages 18 now an easy matter

c The foregomg example uses an unknown mixed CIpher component shdmg &g&lDSt what

was first assumed (and later proved) to be thenormal drrectsequence Whenbothpnmarycomponents are unknown mixed sequences but are idenneal, solutaon 18 more drlficult, naturally,

because the results of assummg values for repeated sequences cannot be proved. and estabhshed

so quickly as m the foregomg example Nevertheless, the general method indicated, and the

appheataon of the principles of indirect symmetry will lead to solution, If there 18 a faar amount

of text evaileble for study When an mtroductory key of several letters 18 used, repetitions

are much reduced and the problem becomes snll more difficult but by no means insurmountable

Space forbids a detailed treatment of the method of solvmg these oases but It 18 beheved that

the student 18 m a position to develop these methods and to expenment With them at his leisure

33. Concludmg remarks on the solution of auto-key systems -a The type of solution

elucidated m the preceding paragraph 18 based upon the successful epphcanon of the probableword method But sometnnes the latter method faJ1s because the commonly expected words

may not be present after all Hence, other pnneiples and methods may be useful Some of

these methods, useful in special cases, are almost mechemeal m theIr nature ExtenSIOn of the

baSIC pnnciples mvolved may lead to rather far-reachmg eomplentIes However, because these

methods are applicable only to somewhat special srtuanons, and because they are somewhat

mvolved they will be omitted from the text proper and placed m Appendix I The student

who 18 especially mterested m these cases may consult that appendix at his leisure

b. It 18 thought that suffiCIent attention hes been devoted to the solution of both Cipher-text

and plain-text auto-key systems to have demonstrated to the student that these cryptographic

methods have senous weaknesses which exclude them from practaeal usage m military cryptography Besides being comparatIvely slow and subject to error, they are rather easJ1y solvable,

even when unknown CIpher alphabets are employed

c In both systems there are charaetenstics which permit of IdentIfymg a cryptogram as

belonging to tlus class of substrtutaon Both cases wJ11 show repetrtions in the Cipher text In

Cipher-text auto-ke~ there willbe far fewer repetitIOns than m the ongmal plam text, especially

when mtroductory keys of more than t-letter m length are employed In plam-text auto-keymg

there will be nearly as many repetitions 10 the Cipher text as m the ongmal plain text unless

long mtroductory keys are used In either system the repeutions Will show no constancy as

regards mterval& them, 8II1d a umhteral frequency distnbutaon will show such messages

to be polyalphabetlc in nature Cipher-text auto-keymg may be distmguished from plum-text

auto-keymg by the appearance of the frequency distnbunon of the second member of sets of

two letters separated by the length of the mtroductory key (see par 25h) In the case of ciphertext auto-keymg these frequency distnbutions will be monoalphabetie m nature, m plain-text

auto-keYIDg such frequency dlstnbutlons wJ11 not show monoalphebenc charactenstaoa
SEOTJON IX

METHODS OF LENGTHENING OR EXTENDING THE KEY

51

transposnaon method of lengthemng the keymg sequence and at the same tune mtroduomg an

irregulanty, such as aperiodic mterruptlon has already been descnbed (see par 18)

c Another method of developmg a long key from 8 short mnemonic one ISthatshown below.

Given the keyword CHRISTMAS, a numerical sequence IS first denved and then one wntes down

successrve sections of tIns numencal key, these sections termmatmg With the successive numbers 1, 2, 3, of the numencal key Thus

Mnemonic key__.__._ C H R 1ST MAS

Numencal key 2-3-6-4-7-9-5-1-8

Extended key C H R I S T Mil IC IC H R IC H R 1ST : IC H I

C H R I ~Ic H R 1ST MA ~Ic H R I sil

Thus the original key of only 9lettelsIS expanded to one of 45 letters (1+2+3 + +9=45)

The lODger key 18 also an mterrupted key of the type noted under paragraph 17, but If the message 18 long enough to require several repeunons of the expanded key the encipherment becomes

penodic and can. be handled by the usual methods employed In solving repeatmg-key Ciphers

If the basic key IS f8.U'ly long, so that the expanded key becomes a quite lengthy sequence, then

the message or messages may be handled in the manner cxplamed In paragraph 20

d Another method of producing a rather long sequence of digrte for keymg purposes from a

smgle key number 18 to select a number whose reciprocal when converted by actual drvision Into

Its eqUlvalent decimal Yields a long series of digits For example the reciprocal of 49, or 1/49,

YIelds a sequence of 42 digite begmnmg 02040815 Such a number, coupled With a

key word hke CHRISTMAS, could be used for interrupted kevmg, the successive CIpher alphabets

bemg used for eneaphenng as many letters as are indicated by the successive digits In the case

of the example Cited, the first dIgit IS 0, hence the C alphabet would not be used The next

dJglt 18 2, the H alphabet would be used for enciphenng the first and second letters The thIrd

dlglt 18 &gam0, the R alphabet would not be used The fourth digrt IS 4~ the I alphabet would

be used for eneiphenng the third, fourth, fifth, and sJ.Xth letters, and so on

36. Other systems employmg lengthy keymg sequences -a The 8o-caUed "run'1l//'ng.Jcey"

81/stem -To be mentIoned in connection With tins subject of extensive or lengthy keys IS the

CIphersystem known as the runmng-key, contmuous-key, or nonrepeatmg-key system, In wluch

the key consists of a sequence of elements which never repeats no matter how long the message

to be enciphered happens to be The most common and most practical source of such a key 18

that In whieh the plain text of a previously agreed-upon book serves as the source for suecessive

key letters for encrpherment I The solution of this type of CIpher, an accomphshment which was

once thought impossible, presents some mterestmg phases and will be considered shortly At thlS

pomt It IS merely desired to indicate that according to the runmng-key system the key for an

mdmdual message mo.y be as long as the message and never repeat, but If a large group of

correspondents employ the same key sequence, It may happen that there will be several messages

In the same key and they will all begin With the same mitral key letter or, there will be several

which will "overlap" one another with respect to the key, that ie, they begin at drlferent untral

points m the keying sequence but one message soon overtakes the other, so that from that pomt

forward all subsequent letters In both messages are enciphered by the same sequence of key

letters

I Sec IX, Adllanced Mddary Cryptography Bee also footnote 8, page 71 of tlus text.

PrebDlInary remarks • •__•__• • ._.__• • •__._•• _

Extended and nonrepeatmg keys, the so-eslled "runmng-key system" _ _ - -••--------------

Other systems emp10ymg lengthy keying sequences_. • •••• • ~~ :::::::::::::::::::::::::::::.::::::::::

Parag!aph

34

35

36

34 Prehmmary remarks -In paragraph Ih of thIS text It was stated that two procedures

suggest themselves for ehmmatmg the weaknesses Introduced by penodlClty of the type produced by simple, repeatmg-key methods The first of these, when studied, embraced some of

the very SImplemethods of suppressing or destroYIng penodierty, by such devices as mterruptmg

the key and usmg vanable-Iength groupings of plain text It was demonstrated that subterfuges of thIs SImple nature are Inadequate to ehmmate the weaknesses referred to, and must be

drscarded in any system Intended to afford real secunty The other alternatIve suggested In

paragraph lb therefore remains now to be mvesngated, VIZ, that of lengthenmg the keys to a

pomt where there would seem to be an InsuffiCIent amount of text to enable the cryptanalyst to

solve the traffic Attempts toward this end usually consist m extendIng the key to such a length

that the enemy cryptanalysts will have only a very hmited number of penods to work WIth

The key may, mdeed, be lengthened to a pomt where It becomes as long as, or longer than, the

text to be enCiphered, so that the key ISused only once

35 Extended and nonrepeatmg keys -a It IS ObVIOUS that one of the SImplest methods of

lengthemng the key to a message IS to use a long phrase or even a complete sentence, provided

It IS not too long to remember In addrtion to the d1fficultIes that would be encountered In

practical military cryptography m selectIng long mnemonic phrases and sentences wluch would

have to be Imparted to many clerks, there IS the fact that the probable-word method of solution

stIll remams as a powerful tool m the hands of enemy cryptanalysts And If only a word or

two of the key can be reconstructed as a result of a fortunate assumpnon, It IS obVIOUS that the

enemy cryptanalysts could readIly guess the entira key from a fragment thereof, SInce any long

phrase or sentence which IS selected because It can easl1y be remembered IS lIkely to be well

known to many people

b There are, however, more or less simple methods of employmg a short mnemomc key In

order to produce a much longer key BasIcally, any method of transposrtion applied to a smgle

alphabetiC sequence repeated several tImes will YIeld a faIrly long key, which, moreover, has the

advantage of bemg umntelligIble and thus approachIng a random selection of letters For

example, a numerical key may bedroned from a word or a short phrase, this numencal key may

then be apphed as a columnar-transpOSltIOn key for a rectangle withm wluch the normal alphabet

has been repeated a preVIously agreed upon number of tImes m a. normal (left to nght) or prearranged manner The letters when transcnbed from the transposrtron rectangle then become

the succesSIve letters for enciphermg the plam text, USIng any desired type of pnmary components Or, If a smgle transpoSItIon IS not thought to be suffiCIently secure, a. double transpositron will YIeld a still more mixed up sequence of key letters Other types of transposmon

may be employed for the purpose, meludmg vanous kinds of geometnc figures Also, a non-

(50)
52

b The 80-Ca&d progr688'tve-alphabet ByBletn -In the so-called progressrve-elphabet system

the baSIC pnnciple IS quite sunple Two or more primary elements are arranged or provided

for according to a key which may be vaned from tune to tune, the mteractIon of the pnmary

elements results in makIng avaalable for cryptographIc purposes a set of cipher alphabets, all

the latter are employed in a fixed sequence or progression, hence the designataon progresares,

alphabet system If the number of alphabets avaIlable for such use IS rather small, and If the

text to be enciphered IS much longer than the sequence of alphabets, then the system reduces

to a penodic method But If the number of alphabets IS large, so that the sequence IS not

repeated, then of course, the cryptographic text will exlnbit no penodic phenomena

c The senes of CIpher alphabets in such a system constItutes a keymg sequence Once set

up, often the only remammg element m the key for a speeific message ISthe startmg pomt m the

sequence, that IS, the mmal CIpher alphabet employed m enciphering a given message If this

keymg sequence must be employed by a large group of correspondents, and If all messages

employ the same startmg point m the keymg sequence, obviously the cryptograms may SImply

be supenmposed WIthout any prehmmary testIng to aseertam proper pomts for supenmposraon

The student has already been shown how cases of tlns sort may be solved However, If messages

are enciphered WIth varymg startmg points, the matter of supenmposmg them properly takes

on a dIfterent aspect This WIll soon be treated m detail

d The respectIve CIpher alphabets eonstrtutmg the entIre complement of alphabets may

be employed in a SImple progression, that IS, consecutIvely from a preselected mmal pomt or

they may be employed aceordmg to other types of progression For example, If the systen:

comprises 100 alphabets one might use them in the sequence 1 3 5 7 or 1 4 7 10

or Irregular types of skipping may be employed ' , , , " '" ,

e In addmon to the foregoing, there are, of course, a great many mechamcel methods of

producing a long key, such as those employed m mechanical or electncal CIpher maclunes In

most cases these methods depend upon the mterecnon of two or more short, pnmary keys which

Jomtly produce a smgle, much longer, secondary or resultant key (See par 4) Only bnef

reference can be made at tlns pomt m the cryptanalytIc studies to cases of this kind A detailed

treatment of complex examples would require much tune and space so that It will be reserved

for subsequent texts

J FInally, there must be mentIoned certain devices m WhICh, as in encipherment by the

auto-key method, the text Itself serves to produce the vanataon in CIpher equivalents, by controlling the seleenon of secondary alphabets, or by influencing or detemumng the sequence WIth

which they will be employed Naturally, in such cases the key IS automancally extended to a

pomt where It comcides m length WIth that of the text .An excellent example of such a device

IS that known as the Wheatstone, the solution of which WIll be descnbed m Its proper place '

Some wnters clasSIfy and treat thIS method as well as auto-key methods as forms of the runningkey system but the present author prefers to consider the latter as bemg radically dIfferent in

pnnciple from the former types, because in the true runnmg-key system the key IS wholly external

to and mdependent of text bemg enciphered ThIs IS hardly true of auto-key systems or of

systems such as the Wheatstone mentIoned herem

I See Seo XII, Ad"ancea MUNaTf/ Cr,lptogra,h1l

SECTION X

GENERAL PRINCIPLES UNDERLYING SOLUTION OF SYSTEMS EMPLOYING LONG

OR CONTINUOUS KEYS

Paragraph Solution when the prImary components are known sequences •• 37

Solution of a runnmg-key cipher when an unknown but mtelhgible key sequence IS used and the primary components are know n______________________________________________ _________________ 38

Solution of a progreesrve-alphabet cipher when the primary components are known_______ 39

General solution for CIphers mvolvmg a long keymg sequenoe of fixed length and composraon, 40

37 SolutIon when the pnmary components are known sequences --a As usual, the solution

of cases mvolvmg long or continuous keys will be treated under two headings FIrst, when the

pnmary components are known sequences, second, when these elements are wholly unknown

or partially unknown

b Smce the essential purpose in USIng long keys IS to prevent the formatIon of repennve

cycles within the text, It IS ObVIOUS that m the case of very long keymg sequences the cryptanalyst IS not gomg to be able to take the text and break It up mto a number of small cycles

which WIll penmt the estabhshment of monoalphabetrc frequency distnbunons that can readily

be solved, an end which he can attain all the more readily If to begm WIth he knows the pnmary

sequences But, there nearly always remains the cryptanalyst's last resort the probable-word

method Inasmuch as this method IS applicable to most of these cases, even to that of the

runnmg-key system, which perhaps represents the furthest extension of the pnneiple of long

keymg sequences, an example USIng a cryptogram of the latter type will be studied

38 SolutIon of a runmng-key mpher when an unknown but mtelligIble key sequence

IS used and the pnmary components are known -a In paragraph 36a mention was made of

the so-called runmng-key, contInuous-key, or nonrepeatIng-key system, m wluch the plam text

of a previously agreed-upon book serves as the source for successrve key letters for eneipherment

Smoe the runnmg-key system IS entirely apenodic, and the CIpher text can therefore not be

arranged In supenmposed short cycles, as in the case of the repeatIng-key system, It would

appear on first consideration to be "mdecipherable" WIthout the key 1 But If the student

WIll bear In mind that one of the pracncal methods of solvmg a repeatIng-key CIpher 18 that of

the probable word, 2 he nll immediately see that the latter method can also be applied m

solving tlns type of nonrepeatmg-key system The essence of the matter IS thIs The

cryptanalyst may assume the presence of a probable word in the text of the message, If he

knows the pnmary components mvolved, and If the assumed word actually eXISts m the message,

he ean locate It by checking agamst the key, 8'tnc~ the latter u tnlelltgtble text Or, he may

assume the presence of a probable word or even of a phrase such as "to the," "of the," etc,

m the key text and check hIs assumptIon agaInst the text of the message Once he has forced

I At one tIme, mdeed, thIs VIew was current among certam cryptographers, who thought that the pnncIple

of factonng the mtervals between repetItIons m the ease of the repeatmg-key CIpher formed the baslB for the

only pOSSIble method of solvmg the latter type of system Smea, aooordmg to thIs erroneous Idea, factonng

cannot be applIed In the case of the runmng-key system (USlDg a book as the key), therefore solutIon was conSIdered to be ImpOSSIble How far tws Idea IS from the truth WIll presently be seen In tlus same connectIon

see also footnote 8, page 71

I See MdstaTfl CryptanalytnB, Part II, par 25

(S3)
54

such an entenng wedge into either the message or the key, he may build upon this foundation

by extending Ius asaumpnons for text alternately in the key and m the message, thus gradually reconstructmg both For example, grven a cryptogram contammg the sequence

HVGGLOWBESLTR , suppose he assumes the presence of the phrase THAT THE in the key text

and finds a place In the plam text where this YIelds MMUNITI Thus, usmg reversed standard

cipher alphabets

Assumed key texL_ __ _ T HAT THE

Cipher text_______________ H V G G LOW B E S L T R

Resultant plain text_________________ M M U NIT I

This suggests the word AMMUNITION The ON in the cipher text then YIelds PR as the beginnmg of the word after THE m the key text Thus

Assumed key text_________________ __ T HAT THE P R

Cipher te'CL__________________________ H V G G LOW B E S L T R

Resultant plain text_________________ M M U NIT ION

PR must be followed by a vowel, with 0 the most hkely canchdate He finds that 0 YIelds VI

m the plain text, which suggests the word WILL The latter then YIelds OTEC in the key,

makmg the latter read THAT THE PROTEC Thus

Assumed key text____________________ T HAT THE PRO T E C

Cipher text____________________________ H V G G LOW B E S L T R

Resultant plam text_________________ M M U NIT ION W ILL

Thia suggests the words PROTECTION, PROTECTIVE, PROTECTING, etc Thus extendmg one

text a few letters serves to "coerce" a few more letters out of the other, somewhat as in the case

of two boys who are running approxunately abreast in a race, 88 BOon as one boy gets a bit ahead

the spirit of competrnon causes the other to overtake and pass the first one, then the latter puts

forth a little more effort, overtakes and passes the second boy Thus the boys alternate m

overtaking and passmg each other until the race IS run The only pomt m wluch the smnle

faJ.1s 18 that while the boys usually run forward all the time, that lS, m a smgle direction, the

cryptanalyst lS free to work m two chrectIons-forward and backward from an mternal point

in the message He may, m the case of the example Cited above, continue hIS building-up

process by adding Ato the front of MMUNITI as well as ON to the rear If he reaches the end of

Ius resources on one end, there remams the other end for espenmentanon He lS certam1y

unlucky If both ends temunate m complete words both for the message and for the key, leavmg

rom Without a single clue to the next word in either, and forcmg him to a more mtensi ve use

of Ius imagination, guided only by the context

b In the foregoing illustranon the cryptanalyst lS assumed to have only one message

available for hIS expenmentanon But 1f he has two or more messages wluch either begin at

idenncal mmal points with reference to the key, or overlap one another Wlth respect to the key,

the reconstrucnon process descnbed above lS, of course, much eaaier and IS aecomphahed much

more quickly Forif the message8 have been correctly s'lJ/pmmposed vnth reference to the key tezl,

the add'l1wn of one or two letters to the key yulds 8'U{Jgest~ons for the aBB'Umptwn of words ~n 8everal

messages The latter lead to the addition of several letters to the key, and so on, m an everwidemng circle of Ideas for further assumpnona, since as the process eontmues the context

affords more and more of a basia for the work

55

c Of course, 1f sufficient of the key text lS reconstructed, the cryptanalyst might IdentIfy

the book that 18 beIng used for the key, and 1f available, hIS subsequent labors are very much

snnphfied

d All the foregomg IS, however, dependent not only upon the use of an mtelhgible text 8.S

the keymg text but also upon having a knowledge of the pnmary components or Cipher alphabets employed in the enoipherment Even 1f the pnmary components are chfferently mixed

sequences, 80 long as they are known sequences, the procedure lS quite obvious m view of

the foregomg explanation The trammg the student has already had lS beheved sufficient, to

indicate to him the procedure he may follow m that solutaon, and no further details will here be

given ill respect to such cases But what 1f the pnmary components are not known sequences?

ThIS contmgency will be treated presently

39. Solution of a progressive-alphabet Cipher when the Cipher alphabets are known-a

TakIng a very surpie case, suppose the mteractmg elements referred to m paragraph 36b consist

merely of two pnmary cipher components which slide agamst each other to produce a set of 26

secondary Cipher alphabets, and suppose that the simplest type of progression lS used, mz, the

Cipher alphabets are employed one after the other consecutIvely Begmnmg at an imnal

juxtapositaon, producing say, alphabet 1, the subsequent secondary alphabets are m the sequence

2, 3, 26, 1, 2, 3, , and so on If a different nutaal juxtaposrtaon ISused, say alphabet 10

lS the first one, the sequence lS exactly the same as before, only begmmng at a chfferent point

b Suppose the two pnmary components are based upon the keyword HYDRAULIC A

message 18 to be enciphered, begmnmg With alphabet 1 Thus

Plam component .H Y D R A U L I C B E F G J K M N 0 P Q S T V WX Z H Y D

Cipher component H Y D R A U L I C B E F G J K M N 0 P Q S T V WX Z

Letter No 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

Alphabet No 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

Plam text___________________ ENE M Y HAS P LAC E D H E A V YIN

Cipher text_________________ E 0 G P U U E Y H M K Q V M K Z S J Q H E

Letter No 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39

Alphabet No 22 23 24 25 26 1 2 3 4 5 6 7 8 9 10 11 12 13

Plam text___________________ T E R D I C T ION FIR E U P 0 N

Cipher text_________________ N L H H L C V B S S N J E P K D D 0

Letter No 40 41 42 43 44 45 46 47 48 49 50 51 52 53

Alphabet No 14 15 16 17 18 19 20 21 22 23 24 25 26 1

Plain text___________________ ZAN E S V ILL E R 0 A D

Cipher text_________________ G P UHF K H H Y L H M R D

e ThIS method reduces to a penodie system mvolvmg 26 secondary cipher alphabets and

the latter are used m Simple progression It IS obvious therefore that the 1st, 27th, 53d,

letters are in the 1st alphabet, the 2d, 28th, 54th, letters are m the 2d alphabet, and so on

d To solve such a cryptogram, knowing the two primary components, IS hardly a problem

at all The only element lacking 18 a knowledge of the starting pomt But this lS not necessary, for merely by completmg the plain-component sequences and exammmg the diagonals of

the diagram, the plain text becomes evident For example, given the followmg HID CT

E H UXI Completmg the plain-componentsequences mrnated by the successive Cipher letters, the
:PIGn.. lO

HIDCTEHUXL

YCRBVFYLZI

DBAEWGDIHC

REUFXJRCYB

AFLGZKA DE

UGIJHII ERF

LJCKYNLFAG

IKBYDOIGUJ

CMENRPCJLK

BNFOAQBKIM

EOGPUSEMCN

FPJQLTFNBO

GQKSIVGOEP

plam text, ENE M Y MAC H I ISseen to come out m SUCCeBS1Ve steps upward in Figure

10 Had the cipher component been shifted m the OPPOSlte direcnon m enerpherment, the steps

would have been downward instead of upward If the shdmg strips had been set up accordmg to

the sequence of cipher letters but on a diagonal, then, of course, the plam-text letters would

have reappeared on one generatnx

e The student will understand what simple modJ.ficatlons m

procedure would be required In case the two prImary components

were d11ferent mixed sequences But what J.f the prImary components are not known sequences? How does the cryptanalyst

proceed m that case?

