eclassified. and app~ fc1~T~M'BJ~A on 11-os-2013 

ursuantto E.O. 13526 
RE8TRIG'l':SD 

REF ID:A66790 

. SECTION IX 

POLYGRAPHIC SUBSTI'l'UTION'SlSTEm 

Paragraph 

General remarks on polygra.phic substitution. o ••••• ~ ••••••••••••••• •.• 64 

.Polygraphic substitution.methods employing large tables............. 65 

Polygraphic substitution methods employing small matrices........... 66 

Methods for recognizing polygraphic substitution •••••• ;............. 67 

General procedure in the identification and analysis of polygraphic 

substitution ciphers.~••••••••••••••••••••••••••••••••••••••••••• 

Analysis of four-square matrix systems ••••••••••••••• ; •••••••••••••• 

Analysis of two-square matrix systeins •• ••••••••••••••••••••••••••••• 

Analysis of Playf'air cipher systems••••••••••••••••••••••••••••••••• Analysis of polygraphic systems involving large tables.~•••••••••••• 

Further remarks on polygraphic substitution systems ••••••••••••••••• 

68 

69 

70 

71 

72 

73 

64. General remarks on polygraphic substitution.--.!. The substitution systems dealt with thus far have involved plaintext units cqnsisting of single elements (usually single letters). The major distinction .between them has been made simply on the basis of the number of 

ele1118nts constituting the ciphertext uriits of each; i.e., those involving single-element ciphertext units were termed uniliteral, and those 

involving ciphertext units composed of two or more elements were termed 

multiliteral.1 That is to say, when the te:rms "uniliteral", ''biliteral", 

"triliteral", etc., were used, it was to have been automatically inferreci 

that the plaintext units were composed of single elements. 

b. This section of the text will deal with substitution systems 

involving plairitext units composed of more than one element; ·such 

systems are termed pol~aphic .2 (By comparing this new term with the 

terms "unili:teral" andlilul.tiliteral" it may then be deduced--end correctly so--that a term involving the suffix "-literal" is descriptive of 

the composition of the cipher text units of a cr;vptosystem, and that a 

term containing the suffix "-graphic" describes the composition of the 

1 . See also subpar. 52a.· 

2 SJBtems involving p~aintext ~its composed of single elements may, 

on this basis, be termed monographic; however, as bas been stated in 

connection with the terms "unil1teral" and "multil1tera1", the plaintext 

units of a system are understood (without restatement) to be monograpbic 

unless ot~rw1se specified. 

Rl!l8TRIO'i'ED 151 
I 

REF ID :A66790i 

! RES'ffi:fC'fED 

---p1;i.~text- ~its. 3) Polygraph1c systems in which thJ plaintext units are 

coir.Posed of two elements are called dieyaphic, thos~ i_n which the plaintext units ere composed of' three elements ere ~r1graph1~, etc. .The 

ciP,hertext units of polygraphie systemB uslt8'1;1Y con8ii~;t ·or the same 

n~er of eleμ,ients 85 the plainte>.'t units. Thus, ~f a system is· called 

"digra.pbic", it may be assumed that the ciphertext *its of the. system 

consist of twC? elements, es do the plaintext units!J!:f'. this were not the· 

case, the term "d:i.graphic 11 by itself would not be -quate to describe • . I 

the system. completely, and an a.dditio~l modi.f'y1:Q8 ~r~ or phrase would 

have to be used to indicate this fact.5 i . · 

c. In polygraphic substitution, the c0mbinat1obs· o:! elements which 

COJJ.stitute the plaintext units .a.re considered as indlivisible compounds. 

The units ere composite in character and the indivi~'ual elements compos-· 

ing the units affect the equivalent cipher units jo~tlz, rather than 

separately. The basic important factor in true polygraphic substitution 

is·that ~the letters of each plainter.t unit partifipate in the determination of its cipher equivalent; the identity o!f .!!2h element of 

the plaintext unit affects the composition of the whple cipher unit.6 

Thus, in e. certain digra.phic system, ABp may be enci~ered e.s XPc; and 

ACp, on the other hand, may be enciphered as ~; a flifference in the i~ntity of but one of the letters of the plaintext J>air here produces a 

difference in the identity of both letters of the cipher pair.7 - ' ' 

.3 In this connection, it is f'urther pointed out tbat since the root 

"literal" derives from the Latin "litex·a", it is conf'entiono.l.ly prefixed 

.by modifiers ci.f' Latin origin, such as "uni-", ''bi-" 1 i and "multi-"; similarly, "graphicr•, deriving from the Greek "graphikosj', is. prefixed by 

modifiers of Greek origin, such as "mono-", "di-",. ~d "poly-". · 

'4 The gua.lifying adverb "usually" is employed bec~use this corre- . I spondence is not essential. For example, if one sho'illd draw up a set of 

6'"{6 arbitrary single signs, it would be possible to i-epresent the 2-

letter pairs from AA to ZZ by single symbols. This wμld still be a digraphic systeDJ.. : 