40. General solution for Ciphers mvolvmg a long-keyIng

sequence of fixed length and composition --a It 18 obvious, as

stated at a previous pomt, that no matter how the keymg sequence

IS denved, ifallthecorrespondents employthesame key, or'ifth'Ul key 'IJl

'USed many nmes by a s~ngle office, and if ~t alwaysbegltns at thesame

po~nt, thetarw'US messages may s~mply be 8'Upe1"tmposed Thus, therr

respectlve 1st, 2d, 3rd, letters WIll all fall Wlthm columns

which have been enciphered by the 1st, 2d, 3rd, key letters

If there 18 a suffiClent number of messages, solution then becomes

possible by frequency analysis of the successrve columns-nomatter

how long the keymg sequence may be, and regardless of whether the keymg sequence constltutes

mtelhgible text or IS a purely random sequence of letters ThISmethod ofsolution by supenmposinon has already been outlined in paragraph 20 and no further reference to It need here be made

b But now suppose that the keymg sequence does not always begm at the same pomt for

all messages Suppose the several correspondents are able to select at will any porot m the

keymg sequence as the pomt of departure m encipherment Thus, such a keymg sequence, Ifregarded as partaking of the nature of a CIrcle, will afford as many possible sta.rtmg pomts as there

are letters or characters in that sequence Now J.f there are no external md1catlons or tndol.cator,·

m the cryptograms pertammg to such a system, such as would afford enemy cryptanalysts direct

and definite mformanon WIth regard to the mmal keymg element for each cryptogram, then It

would seem as though the supenmposmon of messages (to bnng letters enciphered by the same

Cipher alphabets withm the same columns) would be difficult or unposeible, and therefore that

attempts at solution are blocked at their very begmnmg ThIS, however, 18 not the end of the

story For suppose two of the messages have m common only one polygraph, say of 5 letters,

these two messages may be Juxtaposed so as to bnng these repetmons mto snpenmposmon

Thus, the possession of this long polygraph in common serves to "tie" these two messages together or to "interlock" them Then, suppose a shorter polygraph, say of 4 letters, 18 possessed

m common by one of these two messages and a third message, this will serve to tie m the latter

WIth the first two Extension of tlna process, mcludmg the data from shorter repetltlons of

tngraphs and digraphs, will serve to assemble a whole set of such messages m proper superImpoSltlon Therefore, the first step 18 to examme all the messages for repetitions

J Indicators play an Important rOlem practical cryptography An indIcator J8 a symbol (COD8IS~lng of a

letter, group of letters, a figure 01' a group of figures) wluoh indicates the &peOlfio key used under the general

oryptographlc system, or It may mdreate whJ.ch one of a Dumber of general systems has been used, or It may mdioate both

51

e When such repetltlons are found, and J.f there are plenty of them so that assumptaons for

probable words are easy to make, It 18 clear that the correct assumptaons will enable the cryptanalyst to set up plain-cipher equrvalencies which WIll make It possible to reconstruct the primary components Dependmg upon the type used, the pnnciples of direct or indirect symmetry of posinon will be very useful m tlna process

d But J.f It happens that there are no polygraphs by means of which two or more messages

may be ned together and properly supemmposed, the snnple methods mentioned m subparagraphs

tJ-C cannot here be applied However, although the road toward a solution seems to be blocked

rather effectlvely, there 18 a detour which presents rather mterestmg VIstas The latter are

really of such Importance in cryptanalysis as to warrant detailed treatment
SECTION XI

THE "COINCIDENCE" OR ",," TEST

Pamamph The baeie theory of the eomeidence or /C (kappa) test 41

General procedure to be followed m making the /C test_________ _ 42

Example of apphcetion of the /C test 43

Subsequent steps 44

41. The baSIC theory of the eomcidenee or IC (kappa) test -a In AppendIX 2 of the preceding text 1 certain SImple apphcations of the theory of probabihty were presented for the

student's consideration, by way of pomtmg out to him the important role wInch certain phases

of that branch of mathemancs play m cryptanalysis Reference was there made to the subject

of co~nculence8 and Its sigmflcance in connection With the study of repetrnons in cryptograms

In this section the matter will be pursued a few steps further

b In the appendix referred to, It was shown that the probability of monographic coincidence

(1) m random text employmg a 26-letter alphabet 18 0385, (2) in Enghsh telegraphic plain text,

0667 These two parameters were represented by the symbols ICr and ICp, respectively The

Important role which these values play In a certam cryptanalytao test will now be explained

c One of the most Important techniques in cryptanalytlcs 18 that known as appl'g't1t{J the

co~nculence or "kappa te8t " Th18 test 18 useful for several cryptanalytic purposes and one of

the most Important of them 18 to ascertain when two or more sequences of letters are correctly

supenmposed By the word "correct" m tlus case 18 merely meant that the sequences are so

arranged relative to one another as to faoihtate or make possible a solunon The test has for

Its theoretical baSIS the followmg CIrcumstances

(1) H any two rather lengthy sequences of characters are supenmposed, It will be found,

on exammmg both members of the successive pall'S of letters brought mto vertical juxtaposraon,

that ~n a certa~n number of case8 the two supenmp08ed letter8 will co~ncule

(2) H both sequences of letters constitute random text (of a 26-letter alphabet), there will

be about 38 or 39 such cases of coincidence per thousand pall'S examined ThIS, of course, IS

because ICr = 0385

(3) H both sequences of letters constitute plain text, there will be about 66 or 67 such cases

of comcidence per thousand PaIl'S examined ThIS 18 because ICp18 0667

(4) H the superunposed sequences are wholly monoalphabeue encipherments of plain

text by the same CIpher alphabet, there will still be about 66 or 67 cases of comcidence in each

1,000 cases exammed, because m monoalphabetic subsntutaon there 18 a fixed or unvarying

relanon between plain-test letters and cipher letters so that for stansncal purposes monoalphabetic Cipher text behaves Just the same as 1fIt were normal plain text

(5) Even 1fthe two supenmposed sequences are not monoalphabetically enciphered texts,

but are polyalphabetrc In character, there WIll still be about 66 or 67 cases of identity between

superimposed letters per thousand cases examined, provuled the two sequence8 really belong to the

same cryptographte SY8tem and are 8t£penmp08ed at the proper po~nt W'/,th respect to the ke'g'tng

sequence The reasons for tlus will be set forth in the succeeding subparagraphs

I M,Zdarll CrllptanaZ1I8t.B, Part II It IS recommended that the student refresh hIS memory by reviewing

that appendIX

(58)

59

(6) Conmder the two messages below They have been enciphered polyalphabetrcally by

the same two pnmary components shdmg agamst each other The two messages use the same

keymg sequence, begmmng at the same mitaal pomt m that sequence Consequently, the two

messages are Identically enciphered, letter for letter, and the only differences between them are

those occasioned by drlferences m plain text

j

AlPhabets .___ 18 21 13 II 8 • 17 19 21 21 2 8 3 8 13 18 1 7 12 8

No 1 Plam text W HEN I NTH E C 0 U R S E LON G M

CIpher________________ E 9....-!i B T E Y R C X X L Q J N Z 0 YAW

j

Alphabets-___________ 16 21 18 6 8 • 17 19 21 21 2 8 3 8 13 13 1 7 12 6

No 2 Plain text____________ THE G ENE R A LAB SOL UTE L Y

CIpher________________ P 9....-!i T U E B W 0 J L Q H Y Z P T M Q I

Note, now, that (a) m every case m which two supenmposed CIpher letters are the same, the

plam-text letters are idenncal and (b) m every case m wluch two supenmposed. Cipher letters

are d1fterent, the plam-text letters are different In such a system, even though the Cipher

alphabet changes from letter to letter, the number of cases of identity or coincidence in the two

members of a parr of supenmposed Cipher letters will still be about 66 or 67 per thousand cases

examined, became the two member« of each pal1' of 8t£penmpobed leuer« are ~n the same C?,pher

alphabet and tt has been Been ~n (4) that ~n monoalphabmc C?,pher text " '1.8 the 8ame as for pla~n

tm,. mz, 0667 The two messages may here be said to be supenmposed "correctly," that 18,

brought mto proper juxtaposmon With respect to the keymg sequence

(7) But now suppose the same two messages are superimposed "mcorrectly," that IS, they

are no longer m proper juxtaposraon With respect to the keymg sequence Thus

j

.AlPhabets__________ 18 21 18 I 8 • 17 19 21 21 2 8 3 I 13 13 7 12

No 1 Plam text._________ W HEN I NTH E C 0 U R S E LON G

CIpher______________ E Q N B I F Y R C X X b....Q J N 0 Y A

j

.AlPhabets __________ 18 21 18 I 8 • 17 19 21 21 2 8 3 6 18 18 1 7

No 2 Plein text_________ THE G ENE R A LAB SOL UTE

Clpher______________ P Q N I U F B W 0 J b....Q H Y P T M

It 18 evident that the two members of every P8Jl' of superunposed letters are no longer m the

same Clpher alphabet, and therefore, If two superimposed CIpher letters are Identical thia IS

merely an "accident," for now there 18 no basic or general cause for the snmlanty, such as 18

true m the case of a correct supenmpositaon The SlIDllanty, If present, 18, as already stated,

due to chance and the number of such cases of SlIDuanty should be about the same as though

the two Clpher letters were drawn at random from random text, In which ICr = 0385 It 18 no

longer true that (a) m every case m which two supenmposed CIpher letters are the same, the

plam-text letters are Identical or (b) m every case m which two supenmposed Cipher letters are

drlferent, the plam-textletters~e d1fterent Note, for example, that the supenmposed To'srepresent two drlferent plam-text letters and that the Spof the word COURSE m the first message gives

J. while the S of the word ABSOLUTELY m the second message gives H. Thus, It becomes clear

that m an mcorrect supenmposmon two c:hfferent plam-text letters enciphered by two dIfferent

alphabets may "by chance" produce Identical CIpher letters, wluch on supenmposinon yield a

I The fact that In thIs case each monoalphabet eontama but two letters does not affect the theoretical value

of /c, and whether the actual number of COInCIdences agrees closely WIth the expected number based upon /C=

0667 depends upon the lengths of the two supenmposed sequencea
60

comcidence havmg no external mdications as to dissnmlanty in plain-text equrvalents Hence,

J.f there are no other factors which enter mto the matter and which might operate to distort

the results to be expected from the operation of the baSIC factor, the expected number of cases of

idenacal cipher letters brought together by an mcorrect supenmposition will be determmed by

the value Kr= 0385

(8) But now note also that m the foregoing mcorrect supenmposmon there are two Zo's and

that they represent the same plain-text letter L Tills 18 occasioned by the fa.ct that the plaintext messages happened to have L's in Just those two places and that the cipher alphabet happened to be the same both tames Hence, It becomes clear that the same cipher alphabet brought

into play twice may "by chance" happen to encipher the same plain-text letter both times, thus

producmg idenncal cipher letters In some systems tlns source of identity in superimposed

CIpher letters 18 of httle Importance, in other systems, It may materially affect the actual number

of comcidences For instance, J.f a system IS such that It produces along secondary keymg cycle

composed of repeunons of short pnmary keymg cycles, an mcorrect supenmposrnon of two

cryptograms may bnng mto JuxtapoSItIon many of these short cycles, WIth the result that the

actual number of cases of identical supenmposed CIpher letters 18 much greater than the expected number based upon Kr= 0385 Thus, tillq source for the producnon of idenncal CIpher

letters m an mcorrect supenmpositaon operates to mcrease the number of cases to be expected

from the fundamental constant Kr= 0385

(9) In some systems, where nonrelated CIpher alphabets are employed, It may happen

that two identical plain-text letters may be enciphered by two different CIpher alphabets which,

"by chance," have the same eqmvalent for the plam-text letter concerned Tills 18, however,

a functIon of the particular cryptographic system and can be taken mto account when the

nature of the system 18 known

(10) In general, then, It may be said that in the case of a correct supenmpositaon the

probability of identity or coincidence m superimposed upher letters IS 0667, m the case of an

mcorrect aupenmposmon, the probability IS at least 0385 and may be somewhat greater, dependmg upon speeral CIrcumstances The foregomg situation and facts make possible what

has been referred to as the "comcidence test" Sm-e tills test uses the constant K, It 18 also

called the "kappa test "

d The way m which the comcidence test may be applied will now be explained The

statement that Kp= 0667 means that in 1,000 cases where two letters are drawn at random

from a large volume of plam text, there will be about 66 or 67 cases m which the two letters

coincide, that IS, are identacal Nothmg IS specified as to what the two letters shall be, they

may be two Z's or they may be two E's 'I'lns constant, 0667, really denotes a percentage

If many campa-mOM of single letters are made, the letters being drawn at random from among

those eonsntutmg a large volume of plam text, 667 percent of these compansons made will

yIeld comcidences So, If 2,000 such comparisons are made, the theory mdioates that there

should be about 0667X2,000=133 comcidences, J.f there IS sufficient text to permit of making

20,000 compa.nsons, there should be about 1,334 comeidenees, and so on

e Another way of handling the matter 18 to find the rano of the observed number of comcidences to the total number of cases in which the event in question nught possibly occur, 1 e ,

the total number of compansons of supenmposed letters When tills ratio IS closer to 0667

than It 18 to 0385 the correct supenmpoeinon has been ascertained Tills IS true because m

the case of a correct supenmpositaon both members of each pair of supenmposed letters actually

belong to the same monoalphabet and therefore the probability of their comcidmg 18 0667,

whereas m the case of an mcorrect supenmpoSltIon the members of each patr of supenmposed

61

letters belong, as a general rule, to dIfferent monoalphabets 8, and therefore the probability of

theIr ccineidmg 18 nearer 0385 than 0667

J. From the foregomg, It becomes clear that the kappa test mvolves ascert8.1nmg the total

number of eompansons that can be made m a given case, as well as ascertammg the actual number

of comcidences m the case under considerataon When only two messages are supenmposed,

th1B 18 easy The total number of comparisons that can be made 18 the same as the number of

supenmposed p8.11'S of letters But when more than two messages are supenmposed in a trUper-

'&mpomtm d'UJ,(J1'Q,m It 18 necessary to make a simple calculanon, based upon the fact that 71,

71,(71,-1 letters yIeld 2 p8.11'S or comparisons, where 71, 18 the number of letters in the column' For

3X2 example, m the case of a column of 3 letters, there are -2-=3 compansons ThIs can be

checked by notIng that the 1st letter m the column may be compared WIth the 2d, the 2d WIth

the 3d, and the 1st WIth the 3d, making 3 compansons m all The number of compansons per

column tImes the number of columns in the supenmpositaon diagram of letters grvea the total

number of comparisons The extension of thls reasonmg to the case where a supenmpoeraon

diagram has columns of vanouslengths 18 quite obVIOUS one merely adds together the number of

compansona for columns of different lengths to obtain a grand total For convemence, the

followmgbnef table 18 given

Number of Nnmber of Number of Numbprof Namberof Number of letter. 1U lettu. ''1 lettpr. 1'1

column eompanvms column wlllpar son" column eompansons

2 1 11 55 21 210

3 '1 12 66 22 2H

4 6 1& 78 2& 253

5 10 14 91 24 276

6 15 15 105 25 JOO

7 21 16 120 26 32;;

I 8 28 17 13b 27 J51

9 36 18 153 28 &78

10 45 19 171 29 4Gb

20 190 30 435

9 In ascertammg the number of comcidences in the Lase of a column containmg several

71,(71,-1) letters, It IS agam necessary to use the formula 2 ,only m tlna case 71, 18 the number ot

IdentIcal letters in the column The reasoning, of course, 18 the same as before The total

I The qualIfymg phrase "as a general rule" 18 Intended to cover any distortion In results oceasioned by the

presence of an unusual number of those cases of eomeidence described under subpar c (8) and (9)

t Tlus has already been encountered (footnote 3, AppendIX 2, Mddary Crypf.analY8~8,Part 11) It 18merely a

specw case under the general formula for ascertammg the number of combmatlons that may be made of n

C n' different thmgs taken r at a tune, wluch 18 -=-'()' In studymg comeidences by the method mdieated, nr r n-r

n' smce only two letters are compared at a time, r 18 always 2, hence the expression rl(n-r)I' wluch 18 the same as

n(n~~~~)I2)1, becomes by eaneellanon of (n-2)', reduced to n(n;-I)
62

number of eomeidencea 18 the sum of the number of oomoidencee for each case of Identity For

example, m the column shown at the BIde, containmg 10 letters, there are 3 B's, 2 C's, 4 K's, and

1 Z The 3 B's Yield 3 eomcidences, the 2 C's Yield 1 coincidence, and the 4 K's Yield 6

C comcrdences The sum of 3+1+6 makes a total of 10 eomcidenoes m 45 comparisons

K 42. General procedure to be followed in making the IC test.-a The steps in applying

B the foregomg principles to an actual case will now be descnbed Suppose several messages

K enciphered by the same keymg sequence but each begmnmg at a d1fferent point in that

Z sequence are to be solved The indicated method of solution 18 that of eupenmposinon,

K the problem being to determme Just where the respective messages are to be supenmposed

C so that the cipher text wrthm the respective columns formed by the supenmposed messages

B will be monoalphabetac From what has been indicated above, It will be understood that

B the VariOUS messages may be shifted relative to one another to many different pomts of

K aupenmpositaon, there being but one correct supenmposraon for each message With respect

to all the others First, all the messages are numbered according to their lengths, the longest bemg assigned the number 1 Commencmg With messages 1 and 2, and keepmg number 1 m

R fixed position, message 2 18 placed under It so that the mmal letters of the two messages comcide

Then the two letters formmg the successive paars of aupenmposed letters are exammed and the

total number of cases m which the superimposed letters are Identical 18 noted, thlB grving the

observed number of comcidences Next, the total number of superimposed paars 18 ascertam.ed,

and the latter 18 multiplied by 0667 to find the expected number of coincidences If the observed

number of corncidences lS considerably below the expected number, or If the ratio of the observed

number of comeidenees to the total number of compansons IS nearer 0385 than 06b7, the

supenmpositaon 18 mcorrect and message 2 18 shifted to the next supenmposrnon, that lS, so

that Its first letter IS under the second of message 1 Agam the observed number of eomcrdences

IS ascertamed and IS compared With the expected number Thus, by shifting message 2 one

space at a time (to the nght or left relative to message 1) the coincidence test finally should

mdicate the proper relative positaons of the two messages When the correct point of superimposmon ISreached the cryptanalyst IS rarely left m doubt, for the results are sometimes quite

starthng After messages 1 and 2 have been properly supenmposed, message 3 18 tested first

agamst messages 1 and 2 separately, and then against the same two messages combined at their

correct supenmpoamon 5 Thus message 3 18 shifted a step each time unnl its correct positaon

With respect to messages 1 and 2 has been found Then message 4 18 taken and Its proper pomt

of supenmposmon With respect to messages I, 2, and 3 lS aseertamed The process 18 continued

m this manner until the correct points of supenmpoernon for all the messages have been found

It 18 obVIOUS that as messages are added to the supenmpositaon diagram, the determmatlon of

correct points of supenmposraon for subsequent messages becomes progressrvely more certain

and therefore easier

b In the foregomg procedure It 18 noted that there 18 neoessity for repeated displacement

of one message agarnst another or other messages Therefore, It lS advisable to transcnbe the

messages on long stnps of cress-section paper, jommg sections accurately If several such stnps

are necessary to accommodate a long message Thus, a message once so transcnbed can be

shifted to VariOUS points of supenmposraon relative to another such message, Without repeatedly

rewntlng the messages

c Machmery for automatically eompanng letters m applymg the coincidence test has been

deVISed Such machines greatly faClhtate and speed up the procedure

6 At first thought the student IDlghtwonder why It 18 advssable or necessary to test message 3 agaInst message

1 and message 2 separately before testIng It agaInst the eembmation of messages 1 and 2 The first two tests,

It seems to hIm, IDlght be omitted and time saved thereby The matter Will be explaIned In par 431 (3)

1

63

48. Example of apphcatlon of the IC test-a With the foregoing m mind, a precncal example

will now be given The followmg messages, assumed to be the first 4 of a series of 30 messages,

supposedly enciphered by a long keymg sequence, but each message commenomg at a different

point m that sequence, are to be arranged so as to bring them into correct supenmpoamon

MESSAGE 1

P G LPN HUFRK S A U Q Q A Q Y U 0 Z A K G A E 0 Q C N

P R K 0 V H Y E I U Y N BON N F D M W Z L U K Q A Q A H Z

M G CDS LEA G C J P I V J W V A U D BAH M I H K 0 R M

LTFYZ L G S 0 G K

MESSAGE 2

C W H P K KXFLU MKURY X COP H WNJUW K W I H L

o K Z T L AWRDF G D D E Z D LBO T F U Z N A SRHHJ

NGUZK P R C D K Y 0 0 B V D D X C D o G R G I R M r c s

H S G G 0 PYAOY X

MESSAGE 3

W F W T D NHTGM R A A Z G P J D S Q A U P F R o X J R 0

HRZWC Z S R T E EEVPX OAT D Q L D 0 Q Z HAWNX

THDXL HYIGK VYZWX B K 0 Q 0 A Z Q N D T N A L T

CNYEH T S C T

MESSAGE 4

TULDH N Q E Z Z U T Y G D U E D U P S D L I 0 L N N B 0

NY L Q Q V Q G C D U TUB Q X S 0 S K N 0 X U V KCYJX

C N J K S AN G U I F TOW 0 M S N B Q DBA I V I K N W G

V S HIE P

b SUPerImPOSlng' messages 1 and 2, begmmng With their 1st letters,

a ro u m 00 U

No L_____ P G L f N HUE R K S A !l Q Q A Q Y U 0 Z A K G A E 0 Q C N P R K 0 V

No 2_______ C WH f K K X E L U M K !l R Y X COP H W N J U W K W I H L 0 K Z T L

" W M 00 ro

No L H Y E I U Y N BON N F D M WZ L U K QA Q A H Z M g CDS LEA G C

No 2 A WR D F G D D E Z D LBO T F U Z N A S R H H J N g U Z K P R C D K

75 80 86 IlO IllS 100

No L_____ J P I V J WV A U 12 BAH MI H K 0 R M L T F Y Z L G S Q G K

No 2 Y 0 0 B V D D X C 12 0 G R G I R M I C N H S G GOP Y A Q Y X

the number of coincidences ISfound to be 8 Since the total number of comparisons 18 101, the

expected number, If the supenmpositaon were correct, should be 101X 0667=67367, or about

7 comcidenees The fact that the observed number of coincidences matches and 18 even greater

than the expected number on the very first mal creates an element of suspicion such good

fortune lS rarely the lot of the practical cryptanalyst It IS very unwise to stop at the first mal,

even'if the reB1dt8 are favorable, for this close agreement between theoretical and actual numbers

• The student Will have to imagme the messages written out as contmuous sequences on eross-seetion paper
FlOURS 110

123

65

X /'Il! 11/ 1/1/ --- - x x 11/

- ----- x x x

1

2

3

&s being members of the same fauuly, so to speak, then the two letters formmg the successive

parrs of letters brought mto supenmpoaitaon by an mcorrect placement of one message relative

to another are total strangers to each other, brought together by pure chance Tlns happens

nme and again, as one message IS slid against the other-untll the correct supenmposmon IS

reached whereupon m etery rase the two supenmposed letters belong to the same faml1y There

may be'many different famihes (CIpher alphabets) but the fact that in every case two members

of the same fauuly are present causes the marked Jump in number of coincidences

e In slnftmg; one message against another, the cryptanalyst may move to the nght constantly, or he may move to the left constantly, or he may move alternately to the left and nght

from a selected imtaal pomt Perhaps the latter IS the best plan

f (1) Having properly supenmposed messages 1 and 2, message 3 IS next to be studied

Now It IS of course possible to test the latter message against the combmation of the former,

WIthout further ado That IS, escertarnmg merely the total number of comcidences given by the

supenmposnaon of the 3 messages might be thought sufficient But for reasons which w111

soon become apparent It IS better, even though much more work IS mvolved, first to test message

3 against message 1 alone and agamst message 2 alone This will really not Involve much additaonal work after all, since the two tests can be conducted simultaneously, because the proper

supenmpositaon of messages 1 and 2 IS already known If the tests agamst messages 1 and 2

separately at a given supenmposmon give good results, then message 3 can be tested, at that

supenmposraon, agamst messages 1 and 2 combmed That IS, all 3 messages are tested as a

single set Smce, according to the scheme outlmed, a set of three closely related tests IS mvolved,

one might as well systematise the work so as to save tune and effort, If possible With tills In

VIew a diagram such as that shown 10 FIgure lla IS made and m It the co.ncidences are recorded

m the appropriate cells, to show separately the comcidences between messages 1 and 2, 1 and 3,

2 and 3 for each supenmpositaon tested The number of tallies 10 the cell 1-218 the same at

the begmmng of all the tests, It has already been found to be 9 Therefore, 9 tallies are Inserted

In cell 1-2 to begm WIth A column which shows Identical letters In messages 1 and 3 Yields a.

single tally for ce111-3, a column wluch shows identical lettere m messages 2 and 3 Yields a single

tally for cell 2-3 Only when a supenmposinon yields 3 idenncal Ietters 10 8 column, 18 a tally

to be recorded srmultaneously 10 cells 1-3 and 2-3, SInce the presence of 3 idenncal lettera In the

column Yields 3 COIncidences

The total number of eompansons IS now 98, so that the expected number of coincidences 18 98X