I 

5 See sub:pare. 6;e and 66f' for examples of two sueh systems and their .... - I 

names. · , 

6 An analogy 1B f'ou.."l.d in chemistry, when two ele~nts combine to form. 

e molecu.le, the latter usually having properties quite different from 

I those of either of the constituent elements. For ex~le: sodium, a 

metal, and chlc;>rine, a. gas, combine to form sodium cl,liloride, common 

table salt. HOTirever, sodium and fluorine, also a ga4 similar in many 

r.espects to chlorine, combine to form sodium. fluorid;, which is much 

different .from table salt. : 

7 For this reason the two letters ere marked by a!ltgature; that is, 

by a bar across their tops. In. cryptologi.£._notation~ the symbol eap . 

means "any pla.:S.n+.ext digraph"; the symbol eec' "any c;iphertext digraph". 

To refer speeifi-:::e.lly to -~be 1st, 2d, 3d, ••• member of a ligature, the

3 exponent 1, 2, 3, ••• will be used~ Thus e~ of REMp ~ the letter E; ec 

of XRZc is Z.. See also footnote 1 on pagP. r.!1 ~ i 

~ES'FRIO'i'Ei) 

152 
REF ID:A66790 

RES'l'RIO'l'ED 

-•t _....,........_ .. ~--... --............ 

d. The· fundamental purpose of pol;ygraphic substitution is again 

the s\ippression or the elimination of the frequency characteristics of 

single letters of plain text, just as is the case in monoalphabetic 

substitution with variants; but here this is accomplished by a different 

method, the latter arising from a somewhat different approach to the 

problem involved in producing cryptographic securityo When the substitution involves replacement of single letter&' in ~ monoalphe.betic· system, 

even a single cryptogram can be solved rather readily; basically the 

reason for this. is that the principles of frequency and t)le laws ot' 

probability, applied to individual units (single letters) of the plain 

text, have a very good ~ortwiity to manifest themselves. However, 

when the substitution involves replacement of plaintext units co~sed of. 

two or ~re letters-~~t is, when the substitution is polygraphic in 

nature--the principles of trequency and laws of probability have a much 

lesser opportunity to manifest themselves. If the substitution is digraphic, then the units ere pairs of letters and the normal frequencies 

of plaintext digraphs be~~ o~ first _const•ra-liion; if the substitution 

is trigraphic, :the ~its ·are sets of t,.._ letters am. the normal frequencies of plaim:ext trigraphs are involved. In these cases 'the data 

that ~-..~employed in the solution are meager-; that is why 1 pnerall7 .~ng, the aolution of polygraphic subs-tt~ion ciphers is o:f'ten extreme!:;,. d.itttauit. · . . e. B:r way of example, a given plaintext message of say n letters, 

enciphered. by means or a uniliteral substitution system, affords n 

cipher characters, and the same number of cipher units. The smne-messlige, 

e~ciphered · digraphically, still affords ~ cipher characters but ~nly -ftcip)ler units. Statistically speaki.ngJ'"the sample to which the laws of 

probability now ere to be applied hai.~been cut in half. Furthermore,, tram the point of view of f'requency).li'.the very noticeable diversity in 

the frequencies of individual lettell'S.J :·leading to the marked crests and 

troughs of the uniliteral frequencytdl.strib~tion, is no longer so str1k~ngly in evidence in the frequeaeies of digraphs • Therefore, although digraphic encipherment, for eDmlple, simply cuts the crJl)tographic 

textual. units in half, the number of e'tpher units which must be identified has been sguared; and the diffictity of solution is not merely 

Qo\J.bled but, if a matter of Judgment arising from practical experience 

can be expreslH!ci or approximated mathem&ticall;r, squared or cubed. 

f. The. foilowtng two paragraphs w111 treat various polygraphic 

substitution methods. The most practical of these methods are digraphic 

in character and. for this reason the·ir treatment herein will be more detailed ~ th&t of trigraphic methods. 

65. Poizgraphic substitution methods enwloying large tables.--

a. The simplest method of effecting polygraphic substituti.on involves the use of tables similar to that shown in Figm-e 47a. This 

table merel;r provides equivalents for digraphs, by means of-tbe coordinate system. Specifically, in obtaining tbe cipher equivalent of any 

RES'l'RIC'f'ED 153 
I 

REF ID :A66790[ 

RBSTRIG':PF~D I 

-1 

" 

I 

I 

1· 

I 

i 

I 

ABC DEF G HI J KL M N_<!_P_U slT_U V W X Y ~ A ·1 WG EE SN TR IA NL GC HT OI UO AM RP BY KB CD DF FH JJ LK MQ PS QU VV XW YX zil 

a m~TMm~~~~mM~M~~oowmw~~~wn~ll~I c 

1 

sa TE IN NR GA HL oc UT AI RO BM KP CY DB FD JF LH MJ ·PK :QQ .vs ·:fu w zw wx EZ 

C TG IE :NH GR HA OL UC AT RI BO KM CP DY FB JD LF.MH PJ Q,K VQ XS YU ZV WW EX SZ 

E IG NE GN HR OA UL AC RT BI KO CM DP FY JB LD MF PH ~J VK XQ YS ZU WV EW SX TZ 

F. NG GE HN OR UA AL RC BT KI CO OM FP JY LB MD PF QH VJ XK ~Q ZS WU EV SW TX IZ 

c oo~oo~AA~~~~oo~~u~rowmu~~~m~un~ 

H HG OE UN AR RA BL KC CT DI 1'"'0.JM LP MY PB QD VF XH YJ ZK WQ ES SU TV IW NX GZ 

I OG UE AN RR BA KL CC DT FI ,JO LM MP .py QB VD XF YH ZJ WK EQ SS TU IV NW GX HZ 

J oo~~~u~oonn~~"~n~IT~~~~~row~m~ 

K ~~~~~~~nUWNWTI~W~TMru~~uoo~m~m I • 

L RG BE KN CR DA FL JC LT MI PO QM VP XY YB ZD ~F EH SJ TK ~Q NS GU HV OW UX AZ 

M· BG KE CN DR FA JL ·Le MT PI QO VM XP YY ZB WO EF SH TJ IK NQ GS HU OV UW AX RZ 

N • KG CE DN FR JA LL MC PT QI VO XM YP ZY WB ED SF TH IJ NK PQ HS OU UV AW RX BZ 

0 CG DE FN JR LA ML PC QT VI XO YM ZP WY EB SD TF IH NJ GK HQ OS UU AV RW BX KZ 

P' DG FE JN LR MA PL QC VT XI YO Zt.t WP EY SB TD IF tllfGJ HK pQ US AU·RV BW KX CZ 

Q FG JE LN MR PA QL vc XT YI zo WM EP SY TB ID NF CH HJ OK UQ AS RU BV KW ex DZ 

R· JG LE MN PR QA VL XC YT Z! WO EM SP TY IB ND CF HH OJ UK i\Q RS BU KV CW DX FZ 

S • LG ME PN QR VA XL YC ZT WI EO SM TP IY NB GD HF OH UJ AK RQ BS KU CV DW FX JZ I 

Too~~~un~~a~TMun~~~~u~~~ru~"~u 

u PG QE VN XR YA ZL WC ET SI TO IM NP GY HB OD UF. AH RJ BK ~Q cs ·ou FV JW LX MZ I 

V QG VE XN YR ZA WL EC ST TI IO NM GP HY OB UD AF RH BJ KK CQ DS FU JV LW MX PZ 

W VG XE YN ZR WA.EL SC TT II NO GM HP OY UB AD RF BH KJ CK pQ FS JU LV MW PX QZ l 

X XG YE ZN WR EA SL TC IT NI GO HM OP UY AB RD BF KH CJ DK fQ JS LU MV PW QX VZ i 

Y YG ZE WN ER SA TL IC NT CI HO OM UP AY RB BD KF CH DJ FK aQ LS MU PV QW VX XZ 

Z zc· WE EH SR TA IL NC GT HI 00 UM AP RY BB KD CF DH FJ JK i,Q MS PU QV- VW XX Y'Z. I --.. ·--' 

I 

plainte.xt digraph,, the initial letter of the plainteft. dig:Paph·~s used 

to indicate the row in which the equivalent is foundj. and the final 

letter of the plaintext digraph indicates the column; thf,' cipher digraph 

is then found at the intersection of the row and colWim thus indicated. . ...._, ·- ._..,._ - I For example, KGp::FCc; Wl-1p:OY0 ; etc • i 

b. In the preceding table two mixed sequences were e~loyed to - I form the cipher ~quivalents, one sequence being based on the key phrase I • 

WESTINGHOUSE AIR BRAKE and the other on GENERAL EIECTRIC COMPAnY. The 

table in Figure 47a could ho.ve been drawn up in a sltghtly different 

manner,, as shown in Figure 4Tu, end !3t:Ul :yield the ~an:.e cipher equivalents as before.. Using this Iatt.er ta°t'la·, e~ for anjr plain.text digro.ph I ' 

I 1 is found at the intersecti~n of the rm-r and column i~entified by ep- and 

• 2 I ' 

e~, respectively; ec is fmmd in the sequence below ~be table and is 

I 

' 