0667=65366, or still about 7 The 2d and 3d supenmpositaons are defimtely mcorrect, as to

the 1st and 4th, the latter gives almost 30 percent more comcidences than the former Agam

considering the relatively small number of compansons, tills 30 percent drlference In favor of

the 4th supenmpoaraon as against the 1st 18 important Further detailed explanation 18 unnecessary, and the student may now be told that It happens that the 4th supenmposinon IS really

correct, u the messages were longer, all doubt would be dispelled The relatrvely large number

of cornctdences found at the 1st supenmposraon IS purely accidental in tills case

d The phenomenon noted above, wherem the observed number of comcrdences shows a

sudden Increase in moving from an incorrect to a correct supenmpositaon IS not at all unusual,

nor should It be unexpected, because there IS only one correct supenmposinon, while aU other

supenmpositions are entIrely incorrect In other words, a supenmposinon 18 either 100 percent

correct or 100 percent wrong-and there are no gradations between these two extremes

TheoretIcally, therefore, the difference between the correct supenmposrtaon and anyone of the

many mcorrect supenmpoeraons should be very marked, since It follows from what has been

noted above, that one cannot expect that the diacrepancy between the actual and the theoretIcal

number of eomcadences should get smaller and smaller as one approaches closer and closer to

the correct supenmposrnon 7 For uletters belonging to the same CIpher alphabet are regarded

64

70 80 8Ii 90 93 100

No L_____ J P I V J W V A U 12 BAH M I H K 0 BML T F Y Z L g S 0 G K

No 2_______ C D KYO 0 B V D 12 XeD 0 G R G IBM r c s H S G goP Y A 0 Y X

of eomcideaces uught Just be "one of those accidents" Therefore message 2 18 slnfted one

space to the nght, placing Its 1st letter beneath the 2d letter of message 1 Agam the number

of comcideneea 18 noted and this time It 18 found to be only 4 The total number of compansons

18 now 100, the expected number 18 still about 7 Here the observed number of comeidenees 18

considerably less than the expected number, and when the relatIvely small number of compansons 18 borne In mind, the discrepancy between the theoretical and actual results 18 all the

more stnlong The hasty cryptanalyst might therefore Jump to the conelusion that the 1st

supenmpositaon 18 actually the correct one But only two tnals have been made thus far and

a few more are still advisable, for In this scheme of supenmposmg a senes of messages It IS

absolutely essentaal that the very first suponmposinons rest upon a perfectly sound foundatIonotherwise subsequent work w111 be very difhcult, u not entirely fruitless AdditIonal tnals will

therefore be made

e Message 2 18 shifted one more space to the nght and the number of comcidenees IS now

found to be only 3 Once again message 2 IS shifted, to the positaon shown below, and the

observed number of comcidences Jumps suddenly to 9

40 40 so 55 80 115 70

No L H Y E I U Y N BON N F D M W Z L U K Q A Q A H Z M G CDS LEA G C

No 2_______ Z T LAW R D F G D D E Z D LBO T F U Z N A S R H H J N G U Z K P R

s 10 15 20 20 3D 36

No L_____ P G LPN HU F R K SAy Q Q A Q ! U 0 Z A K G A E 0 Q C N P R K Q V

No 2_______ C WH P K K X FLy M K U R ! X COP H W N J U W K W I H L Q K

7 The lDlportance of tlus remark WIll be appreclatt>d when the student comes to study longer examples, m which statIstical expectations have a better opportunity to matenahre
FIGUIl.Jl 116

66

(2) Let message 3 be placed beneath messages 1 and 2 combined, so that the 1st letter of

m811

ths>

8t3h falls under the 1st letter of message 1 (It IS adviseble to fasten the latter In place

so a ey cannot eaBIly be chsturbed) Thus

Total num Number of eomeidenees

CombmatlOD bero'

D18OI'tlP

comparlSODB Expected ObserVlld

allq

PmItlC

MeB8&ges 1 and 3 _•• -_____ 99 About 7 10 +43

MeB8&ges 2 and 3 __•_____ 97 About 6 6 0

Messages 1, 2, and 3 - __ 293 About 20 25 +25

1 2 3

1 x '1/1,

2 x x "f

3 x x X

FIG'l1BJl ue

67

76 M 8lI 95 101

No 1.______ J P I V J W V A U Q BAH M I H K 0 RML T F X Z L g S 0 G K

No 2_______ C 0 KYO 0 V D Q x c o 0 G R G IBM I Q MH S G Q 0 PYA 0 Y X

No 3. K V Y Z W X K 0 Q 0 AZ Q NOT N A L T Q HXE H T s c r

6 10 1& 20 25 30 3&

No L_____ P G LPN HU F R K SAY Q Q A Q! U 0 Z AK G A E Q Q C N P R K Q V

No 2.______ C WH P K K X FLy MK U R ! X COP H WN J U W K W I H L Q. K

No 3_______ WF WTON H T G MR A A Z G P J D S Q A U P F R Q X J R 0 !:! R Z W

(3) The reason for the separate tabulanon of eomcidencea between messages 1 and 3,

2 and 3, and 1, 2, and 3 should now be apparent Whereas the observed number of comcidences

IS 57 percent below the expected number of coincidencesIn the case of messages 1 and 3 alone,

and 50 percent.belowIn the case of messages2 and 3 alone, the discrepancy between the expected

and observed numbers IS not quite so marked (-21 percent) when all three messages are considered together, because the relatIvely high number of comcrdences between messages 1 and 2,

which are correctly superimposed, serves to counterbalance the low numbers o.f comcidences

bet.ween 1 and 3, and 2 and 3 Th1L8, a correct supenmposuwnjor one oj the three comb'maCrons

may yteld 8'UCh good results as to mask the badre81dts for the other two comb~natwns

(4) Message 3 IS then slufted one space to the l'lght, and the same procedure IS followed as

before The results are shown below

4& m &II • 65 70

No L_____ H Y E I U Y N BON N F 0 MW Z I:! U K g A Q AH Z M G C Q S I:! E AGe

No 2 Z T LAW R 0 F GOD E Z 0 LBO T F U N A S R H H J N G U Z K P R

No 3__.____ C Z S R TEE E V P X 0 A T 0 QI:! 0 0 Q. HAW N X T H Q X I:! H Y I G

X .'/11

1/1/ 1/1

- - x x 1/1

x x x

f'omblDatlOn Total number

Number of colnPldpnpeq

or tomparl<on< --- D'<erell

Exppctpd Oh~prved &DPY

-- Mes8&ges 1 and 1 91) About

Percent

Messages 2 and 3 - - 7 3 -')7

Messages 1, 2, and 3 - 96 About 6 3 -50

291 About 19 15 -21

1

2

3

1 2 3 4 6 6 7 8 9 10 11 12 13 U 15 16 17 18 19 20 21 22 23 24 25 26 'P

L_________ P G LPN H U F R K SAY Q Q A Q Y U 0 Z A K G A E 0

2___________ C W H P K K X FLy M K U R XX COP H W N J U

3___________ WF WTON H T G M R A A Z G P J 0 S Q A U P FRO X

23~OO~~~M~u~~~~~n~"""~~~m~~

L_________ Q C N P R K Q V H Y E I U Y N BON N F D M W Z L ;

2___________ W K W I H L Q K T LAW R 0 F G D D E Z D L V 0 T F

3.__________ J R 0 H R Z WC S R TEE E V P X 0 A T Q L 0 0 Q

uHmM~.M~M"PH~HMron~nUUU"~NMM

~---------- Q A Q A H Z M G CDS LEA G C J P I V J W V A U D B

----------- U Z N A S R H !:! J N G U Z K PRe 0 KYO 0 B V 0 DX

3___________ Z HAW N X T 1:1 D X L H Y I G K V Y Z W X B K 0 Q '0 A

1 ~U~uM~MM~m~nM"~~~~~m~~~

_._----.--- A H M I H K 0 R ML T F Y Z L G S 0 G K

2___________ COO G R G I R M r c s H S G GOP Y A 0 Y X

3. • Z Q NOT N A LTC N Y E H T seT

123

The sucoessrve columns are now e d d h only eomordenees b t xamme an t e comcidences are recorded, remembenng that

lated In the dra e we~hmessages 1 and 3, and between messages 2 and 3 are now to be tabuposition YIelds :~~ ('om~::~~~:s :::w~~: ~~t test are shown In FIgure lIb Tlus supenmmessages 2 and 3 Th ttl b ssages 1 and 3, and the same number between

IS drawn up e 0 anum ers of comparisons are then noted and the following table
Total num Number of COIDCldeDCI'S

ComblDatlOD her of l' .t'I'ep

eompansons an("'\o

Expected Observed

Peru"t

Messages 1 and 4 _________ 96 About 6 3 -50

Messages 2 and 4 _________ 96 About 6 3 -50

Messages 3 and 4__ -....... 96 About 6 1 -83

Messages I, 2, 3 and 4 - 582 About 39 33 -18

x '!lit 'II!J /1/

--- - - X X ny 'II

t-- - - - X X X I

I--- - - X X X X

69

J'IGVU 11.

II 10 n 20 2Ii 30 "

No L •• P G LPN H U F R K S A U Q Q A Q Y Y 0 Z A K G A E 0 Q C N P R K 0 V

No 2_______ C WH P K K X FLU M K U R Y X COP H W N J U W K W I H L 0 K

No 3_______ W F W T D N H T G M R A A Z G P J D S Q A U P FRO X J R 0 H R Z W

No 4_______ T U L D H N Q E Z Z U T Y G DUE D UPS D L I 0 L N N BON Y - - - 40 411 liO 5' 60 611 70

No L_____ H Y E I U Y N BON N F D M W Z L U K Q A Q A H Z M G CDS LEA G C

No 2_______ Z T LAW R D F G D D E Z D LBO T F U Z N A S R H H J N G U Z K P R

No 3_______ C Z S R TEE E V P X 0 A T D Q L D 0 Q Z HAW N X T H D X L H Y I G

No 4 L Q Q V Q G C D U TUB Q X S 0 S K N 0 X U V K C Y J X C N J K SAN

1

2

3

4

75 80 85 90 95 101

No L J P ! V J W V A U DBA H M I H K 0 R M L T F Y Z L G S 0 G K

No 2 C D KYO 0 B V D D X C DOG R G I R M I C N H S G GOP Y A 0 Y X

No 3_______ K V Y Z WXB K 0 Q 0 A Z Q N D T N A LTC N Y EH T SeT

No 4 G U I F TOW 0 M S N B Q DBA I V I K N W G V S HIE P - - - -

123 4

(6) It 18 beheved that the procedure has been explained WIth sufficientdetail to make further

examples unnecessary The student should bear m mmd always that as he adds messages to

the snpenmposraon diagram It 18 necessary that he recalculate the number of compansons so

that the correct expected or theoretical number of comcidences will be before hun to compare

WIth the observed number In adding messages he should see that the results of the separate

tests are consistent, as well as those for the combined tests, otherwise he may be led astray at

times by the overbalancmg effect of the large number of comeadences for the already ascertained,

correct aupenmposraons

44 Subsequent steps -a In paragraph 43a four messages were given of a series supposedly

enciphered by a long keymg sequence, and the succeeding paragraphs were devoted to an explanation of the preparatory steps m the solution The messages have now been properly

supenmposed, so that the text has been reduced to monoalphabenc columnar form, and the

matter 18 now to be pursued to Its ultimate stages

Total num Number of coIDCldeDCI'S

( ombmatron ber of D,.crpp

ccmpensons Expected Observed

HDLy

Messages 1 and 4

Perce"t

96 About 6 7 +16

Messages 2 and 4 _ --- 95 About 6 7 +16

Messages 3 and 4 ----- 96 About 6 5 -16

Messages 1, 2, 3, and 4 ___ 581 About 39 43 +10

X '!lit 'II!J 'ff I--

X X lH!, fHJ

I f-- , --

X X X lH! I--- - X X X X

No L _

No 2 _

No 3 _

No 4 _

68

1

2

3

4

1 2 3 4

J'IGVU lid

II 10 15 20 2Ii 30 3'

PGLPNHUFRKSAYQQAQXUOZAKGAEOQCNPRKOV

CWHPKKXFLYMKURXXCO~HWNJijWKWIHLOK

WFWTRNHTGMRAAZgPJDSQAUPFROXJROHRZW

TULRHNQEZZYTYGDUEDUPSDLIOLNNBONYL - - -- 40 411 lIS ftO 611 70

No L_____ H Y E I U Y N BON N F D M W Z U K g A Q A H Z M G CDS LEA G C

No 2 Z T LAW R R F G D D E Z D LBO T F U Z N AS R H H J NG UZ KP R

No 3_______ C Z S R TEE E V P X 0 A T D Q D Qg HAW N X T H Ii X L H Y I G

No 4_______ Q Q V Q G C RUT U B Q X S 0 S K N Q X U V K C Y J X Q HJ K S ! N g

75 80 85 90 911 101

No L_____ J P I V J ! V A U R!! ! H M I H K 0 R M L T F Y Z L G S 0 G K

No 2_______ C D K Y Q 0 !! V D R X C R 0 G R G ! RMI Q NIi S G goP Y A 0 Y X

No 3_______ K V Y Z W X !! K 0 Q 0 ! Z Q N D T N A LTC N Y E H T S C T

No 4 - U I F T Q ! 0 M S N !! Q R B A I V ! K N W GVSHIE P

Note how well the observed and expected numbers of eomeidenees agree in all three combinetlOlliS Indeed, the results of tins test are so good that the cryptanalyst might well hesitate to

make any more tests

(5) Having ascertamed the relative positions of 3 messages, the fourth message IS now

studied Here are the results tor the correct supenmpositaon

The results for an incorrect supenmposraon (Ist letter of message4 under 4th letter of message 1)

are also shown for comparison
70

b The four messages employed in the demonstrataon of the pnneiples of the IC test have

served their purpose The mformation that they are messages enciphered by an mtelhgible

runmng key, by reversed standard cipher alphabets, was WIthheld from the student, for pedagogical reasons Were the key a random sequence of letters instead of mtelhgible text, the

explanatron of the coincidence test would have been unchanged m the shghtest partaculsr, so

far as concerns the mechamcs of the text Itself Were the CIpher alphabets unknown, mixed

alphabets, the explanatIon of the IC test would also have been unchanged m the shghtest partacular But, as stated before, the four messages actually represent encrpherments by means of

an mtelhgible runmng key, by reversed standard alphabets, they will now be used to illustrate

the solutaon of cases of tlns sort

c Assummg now that the cryptanalyst 18 fully aware that the enemy 18 using the runmngkey system WIth reversed standard alphabets (obsolete U S Army CIpher disk), the method of

solutaon outlmed in paragraph 38 will be illustrated, employing the :first of the four messages

referred to above, that begmnmg PGLPN HUFRK SAUQQ The word DIVISION will be taken as

a probable word and tested agamst the key, begmnmg WIth the very:first letter of the message

Thus

CIpher text_________________________ P G LPN H U F R K S A U Q Q

Assumed plain text______________ D I V I S ION

Resultant key text_______________ S 0 G X F

The resultant key text ISumntelhgible and the word DIVISION 18 shifted one letter to the right

CIpher text_________________________ P G LPN H U F R K S A U Q Q

Assumed plam text______________ D I V I S ION

Resultant key text J T K

Agam the resultant key text IS unmtelhgible and the hypothencal word DIVISION 18 shifted

once more Connnuanon of this process to the end of the message proves that the word 18 not

present Another probable word 18 assumed REGIMENT When the point shown below IS

reached, note the results

CIpher text_________________________ P G LPN H U F R K S A U Q Q

Assumed plam text______________ • REG I MEN T

Resultant key text_______________ • E LAN D 0 F T

It certamly looks as though mtelhgible text were bemg obtained as key text The words

LAND OF T suggest that THE be tned The key letters HE give NO, makmg the plam text

read REGIMENT NO The four spaces precedmg REGIMENT suggest such words

as HAVE, SEND, MOVE, THIS, etc A clue may be found by assurmng that the E before LAND

m the key IS part of the word THE Testmg It on the CIpher text gives IS for the plain text,

which certamly mdicates that the message begme WIth the word THIS The latter yields IN

for the :first two key letters And so on, the process of checking one text agamst the other contmumg until the entire message and the key text have been reconstructed

d Thus far the demonstranon has employed but one of the four messages available for

solution When the reconstrucnon process IS applied to all four SImultaneously It naturally

goes much faster, WIth reduced necessity for assummg words after an mrtaal entermg wedge has

71

been dnven into one message For example, note what happens in this case Just es soon as the

word REGIMENT IS tned in the proper place

Key text_____________________ 1

I I ElL AIN D °IF TI I

No

1 {CIPher text__________________ P G L P N H U F R K S A U Q Q Plam text____________________ R E G I M E N T

No

2 {CIPher text__________________ C WH P K K X F L UM K

Plain text____________________ I E L D T R A I

No

3 {CIPher text__________________ W F W T D N H T G M R A A Z

Plam text____________________ L I N G K I T C

No

4 {CIpher text__________________ T U L D H N Q E Z Z U T Y

Plam text____________________ T I T A NK G U

It IS obVIOUS that No 2 begins WIth FIELD TRAIN, No 3, WIth ROLLING KITCHEN, No 4

WIth ANTITANK GUN These words yIeld addrtaonal key letters, the latter suggest addrtaonsl

plam text, and thus the process goes on until the solutaon IScompleted

e But now suppose that the key text that has been actually employed m encipherment IS

not mtelhgible text The process 18 stall somewhat the same, only in this case one must have at

least two messages in the same key For instead of checkmg a hypothetical word (assumed to

be present in one message) agamst the key, the same hOO of a check t8 made aga~nst the other

message or messages Assume, for instance, that in the case Just descnbed the key text, instead

of being mtelhgible text, were a senes of letters produced by applying a rather complex transposition to an ongmally mtelhgible key text Then If the word REGIMENT were assumed to be

present m the proper place in message No 1 the resultant key letters would yIeld an unintelligible

sequence But these key letters when applied to message No 2 would nevertheless yield

IELDTRAI,when applied to message No 3, LINGKITC, and so on In short, the text of one message t8 checked aga~nst the te~ of another message or messages, 1f the ongmally assumed word 18

correct, then plain text will be found m the other messages S

I Perhaps tbJs 18 as good a place as any to make some obeervanons which are of general Interest 18 eonneetion

Wlth the running-key pnneiple, and whieh have no doubt been the subject of speeulatron on the part of some

students Suppose a besie, umntelhgible, random sequence of keying characters which 18 not denved from the

mteract10n of two or more shorter keys and whteh MII6T repeat8 18 employed but once as a key for encipher mont

Can a cryptogram enciphered In such a system be solved? The answer to this question must unqualifiedly be

thiS even If the CIpher alphabets are known sequences, eryptanalytic science IS oertamly powerless to attack

such a cryptogram Furthermore, so far as can now be discerned, no method of attaok IS hkely ever to be devised

Short of methods based upon the alleged phenomena of telepathy-the very objeetrve existence of which 1'1

dented by most "sane" mvestigatora today-It 18 nnpossible for the present author to conceive of any way of

attackIng such a cryptogram

Tws IS a ease (and perhaps the only case) In which the impossibrlrty of cryptanalYSIS IS mathematieallv

demonstrable Two thmgs are Involved m a complete solution In mathematiCS not only must a sat18factory

(logteal) answer to the problem be offered, but also It must be demonstrated that the answer offered ISumqUi',

that IS, the only possible one (The mistake 18 often made that the latter phase of what constrtutes a vahd

solutron IS overlooked-and tlus IS the basic error which numerous alleged Baoon-Shakespeare "cryptographers"

commrs ) To attempt to solve a cryptogram eneiphered 1D the manner mdieated IS analogous to an attempt to

find a unique solution for a single equation eontammg two unknowns, WIth absolutely no data available for

solutacn other than those given by that equation Itself It IS obVIOUS that no unique solutron ISpossible In such

a oase, SInce anyone quanhty whatsoell6T may be chosen for one of the unknowns and the other will follow as a

aonseauenee Therefore an mfimte number of cWferent answers, all equally vahd, 18 posaible In the ease 01a
72

J All the foregomg work IS, of course, based upon a Imowledge of the CIpher alphabets

employed m the encipherment What If the latter are unImown sequences? It may be stated

at once that not much could be done With but four messages, even after they had been superImposed correctly, for the most that one would have m the way of data for the solution of the

mdividual columns of text would be four letters per alphabet--whIch IS not nearly enough

Data for solution by mdirect symmetry by the detection of Isomorphs cannot be expected, for

no Isomorphs are produced In this system Solution can be reached only If there IS sufficient

text to permit of the analysis of the columns of the supenmpositaon diagram When there IS

this amount of text there are also repetmons which afford bases for the essumpnon of probable

words Only then, and after the values of a few CIpherletters have been estabhshed can indirect

symmetry be apphed to facihtate the reconstruenon of the pnmary components-If used

g Even when the volume of text IS great enough so that each column contams say 15 to 20

letters, the problem IS still not an easy one But frequency distnbutaona With 15 to 20 letters

can usually be studied stansucally, so that If two distnbuuons present snmlar charactensncs,

the latter may be used a"l a basis for combmmg drstnbutions which pertam to the same CIpher

alphabet The next sectaon will be devoted to a detailed treatment of the nnplicanons of the

last statement

oryptogram enciphered m the manner mdicated, there IS the equrvalent of an equation WIth two unknowns,

the key 18 one of the unknowns, the plain text 18 the other One may CODJure up an mfimte number of different

plain texts and offer anyone of them as a "solutIOn" One may even perform the perfeotly meanmgless labor

of reeonstruetmg the "key" for thiS selected "solutIon" , but smce there 18 no way of provmg from the cryptogram

Itself, or from the reoonstructed key (which IS unmtelhgible) whether the "soluaon" SO selected 18 thB aotual

plain text. all of the mfinlte number of "SOIUtlOns" are equally vahd Now SInce It 18 mherent ID the very Idea

of cryptography as a pracncel art that there must and can be only one actual solunon (or plain text), and smoe

none of thiS mfimte number of different solutions can be proved to be the one and only correct solution, therefore,

our common sense reJects them one and all, and It may be said that a oryptogram enciphered In the manner

mcbcated 18 absolutely nnpcssible to solve

It IS perhaps unnecessary to pomt out that the foregOlDg statement ISno longer true when the running key

constitutes urtelhgible text, or If It IS used to encipher more than one message, or IfIt IS the secondary resultant of

the mteraeuon of two or me-re '!hort primary keys whioh go through cycles themselves For III these cases there

IS addrticnal mformation available for the dehmrtation of ODe of the parr of unknowns. and hence a unique solution becomes possible

Now although the runmng-key system descnbed m the first peragreph represents the ultimate goal of

eryptographie security and ISthe idesl toward wluch cryptographlo experts have stnven for a long time, there IS

a WIde abyss to be bridged between the reeognrtion of a theorelllcally perfeot system and Its establIBhment as a

practical means of secret mtereommumeatron For the mere meohanloal detaJls Involved In the production,

reproduction, and distnbutron of such keys present ddficultles which are so fonmdable as to destroy the effeotlveness of the method as a system of secret IDteroommumoatlon SUitable for groups of correspondents engaged In a

volummous exohange of messages

SECTION XII

THE "CROSS-PRODUCT SUM" OR "x TEST"1

Paracraph PreIImmary remarks 45

The nature of the "Orose-product sum" or "X (Cln) test" m cryptanalys18___ __ _ 46

Denvation of the x test _ __ _ _ __ 47

Applying the X test In matehrng distnbutrons .____ 48

45. Prehmmary remarks.-a The real purpose of making the oomoidenoe test in cases such

as that studied In the precedmg section 18 to pemnt the cryptanalyst to arrange hISdata so as to

circumvent the obstacle which the enemy, by adopting a complicated polyalphabetIc scheme of

eneipherment, places In the way of solution The essence of the matter IS that by dealing mdividually With the respective columns of the supenmposraon diagram the cryptanalyst has

arranged the polyalphabeac text so that It can be handled as though It were monoalphabenc

Usually, the solution of the latter 18 a relatively easy matter, especially If there 18 auffieient text

In the columns, or If the letters wrthm certam columns can be combined mto SIngle frequency

distnbunons, or If some cryptographIc relationship can be estabhshed between the columns

b It 18 obvious that merely ascert&mlng the correct relative posmons of the separate messages of a senes of messages In a supenmposiaon dragram 18 only a means to an end, and not an

end in Itself The purpose IS, as already stated, to reduce the complex, heterogeneous, polyalphabetic text to SImple,homogeneous, monoalphabetic text But the latter can be solved only

when there are suffiCIent data for the purpose-sand that depends often upon the type of CIpher

alphabets mvolved The latter may be the secondary alphabets resulting from the sliding of the

normal sequence agamst Its reverse, or a mixed component agamst the normal, and so on The

student has enough mformatIon concermng the vanous cryptanalytic procedures whIch may be

apphed, dependmg upon the CIrcumstances, m reconstructing dIfferent types of pnmary components and no more need be saad on thIS score at thIS POint

c The student should, however, realize one pomt which has thus far not been brought

speeiflcally to hISattention Although the eupenmpositaon diegram referred to In the preceding

subparagraph may be composed of many columns, there IS often only a relatively small number

of d'd!erenl CIpher alphabets mvolved For example, m the case of two pnmary components of

26 letters each there 18 a maxnnum of 26 secondary CIpher alphabets Consequently, It follows

that m such a case If a supenmpoaraon diagram 18 composed of say 100 columns, certain of those

columns must represent SImIlar secondary alphabets There may, and probably will be, no

regu1anty of recurrence of these repeated secondanes, for they are used m a manner dIrectly

governed by the letters composmg the words of the key text or the elements composmg the

keymg sequence

d But the latter statement offers an excellent clue It 18 clear that the number of nmee a

given secondary alphabet 18 employed In such a supenmposinon diagram depends upon the comI The X test, presented m thiS section, as well as the ill test, presented in Bection XIV, were first described

m an Important paper, Stat"tlcal Methods..." Cr1lpta"al1lBIB, 1935, by Solomon Kullback, Ph D , ASSOCiate Cryptanalyst, Srgnal Intelligence ServJce I take pleasure m acknowledgmg my Jndebtedness to Dr Kullback's

paper for the basICmaterJal used m my own expoBltloDof these tests, as well as for hJshelpful cntlCI8DIII thereof

wlule m manusoript

(73)
I MddaT1/ Cryptanal1llnB, Part II, AppendIx 2

75

d It IS advisable to pomt out, however, that the student must not expect too much of a

mathematical method of companng distnbutions, because there are lnmts to the size of distnbutions to be matched below which these methods will not be effective If two drstnbutions

contam some smnlar charactenstacs the mathematical method will merely afford a quantitative

measure of the degree of smnlanty Two distnbuuons may actually pertam to the same cipher

alphabet but, as occesionally happens, they may not present any external evidences of this

relanonship, m which case no mathematical method can mdicate the fact that the two distnbunons are really snmlar and belong to the same alphabet

47. DerIvation of the xtest-a Consider the followmg plam-text distnbunon of 50 letters

0067NJ- 0667N

2 (I)

c Iakewise, If jA. represents the number of occurrences of A m the foregomg distnbutaon,

then the number of comoidences for the letter A may be indicated symbohcally byjA(j~-I)

And smnlarly, the number of comeidenees for the letter B may be indicated by jB~-I), and

so on down to jz(fz-l) The total number of actual comeideneea found in the distnbutaon IS,

2

of course, the sum of j.4.«'2- 1)-t!B<t;-I)+ jz(j;-I) If the symbolje IS used to mmcate

any of the letters A, B, Z, and the symbol IS used to mmcate that the qum of all the

~,~~ ~~ ~~~~--~~~~

ABCDEFGHIJKLMNOPQRSTUVWXYZ

In a previous text 1I It was shown that the chance of drawmg two identical letters in normal

Enghsh telegraphic plain text lS the sum of the squares of the relative probabilities of occurrence

of the 26 letters m such text, which IS 0667 That is, the probability of monographic comcidence

in Enghsh telegraphic plsm text lS Kp = 0667 In the message to which the foregomg distnbution of 50 letters apphes, the number of possible pamngs (comparisons) that can be made between

50X49 SIngle letters IS 2 t:::::l,225 Accordmg to the theory of comcidences there should, therefore

be 1,225X 0667=81 7065 or approximately 82 comcidences of single letters ExaIDllllDg the