RES'FRICPBD 
REF ID:A66790 

RE8TRIG'FElD 

(J2p 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

A WESTINGHOUARBKCDFJLMPQVXYZ 

B ESTINGHOUARBKCDFJLMPQVXYZW 

C STING H.O UAR BK CD F J L MP Q V X Y Z WE 

D T I N G H 0 U A R B 'K C D F J L M P Q V X Y Z W E S 

E INGHOUARBKCDFJLMPQVXYZWEST 

F NGHOUARBKCDFJLMPQVXYZWESTI 

G G H 0 U A R BK C D F J L M P Q V X'Y Z WES T IN 

H .H 0 UAR BK CD F J L MP Q V X Y Z WESTING 

I 0 UAR BK CD F J L M P.Q V X Y Z WESTING H 

J UARBKCDFJLMPQVXYZWESTINGHO 

K A R B K C D F J L M P Q ~ X Y Z W E S T I N G H 0 U 

L R B K C D F J ~ M P Q V X. Y Z W E S T I N G H 0 U A ~ 

~M BKCDFJLMPQVXYZWESTINGHOUAR 

t~ KCDFJLMPQVXYZWES~INGHOtiARB 

. 0 CDFJLMPQVXYZWESTINGHOUARBK 

P DFJLMPQVXYZWESTINGHOUARBKC 

Q F J L M P Q V X Y Z W E S T l N G H 0 U A R B K C D 

R JLMPQVXYZWESTINGHOUARBKCDF 

S LMPQVXYZWESTINGHOUARBKCDFJ 

T MPQVXYZWESTINGHOUARBKCDFJL .C 

U P Q V X Y Z WESTING H.O UAR BK CD F J L M 

V QVXYZWESTINGHOUARBKCDFJLMP 

W VXYZWESTINGHOUARBKCDFJLMPQ 

X X Y Z WE s·T ING H 0 UAR BK CD F J L MP Q V 

Y YZWESTINGHOUARBKCDFJLMPQVX 

Z ZWESTINGHOUARBKCDFJLMPQVXY 

~GENRALCTIOMPYBDFHJKQSUVWXZ 

Figure .4'fE.. 

taken from the position directly llllder the column identified bye~. A 

few sample encipherments will illustrate that this table is cryptogra.phice.lly equivalent to that of Fig. 47!!:• 

c • Figures 48 and 49, below, contain other possible types of tables 

for digraphic substitution. In Fig. 48, it will be seen that tliere are 

two vertical sequences to the· le~ of this table and no horizontal 

sequence below it. el is located in the leftmost sequence, eel being P· . 

found' directly to its side in the right-hand sequence; e~ is then :found 

at the intersection of' the row and column identified by e~ and e~, 

RBSTRIG'FBD 155 
REBTRIO'l':SD 

REF I 

ID:A667901 

. I 

eip 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

lllpfllo • I --

AW GENRALCTIOMPYBDFHJKQSpv~XZ 

BE ENRALCTIOMPYBDFHJKQSY~WXZG 

CS NRALCTIOMPYBDFHJKQSUVWXZGE 

DT RALCTIOMPYBDFHJKQSUVWKZGEN 

EI ALCTIOMPYBDFHJKQSUvwxkGENR 

FN LCTIOMPYBPFHJKqsuvwxz~ENRA 

G G C T I 0 M P Y B D F H J K Q S U V W X,Z G E N R A L 

HH TIOMPYBDFHJKQSUVWXZGENRAtC 

I 0 I 0 M P Y B D F H J K Q'S 11 V W X Z.G E N R A L C T· 

JU OMPYBDFHJKQSUVWXZGENR~LCTI 

KA MPYBDFHJKQSUV\'fXZGENRALCTIO 

LR PYBDFHJKQSUVwxzr.ENRALP~IOM 

MB YBDFHJKQSUVWXZGENRALC~IOMP 

NK BDFHJKQSUVWJCZGENRALCTIOMPY 

OC DFHJKQSUVWXZGENRALCTihMPYB 

PD FHJKQSUVWXZGEiRALCTIO~PY~D 

QF HJKQSUVWXZGENRALCTIOMPYBDF 

RJ JKQSUVWXZGENRALCTIOMPYBDFH 

SL KQSUVWXZGENRALCTIOMPYBDFHJ 

T M· Q S U V W X Z G E N R A L C T I 0 M P Y B D F H J K 

U P S U V W X Z G E N R A L C T 1 0 M P Y B D F H J K Q 

VQ UVWXZGENRALCTIOMPYBDFHJKQS 

WV VWXZGENRALCTIOMPYBDFHbKQSU 

XX WXZGENRALCTIOMPYBDFHJKQSUV 

YY XZGENRA~CTIOMPYBDFHJK~SUV~ ZZ ZGENRALCTIOMPYBDFHJKQSUVWX 

---·- I : 0 i 

Figure·~S. 