distnbunon It IS found that there are 83 eomcidenees, as shown below

- ~~~~ ~~ ~~~~ ~~~~

ABCDEFGHIJKLMNOPQRSTUVWXYZ

3+0+0+ 1+21+ 0+0+ I+3+0+ 0+0+1+10+15+0 +0+1+10+15+ I+0+1+0+0+0-83

The actual number of eomcidencea agrees very closely With the theorencal number, which IS

of course to be expected, smce the text to which the distnbution applied has been indicated as

bemg normal plam text

b In the foregoing; simple demonstratIon, let the number of compansons that can be made

N(N-l) in the distnbutaon be mdieated symbolIcally by 2 ' where N=the total number of letters

m the distnbution Then the expected number of comeidences may be wntten as 0067~(N-1),

which may then be rewntten as

74

posmon of the key text Smce m the case of a runnmg-key system using a book as a key the

key text constatutes mtelhgible text, It follows that the varwus 8econdary alphabet8 wUl be employed'/J)'/,th jrequencu8whtch are dtrectly related to the re8pectwe jrequencu8 oj OCcurrence oj leuer«

tn normal platn te:Bt Thus, the alphabet correspondmg to key letter E should be the most

frequently used, the alphabet corresponding to key letter Tshould be next in frequency, and so on

From this It follows that instead of bemg confronted With a problem involving as many different

secondary CIpher alphabets as there are columns in the supenmpositaon wagram, the cryptanalyst will usually have not over 26 such alphabets to deal With, and allowmg for the extremely

Improbable repetrave use of alphabets eorrespondmg to key letters J, K, Q, X, and Z, It IS hkely

that the cryptanalyst will have to handle only about 19 or 20 secondary alphabets

e Moreover, since the E secondary alphabet will be used most frequently and so on, It IS

possible for the cryptanalyst to study the various distnbutaons for the columns of the superunposrnon diagram With a VIew to assemblmg those distnbunons which belong to the same Cipher

alphabet, thus makmg the actual determmanon of values much easier m the combmed distnbunons than would otherwise be the case

j However, If the keymg sequence does not Itself constitute mtelhgible text, even If It lS

a random sequence, the case lS by no means hopeless of solunon-c-provided there lS sufflcient

text within columns so that the columnar frequency distnbunons may afford mdications enabling

the cryptanalyst to amalgamate a large number of small distnbutions mto a smaller number of

larger distnbutions

9 In thIS process of assembling or eombmmg mdrvidual frequency distnbunons which belong to the same CIpher alphabet, recourse may be had to a procedure merely alluded to m connection With previous problems, and designated as that of "matchmg" distnbunons The next

few paragraphs will deal With thIS Important subject

46 The nature of the IlCross-product sum" or "x (Chi) test" m cryptanalySIS -a The

student has already been confronted With cases in which It was necessary or deairable to reduce

a large number of frequency distnbunons to a smaller number by Identlfymg and amalgamatIng

distnbunons which belong to the same CIpher alphabet Thus, for example, m a case in which

there are, say, 15 diatnbunons but only, say, 5 separate CIpheralphabets, the <hfficultym solving

a message can be reduced to a considerable degree provided that of the 15 distnbuuons those

which belong together can be identified and allocated to the respectIve CIpher alphabets to which

they apply

b ThIs process of Identlfymg distnbutiona which belong to the same Cipher alphabet involves a careful exammanon and companson of the vanous members of the entire set of distnbunons to ascertam which of them present suffiCIently similar' charactensnce to warrant their

bemg combined mto a smgle distnbution applicable to one of the Cipher alphabets mvolved m

the problem Now when the mdrvidual distnbutiona are faIrly large, say contammg over 50

or 60 letters, the matter lS relatively easy for the expenenced cryptanalyst and can be made by

the eye, but when the distnbunona are small, each contammg a rather small number of letters,

ocular comparison and idennfieataon of two or more distnbutions as belongmg to the same alphabet become qurte difficult and often mconclusrve In any event, the tame required for the successful reduction of a mulnphorty of mdrvidual small distnbunons to a few larger wstnbutIons

IS, m such cases, a very matenal factor m determmmg whether the solutIOn will be accomphshed

m tIme to be of actual value or merely of hIstoncal mterest

c However, a certam statIstIcal test, called the "cross-product sum" or "x test", has been

deVIsed, whIch can be brought to bear upon thIs question and, by methods of mathematical

companson, ehmmate to a large degree the uncertamtIes of the ocular method of matchIng and

combmmg frequency wstnbutIons, thus m many cases matenally reducmg the tIme reqUlred

for solutIon of a complex problem

I I

I
(VIII)

2~f9dElJ= 0667(2NlNa), or

~f9d91= 0667

NINI

9 The kut eq:uatwn th'U8 perrrl/l.t8 of e8tab1Mh~ng an expected value for the 8um of the prOductB

of the corre8pond~ng frequencu8 of the two dutMbut'Wn8 be~ng conmdered for amalgamat'Wn The

croBB-product BUm or X teetfor match~ng two dumbut~on8 u based upon equat'Wn (VIII)

48 Applymg the x test In matching distrIbutIons --a Suppose the followmg two distnbutlons are to be matched

13~922-39-6

77

Let the frequenCIes be Juxtaposed, for convenience m findmg the sum of the cross products

Thus'

fal-··---------------- 1 4 0 3 0 1 0 0 1 0 0 1 0 0 1 0 0 3 2 2 1 0 1 3 0 2 --_..N l=26

ABCDEFGHIJKLMNOPQRSTUVWXYZ

f9l------------------- 0 2 0 0 0 3 0 0 1 0 1 0 0 1 1 0 0 3 1 1 0 0 0 0 1 2 --_._N~=17

fal faa- ------------- 0 8 0 0 0 3 0 0 1 0 0 0 0 0 1 0 0 9 2 2 0 0 0 0 0 4

In tms case ~jadElJ=8+3+1+1+9+2+2+4=30

NINa= 26X 17=442

Reducing to simplest terms by cancelhng out smular expressions

fl-------------- ABC DE F G H I J K L M N 0 P Q RSTU V WXy Z

f2-------------- ABC D E FG H I J K L M N 0 P Q RSTU V W X YZ

b The fact that the quotient (0711) agrees very closely WIth the expected value (0667)

means that the two distnbunons very probably belong together or are properly matched Note

the quahfymg phrase "very probably" It imphes that there IS no certamty about tlns business

of matching distnbunons by mathematical methods The mathematics serve only as measunng

devices, so to speak, which can be employed to measure the degree of smulanty that exists

c Instead of dividing ~f9dElJ by NIN2and seeing how closely the quotient approximates the

value 0667 or 0385, one may set up an expected value for ~f9dElJ and compare It WIth the observed value Thus, in the foregomg example 0667 (NlNa)= 0667X422=28 15, the observed

value of ~f9d9s IS 30 and therefore the agreement between the expected and the observed values

IS quite close, mdicatmg that the two diatnbunons are probably properly matched

d There are other mathematical or statasucal tests for matchmg, m addition to the x test

Moreover, It IS possible to go further With the x test and find a measure of the reliance that may

be placed upon the value obtamed , but these pomts WIll be left for future discussion m subsequent texts

0667N2- 0667N

2

elements that follow this sign IS to be found, then the sum of the actual eomcidences noted m

the distnbunon may be mdieated thus ~ia(f~-l),which may be rewritten as

~19ll= 0667N12+ 9333Nl and

~f9s2= 0667Nl+ 9333N2,

d Now although denved from chfferent sources, the two expreasiona labeled (I) and (II)

above are equal, or should be equal, m normal plain text Therefore, one may write

(VI)

(II)

0667N12+ 9333Nl+2~f9dElJ+0667N:l+ 9333N2=

0667(N12+2NlNa+Nl)+ 9333Nl+ 9333N2

76

Expanding the terms of this equation

(VII) ~lall+2~f9d9s+~feI2=0667(N12+2NlNI+N22)+ 9333Nl+ 9333NI

But from equation (V)

Sunphfymg this equanon

(III) ~lal-~fa= 0667N2- 0667N

e Now~fa=N

Therefore, expression (III) may be wntten as

(IV) ~lal-N= 0667N2- 0667N,

which on reduction becomes

(V) ~lal= 0667N2+ 9333N

Thia equation may be read as "the sum of the squares of the absolute frequencies of a distribution

IS equal to 0667 tames the square of the total number of letters m the distnbunon, plus 9333

times the total number of letters m the distnbution " The letter 81 18 often used to replace the

symbol ~la2

1 Suppose two monoalphabetic distnbuaons are thought to pertain to the same Cipher

alphabet Now If thev actually do belong to the same alphabet, and Jf they are correctly a

combined mto a single distnbunon, the latter must stJ.11 be monoelphabenc in character That

IS, agam representmg the mdividual letter frequencies m one of these distnbunons bv the general

symbol fal the mdrvidual letter frequencies m the other distnbuuon by191' and the total frequency

in the first distnbunon by Nit that in the second distnbuncn by NI , then

3 By "correctly" IS meant that the two dIStrIbutIOns are slid relative to each other to their proper superImposrtion

80 that equation (VII) may be rewritten thus
and

78

e One more pomt will, however, here be added m connectIon With the x test Suppose

the very same two chBtnbutIons m subparagraph a are agam Juxtaposed, but With fa. slufted one

mterval to the left of the posmon shown m the subparagraph of reference Thus

{

I 4 0 3 0 1 0 0 1 0 0 1 0 0 1 0 0 3 2 2 1 0 1 3 0 2 ------N1=26

fOl--- ------------- ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

{

B C D E F G H I J K L M N 0 P Q R STU V W X Y Z A ------N2= 17

f9l---- ------------ 2 0 0 0 3 0 0 1 0 1 0 0 1 1 0 0 3 1 1 0 0 0 0 1 2 0

'1-fodo! = 10 = 0226

N1"N; 442

The observed ratio (0226) ISso much smaller than the expected ( 0667) that It can be saad that If

the two distnbunona pertain to the same pnmary components they are not properly superimposed

In other'lJ)()rd8, the xtestmay also beapplud'l.n case8 where t'lJ)() ormorefreg:uency d'l.8trtlrutwns m'U8t

be shifted relatwely 'I.n order tofind thetr correct 8'Upertmposmon The theory underlymg thia apphcation of the x test ia, of course, the same as before two monoalphabenc distnbunona when properly combined will yield a smgle distnbutaon which should still be monoalphabene m character

In applyIng the x test m such cases It may be necessary to smft two 26-element distnbunons to

various supenmposmons, make the x test for each supenmposmon, and take as correct that one

wmch yIelds the best value for the test

f The nature of the problem will, of course, determme whether the frequency distnbutaona

which are to be matched should be compared (1) by direct supenmposraon, that IS, settIng the A

to Z ta.lhes of one distnbuuon directly opposite the correspondmg tallies of the other distnbunon,

as m subparagraph a, or (2) by slufted supenmpoeraon, that is, keepmg the A to Z ta.lhes of the

first distnbunon fixed and shdmg the whole sequence of ta.lhes of the second distnbunon to

vanous supenmposraens agamst the first

SECTION XIII

APPLYING THE CROSS·PRODUCT OR X TEST

Paragraph Study of a situanon In which the x test may be apphed_______________ __.___________________________ 49

Solution of a piogreesrve-alphabet system bv means of the x test______________________________________________________ 50

Alternative method of solution __ __ _ _ ._______________ 51

49 Study of a Sltuatlon in wluch the x test may be apphed -a A SImple demonstration

of how the x-test lS apphed m matchmg frequency distnbutacns may now be set before the

student The problem mvolved lS the solution of cryptograms enciphered according to the

progressrve-alphabet system (par 36b), With secondary alphabets denved from the mteracnon

of two identical JIUXed primary components It will be assumed that the enemy has been usmg

a system of thIs kmd and that the pnmary components are changed dBJ.1y

b Before attacking an actual problem of thlS type, suppose a few mmutes be devoted to a

general analYSlS of ItS elements It lS here assumed that the primary components are based

upon the HYDRAULIC Z sequence and that the CIpher component IS shifted toward the

nght one step at a time Consider a CIpher square such as that shown in FIgure 12, which IS

applicable to the type of problem under study It has been arranged in the form of a deciphenng

square In tlna square, the hortzontal sequence8 are all tdenncal but merely shifted relattvely, the

letters tMule the square are platn-textletters

(79)

•
80

ALPHABJ!,T No

1 2 3 <I 5 6 7 8 9 10 11 12 13 1<1 15 16 17 18 19 20 21 22 23 2;l 25 26

A A U L I C B E F G J K MN 0 P Q S T V WX Z H Y D R

B B E F G J K MN 0 P Q S T V WX Z H Y D R A U L I C

C C B E F G J K MN 0 P Q S T V WX Z H Y D R A U L I

D DRAULICBEFGJKMNOPQSTVWXZHY

E E F G J K MN 0 P Q S T V WX Z H X D R A U L I C B

F F G J K MN 0 P Q S T V WX Z H Y D R A U L I C B E

G G J K MN 0 P Q S T V WX Z H Y D R A U L I C B E F

H H Y D R A U L I C B E F G J K MN 0 P Q S T V WX Z

I I C B E F G J K MN 0 P Q S T V WX Z H Y D R A U L

J J K MN 0 P Q S T V WX Z H Y D R A U L I C B E F G

K KMNOPQSTVWXZHYDRAULICBEFGJ

pil L LICBEFGJKMNOPQSTVWXZHYDRAU

M MNOPQSTVWXZHYDRAULICBEFGJK

N NOPQSTVWXZHYDRAULICBEFGJKM

Iloo II:i 0 OPQSTVWXZHYDRAULICBEFGJKMN

o P PQSTVWXZHYDRAULICBEFGJKMNO

Q QSTVWXZHYDRAULICBEFGJKMNOP

R R A U L I C B E F G J K MN 0 P Q S T V WX Z H Y D

SST V W X Z H Y D R A U L I C B E F G J K M N 0 P Q

T T V WX Z H Y D R A U L I C B E F G J K MN 0 P Q S

U U L I C B E F G J K MN 0 P Q S T V WX Z H Y D R A

V V WX Z H Y D R A U L I C B E F G J K MN 0 P Q S T

W WX Z H Y D R A U L I C B E F G J K MN 0 P Q S T V

X X Z H Y D R A U L I C B E F G J K MN 0 P Q S T V W

Y Y D R A U L I C B E F G J K MN 0 P Q S T V WX Z H

Z Z H Y D R A U L I C B E F G J K MN 0 P Q S T V WX

[Plam text letters are wlthm the square proper]

FIGUIllI: 12

• c If, for mere purposes of demonstration, instead of letters withm the cells of the square

there are placed tallies correspondmg m number With the normal frequencies of the letters

occupymg the respectrve cells, the cipher square becomes as follows (showing only the 1st

three rows of the square)

ALPHABET No

1 2 3 <I 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 2;l 25 26

:::

::::: ::: i!'i ::: :::- ::::: ::: A -:::::

i!'i ::: i!'i ::: i!'i ::: ::: - i!'i - i!'i i!'i ::: § - ::: ::: i!'i -- :::- --- - - - - - --- - --- - -- - - -- - -- - - -- :::

i!'i ::: - B :::::. - ::: ::: -:: ::.::

i!'i ::: ::: ::: i!'i i!'i 2:: 2:: :::::

- ?:: -- Z. :::: -- - ::::: ::::: 1--- - ---- - - -- - - - --- --- --- - ---

" - --- :::

::: ::::: :::: :::: C ::: -::::: :::::

::: -i!'i ::: ::::: ::: i!'i ::: i!'i i!'i - - ::: ::: § i!'i ::: :::

FIGURE 1311

81

d It IS ObVIOUS that here IS a case wherem If two drstnbutions pertammg to the square are

Isolated from the square, the x test (matching dismbutions) can be apphed to ascertain how the

distnbuuons should be shifted relatrve to each other so that they (an be supenmposed and made

to Yield a monoalphabene composite There is obviously one correct supenmposiuon out of 25

pos-abihties In this case, the B row of talhes must be displaced 5 mtervals to the nght 1Il order

to match It and amalgamate It WIth the Arow of talhes TIm,>

:::::

::: i!'i ::: -:: :::: -- -:: -- - A i!'i :; "'- it. 2;: :g. :; '12 -'" ..... :E if -- z.

1 , 4 5 6 7 10 11 l' 14 15 16 17 18 -lq )0 .<1 22 21 '::4 J; 26

- --- --- - - - - - --- - - - - -- - - - --- - -- - - :::

-:: :::: i!'i .". - -- - B 2;: ::: i!'i :::. :::- :.?' ::: ~8 ::::: ::::.. ;?

.J ", J5 26 "1 2 5 6 7 8 J 10 11 12 n 14 15 16 17 19 .0 '<1

FlrURE 13b

e Note that the amount of displacement, that IS, the number of intervals the B sequence

must be shrfted to make It match the Asequence m FIgure 13b, corresponds exactly to the dietance

between the letters A and B m the primary CIpher component, which IS 5 mtervals Thus

0123<15

A U L I C B The fact that the primary plain component 1"1 m thi« case identical

With the primary CIpher component has nothmg to do with the matter The d'/,splacement '/,nterval

'/,s be'/,ng measured on the c'/,phel component It IS Important that the student see tlus pomt very

clearly He can, If he hke, pro" e the pomt by expenmentmg With two different primary components

f Assummg that a message 1Il such a system I'> to be solved, the text IS transcnbed m rows

of 26 letters A umhteral frequency distnbution IS made for each column of the transcnbed

text, the 26 separate distnbunons bemg compiled withm a smgle square such as that shown m

FIgure 14 Such a square may be termed afrequency d'/,stnbutwn sqoore

9 Now the vertical columns of talhes within such a distnbution square constitute frequency

diatnbunons of the usual type They show the distnbunon of the various CIpher letters m each

CIpher alphabet If there were many lmes of text, all arranged m penods of 26 letters, then each

column of the frequency square could be solved m the usual manner, by the apphcatron of the

SImple pnnciples of monoalphabetic frequency But what do the horizontal rows of talhes

withm the square represent? Is It not clear that the first such row, the A row, merely shows the

distnbuuon of A. throughout the SUCCeSSIVE' CIpher alphabets? And does not th'/,s graph'/,c puture

of the d'/,stnbutwn of A. correspondto the sequence of letters compos'/,ng the pnmary pla'/,n oomponentr

Furthermore, ISIt not clear that what has been said of the A row of tallies applies equally to the

B. C. D. Z rows? Finally, IS It not clear that the graphic pictures of all the distnbunons

correspond to the same sequence of letters, except that the sequence begins With a different letter

III each row? In other words, all the horizontal rows of tallies within the distnbution square

apply to the same sequence of plain-text letters, the sequences m one row merely begmnmg WIth

a different letter from that With which another row begms The sequences of letters to wluch

the talhes apply III the varIOUS rows are merely displaced relative to one another Now If there

are sufficient data for statistical purposes In the varIOUS horizontal sequences of tallies within the

distnbunon square, these sequences, bemg approxrmately smnlai , can be studied by means of

the x test to find the'/,r rplat'/,t'p d'/,~placement~ And m findmg the latter a method IS plOVIdN]

wherE'by the prImary CIpher component may be rE'constrlletE'd, smce the correct absembhng of

the dIsplacement data wIll yw]d the sequenee of letters l'Onstitutmg the prlmary CIpher component

If the plam eomponent 1"1 IdpntICltl With the elpher component, tIl(> e;oluhon I'> ImmE'dlc1tely III
82 83

hand, If they are dIfferent, the solunon IS but one step removed Thus, there has been elabo- b The message IS transcnbed mimes of 26 letters, since that IS the total number ofsecondary

rated a method of solvmg tlus type of cipher system vnthout mahng any aB8Umptwns oj values alphabets in the system The transcnbed text IS shown below

for mpher letters

1 8 4 S 8 7 8 9 ro II " D U ro u ro ro m • H • • 60 Solution of a progressive-alphabet system by means of the X test -a The followmg

cryptogram has been enciphered according to the method indicated, by progressive, SImple, 1 W G J J M M M J XED G C 0 C F T R P B M I I I K Z

unmterrupted slnftmg of a primary Cipher component against an Identical pnmary plain 2 RYNNBUFRWWWWYOIHFJKOKHTTAZ

component 3 CLJEPPFRWCKOOFFFGEPQRYYIWX

CRYPTOGRAM 4 MXUDIPFEXMLLWFKGYPBBXCHBFY

W G J J M M M J X E 5 lET X H FBI V DIP N X I V R P W T M G IMP T D G C 0 C F T R P B M I I I K ZRYNN

B U F R W W W W Y 0 6 ECJBOKVBUQGVGFFFKLYYCKBIWX I H F J K o K H T T A Z C L J E P P F R

W C K 0 0 F F F G E P Q R Y Y I W X M X 7 MXUDIPFFUYNVSSIHRMHYZHAUQW U DIP F E X M L L

W F K G Y 8 G K T I U X Y J J A 0 W Z 0 C F T R P P 0 Q U S G Y P B B X C H B FYI E T X H F B I V D I P N X I V

R P W T M G IMP T 9 CXVCXUCJLMLLYEKFFZVQJQSIYS E C J B 0 K V B U Q G V G F F F K L Y Y

C K B I W 10 PDSBBJUAHYNWLOCXSDQVCYVSIL XMXUD I P F F U Y N V S S I H R M H Y Z H A U

Q W G K T IUXYJ 11 IWNJOOMAQSLWYJGTVPQKPKTLHS J A 0 W Z o C F T R P P 0 Q U S G Y C X

V C X U C 12 ROONICFEVMNVWNBNEHAMRCROVS J L M L L Y E K F F Z V Q J Q SlY S P D S B B J

UAHYN W L 0 C X 13 TXENHPVBTWKUQIOCAVWBRQNFJV S D Q V C Y V S I L I W N J 0 o M A Q S

LWYJG T V P Q K 14 NRVDOPUQRLKQNFFFZPHURVWLXG P K T L H S ROO N I C F E V M N V W N

BNEHA M R C R 0 15 SHQWHPJBCNNJQSOQORCBMRRAON V S T X E NHPVB T W K U Q I 0 C A V

WBRQN 16 RKWUHYYCIWDGSJCTGPGRMIQMPS F J V N R V D 0 P U Q R L K Q N F F F Z PHURV

W L X G S 17 GCTNMFGJXEDGCOPTGPWQQVQIWX H Q W H P J B C N N J Q S 0 Q o R C B M R R A 0 N

RKWUH Y Y C I W 18 TTTCOJVAAABWMXIHOWHDEQUAIN D G S J C T G P G R M I Q M P S G C T N

M F G J X E D G C 0 19 FKFWHPJAHZITWZKFEXSRUYQIOV P T G P W Q Q V Q I W X T T T C 0 J V A

AABWM X I HOW 20 RERDJVDKHIRQWEDGEBYBMLABJV H D E Q U A I N F K F W HPJ A H ZIT

W Z K F E XSRUY 21 TGFFGXYI VGRJ YEKFBEPBJ OUAHC Q I 0 V R E R D J V D K H I R Q WED G

EBYBM LAB J V 22 UGZLXIAJKWDVTYBFRUCCCUZZIN T G F F G X Y I V G R J Y E K F B E P B 23 NDFRJFMBHQLXHMHQYYYMWQVCLI J 0 U A H C U G Z L X I A J K W D V T Y B F R U C C C U Z Z 24 PTWTJYQBYRLITUOUSRCDCVWDGI INN D F R J F M B HQLXH MHQYY YMWQV C LIP T

WTJYQ 25 GGUBHJVVPWABUJKNFPFYWVQZQF B Y R L I T U 0 U S R CDC V W D GIG G U B H J

V V P W A B U J K N F P F Y W 26 LHTWJPDRXZOWUSSGAMHNCWHSWW V Q Z Q F L H T W J P D R X Z

o W U S S GAMHN 27 LRYQQUSZVDNXANVNKHFUCVVSSS C W H S W W L R Y Q Q U S Z V DNXAN

VNKHF 28 P L Q U P C V V V W D G S JOG T C H D E V Q S I J U C V V S SSP L Q U P C V V V W D G S JOG T C

HDEVQ 29 PHQJAWFRIZDWXXHCXYCTMGUSES S I J P H QJAWF R I Z D W X X H C X Y C T M G

USE S N 30 NDSBBKRLVWRVZEEPPPATOIANEE D S B B K RLVWR V Z E E P P PAT 0 I A NEE

EEJNR C Z B T B 31 EEJNRCZBTBLXPJJKAPPMJEGIKR L X P J J K A PPM J E G I K R T G F F

HPVVV Y K J E F 32 TGFFHPVVVYKJEFHQSXJQDYVZGR HQSXJ Q D Y V Z GRRHZ QLYXK

X A Z 0 W RRXYK 33 RHZQLYXKXAZOWRRXYKYGMGZBYN Y G M G Z BYNVH Q B R V F E F Q L L

WZEYL J E R 0 Q 34 VHQBRVFEFQLLWZEYLJEROQSOQK S 0 Q K 0 M W lOG MBKFF LX D X T

L W I L P Q SED Y 35 OMWIOGMBKFFLXDXTLWILPQSEDY I 0 E M 0 I B J M L NNSYK X J Z J M

L C Z B M S D J W Q 36 IOEMOIBJMLNNSYKXJZJMLCZBMS X T J V L FIR N R XHYBD B J U F I

R J I C T UUUSK 37 DJWQXTJVLFIRNRXHYBDBJUFIRJ KWDVM F W T T J K C K C G C V SAG

Q B C J M E B Y N V 38 ICTUUUSKKWDVMFWTTJKCKCGCVS S S J K S D C B D Y F P P V F D W Z M T

BPVTT 39 AGQBCJMEBYNVSSJKSDCBDYFPPV C G B V T Z K H Q D o R M E Z o 0 40 FDWZMTBPVTTCGBVTZKHQDDRMEZ

41 o 0
84

Nw=52

~fvlw=122

Nv=53

r 1 0 2 0 0 2 6 4 8 0 0 7 0 0 2 '1 1 1 1 1 0 6 4 0 2 4 Nv=53

IVl 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

IW{ : 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 1 2 3

0 1 0 0 2 8 1 7 6 0 1 0 0 2 3 0 2 1 2 0 4 2 1 1 5 Nw=52

Ivl." 3 0 2 0 0 4 48 4 56 0 0 7 0 0 4 3 0 2 1 2 o 24 8 0 2 20 ~/vlw=190

{

I 0 2 0 0 2 6 4 8 0 0 7 0 0 2 1 1 1 1 1 0 6 4 0 2 4

Iv 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

{

18 19 20 21 22 23 24 25 26 1 2 3 4 5 6 6 8 9 10 11 12 13 14 15 16 17

I." 2 3 0 2 1 2 0 4 2 1 1 5 3 0 1 0 0 2 8 1 7 6 0 1 0 0

Ivl." 2 0 0 0 0 4 0 16 16 0 0 35 0 0 2 0 0 2 8 1 0 36 0 0 0 0

~vl." = 122 = 044

NvNw 2756

THIRD TEST

FIRST TEST

Ir{ 0 2 0 0 2 6 4 8 0 0 7 0 0 2 1 1 1 1 1 0 6 4 0 2 4 Nv=53

2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

I {24 25 26 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

." 0 4 2 1 1 5 3 0 1 0 0 2 8 1 7 6 0 1 0 0 2 3 0 2 1 2 Nw=52

Ivlw 0 0 4 0 o 10 18 0 8 0 o 14 0 014 6 0 1 0 0 o 18 0 0 2 8 ~/vlw=103

~fvlw = 103 = 037

NvNw 2756

SECOND TEST

~/vlw = 190 = 069

NvNw 275b

e Smce the last of the three foregoing tests grves a value somewhat better than the expected

0661, It looks as though the correct pOSItIOn of the Wdistnbution WIthreference to the Vdiatnbutaon has been found In practice, several more teats would be made to Insure that other close

approximataons to 0667 will not be found, but these WIll here be omitted The test indicates

1 2 3 i

that the primary CIpher component has the letters V and WIn these positrons V W, SInce

the correct supenmpositaon requrres that the 4th cell of the Wdistnbution must be placed under

the 1st cell of the V distribution (see the last supenrnposition above)

f The next best distnbutaon WIth which to proceed IS the F distnbution, WIth 51 occurrences

Paralleling the procedure outhned In paragraph 43, and for the same reasons, the F sequence

IS matched agamst the Wand V sequences separately and then against both Wand V sequences

85

d The:t test will now be applied to the honzontal rows of tallies In the distribunon square,

In accordance WIth the theory set forth in paragraph 49g Since this test IS purely statIstIcal

In character and becomes mcreasmgly reliable as the srze of the distnbutions Increases, It IS best

to start by workmg WIth the two distnbutions having the greatest total numbers of tallies

These are the V and Wdistnbunons, WIth 53 and 52 occurrences, respectively The results of

three relatIve displacements of these two distributions are shown below, labeled "J:41rst test,"

"Second test," and "Third test"

46

25

43

88

a1

45

52

44

45

34

39

39

35

43

33

37

31

39

37

N

Fmuftl' 14

I I I I-I [-I~I-I~I-I I-I I I I~l l~l I-[ 1~1~1-1

I j 1~1~11~1~1-1-1-1-11-1~11-1~1-1~111-1~11

~1~C 1~1-1~1-/-I-I-1 I-I~I i~I~1 l-lgl~~I§1 1~1 1-

li§! j~1 I I~I I I~I~I I 1-'-' I~I '-I~I~I-I '-'-I

I I 1-' I I I%I I I I I-I I I I I 1-I I 1-I 1-I r- ~I I~I~I I~I~'-I-I~I-I I I~I~I~I~I I~I I , I~I-I-I-

~I~I I 1-1-/-/ I 1-1-1~1~1 I-I~I~I 1-1-1 I~I~I I~I~

I~I I I~l I I I~I I I 1-' 1~1~1 I~I~I I I~I~I I~I-

~I I I~'~'~I '~I~I-I~I-I I-'~I I I I-I I 1~1~1~1~1~

1-1§1~1~1~1~1~1-1 I I~l 1~1~1 I-I~I~I 1~1 I I I~I~

I~I I I 1~1 1~1~1 I~I I I 1~1~1~1~1~1-1~1~1 I 1~1-

~I~I 1-1-' I 1-1~1~1~1%1-1 I I I~l-I 1-'-1-' I~I<I-

~I-I [l~l-I~I :I-I~I ] I~l-I I I '-I I~I~I I 1~I-r

\ \ I~ I I I I 1=1-1 \-1 I [ I I I I I-I I l-I-I-r- ~I~I-I I~l-l 1I I 1~1~1-1~1~1 1~1 I I-I~I-I I~I~I

~I I J]~I~I r-'-I I 1-1-1 1-1-1-1~1~1-I~j I I' 14-

I I~I~J-I j-I-I-I~I I~)~) j 1~1 I )~I~I-I~I~1 I~I

~I~I-I-I~I 1-1~1-1--1~1-1 I~I-I-I~I~I I~I%I-I~I IT

-, I~I I I I~I I I-I I I~I~I-I '~I I-I I I I~I~I-r~

~I~I~I] I~I I-I~I-I-I-I~I I I~I~I I I~I I I~I-I l~

:I ]~I~I:I~I~I]~[ I I-I~I-I I-I '-I 1~1-1~1~1-I'1

-, I~I I I~I~I~I:I I I~I I I~I-I-I-I-I-I I~I~I l~l~

-1-1~1~1 I-I I 1~1~1--1~1~1 \-1 I I~I~I I~I-I~I I~I~

I~I I-I~l~l-I I~I I 1~1~I~j~j~I-I~1 I I-I I I I-I~

1-1-1 I l~j~1 I-I~I I I~I~I I-I~I~I~I~I I~I-I /~I~

I 1~1-1 I 1-1-' 1~1-1 1~1~1 I l~1 ~I I I-I I~l~! I~

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 26 26 1

Q

R

S

T

U

V

W

X

Y

Z

A

B

C

D

E

F

G

H

I

J

K

L

M

N

o

p

c A frequency distnbunon square IS then complied, each column of the text formmg a

separate distnbunon ill columnar form m the square The latter IS shown ill figure 14

I ? 3 4 ft 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26
86

123 4 6 G 7 8 9 W II U W M n M z

V A L WN 0 X F B P Y R C Q ZIG S E H T D J U MK

at their correct supenrnposmon The following shows the correct relatrve posrnons of the three

distnbunons

87

1 2 4 5 6 7 8 9 10 11 12 1~ 14 15 16 17 18 19 20 21 22 2~ 24 25 26

1 WG J J MMMJ XED G C 0 C F T R P B M I I I K Z

WIT H THE IMP R 0 V E MEN T SIN THE A I

2 R Y N N B U F R WWWWY 0 I H F J K 0 K H T T A Z

R P LAN E AND THE MEA N S 0 F COM MU N I

3 CLJEPPFRWCKOOFFFGEPQRYYIWX

CAT ION AND WIT H THE V A S T S I Z E 0 F

4 MX U DIP F E X M L L WF K GYP B B X C H B F Y

MOD ERN ARM I E SST RAT E G I C SUR P R

5 lET X H FBI V DIP N X I V R P WT MG IMP T

I SEW ILL B E COM E H A R D ERA N D H A R D

6 E C J B 0 K V B U Q G V G F F F K L Y Y C K B I WX

E R T 0 A T T A I N X I NTH E PRE SEN CEO F

7 MX U DIP F F U Y N V S S I H R MH Y Z H A U Q W

MOD ERN A V I A T ION AND F A S T M0 V I N

8 G K T I U X Y J J A 0 WZ 0 C F T R P P 0 Q U S G Y

G M E C HAN I ZED E L E MEN T S G REA T E R

9 C X V C X U C J L ML LYE K F F Z V Q J Q SlY S

COM P LEX I TIE S M0 RES U BTL E DEC E

10 P D S B B J U A H Y N WL 0 C X S D Q V C Y V S I L

P T ION SST RAT E GEM SAN D F E I N T S W

11 I WN J 0 0 MA Q S L WY J G T V P Q K P K T L H S

ILL H A VET 0 BEE M P LOY E D X I N MOD E

12 ROO N I C F E V MN V WN B N E HAM R C R 0 V S

R N WAR FAR E I TIS S TIL L P 0 S SIB L E

13 T X E N H P V B T WK U Q I 0 C A V WB R Q N F J V

TOG A I N T ACT I CAL SUR P R I S E B Y MA

14 N R V D 0 P U Q R L K Q N F F F Z P H U R V WL X G

N Y MEA N S X WH I LET HEM E A N S 0 FOB S

15 S H Q WHPJ B C N N J Q S 0 Q 0 R C B MR R A 0 N

S E R V I N G AND T RAN S MIT TIN GIN F 0

t Of course, It IS probable that m practical work the process of matching distrrbutions

would be interrupted soon after the pOSItIOns of only a few letters in the primary component had

been ascertained For by trymg partially reconstructed sequences on the CIpher text the skeletons of some words would begin to show By fillmg in these skeletons With the words suggested

by them, the process of reconstructmg the components IS much facilitated and hastened

J The components having been reconstructed, only a moment or two IS necessary to ascertain their mitral pOSItIOn m enciphering the message It 18 only necessary to Juxtapose the

two components so as to grve "good" values for anyone of the vertical distnbunons of FIgure 14

This then gives the juxtaposition of the components for that column, and the rest follows very

easily for the plain text may now be obtamed by direct use of the components The plain text

of the message IS as follows

N,=51

I.fv/F=212

Nv=53 {

I 0 2 0 0 2 6 4 8 0 0 7 0 0 2 1 1 1 1 1 0 6 4 0 2 4

Iv 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

I {8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 1 2 3 4 5 6 7

., 1 1 2 100 6 3 9 3 0 2 0 0 0 2 1 1 1 2 0 4 2 0 3 7

Ivl., 1 0 4 0 0 0 36 12 72 0 0 14 0 0 0 2 1 1 1 2 0 24 8 0 6 28

I.lvl., = 212 = 078

NvN, 2,703

{

I 1 5 3 0 1 0 0 2 8 1 7 6 0 1 0 0 2 3 0 2 1 2 0 4 2 N w=52 Iw 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

{

5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 1 2 3 4

I., 0 3 7 1 1 2 1 0 0 6 3 9 3 0 2 0 0 0 2 1 1 1 2 0 4 2 N.,=51

Iwl., 0 3 35 3 0 2 0 0 0 48 3 63 18 0 2 0 0 0 6 0 2 1 4 0 16 4 'Zlwl.,=21O

'Zlw/F == 210 = 078

NwN, 2,703

Smce It was stated that the problem mvolves identical primary components, both components

are now at hand

g The process IS continued in the foregoing manner until the entire primary CIpher component has been reconstructed It IS ObVIOUS that as the work progresses the cryptanalyst IS

forced to employ smaller and smaller distributions, so that statastacally the results are apt to

become less and less certam But to counterbalance this there IS the fact that the number of

possible supenmposiuons becomes progressively smaller as the work progresses For example,

at the commencement of operations the number of possible pomts for superimposing a second

sequence agamst the first IS 25, after the relative pOSItIOns of 5 drstnbutions have been ascertamed and a 6th distnbunon If, to be placed m the primary sequence being reconstructed, there

are 21 possible pOSItIOns, after the relative pOSItIOns of 20 drstnbutions have been ascertaaned,

there are only 6 possible pOSItIOns for the 21st distnbunon, and so on

h In the foregoing case the completely reconstructed pnmary CIpher component IS as

follows

{

4 0 3 0 0 4 14 5 15 6 0 8 0 0 4 4 1 3 2 3 0 10 6 1 3 9 NH W =105

I(v+w) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

f {

8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 1 2 3 4 5 6 7

, 1 1 2 1 0 0 6 3 9 3 0 2 0 0 0 2 1 1 1 2 0 4 2 0 3 7 N.,=51

l(v+w)/F40 6 0 0 0 84 15 35 18 0 16 0 0 0 8 1 3 2 6 0 40 12 0 9 63 I.ICV+Wl!Jr=422

I.1(v+wJ.,= 422 = 079

N(V+WlN., 5,355

1 284 a G 7 8

The test YIelds the sequence V W F

I ",
88

1 2 3 4 Ii 6 7 8 9 10 11 12 13 14 Iii 16 17 18 19 20 21 22 21 24 2Ii 26

16 R K WU H Y Y C I WD G S J C T G P G R M I Q MP S

R MAT ION 0 F T ROO P M 0 V E MEN T S ARE

17 G C T N MF G J XED G COP T G P WQ Q v Q I WX

G REA T L Y IMP R 0 V E D 0 V E R THO S E 0 F

18 T T T C 0 J V A A A B WMX I HOW H D E QUA I N

THE PAS T THE ME C HAN I CAL MEA N S 0

19 F K F WHPJ A H ZIT WZ K F E X S R U Y Q I 0 V

F M 0 V I N G T ROO P S ARE L IKE WI S E F A

20 R E R D J V D K H IRQ WED G E B Y B MLAB J V

R S PEE DIE R X A L S 0 F A L S E I N FOR MA

21 T G F F G X Y I V G R J Y E K F B E P B J 0 U A H C

T ION CAN B E FAR M 0 R E E A S I L Y AND Q

22 U G Z L X I A J K WD V T Y B F R U C C C U Z Z I N

U I C K L Y DIS T RIB UTE D X THE L E S S 0

23 N D F R J F MB H Q L X H MH Q Y Y Y MWQ v C L I

N T 0 BEL EAR NED FRO MTHE 0 PEN I N G

24 P T WT J Y Q B Y R LIT U 0 U S R CDC V WD G I

P HAS E 0 F ALL E N B Y S BAT T LEO F MEG

25 G G U B H J V V P WABU J K N F P F Y Wv Q Z Q F

G I D 0 1ST HAT SUR P R I S E I S P 0 S SIB

LHTWJPDRXZOWUSSGAMHNCWHSWW

LEEVENINMODERNWARFAREBUTON

LRYQQUSZVDNXANVNKHFUCVVSSS

L Y B Y PER F E C T DIS C I P LIN EON THE

28 P L Q U P C v v v WD G S JOG T C H D E V Q S I J

PAR T 0 F THE T ROO P SAN D A L M 0 S T S U

29 P H Q JAW F R I Z D WX X H C X Y C T MGUS E S

PERHUMANFORETHOUGHTANDATTE

30 N D S B B K R L V WR V Z E E P P PAT 0 I A NEE

N T ION T 0 D ETA I LON THE PAR T 0 F T H

31 E E J NRC Z B T B L X P J J K A PPM J E G I K R

EST A F F B A C KED U P B Y RES 0 L UTE A C

23 T G F F H P V V V Y K J E F H Q S X J Q D Y V Z G R

T ION I NTH E A I R X TOM A I N T A INS E C

33 R H Z Q L Y X K X A Z 0 WR R X Y K Y G MG Z B Y N

R E C Y M 0 V E MEN T S MUS T B E U N D E R C 0

34 V H Q B R V F E F Q L L WZ E Y L J E R 0 Q S 0 Q K

V E R 0 FDA R K N E S SAN D C 0 V ERE D B I V

350M WI 0 G MB K F F L X D X T L WI L P Q SED Y

o U A CAR E A S MUS T B E 0 C CUP I E D D U R

89

1 2 3 4 Ii 6 7 8 9 10 11 12 11 14 n 16 17 18 19 20 21 22 23 24 Ali 26

36 I 0 E M0 I B J ML N N S Y K X J Z J ML C Z B MS

I N G DAY L I G H THO U R S X UNO B S E R V E

37 D J WQ X T J V L FIR N R X H Y B D B J U FIR J

DDAYLIGHTMOVEMENTSWILLREQU

38 I C T U U U S K K WDVM F WT T J K C K C G C V S

IRE THE RES T RIC T ION 0 F H 0 S TIL E

39 A G Q B C J ME B Y N V S S J K S D C B D Y F P P V

A I ROB S E R V A T ION B Y ANT I A I R C R A

40 F D WZ MT B P V T T C G B V T Z K H Q D D R ME Z

F TAR TIL L E R Y AND COM BAT A V I A T I

41 0 0

o N

WITH THE IMPROVEMENTS IN THE AIRPLANE AND THE MEANS OF COMMUNICATION AND WITH

THE VAST SIZE OF MODERN ARMIES STRATEGIC SURPRISE WILL BECOME HARDER AND

HARDER TO ATTAIN XINTHE PRESENCE OF MODERN AVIATION AND FAST MOVING MECHANIZED

ELEMENTS GREATER COMPLEXITIES MORE SUBTLE DECEPTIONS STRATEGEMS AND FEINTS

WILL HAVE TO BE EMPLOYED X IN MODERN WARFARE IT IS STILL POSSIBLE TO GAIN

TACTICAL SURPRISE BY MANY MEANS XWHILE THE MEANS OF OBSERVING AND TRANSMITTING

INFORMATION OF TROOP MOVEMENTS ARE GREATLY IMPROVED OVER THOSE OF THE PAST THE

MECHANICAL MEANS OF MOVING TROOPS ARE LIKEWISE FAR SPEEDIER X ALSO FALSE

INFORMATION CAN BE FAR MORE EASILY AND QUICKLY DISTRIBUTED XTHE LESSON TO BE

LEARNED FROM THE OPENING PHASE OF ALLENBYS BATTLE OF MEGGIDO IS THAT SURPRISE IS

POSSIBLE EVEN INMODERN WARFARE BUT ONLY BY PERFECT DISCIPLINE ON THE PART OF THE

TROOPS AND ALMOST SUPERHUMAN FORETHOUGHT AND ATTENTION TO DETAIL ON THE PART OF

THE STAFF BACKED UP BY RESOLUTE ACTION IN THE AIR XTO MAINTAIN SECRECY MOVEMENTS MUST BE UNDER COVER OF DARKNESS AND COVERED BIVOUAC AREAS MUST BE OCCUPIED

DURING DAYLIGHT HOURS XUNOBSERVED DAYLIGHT MOVEMENTS WILL REQUIRE THE RESTRICTION OF HOSTILE AIR OBSERVATION BY ANTIAIRCRAFT ARTILLERY AND COMBAT AVIATION

k The student should clearly understand the real nature of the matchmg process employed

to such good advantage 10 tills problem ln pracncally all the previous cases frequency distnbunons were made of c~pher letters occurnng 10 a cryptogram, and the tallies 10 those distnbunons represented the actual occurrences of CIpher letters Furthermore, when these distnbunons were compared or matched, what were being compared were actually Cipher alphabets

That IS, the textwas arranged 10 a certain way, so that letters belonging to the same Cipheralphabet

actually fell withm the same column and the frequency distnbunon for a specific Cipher alphabet

was made by tabulatmg the letters 10 that column Then If any distnbunona were to be compared, usually the entire distnbunon applicable to one Cipher alphabet was compared With the

entare distnbuuon applymg to another Cipher alphabet But 10 the problem Just completed,

what were compared 10 reality were not frequency distnbutions applying to the columns of the

CIphertext as transcribed on p 83, but graphic representations of the vananons 10 the frequencies

of platn-text letters jaU~ng ~n u1entwal sequences, the ulennne« oj these pla~n-text letters be~ng

unknown jor the moment Only after the reconstruction has been completed do their Identities

become known, when the plain text of the cryptogram IS established
COMPONENTS

MESSAGE

90

D U F F T

Y NUN L etc, etc

V W P X W

A Z V I S

W LPN M

CAD U V

LID 0 L

X GAM X

I K MK I

F N I I G

91

1 2 3 4 5 6 7 8 U 10 II U 14 W n z

Assumed plain text COM MAN DIN G G ENE R A L FIR S TAR M Y

Cipher I K M K I LID 0 L W LPN M V W P X W D U F F T F

12345 6 7 8 9 10 II U 14

TON

Y . Y Y

•

Reference to the plain component will show that the plain-text letters represented by the three

Y's appear m the order NOT, that 1.3, reversed With respect to their order in the plain text

But the intervals between these letters IS correct Again a consideration of the mechamcs of

the enciphering system shows why this IS so since the CIpher component IS displaced one step

With each encrpherment, two identical letters n intervals apart in the CIpher text must represent

plain-text letters which are n intervals apart m the plam component In the present case the

direction m which these letters run in the plain component IS opposite to that in which the

CIpher component IS displaced That IS, If the CIpher component IS displaced toward the left,

the values obtained from a study of repeated plain-text letters give letters which coincide in

sequence (interval and direction) With the same letters m the CIpher component, the values

obtained from a study of repeated CIpher-text letters give letters the order of which must be

reversed m order to make these letters comcide in sequence (interval and direction) With the

same letters m the plain component If the CIpher component IS displaced toward the right, this

relationshrp IS merely reversed the values obtained from a study of the repeated pl am-text

letters must be reversed m their order when placing them m the CIpher component, those Yielded

by a study of the repeated CIpher-text letters are inserted in the plain component m their ongmal

order

e Of course, If the primary components are identical sequences the data from the two

sources referred to in subparagraphs c and d need not be kept separate but can be combined

and made to Yield the pnmary component very quickly

j WIth the foregoing pnnciples as background, and given the followmg message, which IS

assumed to begm With COMMANDING GENERAL FIRST ARMY (probable-word method of attack),

the data yielded by this assumed text are shown in FIgure 15

MESSAGE

d Now consider the repeated CIpher letters m the example under b There happens to be

only two cases of repetition, both involving Y's Thus

(1 )

(2)

(3)

(4)

(5 )

(6)

FIR S T BAT TAL ION

128 4 5 6 7 8 U 10 II U 14

I I

I K

T T T

X P Y

A A

S T

Plam _

Cipher _

PlaIn _ ------------- CIpher _

Plam _ ------------- CIpher _

Plam_________________ H Y D R A U L I C B E F G J K M N 0 P Q S T V W X Z

Cipher F B P Y R C Q ZIG S E H T D J U M K V A L W N 0 X

1234567891011121314

Plain FIR S T BAT TAL ION

Cipher E I C N X D SPY T U K Y Y

c Certain letters are repeated m both plam text and CIpher text Consider the former

There are two I's, three T's, and two A's Their encipherments are Isolated below, for convemence in study

61 Alternative method of solution -a The foregoing method of solution IS, of course,

almost entirely statastical in nature There IS, however, another method of attack which should

be brought to notice because m some cases the statistical method, mvolvmg the study of relatrvely large distnbutions, may not be feasible for lack of sufficient text Yet in these cases there

may be sufficient data in the respective alphabets to permit of some assumptaons of values of

CIpher letters, or there may be good grounds for applying the probable-word method The

present paragraph will therefore deal With a method of solving progreasrve CIpher "ystems which

IS based upon the apphcanon of the pnnciples of mdirect symmetry to certain phenomena ansmg

from the mechanics of the progressive encipherment method Itself

b Take the two sequences below and encipher the phrase FIRST BATTALION by the progressrve method, slidmg the CIpher component to the left one interval after each encipherment

The two I's in line (1) are 10 letters apart, reference to the CIpher component Will show that the

interval between the CIpher equivalent of the first I p (which happens to be Ie) and the second I p

(wluch IS Ke) 18 10 Conaideration of the mechamcs of the enciphering system soon shows why

this IS so: since the CIpher component ISdisplaced one step With each encipherment, two identical

letters n intervals apart in the plain text must Yield CIpher equivalents which are n mtervals

apart m the Cipher component Exammanon of the data in lines (3) and (4), (5) and (6) will

confirm this finding Consequently, It would appear that m such a system the successful apphcation of the probable-word method of attack, coupled withm indirect symmetry, can quickly

lead to the reconstruction of the Cipher component
FIGUREH

92 93

128 4 5 6 7 8 D m 11 d

CIpher______________ N I I G X GAM X CAD

PlaIn________________ I LEO R

The word after ARMY 18 probably WILL TIus leads to the msertion of the letter Win the plam

component and Gm the cipher component In a short tune both components can be completely

estabhshed

9 In passmg, It may be well to note that in the illustrstrve message m paragraph 50a the

very frequent occurrence of tnpled letters (MMM, WWW, FFF, etc) mdrcatee the presence of a

frequently used short word, a frequently used ending, or the hke, the letters of which are sequent

m the plam component An astute cryptanalyst who has noted the frequency of occurrence

of such tnplets could assume the value THE for them, go through the entlre text replacmg all

tnplets by THE, and then, by applymg the principles of md1rect symmetry, build up the plain

component m a short tune WIth that much as a start, solunon of the entlre message would be

constderably sunphfied.

h The pnncrples eluCldated m this paragraph may, of course, also be applied to cases of

progressrve systems in wluch the progression 18 by mtervals greater than 1, and, WIth necessary

mochficatlons, to cases in which the progression 18 not regular but follows a speCIfic pattern, such

as 1-2-3, 1-2-3, , or 2-5-7-3-1, 2-5-7-3-1, and 80 The latter types of progres&lOn

are encountered m certam mechanical cryptographs, the study of wluch will be reserved for

future texts

letters m the message, gaps bemg filled m from the context For example, the first few letters

after ARMY decipher as follows

I-- - I - - - - - - - - _I-- - - - - - - - - - - - - K

I-- - - - - - - - - - - - - - - - - - - - - - - - - - M

>-- - - - - - - - - - - - - - - - - - - - - - - - - - K f--- - - - - - - - - - - - - - - - - - - - - - - - - - I

I--- - - - - - - - - - - - - - - - - - - - - - - - - L - - - - - - - - - - - - - - - - - - - - - - - - - II - - - - - - - - - - - - - - - - - - - - - - - - - - D

I--- - - - - - - - - - - - - - - - - - - - - - - - - 0

>-- - - - - - - - - - - - - - - - - - - - - - - - - - L

>-- - - - - - - - - - - - - - - - - - - - - - - - - 1-

W

I--- - - - - - - - - - - - - - - - - - - - - - - - - L

>-- - - - - - - - - - - - - - - - - - - - - - - - - 1-

P - - - - - - - - - - - - - - - - - - - - - - - - - - N '--- - - - - - - - - - - - - - - - - - - - - - - - -

f--

M - - - - - - - - - - - - - - - - - - - - - - - - - V

I--- - - - - - - - - - - - - - - - - - - - - - - - - W

I--- - - - - - - - - - - - - - - - - - - - - - - - - P

f--- - - ---- - - - - - - - - - - - - - - - - - - - IX

I--- - - - - - - - - - - - - - - - - - - - - - - - - W

I--- - - - - - - - - - - - - - - - - - - - - - - - 1-

- D - - - - - - - - - - - - - - - - - - - - >-- - -- ,---'

- U - - - - - - - - - - - - - - - - - - - - - - - - - F

f-- - - - - - - - - - - - - - - - - - - - - - - - - IF f-- - - - - - - - - -1-- - - - - - -

=1=- --- - - T - -- IF

ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

1 2 'J 4 5 6 7 8 9 10 11 12 18 14 15 16 17 18 19 20 21 22 23 24 25 26

Plam________________ A L I C E F G M N 0 S YDR

CIpher_______________{D MKV L W N 0 F P I T

• X

Analys18 of the data afforded by FIgure 15, in conjunction with the principles of indirect symmetry, YIelds the followmg partial components

Settmg the two partial components mto juxtaposinon so that Cp=I. (first encipherment) the

8th value, Ip=De• gives the posrtion of DIn the cipher component and permits the addmon of X

to It, these being two letters which until now could not be placed into posiuon m the cipher

component WIth these two partasl sequences It becomes possible now to decipher many other
+f z (iz- l ) X N(N-l), 2 ", 2 or

(X) Expected value offA(jA-l)+fB(jB-l)+ +Jz(fz-l)=",N(N-l)

If for the left-hand side of equataons (IX) and (X) the symbol E (~) IS used, then these equations

become

where E(4)) means the average or expected value of the expression m the parenthesis, IC" and

", are the probabihties of monographic comcidenoe ill plmn and in random text, respectively

d Now ill normal English plam text It has been found that IC,,= 0667 For random text

of a 26-1etter alphabet IC,= 038 Therefore, equations (XI) and (XII) may now be wntten

thus

(XIII) For normal English plain text E(~,,)= 0667 N(N-l)

(XIV) For random text (26-1etter alphabet) E(4),)= 0385 N(N-l)

e By employmg equations (XIII) and (XIV) It becomes possible, therefore, to test & plNe

of text for monoalphabetacity or for "randomness" That IS, by USIng these eqnauons ooe can

mathematlcally test a very short cryptogram to ascertain whether It 18 .. monoolphabMlcally

enciphered substrtutaon or involves several alphabets so that for all practical purposes It IS

equrvalent to random text ThIS test has been tel med the 4> test

64 Applying the 4> test -a GIven the following short piece of text, IS It likely that It IS

normal EnglIsh plain text enciphered moncalphabencally"

N=25

E(4),,)=IC,,N(N-l)

E(4),)=IC,N(N-l),

FOI plain text

For random text

ABCDEFGHIJKLMNOPQRSTUVWXYZ ~~~~~ ~~

(XI)

(XII)

For this case the observed value of ep IS

(1XO)+ (1XO)+ (2Xl)+ (3X2)+(4X3)+ (2X 1)+ (1XO)+ (4X3)+ (2X 1)+(1XO)+ (1XO)+

(3X2)=2+6+12+2+12+2+6=40

If t1us text were monoalphabenoally enciphered English plain text the expected value of 4> IS

E(4),,)=K,,N(N-l)= 0667X25X24=40 0

If the text were random text, the expected value of 4> IS

E(4),)=K,N(N-l)= OJ85X25X24=23 1

The conclusion IS warranted, therefore, that the cryptogram IS probably monoalphabetic subsntunon, smce the observed value of ep(40) more closely approximates the expected value for

English plain text (400) than It does the expected value for random text (23 1) (As a matter

of fact, the cryptogram was enciphered monoalphabetically )

b Here IS another example Given the followmg series of letters, does It represent a

selection of EnglIsh text enciphered monoalphabetacally or does It more nearly represent a

random selection of letters?

YOUIJ ZMMZZ MRNQC XIYTW RGKLH

Paragraph Purpose of the • test __ _ 52

Derivation of the • test_______________________________________ _ • 5.:1

69. Purpose of Ule (pm) test -a The student has noted that the X test IS based upon the

general theory of comcidences and employs the probability constants ICp and ICr There IS one

more test of a. related nature which may be useful for hun to understand and Its explanation

wUl be given ill the succeeding paragraphs

it In paragraph 48e It was stated that two monoalphabeuo distnbuuons when correctly

oombmed will yield a smgle distnbunon which should sWI be monoalphabenc ill character

ThIS question anses, therefore, ill the student's mmd Is there a test whereby he can ascertam

mathematlcally whether a diatnbution IS monoalphubeno or not, especially ill the case of one

which has1'elatlvely few data? Such a test has been devised and IS termed the "4> (phi) test"

68. Dennt1oJ1 of the 4> test.-a Consider a monographic or umhteral frequency distnbutaon

which IS monoalphabetac m eomposmon If there IS a total of N letters ill the distnbutaon,

N(N-l) ill a system ill which there are n possible elements, then there IS a possible total of --2--

pairs of letters (for companson purposes)

b Let the symbolfA represent the number of occurrences of A,fB the number of occurrences

of B, and so on tofz WIth regard to the letter A then, there are fAif;-1) comcidences (Agam

the cornbmanons of fA thmgs taken two at a time ) WIth regard to the letter B, there are

fB(f~-I) comcidences, and so on up to fz(fz

2-

1) coincidences for the letter Z Now It has been

N(N-l) seen that accordmg to the " test, ill 2 compansons of letters formmg the two members

IC N(N-l) of pears of letters in normal Enghsh plain text, there should be P.2 comoidences, where

"" IS the probabihty of monographic coincidence for the language III question

C Now the expected value offA(f;-I)+fB(f~-I)+ +fz(f~-I) ISequal to the theoretN(N-l) ical number of comcideneea to be expected in 2 compansons of two letters, which for

N(N-l) N(N-l) normal plam text IS "" times 2 and for random text IS IC, nmes 2 That IS, for

plam text

Expected value offA(fA-l)+fB(fa- 1)+ +fz(fz-l) x N (N - l ) 2 2 2 IC" 2' or

(IX) Expected value offA(jA-l)+fB(jB-l)+ +fz(fz-l)=KpN(N-l), and for random

text

Expected value of fA(fA-l) -ti-B(fB- l )+

2 2

(94)

SECTION XIV

THE "MONOALPHABETICITY" OR "4> TEST"
96

The distnbunon and caloulation are as follows

ABCDEFGHIJKLMNOPQRSTUVWXYZ - --~-~-~-- ~~ -- --~~

j(j-l) . . 0 0 0 2 0 0 0 6 0 0 0 2 0 0 0 0 2 6

'];j(l-I)=18 (That 18, observed value of cI>= 18)

E(cI>p)= 0667X25X24=40 0 (That 18, expected value of cI>p=40 0)

The conclusion 18 that the series of letters does not represent a selection of English text monoalphabetically enciphered Whether or not It represents a random selectaon of letters cannot

be told, but It may be saad that If the letters actually do constitute a cryptogram, the latter IS

probably polyalphabetically enciphered (As a matter of fact, the latter statement 18 true, for

the message was enciphered by 25 alphabets used m sequence)

c The cI> test is, of course, closely related to the X test and denves from the same general

theory as the latter, which IS that of coincidence When two monoalphabetic distnbutaons

have been combmed into a single distnbunon, the x test may be applied to the latter as a check

upon the til test. It 18 also useful m testing the columns of a supenmposinon diagram, to ascertam whether or not the columns are monoalphabetic

SECTION XV

CONCLUDING REMARKS

Paragraph

Ooneludmg remarks on apenodre substrtutrcn systems --------_.----------- 55

SynoptIc table • • ••------------- 06

55. Concludmg remarks on apenodie subsntunon systems.--a The various systems

described m the foregomg pages represent some of the more common and well-known methods

of mtroducmg complexities in the general scheme of cryptographic substrtunon With the view

to avoiding or suppressmg periodicity There are, of course, other methods for accomphshmg