, I 

respectively. The table in Fig. 49 pr,2!.id!! digra.pl:).ic equivalents by 

mee.ns of the coordinate ayatem. (e.go·, REp:JZc) 1 in -t;!ie s~ manner. &s in 

Fig. 47!, and a. .cure?ry eY.amina.tioil of the inside o~ the ta~le might 

disc lose nothirt.g new about t.his table tt all. But, ; if O?le were to scan 

closely the diagonals formed by eacl'l ec from upper li'igbt to lower left 1 . ' 

he would see that ea.ch such diagonal. cha.riges below yhe "l4p row"; sim:l- · 

la.rly, 1.:r the die.gone.ls :formed by e~ are scanned :r.rcrn uw..~r left to 

lower right, it will be seen that ea.ch of them also I changes after the' · 

"1'\n row". In effect, the inside of the table is di"'fided into two separate portions by' an i.Diaginaxy line extending horizo4tallybetween the 

M and N rows; but vithin ea.ch .portion 11 straightfoi,-ard. type of symmetry 

is ex,l;ii.bited ADd the same two mixed sequences have l:?een employed in ea.ch. 

Actually, in a 26x26 tagle, it is not possible to maintain the diagonals 

formed thus bye~ and ec in a completely "unbroken" !sequence ·without I 

producing repeated digraphs within ·the table and wi~hout consequent 

cryptogra:l';)hic ambiguity; thus, Fig. 49 illustrates ~ne type of limited 

c.'lfo.gona.l Gynl'Jtetry whic"1 mu.st 'be resorted to in the systematic construction of such a ta.l:> le. 

HES'fRJC'f'ED 
e 

REF ID:A66790 

RElSCf'RIC'i'ED 

A 

I 

0 

J) 

I 

'I 

0 

Jl 

I 

.r 

I 

J. 

~Pt I 

I 

0 

p 

Cl 

Jl 

8 

le 

v 

T 

•. 

lt 

t 

I 

1 I O D I 'I 0 11 ! .r KJ.·lllOPO.ll 11'1'11TWXTI 

• I s 'I! I· JI II B 0 11 A R B I 0 D r J L u p Q v x y z 

z x • ' 11 B o.· I J B , D I T p II 0 I ' c L A R • I Q 

I s l'I! T JI Q B 0 u A R B lt 0 D J' IJ L u p Q v x y z II' 

Q z x II' v 11 s 0 K J R , D B y p u .o I 'I! c L A R Ir I 

s 'l I H II R 0 11 A 1l B K 0 D r J L u p Q IV x y IZ. II' E 

I 0 z x • v 11 s 0 I J I r D B y p u 0 I 'l 0 L A R E 

'I! 11 N II R 0 u A R B lt 0 D r 1.r L u p Q y IA T z " E s 

• I G z x • v u s 0 I J I r D B T p LI 0 1 T c L A 1l 

I II 0 R 0 u A R B lt c D J' J L II p Q v x y z • !l s 'I! 

• • I II z x • v 11 B 0 lt J B r D B T p ll 0 I T c L Jo 

• II B o u A a :a lt 0 D r J L u p Q v X T z IT I s T I 

A 1l • Ill II z x • v u s 0 I .r B r D B T P ll 0 I T 0 L 

!G B 0 u :l R IB lt c D r J L Ii p Q v :x y z " !I s T I IU 

L A R :tr E II z x • v u s 0 It .r H r D B T p ti 0 I 'I! c 

H 0 u A l!. B lt 0 D ., J L Ii p Q v JC y z 11 E s T I ll G 

0 L A R H I II z x • v 11 B 0 IC .r R r J) B T p II 0 I T 

0 v A R B IC 0 D r J L u p Q v x y z w I s 'l' I Ir II H 

'1' c L A R • lil II z x 11 v u s 0 It J H r D B T p IJ 0 I 

u ... i\ B IC 0 J) r J L II p Q v x y z • I s 'l' 1 !I II e 0 

I T c L A R H I G z x II' v u s 0 IC J R ., J) B T p IJ 0 

A ~ B K 0 D r J L ll p Q v x y z • B s T II I{ G H 0 u 

0 I '1' 0 L A R !r I G z x • v u s 0 It J R r J) B T p I.I 

1l iB flt a J) r J ,L Ill p Q .V IX IT z ,II' lll s T ;l Ill II e 0 u A 

u 0 I '1' 0 L .A R • JI G z x • v u s 0 IC J II ., D B T p 

!B ' 10 D ., J. IL u I' Q IV x I z • lil IS IT 'o f.I II !I 0 l1 A IR 

p M 0 I '1' 0 L A R N lll G z x • v u s K J H r D B ? 

z T X v Q p II L J r J) c It B R A u 0 ii G IN

0 

I 'l' s E I' 

z 0 I !r 1l A L c 'I! I 0 u p T ll J) r II .r IC s u v • x I x v. I~ p Ii ;i. J J' D 0 It JI R A u ID II G Ir IJ T s E 'II' z x z G E ti R A L 0 T I 0 I.I p T B D ., H J IC 0. s u v I 

x T ~ IP " L " 1r u u & B R A U 0 If 0 IU I T S :;: \'I z y 

• x z G I N R A L c ' I 0 I.I p T ll J) .,. II J IC 0. s tt ' v Q p II L J r D 0 I :a ll A v 0 H II JI ' T S E If z y x 