this purpose, which, while perhaps a bit more complex from a practical pomt of VIew, yield more

desirable results from a cryptograpluc point of VIew That IS, these methods go deeper into the

heart of the problem of cryptographic secuntyand thus make the task of the enemy cryptanalyst much harder But studies based on these more advanced methods will have to be

postponed at this time, and reserved for a later text

b Thus far in these studies, aside from a few remarks of a very general nature, no attention

has been paid to that other large and Important class of CIphers, VIZ, transposraon It 18 desirable, before gomg further With subsntunon methods, that the student gam some understandmg

of how to solve certain of the more SImple vanenes of transposition CIphers Consequently,

m the text to succeed the present text, the student WIll temporanly lay aside the vanous useful

methods and tools that he has been given for the solution of substatution CIphers and will turn

hISthoughts toward the methods of breaking down transposition CIphers

56. SynOptIC table.-Contammg the plan mstituted in preVIOUS texts, of summanzmg the

textual material m the form of a very condensed chart called An Analyncel Key for Mihtary

Cryptanalysis, the outlme for the studies covered by Part III IS shown on p 119

(97)
b The peculiar nature of the phenomenon Just observed, mz, a completion diagram With the

vertical sequences in adjacent columns progressing m opposite directions, those in alternate

columns m the same drrectIOn, calls for an sxplanataon Although the matter seems rather

mysterious, It WIll not be hard to understand First, It IS not hard to see why the letters m

column 1 of FIgure 1 should form the descending sequence QPO for these letters are merely

will now be shown Talong the two Cipher groups under considerataon, let them be "decrphered"

WIth mrnal key letter A

CIpher m m __mmn n mn ---mn - mm QVGLBTPJ'l'F

Deciphered With keyletter A ·. QFBKRCNWXI

The deciphered text IS certamly not "plain text" But If one completes the sequences imtiated

by these letters, using the direct standard sequence for the even columns, the reversed standard

for the odd columns, the plain text sequence IS seen to reappear on one generatnx It ISHOSTILE

FOR( eE) From this It appears that mstead of going through the labor of making 26 successive

trials, which would consume considerable time, all that IS necessary IS to have a set of strips

bearing the normal direct sequence and another set bearing the reversed normal sequence, and

to align the strips, alternately direct and reversed, to the first "deCipherment" The plam text

will now reappear on one generatnx of the complenon dIagram (See Fig. 1 )

APPENDIX 1

ADDITIONAL NOTES ON METHODS FOR SOLVING PLAIN-TEXT AUTO-KEYED CIPHERS

Paragraph Introductory remarks __ 1

~mple "mechanical" solution 2

Another "mechanical' solution.c, __ 3

Solution of plain-text auto-keyed cryptograms when the Introductory key IS a. word or phraae.,., 4

Subsequent steps after determmmg the length of the mtroductory key __ _ 5

Conversion of foregoing apenodro cipher into periodic form, _ 6

Ooneludmg remarks on auto-key systems _ 7

1. Introdu<nory remarks.-a In paragraph 33 of the text proper It was indicated that the

method elucidated in paragraph 32 for solving plain-text auto-keyed ciphers IS likely to be suecessful only If the cryptanalyst has been fortunate m hIS selecnon of a "probable word" Or, to

put It another way, If the "probable words" which hIS imagmataon leads him to assume to be

present m the text are really not present, then he IS unfortunate, for solution will escape him

Hence, It 13 desirable to point out other prmciples and methods which are not so subject to chance

But because most of these methods are applicable only in special cases and because m general It

IS true that auto-key systems are no longer commonly encountered in practical military cryptography, It '\\88 thought best to exclude the exposition of these prmcrples and methods from the

text proper and to add them In an appendrx, for the study of such students as find them of

particular mterest

b A complete dISCUSSIOn of the solution of plam-text auto-key systems, With examples,

would require a volume in Itself Only one or two methods will be descnbed, therefore, leaving

the development of addmonal principles and methods to the mgenmty of the student who Wishes

to go more deeply into the subject The discussion herem Will be presented under separate

headings, dependent upon the types of primary components employed

c As usual, the types of primary components may be classified as follows

(1) Primary components arc identrcal

(0.) Both components progress m the same drrection

(b) Both components progress in opposite directions

(2) Pnmary components are different

2. SImple "mechanical" solution -a (1) Taking up the case wherein the two identical

primary components progress m the same drrection, assume the following additional factors to

be known by the cryptanalyst

(a) The primary components are both normal sequences

(b) The encipherment IS by plain-text auto-keying

(c) The encrphenng equauons are 8k/2=81/1,8p/I=8C!2

(2) A message begmnmg QVGLB TPJTF IS intercepted, the only unknown factor IS

the imnal key letter Of course, one could try to decipher the message using each key letter m

turn, beginning With A and contmumg until the correct key letter IS tried, whereupon plain text

will be obtained But It seems logical to tlunk that all the 26 possible "decipherments" might

be derived from the first one, so that the process might be much simplified, and tills IS true, as

(98)

Initial

key

letter

A

B

e

D

E

F

G

H

I

J

K

L

M

N

o

P

Q

R

S

T

U

V

W

X

Y

Z

Q V G L B T P J T F

Q F B K R C N WX I

PGALQDMXWJ

o H Z M PEL Y V K

N I Y N 0 F K Z U L

MJXONGJATM

L K WPM H I B S N

K L V Q L I HeR 0

J MU R K J G D Q P

I N T S J K F E P Q

H 0 S TIL E FOR * G P R U H MD G N S

F Q Q V G N e H MT

E R P WFOB I L U

D SOX EPA J K V

e T N Y D Q Z K J W

BUM Z e R Y L I X

AVLABSXMHY

Z WK BAT WN G Z

Y X J e Z U V 0 F A

X Y I D Y V U P E B

WZ HEX WT Q D e

V A G F WX S ReD

U B F G V Y R S B E

TeE A U Z Q T A F

S D D I TAP U Z G

R E e J S B 0 V Y H

FIGURE 1
, . ,

100

the ones resultmg from the successrve "decipherment" of Qc by the successive key letters A, B,

C, Now since the "decipherment" obtained from the 1st cipher letter in any row m

Figure 1 becomes the key letter for "deciphering" the 2d cipher letter in the same row, It IS

apparent that as the letters m the 1st column progress m a reversed normal (descending) order,

the letters m the 2d column must progress m a direct normal (ascendmg) order The matter

may perhaps become more clear If encipherment IS regarded as a process of addmon and decipherment as a process of subtraction. Instead of primary components or a Vigenere square,

one may use simple anthmetic, assignmg numerical values to the letters of the alphabet, beginnmg With A=0 and ending With Z=25 Thus on the basis of the pair of enciphermg equations

~(2=81(1J 8p(I=8c/2' the letter H, enciphered by key letter Mk With direct primary components

YieldsTc But using the following numerical values

ABCDEFGHIJKLMNOPQRSTUVWXYZ

o 1 234 6 6 7 8 9 ro II U H W M U W

the same result may be obtamed thus f!pCMk)=7+12=19=Tc Every nme the number 25 IS

exceeded m the addrtion, one subtracts 26 from It and finds the letter equivalent for the remainder In decipherment, the process IS one of subtraction 1 For example Tc(Mk=19-12=7=

Hp , Dc(Rt)=3-17=[(26+3)-17]=29-17=12=Mp Using this anthmencal equivalent of

normal shdmg-stnp encipherment, the phenomenon Just noted can be bet down m the form of a

diegram (FIg 2) which will perhaps make the matter clear

1 It WIll be noted that If the letters of the alphabet are numbered from 1 to 26, In the usual manner, the

antbmencal method must be modified In a minor particular In order to obtain the same results as are given by

employing the normal VIgenere square ThIS modificatron eonsists merely In subtractmg 1 from the numerical

value of the key letter Thus

ABCDEFGHIJKLMNOPQRSTUVWXYZ

1 234 6 6 7 8 0 W II U HUM U W

H,,(Mk)=8+ (13-1) =8+ 12=20=T.

T.(Mk) =20-(13-1) =20-12=8=H"

For an mterestmg extension of the bssic Idea Involved In anthmetic cryptography, see

Hill, Lester S Cryptography ~n an Algebra~c Alphabet American Mathematical Monthly, Vol XXXVI,

No 6,1929

Ibid Concermng certa~n bnear transformatton apparatus of cryptography American Mathematrcal Monthly,

Vol XXXVIII, No 3,1931

101

Q V G L B T P J etc

Qc(AlIJ=16- O=16=Q--~Q F B K R

Vr ( ) =21-16= 5=F : T 111

Gc(Ft)= 6- 5= 1=B ---'

Le(Bk)=ll- 1=10=K :

Bc(Kk)= 1-10=17=R : i ,

, ,

* * * * * * * * * * * * * * * * * * * * * *

,

o

o

* * * * * * * * * * * * * * * * * * * * * *

Qc(Cc)=16- 2=14=0-----.0 H Z M P

Vc(Ok)=21-14= 7=H : r 111

GC(Hk)= 6- 7=25=Z .:

L (Z )=11-25=12=M ::: c t I I , I

Bc(Mk)= 1-12=15=P ::::

FIGVRE2

Note how homologous letters of the three rows (joined by vertical dotted lines) form alternately

descending and ascendmg normal sequences

c When the method of encipherment based upon enciphenng equations ~12=81/1' 8p(2=80 /1

IS used instead of the one based upon enciphenng equations ~(2=81/1J 8 p /1 = 8cflh the process

indicated above 18 simplified by the fact that no alternation m the direction of the sequences

In the completion diagram IS required For example

CIpher Y H E B PDT B J D

Deciphered A=A________ Y F J K Z C V W F I

ZGKLADWXGJ

AHLMBEXYHK

B I MN C F Y Z I L

C J NOD G Z A J M

DKOPEHABKN

E L P Q FIB C L 0

F MQ R G J C D MP

GNRSHKDENQ

*H 0 S TIL E FOR

FIGvaz3

d (1) In the foregoing example the primary components were normal sequences, but the

case of Identical mixed components may be handled m a similar manner Note the following

example, based upon the followmg primary component (which IS assumed to have been reconstructed from previous work)

FBPYRCQZIGSEHTDJUMKVALWNOX

Message____________ U SIN L Y Q E 0 P ••• etc
MESSAGE

X T WZ L X H Z R X

FIGURE 6

V D D NeT S EPA

Z V C I Y U Q L V X

I A Q G R M Z WAF

G L Z S C KIN L B

S WI E Q V G 0 WP

ENG H Z A S X N Y

H 0 S TIL E F 0 R*

T XED G WH B X C

D F H J S N T P F Q

J BTU E 0 D Y B Z

U P D MH X J R P I

M Y J K T F U C Y G

K R U V D B M Q R S

V C MA J P K Z C E

A Q K L U Y V I Q H

L Z V WMRAG Z T

WI A N K C LSI D

N G L 0 V Q WE G J

o S WX A Z N H S U

X E NFL lOT E M

F HOB WG X D H K

B T X P NSF J T V

PDF Y 0 E BUD A

YJBRXHPMJL

R U P eFT Y K U W

C MY Q B D R V M N

Q K R Z P J C A K 0

Z V C I Y U Q L V X

100

IWvu ..

XTWZLXHZRX

C J NOD G Z A J M

D K 0 P E H A B K N

E L P Q FIB C L 0

F MQ R G JeD M P

G N R S H K DEN Q

H 0 S TIL E F 0 R*

I P T U J M F G P S

JQUVKNGHQT

K R V WL 0 H I R U

LSWXMPIJSV

MTXYNQJKTW

NUYZORKLUX

o V ZAP S L M V Y

P WA B Q T M N WZ

Q X B C RUN 0 X A

Rye D S V 0 P Y B

S Z D E T WP Q Z C

T A E F U X Q R A D

U B F G V Y R S B E

V C G H WZ S T C F

WD H I X A T U D G

XEIJYBUVEH

Y F J K Z C V WF I

Z G K LAD WX G J

AHLMBEXYHK

B I M N C F Y Z I L

U SIN L Y Q E 0 P

WDAY K E LUI A

N T L P V S WJ G V

o H WBAG N D S K

X E NFL lOT E M

F SOX WZ X H H U

B G X 0 N Q F E T J

PIE N 0 CBS D D

Y Z B WX R P G J T

R Q P L F Y Y I U H

C C Y A B P R Z ME

Q R R V P B C Q K S

Z Y C K Y F Q C V G

I P Q MR X Z R A I

G B Z U COl Y L Z

S F I J Q N G P WQ

E X G D Z WS B N C

H 0 S TIL E F 0 R*

TNEHGAHXXY

D WH E S V T 0 F P

J L T S E K D N B P

U A D G H MJ WP F

MV'JI1'UULYX

}{KUZbJMARO

V MMQ I D K V C N

AUK CUT V K Q W

LJVRMHAMZL

1 I 1 I 1 I 1 I 1 I

C F U Y L V X U D J

102

V D D NeT S EPA

Plam component.c.r... F B P Y R C Q ZIG S E H T D J U M K V A L W N 0 X

CIpher component.L,, X 0 N W L A V K M U J D THE S G I Z Q CRY P B F

Note here that the primary mixed sequence IS used for the completion sequence and that the

plain text, HOSTILE FOR (CE), comes out on one generatnx It IS immaterial whether the

direct or reversed mixed component IS used for the completion sequence, so long as all the

sequences m the diagram progress in the same direction (See FIg 6)

j (1) There remains now to be considered only the case m which the two components

are different mixed sequences Let the two primary components be as follows

Plam_________________ ABC D E F G H I J K L M N 0 P Q R STU V WX Y Z

Cipher F B P Y R C Q ZIG S E H T D J U M K V A L WN 0 X

and the message

(2) The procedure in this case IS exactly the same ah before, except that It IS not necessary

to have any nlternataon m direction of the completion sequences, WhICh may be either that of

the plam component or the CIpher component Note the solution in FIgure 5 Let the student

ascertain whv the alternation m direcuon of the completion sequences 18 not necessary in this

case

(3) In the foregomg case the alphabets were reversed standard, produced by the shding

of the normal sequence against ItS reverse But the underlying prinoiple of solution 18 the same

even If a mixed sequence were used instead of the normal, so long as the sequence IS known, the

procedure to be followed IS exactly the same as demonstrated in subparagraphs (1) and (2) hereof

Note the following solutron

(2) FIrst, the message 16 "deciphered" wrth the mrtial key-letter A, and then a completion

diagram IS established, usmg shdmg strips beanng the mixed primary component, alternate

stnps bearm-; the reversed sequence Note FIgure 4, m WhICh the pi am text, HOSTILE

FOR( CE}, reappears on a single genere.trrx Note also that whereas m FIgure 1 the odd columns

contain the P! unary sequence m thr- rover-sed order, and the even columns contam the sequence

in the direct order, III FIgure 4 the situation IS reversed the odd columns contam the pnmary

sequence m tl.o direct order, and the even columns contam the sequence m the reversed order

ThIS point IS brought to notice to show that It IS immaterial whether the direct order IS used

for odd colurrns or for even columns, t1><, aliernaium. tn direciurn. IS all that IS required m this

type of solution

e (1) Thrre IS next to be con'lldE'H',l the case m which the two prnnary components progress

m OPPOSltp du ocnons [par Ic (1) (b)] Here IS a message, known to have been onoiphored by

reversed standard alphabets, plum-text auto-keymg having been followed
104

Now prepare a stnp bearing the cipher component reversed, and set It below the plain component

so that Fp=Lo, a setting grven by the 1st two letters of the spunous "plam text" recovered

Thus'

Plam____________ ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

CIpher__________ F X 0 N W L A V K M U J D THE S G I Z Q CRY P B

(3) Now OPPOSIte each letter of the completion sequence in column 1, write Its plamcomponent equivalent, as given by the Juxtaposed sequences above This grves what IS shown

m FIgure 7b Then reset the two sequences (reversed cipher component and the plain component) so that Qp=Fo (to correspond WIth the 2d and 3d letters of the spunous plam text),

wnte down the plain-component equivalents of the letters m column 2, formmg column 3

Contmue this process, scannmg the generatrices from tune to trme, resettmg the two components

and findmg equrvalents from column to column, until It becomes evident on what generatnx

the plain text IS reappearing In FIgure 7c It IS seen that the plain text generatnx IS the one

begmnmg HOST, and from this point on the solution may be obtamed directly, by usmg the

two primary components

Message_________ B B V Z U D Q X J D

B B V Z U D Q X J D

V Y R I Y Z E FOR

I Q N J

G E Y G

X V W Z

L L K 0

*H 0 S T

YKB

AHH

JMV

ZDX

M J G

NGJ

F B E

o I Z

R T L

P U I

E R 0

Q S A

D N e

S P P

e e F

T F Q

K A U

UZM

W X D

Plam., W B V I G X L H Y A J Z M N FOR P E Q D SeT K U

CIpher .______ F B P Y R e Q ZIG S E H T D J U M K V A L W N 0 X

105

FIGURE S.

CIpher B B V Z U D Q X J D

"Plain" (8k=X) V Y R I Y Z E FOR

To solve the message, "decipher" the text WIth any arbitrarily selected nutial key letter and

proceed exactly as m subparagraphs (2) and (3) above Thus

Note the completion diagram in FIgure 8 which shows the word HOST very soon m the

process From this pomt on the solution may be obtained directly, by using the two primary

components

(4) When the plain component IS also a mixed sequence (and different from the CIpher

component), the procedure IS identacal WIth that outlmed m subparagraphs (1)-(3) above.

The fact that the plain component in the preceding case IS the normal sequence IS of no particular

significance in the solution, for It acts as a mixed sequence would act under SImilar circumstances

To demonstrate, suppose the two following components were used in encipherment of the

message below

FlGt7BE 7a FIGURE 76 FIGUBII t«

(2) FIrst "decipher" the message WIth any arbrtranly selected mrnal key letter, say A,

and complete the plam component sequence in the first column (FIg 7a)

Cipher e F U Y L V X U D J e F U Y L V X U D J e F U Y L V X U D J

Plam________ L F Q X W X A W S F L F Q X W X A W S ELF Q X W X A W S E

M MJ MJBe

N N1D N Dey '-' o oe oeLI

P PY PYNG

Q QU QUAJ

R RW RWUN

S SQ SQKL

T TN TNTQ

U UK UKYA

V VH VHES

W WE WEFD

X XB XBPB

Y YX YXRZ

Z ZT ZTDP

A AG AEHR

B BZ BZJO

e ev eVXE

D DM DMZW

E EP EPOF

F FA FAWH

G GR GRMM

H H 0 *H 0 S T

I IS ISG

J JL JLV

K KI KII
106

3. Another "mechanical" solution -a Another "mechanical" solution for the foregoing

cases will now be described because It presents rather mterestmg cryptanalytic sidelights

Take the message

b NO\\ suppose the message has been intercepted and IS to be solved The only unknown

factor will be assumed to be the nuual key letter Let the message be "deciphered" by means

of any nutral key letter," say A, and then note the underscored repetmons m the spurious plain

text

107

d The student has probably already noted that the phenomena observed m this subparagraph are the same as those observed m subparagraph 2b In the latter subparagraph It

was seen that the drrectaon of the sequences in alternate columns had to be reversed m order

to bnng out the plain text on one generatnx If this reversal IS not done, then obviously the

plain text would appear on two generatnces, which IS equivalent to having the plain text reduced

to two mono alphabets

e When reciprocal components are employed, the spunous plain text obtained by "decipherment" with a key settmg other than the actual one will be mono alphabetac throughout Note

the following encipherment (with uutral key scttang Ap=Ge , using a reversed standard sequence

shdmg agamst the direct standard) and It" "decipherment" by setting these two components

Ap=A.

Plain text,.. REF ERE N C E HIS PRE FER E N C E

Cipher P N Z B N N R L Y X Z Q D Y N Z B N N R L Y

Spurious plain text., L Y Z Y L Y H W Y B C M J L Y Z Y L Y H W Y

Here the spurious plain text IS wholly monoalphabettc

j The reason for the exceptaon noted m footnote 2 on page 106 now becomes clear For

If the actual imtaal key letter (G) were used, of course the decipherment yields the correct plain

text, If a letter 13 intervals removed from GIS used as the key letter, the CIpher alphabet selected

for the first "decipherment" IS the reciprocal of the real rmtial CIpher alphabet and thereafter

all alternate CIpher alphabets are reciprocal Hence the SpurIOUS text obtained from such a

"decipherment" must be mono alphabetic

g In the foregoing case the prImary components were identical normal sequences progressmg in the same direction If they were mixed sequences the phenomena observed above would

still hold true, and so long as the sequences are known, the indicated method of solution may be

applied

h When the two primary components ale known but differently mrxed sequences, tills

method of solution IS too involved to be practical It IS more practicable to try successive

imnal key letters, notmg the plain text each time and resettmg the strips until the correct

settmg has been ascertamed, as will be evidenced by obtammg mtelhgible plain text

4 Solution of plain-text auto-keyed cryptograms when the Introductory key IS a word or

phrase -a In the foregoing discussion of plain-text auto-keymg, the introductory key was

assumed to consist of a single letter, so that the subsequent key letters are displaced one letter

to the right With respect to the text of the message Itself But sometimes a word or phrase

may serve tills function, in which case the subsequent key IS displaced as many letters to the

right of the miual plain-text letter of the message as there are letter" in the imtial key Tills

will not, as a rule, interfere in any way With the apphcation of the pnnciples of solution set

forth m paragraph 28 to that part of the cryptogram subsequent to the introductory key, and

a solution by the probable-word method and the study of repetitaons can be reached However,

It may happen that tnal of this method 1<; not successful in certain cryptograms because of the

paucity of repetitaons, or because of failure to find a probable word in the text When the Cipher

alphabets are known there IS another point of attack which IS useful and mterestmg The

method consists in finding the length of the introductory key and then solving by frequency

prmcrples Just how tills IS accomplished WIll now be explained

b Suppose that the introductory key word ISHORSECHESTNUT, that the plain-text message

18 as below, and that identical primary components progressing in the same direction are used

1-2

E F

K Z

E R

K L

E N

K H

C E

I Y

C H

I B

AR

G S

T S

S T

1'1011....

1-2 1-2

E F R E

K Z X Y

ERN C

K L T W

ENE B

K H K V

CEO 0

I Y U I

INK S

o H Q M

REA N

XY GH

FED R

L Y J L

1-2

R E

X Y

F E

L Y

R E

X Y

N C

T W

E H

K B

I S

o M

P R

V L

HIS PRE FER E N C E I N REFERENCE

REF ERE N C E C H ART S

CIpher __ m X V J J V V R P G L P A H G V J J V V B P G M V E LU

"Plain text" X Y L Y X Y T W K B 0 M V L K Z K L K H I Y 0 H X Y L Y

Cipher V V R P G FPC Y C S N Q U V J J V V R P G G J H Y K L

"Plum text" X Y T W K V U I Q M G H J L K Z K L K H I Y I B G SST

The ongmal four 8-letter repetations now turn out to be two

different sets of 9-letter repetttions TIllS calls for an explanation Let the SpUriOUS piam text, With Its leal plam text be

transcribed as though one were dealmg WIth a periodic CIpher

mvolving two alphabets, as shown m FIgure 9 It will here be

seen that the letters in column 1 are monoalphabetic, and so are

those m column 2 In other words, an auto-key CIpher, which

IS commonly regarded as a polyalphabetic, apenodic CIpher, has

been converted into a 2-alphaLet, periodic CIpher, the individual

alphabets of which are now monoalphabetic m nature The two

repetmons of X Y L Y X Y T W K represent encipherments of

the word REFERENCE, m alphabets 1-2-1-2-1-2-1-2-1, the two

repetrtaons of L K Z K L K H I Y likewise represent encipherments ofthe same word but in alphabets 2-1-2-1-2-1-2-1-2

c Later on It will be seen how tills method of oonvertmg an

auto-key CIpher mto a penodic CIpher may be applied to the

case where an introductory key word IS used as the uutial keying

element instead of a single letter, as in the present case

, Except the actual key letter or a letter 13 intervals from It See subparagraph (7) below

and encipher It by plain-text auto-key, with normal dn ect primary components, mitral key

settmg All=GC Then note the underscored repetitions

REF ERE N C E HIS PRE FER E N C E I N REF E

X V J J V V R P G L P A H G V J J V V R P G M V E V J J

R E N C E BOO K SAN D REF ERE N C E C H ART S

V V R P G FPC Y C S N Q U V J J V V R P G G J H Y K L

REF ERE N C E

BOO K SAN D
109

6 7 8 9 io 11 12 13

T

E

X

•

1 2 3 4 5 6 7 8 9 10 11 12 13

T Mew J V M PSG X C L

DeN I NON Y GUO I N

P T Q G ! R X F JIM

C E X U J ! WD Y X A Z

R K G V A MX K F 0 D WN

G L KE B H P F WQ Z R H

X S KEN MI A J C F G K

PYX I Y MP R X E 0 P Q

WWR V C WJ SEW F Z M

C LOP I U G WA X WU G

V MF Y X J X ! Z F E V

E U R Z R H H GUT Q B G

:I 3 4 5

FIGURJ: 10

1 2 3 4 5 6 7 8 9 10 11 12

T M WJ V Mpsg X C

L D N I NON Y guo

I N PET X Q G T R X F

JIM C E E X U J T W D

YXAZRKGVAMXK

E 0 D WN G L K F B H P

E WQ Z R H X S K F N M

I A J C F G K PYX I Y

M P R X 0 P Q WWR V

C W J S W F Z MeL 0

P I U G WA X WU GyM

F Y X J X WZ F WEyE

U R Z R H H GUT Q B G

1311922-39-8

•

1 2 3 4 5 6 7 8 9 10 11 12 13 1

(1) Key H 0 R SEC H EST NUT

(2) Plam___________ T

(3) CIpher _

1 284 5 6 7 8 9

(1) Key E

(2) PlaIn___________ T •

(3) CIpheL._______ X

Here It Will be noted that Ep m hne (2) has a Tp on either SIde of It, at a distance of 13 mtervals,

the first enerpherment (Ep by TI<) Yields the same equrvalent (X.) as the second encipherment

(Tp by~) Two Cipher letters are here idenncal, at an interval equal to the length of the mtroductory key But the converse ISnot true, that IS,not every pair of identtcal letters in the CIpher

text represents a case of tlus type For in this system Identity m two Cipher letters may be

the result of the following three conditions each having a statrstically ascertamable probability

of occurrence

(1) A given plain-text letter IS enciphered by the same key letter two different times, at an

interval which IS purely accidental, the CIpher equrvalents are identical but could not be used

to give any mformation about the length of the mtroductory key

(2) Two different plain-text letters are enciphered by two different key letters, the Cipher

equrvelents are forturtously identical

(3) A given plam-text letter ISenciphered by a given key letter and later on the same plaintext letter serves to encipher another plain-text letter which IS identical WIth the first key letter,

the CIpher equivalents are causally rdentical