T W x z 0 I W R A L C T I 0 " p y B J) ., H J It 0. s n 

Q p u L. J r D 0 It B a A u 0 II G Ir I T S I If z y x T 

11 T • x z II I JI R A L 0 ' I 0 M p T B D r H J K 0 s 

I!' y IL IJ I' ~ c ;& B ll IA u :o Ill G Ill II IT S ;: I z y IX v Q 

B U v • x z 0 B II R A L c 'I! r 0 I& p y B D r R J x -~ 

Iii L J 11 D c I& B R A u 0 e II IN II IT s £ flT lilo II x IV ~ IP 

Q s tr v • x z G E JI R .l L 0 'I! I 0 ll p T B D F B J x L J II' J) c It IB R ... :u 0 a G II . IT s m II z T x v -l p II 

I Q s 11 v If X· z 0 E JI II A L c T I 0 u p y B D r H J 

J I' D C IC B R A u 0 H 0 II l l'l' s E " z fl x v ~ p II IL 

J It 0 s u .v If x z 0 I :tr R A L c T I 0 II P T B D F B 

r J) c llC£ B R A u 0 11- 0, II I 'l' s I IT z I ~ :v q, p 14 L iJ 

B J IC -'o s u v w x z 'O I II R A L c T I 0 ll p y B D r J) c I B IR A- IV 0 ii 0 N \ 1 'l' s IE II' IZ I x v ·"'o :l' 14 L J ;F 

., . H .r I 0 s u v ' x z G E JI R A L· c T I I! p y B D 

c It B R ... u ~ H G Ii I T s E IT z ,y x v Q r IA L J r D J) r R J x 0 s u v If x z G E JI R A L c T I 0 II p T B 

IC B R A u 0 Ii 0. II H l T s E • z T x v q, p II L J r J) c B D F H J IC s u v 11 x z 0 .. • II A L ll 'I! I 0 u p T 

.. Figure 49. 

d. All of the foregoing tables have exhibited a symmetry in the 

arrangement o"f their contents, which is undesirable from the standpoint 

of cryptographic security. This systematic internal arrangement could 

be detected by a cryptanalyst early in his attack on cryptograms produce~ through their use, permitting rapid reconstruction of the particular 

table involved; this subject will be given a more detailed treatment in 

par. 72. The table in Figure 50 is an example of one t;ype of table which 

would provide more security than the foregoing. This table is constructed by random assignment of values e.nd shows no symmetry whatsoever 

in its arrangement of contents. It vill be noted that this table is 

RESTIUG'i?BD 

157 
REF ID:A66790 

RESTRIG':FED 

A 

c 

- D 

a. "' E -.... 

Q) 

~·F Q) 

-

(Showing only a parlJally Oiled table) · 

Final Letter (IP11) 

A B C D E F G H I J K 

zx 

\ 

BB YA .. AI 

NZ - - - - - - - - - -

. 

~NfS=HdlllJ-1 x 

y 

z 

. . . . . . . . . . . . . . . . . . AC AJ - - - - --- DE AF , .. --- I . A BD ; 

A B C D E F G H I J 'K 

Figure 50. · 

... 

x y z. 

• E~DJFH ·A - - B 

• BF ·p 

. 

---·E 

_,__ 

AA . F· 

. '• . . ':: 

BE 

AD 

AK 

xly z 

I 

:x 

y, 

,z 

reciprocal in nature; that is iiFp=mc ana mp:AF'c. ~Thus, this single 

table serves for deciphering as well as for enciphe~ing. Reciprocity 

is, however, not an essential factor; in fact, greater s~curity is provided by non-reciprocal tables. But,. in the case o:r sue~ non-reciprocal, 

randomly· constructed tables, each enciphering table! must.have its conq>lementary deciphering table. 

e. Digrapbic tables enit>loying 'numerical: equi~alents instead of' 

letter equivalents ~)'be encountered. However, si·nce 676 equivalents 

are required (there being 676~ or 26x26, different pairs.of letters), 

this means that combinations 'Of three figures must ~e us.ed; such systems 

ar.e termed trinome-digraphic'-systems:, ·indicating clearly the number of' 

elements which comprise the,.tipber units. By way dr an e:x:ample, the 

RES'f'RiC'f'ElD 

158 
I 

I 

I 

' I i-i . I 

\ 

I 

REF ID:A66790 

n FiS'FRICTElD 

fo~~~1~ figure-contai~ ~fragment of a table8 which provides trinome 

equivalents for the plaintext digraphs: . 

., .:. A-·. B. ·c: n E y z 

.. -. A .001 002 003 0 005--·•. •- ••• -••• 025 02 

: · B - 027 -028 029 '030: '03L ·'. - - - : 051· 052 '' ·. c 053 'b5' 4: ·. ' '.; . . .• . ... ' .. -c-, c .. • • • 'r ,. • ,> I '• .. " '- • ':. ! • 

• ..... , ·_. ,, ~ . ': ·' .. ,· .: ', .. 

I ..... '• .._ ; ••• .a , 

- ;... . ·,. ,, . '_,. _ ... 

·. Figure 5i. : 

! . All o.f the foregoing tables have ·been digra.p:fli~ in nature, but 

a kind of false trigraphic ·substitution may also be a.ccomplished by means 

" of similar tables, as illustr.ated i.n Figure 52, wherein the table is the 

same as that in·Figure 49 with the a4dition.of one more sequence at the 

top of the tabl.~·.· ~-In ~.ing th~ ~able, e~ is_ loc8:ted in sequence I, 6.Dd 

8 '. . ........ · . ,, . . It is interesting to note that this comparatively bulky and unwieldy 

table can be reduce.d to the following two alphEi.bets with numerical 

equivalents tort~ ~etters: · 

I. ... 

(1) · A· ··B- ·· C- i> E F 

000 026 052 078 104 130 • • • x y z • •• 598 624 650 

.. • 

• • • ••• ••• • •• 

(2) A B C D E F • • • • • X Y Z ._, .. ·. -.. -·-;1 ' 2· ' . '3 . . 4 .. 5 . 6 .•. • • i •·· .24 25 .26 .. 

.. :::' I ;• i I : ~ .. ,;_.I ~ "' I;,,'", ~ : _.-~ '":.. ' I\ 0 I - ' • '.. I 

In enciphering, tlie first letter of the ·plaintext digraph is converted 

mto·· 1ts mimerical· value trom alphabet '(11), and the second plaintext 

letter is,, converted by means of alphabet (2); the two numerical values 

thus' derived are added.together, ana.·their sum is ta.ken as the cipher 

equivalent of .:the particular plaintext atgripii. Of course, this simple· 

r~uction .would .not be possible if the trinomes, 1n ascending order, had 

been arranged.:1n the table in, say, a diagonal manner • 

. ' . c •• ' ... ' 

J 't, '1.,, \ ' r 

REJS'f'RIO'i'ED 

159 
REF ID:A66790 

1··_ e 

III. ABC DEF G ~I J KL M·~~ P QR S Tju V.W t Y ~. IV. RAD I 0 C PT N. FM EB G HJ K-L Q SUV W X Y Z 

I.II. · : ' '· 

A W G E N R A L C T I 0 M P Y B D F H J K Q~S U V W X Z 

B E EN RA L c TI 0 Mp y B D F HJ K Q s1u.v w x z G 

C S NRA LC TI 0 MP YB Q F HJ K Q S U1V W X Z GE 

D T R A J. C T I 0 M P Y B D F H J K Q .S U, VI W X Z G E N 

EI ALCTIOMPYBDFHJKQSUVWXZGENR 

F N LCTIOMPYBDFHJKQSUVWXZGEN.RA • 

G G ·c TI 0 MP YB D F HJ K Q SUV W X Z GEN R,A L 

H H T I 0 M P Y B D F H J K Q S U V W X Z G E N R A f.. ·C 

I 0 I 0 MP YB D F HJ K Q SUV W-X Z GEN RA-LC T 

J U 0 MP YB D F HJ K Q SUV W X Z G E'N RA LC TI' 

K A M p y B D F H J K Q s u v w x z','a EN R A L c T'i 0 

LR PYBDFHJKQSUVWXZGENRALCTIOM , 

M B Y B D F H J K Q S U V W X Z G E N R A L• C T I 0 M P 

N K BDFHJKQSUVWXZ.GENRALC1 TIOMP.Y 

0 c D F H J K Q s u v w x z· G E N R A L c Tl I' 0 M ·p' y• s' . PD FHJKQSUVWXZGENRALCTI,OMPYBD. 

Q F H J K Q S U V W X Z G E N R A L 'c T I ~ M P Y ~ D F 

. : ~ ~ ~ : ~ ~ : ~ ~ ~ ~ .: .: ~ ~ ~ ; i. ~ ~ ~ ~ i ~ ~ ~ ~· TM QSUVWXZGENRALCTIOMPYjBDFHJK 

UP SUVWXZGENR:ALCTIOMPY~DFHJKQ 

V Q U V W X Z G E ·N R A ~A: T I 0 14 P Y B D, F H .J K Q S 

W V V W X Z G E N R A .. L ~ !l' I 0 M P Y B D Fj H J K. Q S U 

XX WXZGENRAL<Pl'lOMPYBDFJiJKQSUV 

y y x z GEN RA L c TI 0 Mp y B D F. H ~ K Q s·u v w 

Z Z Z GEN RA LC TI 0 MP YB D F HJ_~ Q SUV W X · 

I 

Figure 52. I 

its equivalent,, e!,, taken from sequence .II; e~ 1~ loc~ted. in sequence 

III,, and its equivalent,, e~,, taken from se.quencellV; e~ is the letter 

lying at the intersection of t~· rotl indicated bi e~ in sequence ·x end 

2 . I . --- the column determined by ep• Thus,, FIRE Lms ~ul~ be enciphered NNZ 

-- i IEQ KOV. Various other agreements 1MJ:1 be made with respect to the · alphabets in which each pla.iutext letter will be ! sought in such a table, 

but the basic cryptographic principles are the s~ as in the case 

described. I 

I 

~· Tables such as those illustrated in Fig •• 47.521 ~bove,, have 

been encountered in operational. systems,, but thefr use has not been~· 

Widespread because of their relatively large siz' and the inconvenienee 

in their production and handling. In lieu of th~se l~e tables it is 

possible to employ much smaller matrices or geometrical designs to ac- 1 complish digraphic substitution; methods involvi~ their use will be 

discussed in the following paragraph. 