It can be proved that the probability for rdentiues of the third type IS greater than that for

identrtaes of either or both 1st and 2d types jor that uiteroal wh~ch corresponds unih. the length

oj the ~ntroductory key, that IS,If a tabulation IS made of the intervals between identical letters in

such a system as the one being studied, the interval which occurs most frequently should comcide

With the length of the mtroductory key The demonstration of the mathematical basis for this

fact IS beyond the scope of the present text, but a practical demonstration Will be convincing

d Let the illustrative message be transcribed in lines of say 11, 12, and 13 letters, as m

FIgure 10

1 2 3 4 6 6 7 8 9 10 11

T MeW J V M PSG X

C L DeN I NON Y G

U 0 I N PET X Q G T

R X F JIM C E E X U

J T WD Y X A Z R K g

V A MX K F 0 D WN g

L K F B H P F WQ Z R

H X S K F N M I A J C

F G KEY X I Y M P R

X E 0 E Q WWR V C W

J S E F Z MeL 0 P

lUG A X W U G V M

F Y X J X WZ F WE V

EURZRHHGUTQ

B G

108

to encipher the message, by enciphenng equation 8 1;12=8,/1' 8 p/1=8c/2 Let the components

be the normal sequence The encipherment IS as follows

123 4 G 6 7 8 9 ro II U U H W n ro

Key-__________________ H 0 R SEC H EST NUT M Y L EFT F LAN K I S

Plam_________________ M Y L EFT F LAN K I S R E c s r V I N G H E A V

Clpher_______________ T Mew J V M PSG X C L DeN I NON Y GUO I N

Key R E c s r V I N G H E A V Y ART ILL E R Y FIR

Plain Y ART ILL E R Y FIR E ENE M Y ISM ASS I

Cipher PET X Q G T R X F JIM C E E X U J T W D Y X A Z

Key E ENE M Y ISM ASS I N G T ROO PST 0 L E F

Plam_________________ N G T ROO PST 0 L EFT FRO N TAN D CON C

Cipher R K G V A M X K F 0 D W N G L K F B H P F W Q Z R H

Key T FRO N TAN D CON C E N T RAT I N GAR T I

Plam_________________ E N T RAT I N GAR TIL L E R Y THE REX W I

Cipher X S K F N M I A J C F G K PYX I Y M P R X E 0 P Q

Key L L E R Y THE REX W ILL NEE D CON SID E

Plam_________________ L L NEE D CON SID ERA B L ERE I N FOR C

CIpher W W R V C W J SEW F Z MeL 0 P lUG W A X W U G

Key R A B L ERE I N FOR C E MEN T S TOM A I N T

PlaIn_________________ E MEN T S TOM A I N T A I N M Y P 0 SIT ION

Clpher.._____ V M F Y X J X W Z F W EVE U R Z R H H GUT Q B G

It will now be noted that since the introductory key contains 13 letters the 14th letter of the

message ISenciphered by the 1st letter of the plam text, the 15th by the 2d, and so on Likewise,

the 27th letter 18 enciphered by the 14th, the 28th by the 15th, and so on Hence, If the 1st

cipher letter 18 deciphered, this will give the key for deciphenng the 14th, the latter Will give

the key for the 27th, and so on An important step m the solutaon of a message of this kind

would therefore involve ascertammg the length of the mtroductory key This step will now

be explained

c Since the plain text Itself constrtutes the key letters m this system (after the mtroductory

key), these key letters Will occur with their normal frequencies, and this means that there will

be many occurrences of E, T, 0, A, N, I, R, S, enciphered by EI<, there will be many occurrences

of these same high-frequency letters enciphered by TI<' by 01<, by AI<, and so on In fact, the

number of tunes each of these eombmations will occur may be calculated statrstacelly WIth

the enciphenng condinons set forth under b above, Ep enciphered by TI<, for example, will Yield

the same CIpher equivalent as Tp enciphered by ~, m other words two encrpherments of any

parr of letters of which either may serve as the key for enciphering the other must Yield the same

cipher resultant 8 It IS the cryptographic effect of these two phenomena working together

which permits of ascertammg the length of the mtroductory key m such a case For every

time a given letter, 8p , occurs m the plain text It Willoccur n letters later as a key letter, 81<, and

n m thIs case equals the length of the mtroductory key Note the followmg illustranon

I It 18 important to note that the two components must be identrcal sequences and progress in the same

direction If thIs 18 not the case, the entire reasomng 18 mapphcable
I'IOUIII: 11

110

(a) Flrqt column of 1< lllur~ 10 (c) • d,cI\,hrred I(b) nrbt column of FI~urc ,0 (r) 'du1\lhucd'I(,) 1< Irbt column of FlJlure 10 (,) d,clphcleu

willi IDltldi O.=A wrth III1t1sl O.-B With O.-C

c It will be noted that the vertical sequences m adjacent columns proceed m opposite

directions, whereas those in alternate columns proceed ill the same direction The explunation

for tlus alternation ill progression IS the same as m the

previous case wherein tlns phenomenon was encountered

(par 2b), and the sequences m FIgure 12 may now be

completed very quickly The diagram becomes as shown

m Figure 13

d One of the horizontal hnes or generatnces of figure

13 IS the correct one, that IS, It contams the actual plaintext equivalents of the 1st, 14th, 27th, letters of the

message The correct generatnx can be selected by mere

ocular examination, as IS here possible (see generatnx

marked by asterisk m Fig 13), or It mav be selected by a

frequency test, assignmg weights to each letter accordmg

to Its normal plam-text frequency (See par 14} of

Mu~tary GryptanalY8~8, Part II )

FIGUBB 13

FIGURE 12

CIpher letters of ColI, Fig 1L T D P C R G X P W C V E

A_________ T K F X U M L E S K L T

B_________ S LEY T N K F R L K U

Keyletters C R M D Z S 0 J G Q M J V

~_~~~~~-~~ III 1III 1III 1

111

b Inspection of the result'! of these three trials soon shows that the entire senes of 26

trials need not be made, for the results can be obtained from the very first tnal This may be

shown graphioally by supenmposmg merely the results of the first three tnals hOTlzontally

Thus

e Identical procedure ISfollowed With respect to columns 2, 3, 4, of FIgure 10c, WIth

the result that the mitaal key word HORSECHESTNUT IS reconstructed and the whole message

may be now deciphered quite readily

T D P C R G X P WC V E

TKFXUMLESKLT

SLEYTNKFRLKU

R MD Z S 0 J G Q MJ V

Q N CAR P I H P N I W

P 0 B B Q Q H I 0 0 H X

o PAC P K G J N P G Y

N Q Z DOS F K M Q F Z

M RYE N TEL L R E A*

LSXFMUDMKSDB

K T W G L V C N J T C C

J U V H K WB 0 I U B D

I V U I J X A P H V A E

H WT J I Y Z Q G WZ F

GXSKHZYRFXYG

FYRLGAXSEYXH

E Z Q MF B WT D Z WI

D A P N E C V U C A V J

C BOO D D U V B B U K

B C N P C E TWA C T L

ADMQBFSXZDSM

ZELRAGRYYERN

YFKSZHQZXFQO

X G J T YIP A W G P P

W H I U X JOB V H 0 Q

VIHVWKNCUINR

UJGWVLMDTJMS

1 2 1 4 R 7 l! 0 10 11 12 II

TMCWJVMPSGXCL

R

D

M

P

D

C

Z

R

S

G

o

X

J

P

G

W

Q

C

M

V

J

E

V

, 2 , 4 f> 7 II 0 10 11 12 13

- TMCWJVMPSGXCL

S

D

L

P

E

C

Y

R

T

G

N

X

K

P

F

W

R

C

L

V

K

E

U

1 2 3 4 R 7 l! 'I 10 II 12 l>

TMCWJVMPSGXCL

T

D

K

P

F

C

X

R

U

G

M

X

L

P

E

W

S

C

K

V

L

E

T

In each transcnptaon, every pair of superimposed letters IS noted and the number of rdentitaes

IS mdicated by ringing the letters involved, as shown above The number of identit.es for nn

assumed mtroductory-key length 13 IS 9, as agamst 3 for the assumption of a key of 11 letters,

and [) for the assumption of a key of 12 letters

e Once having found the length of the introductory key, two hnes of attack are pos-able

the compositaon of the key may be studied, wlnch "Ill yield sufficient plam te"{t to get a st ,11t

toward solution, or, the message may be rodur ed to penodic terms and solved as a repeatmz-kev

CIpher The first hne of attack will be discussed hrst, It being constantly borne m mmd In tln.,

paragraph that the entrre dISCUSSIon IS based upon the assumption that the CIpher alphaLets

are known alphabets The illustratrve message of b above "ill be used

6 Subsequent steps after determmmg the length of the mtroductory key -a Assume that

the first letter of the introductory key IS A and decipher the 1st CIpher letter Tc (WIth direc t

standard alphabets) Thrs yields Til and the latter oecomcs the key letter for the 14th letter of

the message The 14th letter 1"1 deciphered D. (Tt)=KII , the latter becomes the key letter for

the 27th letter and so on, down the entire first column of the message ns transcribed ill lines of

13 letters The same procedure IS followed usmg B as the mmal key letter, then C, and so on

The message as It appears for the first three tnals (assuming A, B, then C as the Iwt1l11 key letter)

IS shown m FIgure 11

II

I

I II

'I

II
112

6 Conversion of foregomg apenodio eipher into periodic form -a In paragraph 4 It was

stated that an aperiodic CIpher of the foregoing type may be reduced to penodic terms and

solved as though It were a repeatmg-key CIpher, provided the primary components are known

sequences The baSIS of the method lies m the phenomena noted m paragraph 2b An example

will be given

b Let the Cipher text of the message of paragraph 4b be set down again, as in FIgure 10c

2 3 • 6 6 7 8 0 10 11 12 13

T M C W J V M P S G X C L

D C N I N 0 N Y G U 0 I N

P E T X Q G T R X F J I M

C E E X U J T W D Y X A Z

R K G V A M X K F 0 D W N

G L K F B H P F W Q z R H

X S K F N M I A J C F G K

P Y X I Y M P R X E 0 p Q

W W R V C W J S E W F Z M

C L 0 P I U G W A X W U G

V M F Y X J X W Z F W E V

E U R Z R H H G U T Q B G

FIGVBB IOC

Using direct standard alphabets (Vigenere method), "decipher" the second line by means of

the first hoe, that IS, taking the letters of the second hoe as Cipher text, those of the first lme

as key letters Then use the thus-found "plain text" as "key letters" and "decipher" the thud

lme of FIgure l Oc, as shown in Figure 14 Thus

"Key" T M C W J V M PSG X C L

CIpher D C N I NON Y GUO I N

"Plam" K Q L MET Z J 0 0 R G C

"Key" K Q L MET Z J 0 0 R G C

Cipher PET X Q G T R X F JIM

"Plam" F 0 I L M NUl J R S C K

FIGVBB 14.

Continue this operation for all the remammg hnes of FIgure 10c and wnte down the results in

lmes of 26 letters Thus

1 2 3 t 6 6 7 8 9 W 11 U 13 HUM tl 13 ill

T M C !! J Y. M PSG X .Q L K g L MET f! 0 0 R G C

F 0 I L M NUl J R S .Q K X g !! M I W f! Q UHF Y .e UUKJSQYWLHYYYMRAWJBR~LJ~TJ

L B K J E V R R Y TEN B E X N Z U R Y A Z L K C P - - - - -- - SZE!!IFL§FLY.XXKMKTAPVEVM~XJ

~AVFXUC§ETy'HMTU!!UYNFQQAVUU

FIGVBB 16

113

Now wnte down the real plain text of the message m hnes of 26 letters Thus

1 2 3 4 6 6 7 8 0 W 11 U 13 HUM tl 13 ill

MYLEFTFLANKISBECEIVlliGHEAV

YARTILLERYFIREEliEMYI§MASSI

N G T ROO PST 0 L EFT FRO N TAN D CON C

ENTRATINGARTILLERYTHEREXWI

LLNEEDCONSIDERABLEREINFORC

-

E MEN T S TOM- --A i N T AI N M Y P 0 - - -SIT iON

FIGVBB 16

c When the underhned repetatrons m FIgures 15 and 16 are compared, they are found to be

identacal m the respectrve columns, and If the columns of FIgure 15 are tested, they will be found

to be monoalphabetic The Cipher message now grves every mdicanon of being a repeatmg-key

Cipher It ISnot difficult to explam this phenomenon in the light of the demonstration given in

paragraph 3g FIrst, let the key word HORSECHESTNUT be enciphered by the following alphabet

ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z

A Z Y X W V U T S R Q P 0 N M L K J I H G FED C B

"Plam" H 0 R SEC H EST NUT

"CIpher" T M J I W Y T W I H N G H

Then let the message MY LEFT FLANK, etc, be enciphered by direct standard alphabets as

before, but for the key add the monoalphabetic equivalents of HORSECHESTNUT TMJIW to

the key Itself, that IS, use the 26-letter key HORSECHESTNUTTMJIWYTWIHNGH m a repeatmg-key

manner Thus (Fig 17)

123 • 6 6 7 8 9 W 11 U 13 HUM tl 13 ill

Key H 0 R SEC H EST NUT T M J I W Y T W I H N G H

Plam_________________ M Y L EFT F LAN K I S R E C E I V I N G H E A V

Cipher T M C W J V M PSG X C L K Q L MET Z J 0 0 R G C

Plain Y ART ILL E R Y FIR E ENE M Y ISM ASS I

Cipher F 0 I L M NUl J R S C K X Q W M I W Z 0 UHF Y P

Plam_________________ N G T ROO PST 0 L EFT FRO N TAN D CON C

Cipher U U K J S Q Y W L H Y Y Y M RAW J R R J L J B T J

Plam_________________ E N T RAT I N GAR TIL L E R Y THE REX W I

Cipher L B K J E V R R Y TEN B E X N Z U R Y A Z L K C P

Plam_________________ L L NEE D CON SID ERA B L ERE I N FOR C

Cipher S Z E W I F L S F L V X X K M K TAP V E V M B X J

Plam_________________ E MEN T S TOM A I N T A I N M Y P 0 SIT ION

Cipher L A V F X U C SET V H M T U W U U N F 0 Q A V U U

FiGtTBB 17

The Cipher resultants of this process of enc~phenng a message comcide exactly With those obtained

from the "deevpheruu;" operation that gave rise to FIgure 15 How does this happen?
114

Thus, equations (1) and (2) turn out to be Identical but from what appear to be qurte diverse

sources

j What has been demonstrated in connection With the letters in lme 1 of Figures 15 and

17 holds true for the letters m the other lines of these two figures, and It IS not necessary to

repeat the explanation The steps show that the originally aperiodic, auto-key Cipher has been

T ION FRO

A 0 K VCR Q

Repsatmg kPYenCIpher

ment

T U E 5 DAY

INFORMA

P T B W0 MC

MRELIAB

TXATFAD

L E 5 0 U R C

5 K 0 WR R E

E 5 I N D I C

LYE V A I E

ATE5THE

~---__, HZAAQHG

A 0 K VCR Q

TJQYDJN

Orlgmal eipher te~t

BDd converted text

FIGURE 18

S K 0 WR R E

TOQZJRA

+----- PTBWOMC

L V J Z 0 F 0

LYEVAIE

~---~. WB WF Q Z C

HZAAQHG

b

Orlgmal Cipher tcxt

TXATFAD

Z NOD M R B ------- Z NOD MR B

TJQYDJN

P T B W0 M C

LVJZOFO

/I

\~ B W F Q Z C

TOQZJRA

converted, through a knowledge of the primary components, mto a repeating-key Cipher WIth a

penod twice the length of the mtroductory key The message may now be solved as an ordinary

repeatmg-key Cipher

g (1) The foregomg case IS based upon enciphermont by the eneiphenng equations

~/2=81/1' 81>/1=80/2 Wb£'n encipherment by the enoiphenng equations ~/2=O 8-8 h b f 11 'I ~"I< III, p/1- 011

as een 0 owed, the conversion of a plain-text auto-keyed Cipher yields a repeatmg-key CIpher

With a penod equal to the length of the mtroductory key In this conversion, the enciphenng

equations ~/2=81/11 8 P/I=80/2 are used m finding equivalents

(2) An example may be useful Note the encipherment of the following message by

auto-key method by enciphermg equauons 8k/2=81/1' 8p/2=80/1

T U E 5 D A YII N FOR MAT ION FRO M R ELI A B L E 5 0 U R C E 5 I N D I C

INFORMATIONFROMRELIABLE50URCE5INDICATE5THE

PTBWOMCLVJZOFOTJQYDJNZNODMRBTOQZJRAWBWFQZC

(3) If the message IS written out in lines conespondmg to the length of the mtroductory

key, and each Ime IS enciphered by the one directly above It, using the encrphermg equations

~/2=81/11 8p/l=80/2 m finding equivalents, the results are as shown m Figure 22b But If the

same message IS enciphered by equanons 8k/2=8111, 8p/2=80/1l using the word TUE5DAY as a

repeatmg key, the Cipher text (Fig 18c) IS idenncal With that obtained m Figure 18b by enciphermg each successive Ime With the Ime above It

115

, these

KQLME=RECEI + TMJIW

Hence,

Or,

Hence,

Or,

But It has been shown in subparagraph d above that

T MJ I W= - H 0 R S E

K Q L M E = R E C E I + (- H 0 R 5 E)

K Q L M E = R E C E I - H 0 R S E (2)

As for the letters m the second half of line 1 of Figure 17, also begmnmg KQLME

letters were the result of enc~phertng RECEI by TMJIW

Thus

d FIrst, let It be noted that the sequence TMJI , which forms the second half of the

key for enciphenng the text in FIgure 17 may be described as the standard alphabet complement

of the sequence HOR5ECHE5TNUT, which forms the first half of that key Anthmetically, the

sum of a letter of the first half and Its homologous letter in the second half IS 26 Thus

H+T= 7+19=26=0

O+M=14+12=26=0

R+J=17+ 9=26=0

5+I=18+ 8=26=0

E+W= 4+22=26=0

That IS, every letter of HORSECHE5TNUT plus It.., homologous letter of the sequence

T\lIJIWYTYIHNGH equals 26, which IS here the same as zero In other words, the sequence

TMJIWYTWIHNGH IS, by cryptographio anthmeuc, equivalent to "mmus HOR5ECrlE5TNUT"

Therefore m Figure 17, enctphenng the second half of each hne by the key letters

TMJIWYTWIHNGH (I e , addmg 19, 12,9,8, ) IS the same as dectphenng by the key letters

HOR5ECHE5TNUT (I e, subtractmg 7, 14, 17, 18, ) For example

Rp(Tk)=17+19=36=10=K, and

Rp(-Hk)=17-7=10=K

Ep(Mk)=4+12=16=Qo, and

Ep(-Ok)=4-14=(26+4)-14=16=Qo, and so on

e Refer now to Figure 15 The letters m the first half of lme 1, begmnmg TMCWJ

are idenncal WIth those m the first half of line 1 of FIgure 17 They must be Identical because

they are produced from identical clements The letters m the second half of this same line m

Figure 15, begmmng KQLME were produced by dectphertng the letters m the second line

of Figure lOc Thus (taking for Illustrative purposes only the first five letters in each case)

K Q L M E =D C N I N - T M C WJ

&t DCNIN=RECEI+MYLEF

And T M C W J = M Y L E F + H 0 R 5 E

K Q L M E = (R E C E I + M Y L E F) - (M Y L E F + H 0 R 5 E)

K Q L M E = R E C E I - H 0 R S E (1) I I

I

, I
INDEX

Identity or comeidence, - - - __________________ 58

Idiomorplnsm, - - - __________________________ 8

Indlcators_________________________________ 56

Influence letter 21

Inltl&lkey Interlocking messages ============================- by repetrtiona __________ 56 2~32 Intermittent cOInCldences__ __________________ 18

Interruptmg a cyche keying sequence_________ 19

Interrupting the key, three basic methods of.__ 19

Interruptions, keyIng____ ____________ _____ 19

InternIptor________________________________ 21

Cipher-text letter a'l - - - ___ ________ 25

Plain-test letter as 21

Disadvantages of._ -_ -- -___ ____ 27

Introductorykey 28,32

Consisting of more than one letter____ 32, 45, 107

Irregular mterruptions In keying sequence _____ 19

Isomorphie sequences_______________________ 11

Isomorphism

Detection of - - - --- - - ________ ____ 11

Hlustration of the use of 11,39

Phenomena of._ -_ ______________________ 11

Isomorphs, blockmg out of.__________________ 14

56

58

63

1

4

5

19

50

50

Page

8

81

2,19

16

5

General solution for Ciphers mvolvmg a long keying scquence _

Groupmgs

Constant-length plain-text _ Irregular _

Variable-length, plain-text _

Kappa test _

AppheatIOn of. _

Keymg, fixed _

Keying cycles, mteraetron of _

KeyIng umts

Constant length _

Variable length _

Keys, extended, nonrepeatmg, runnmg _ 7

5

50 Lengthemng keys _

(117)

112

112

73

58

100

1

1

Page

1 Formulae, idiomorphie _

Frequency drstnbution square _

1811922-39--9

ApenodIc systems _

ArIthmetIcal equivalent of normal shdmg-stnp enCipherment______ ___________ ________ 100

Auto-key eneipherment, two baSIC methods of- _ 28

Auto-key systems Solution of 28,98

Oharectenstres of- ______________________ 31

Concluding remarks on_ ____ 48

Auto keying

Cipher text 28,30

Plam text 28, 45, 98

AVOIdIng periodrcrty, methods of-_____________ 1

Base letter--- - 32, 36

BaSIC period masked by apenodic repetationa.; , 16

Blocking out lsomorphs______________________ 14

Blocking out words_________________________ 14

Book as key 5,50,51,53,74

Enclphenng equations _

Enclpherment by word lengths _ Extendedkeys _

Chi test; _ 73, 89

ApplyIng the 77,79

Derivanon 0'-__________________________ 75

Example of appheation 0'-_______________ 79

In matchmg shifted distnbutrona, ________ 77

Nature of- __________ _______ _____ 74

Oomeidenee test_ _________________ ____ 58

ApplIcatIOn of____ _________ ____ 63

B&81c theory of______ ________ 58

Oomeidence, mtermrttent, , __ _______ __ __ __ 18

Oombmmg mdividual frequency distnbutiona, _ 74

Companaons for cOIncidence_________________ 60

Constant-length, plam-text groupmgs_________ 2,19

Contmuous-key system 50,51

Conversion of an apenodie CIpher Into periodic form _

Converting auto-key text to penodie terms _ Cross-product or x test _

Cryptanalytic comeidenee test _

CryptographiC anthmetie _

CryptographIC penodicity, nature of _

Cychc phenomena _

Orlillnal Olphertat Onglnal cipher ten Repeating key encipher

BUdconverted text ment

TUESDAY

INFORMA

LHZEMOY LHZEMOY LHZEMOY

PFRBMVM PFRBMVM TIONFRO

AMQFYJK AMQFYJK

HRKCXRN _---0 HRKCXRN MRELIAB

HDAHVAX HDAHVAX

BNMXOJZ BNMXOJZ LESOURC

IQMEJJW IQMEJJW

HMKBRJA HMKBRJA E SIN D I C

PCWFASW 0-------- PCWFASW

EZEVKBY EZEVKBY ATESTHE

TBAAKTU TBAAKTU

• b

FIOURE 18

116

'l. The foregomg procedures mdicate a SImple method of solvmg Ciphers of the foregomg

types, when the pnmary components or the secondary Cipher alphabets are known It consists

in assummg mtroductory keys of vanous lengths, convertmg the Cipher text mto repeatmg-key

form, and then exammmg the resultmg diagrams for repetitions When a correct key length IS

assumed, repetitions will be as numerous as should be expected in Ciphers of the repeatmg-key

class, incorrect assumptions for key length will not show so many repetitions

3 All the foregoing presupposes a knowledge of the CIpher alphabets mvolved When these

are unknown, recourse must be had to first prmeiples and the measages must be solved purely

upon the basis of probable words, and repetinons, as outlmed m paragraphs 27-28

(4) Now note that the sequences lomed by arrows m FIgure 186 and care idenneel and smce

It IS certam that FIgure 18c IS penodic m form because It was enciphered by the repeatmg-key

method, It follows that Figure 18b IS now also m periodic form, and ill that form the message

could be solved as though It were a repeatmg-key cipher

II. (1) In case of pnmary components COnsISting of a direct normal sequence shdmg agarnst

a reversed normal (U S Army disk), the process of convertmg the auto-key text to penodie

terms IS accomplished by using two direct normal sequences and "deeaphenng" each lme of the

text (as transcnbed m periods) by the lme above It For example, here IS a message autoenciphered by the aforementioned disk, With the lnltlal key word TUESDAY

T U E S DAYI I NFOR MAT ION FRO MR ELI AB L E SOU R C E SIN D I C

INFORMATIONFROMRELIABLESOURCESINDICATESTHE

LHZEMOYPFRBMVMHRKCXRNBNMXOJZHMKBRJAEZEVKBY

(2) The Cipher text IS traascnbed in penods equal to the length of the minel key word

(7 letters) and the 2d lme IS "deCIphered" With key letters of the 1st lme, usmg enciphenng

equations ~fJ=81/l' 8p /1=8CfJ 'lhe resultant letters are then used as key letters to "decipher"

the 3d lme of text and so on '1he results are as seen in FIgure 19b Now let the original message be e'M'/,phered m repeatmg-key manner by the disk, With the key word TUESDAY, and the

result IS FIgure 19c Note that the odd or alternate lmes of Figure 19b and e are Identical,

showing that the auto-key to'\.t has been converted mto repeatmg-key text
Page

118

52

14

5

15

19

19

5

46

Vanable-Iength

Groupings of keymg sequence _ Key eneiphermg _

Plain-text groupmgs _

Vigenere method _

Wheatstone cryptograph _

9 Word habits of the enemy, farmharrty with _

Word-length eneipherment, solution of, _ 3 Word separators _

RepetItIons-Contmued

Nonper!odIc____________________________ 3

Partially penodlc_______________________ 3

Slgnlficant_____________________________ 25

62 Resultant key 4,52

73 Runnmg-key cipher, solution of 53,56,63,71

94 Runmng-key system; _____ 51

58 Secondarykey 4,52

50 Separators, word____________________________ 15

Sequences, umnterrupted____________________ 26

51 Solution by supenmpositron 23,53,58

3 Spunous plain text 43,104

Statistical test____ _ ________________ 26

Stereotypie phraseology_____ 14

8 Supenmposable penods______________________ 23

8 Superimposed sequences and the comeidenee

test_____________________________________ 58

4 Supenmpo&tIon____________________________ 53

16 BaSIC pnnciples of- ______________ ____ 53

Correct and mcorrect____________________ 58

Solution by__ _________ _ 53

Dlagram_______________________________ 61

Synoptic table 97, 119

Symmetry of posrtion, direet., __ ___________ 9

1,50

52

Makmg the IC test, general procedure _

Matclung of frequency distributaons _

MonoalphabetIclty or test , _

Monographic comcidenee, probabilrty of _

Lengthy keys Systems usmg _

Mechamcal methods of producing _

Nonrepeatmg key system _

Overlap _

Partial penodierty _

Patterns IdIomorpluc _

~ord _

Period, apparent, basic, complete, hidden,

latent, patent, pnmary, resultant, secondary; Penodieity, masked _

Periods

Component____________________________ 4

Bupenmpcsed, _ ____________________ 23

Plu test___________________________________ 94

Applylng______________________________ 95

Denvatron of-_____ _ __ ___________ 93

Purpose of._ __ ______ ___________ 93

Related to X test_______________________ 96

Probabihty, theory of-______________________ 58

Probabilrty of monographic comcldence________ 58

Progressive-alphabet cipher, solution of- 52,55,82

Progressive alphabet system 52, 55

Reconstruction skeleton _

Repetitions Completely penodie _
506-AperlOdlc systems

(1-54)

"I'

I

71'"

616-Systems using lengthy

keys (34-54)

I I

rig' , ! .., ~Run I 1't6-Progres Ding key sys I slve alphabet tems (35, 36a, systems (36b, 39-

37-38, 40-54) 40,41-54)

I I

816-Introduc 816-Introductory key IS a tory key IS a

smgle letter (23- word or phrase

(23, 2M, 26, 30- 26,27-29) 33)

616-Auto key systems

(23-33)

I I

716-Clpher 716-Plaln

text auto key text auto key mg (27-33, Ap mg (23-26) pendix 1)

I I

o

714-Interrup

tor IS a Cipher

text letter (21-

22)

614-Varlable length keymg umts encipher constant length plain text groupings (17-22)

713-Interrup

tor IS a plam text letter (Ill20)

[Numbers In parentheses refer to Paragraph Numbers In this text)

Analytical Key for MIlitary Cryptanalysis, Part III

613-Constant length keying

UOltS encipher variable length plain text groupings (2-16)

I I

711-Varlablelength p l a i n 712-Word text groupings length plain other than word text groupings lengths (2, 3, (6,10-13)

16)

I I

I

I I

813-0rlgmal 814-0rlglnal

plain text group- plain text group

ings are retained mgs are not re

m the cry~to tamed m the

grams (10-13 cryptograms

(14-15)