RES'FRIO'i'BD 

l6o 
• 

REF ID:A66790 

RES'fRIC'fED 

66. Polyc;rt:'.phic substitut:l.on methods eMgloyine smo.11 m~.tr:i.ces .9 __ a. A simple method for accomplishing digraphic substitution 1nvol ves the use of the four-square mo.trix, a matrix consisting of four 

5x5 squares in which the letters of a 25-element alphabet (combining I 

and J) are inserted in any prearranged order. When four such squares 

are arranged in a. matrix as shown in Figure 53 , the lo.tter may be employed for digro.phic substitution to yield the same cipher results as 

does a much larger table of the type treated in the preceding paragraph. 

1 - 2 In a four-square matrix, ep of eep is sought in section l; ep, in section 

l 2 . . 2. Thus, ep and ep will always form the northwest-southeast corners of 

an imaginary rectangle delimited by these two letters as located in 

1 2 . 

these two sections of the square. Then ec and ec are, respectively, the 

letters at· the northeast-southwest corn~rs of this s~ rectangle. Thus, 

TGP :xs c ; WDP ::Ciic; ORP =IY c ; Uf\, :XB c ; etc • In decrypting, e~ and e~ are 

sought in sections.3 and 4, respectively, and their equivalents, e~ and 

2 . . 

ep, noted in sections 1 and 2, respectively. · 

A B c D E F 0 u R T 

F G H I K L M p Q E 

L M N 0 p K y z s N Sec. 3 (e~) 

Q R s T .u I x w v A 

v· w x y z H G D c B 

T H I R E A B c D E 

0 P· Q ·s N ··F· G H I K' 

Sec. 4 (e~) M y z u A L M N 0 p 

L x w v B Q R s T u 

K G F .D c v w x y z 

Figure 53. 

b. It is possible to effect digraphic substitution with a. matrix 

consisting of but two sections by a modification in the method of finding equivalents. In a horizontal two-square matrix, such as that shown 

4 l ~ ~ in Figure 5 , ep of eep is located in the square at the left; e;, in the 

square at the right. 

9 The word matrix as employed in this paragraph refers to checkerboard-type diag1·ams smaller than the tables illustrated in the preceding 

paragraph. These matrices are usually composed of sections containing 

25 cells each. 

RBS'i?RIC'f'ED 
REB'FRIO'FEP \ 

9192 

pc. 

M 

c 

B 

L 

v 

A 

.T 

D 

0 

w 

REF ID:A66790 . . 

N u F A u T 0 tii . I ,_ - -i:-: R I G B I L E s 

! 

' E H K c D F G ~ 

p Q s K N p Q 'R 1. 

x y z v w x· y I~ I 

Figure 54. i . 1 2 · I . When Sp and 0p are at the opposite ends of the d/iagonal of a.n·imaginary 

I 

rectangle defined by. these letters, the ciphert~xt equivale~t comprises 

the two letters el>Pea.ring at the Ol?J?Osite ends df the other diagonal of • r ~ • . 

1 I the same rectangle; ec is the particular,one wh~ch is in the same row as 

1 2 . 2 i --· 

ep, and ec is the one in the same row a.a ep. For example, ALp~ci 

- - l 2 i DOp:GAc. When ep and 0P happ~n to be in the smpe row, the ciphertext 

,!g,Uivalent i!__merely the reverse of the plaintext digraph; for exam:ple, 

.ATp~Ac and EB:P=HEc • i 

~ . 

c. Digra.phic substitution may also be effected by means of vertical 

two-square matrices, in which one section is d1tectly above the otb.e1"; as 

in Figure 55; it will be noted that matrices ofithis type have a feature 

Of reciprocity When employed 8.CCOrCliD.g tO the USUal rules I Which f'OllOW e 

M 

c 

B 

L 

v 

-

A 

-

B 

r---

·c 

-

K 

~ 

v 

RBSTRlO'FED 

A N u F --- T R I· G - - D E H K 

- 0 p Q. s 

w x y z 

u T 0 M -

I L E s - - - ~-

D F G H 

- - --1-

N p Q R 

-wlx- y z 

Figure 55 .• 

I 

' 

) '

I 

' I 

I 

.r. 

' 
REF ID:A66790 

RESTRICTED 

l 2 . 'When ep and ep are at th~ opposite ends of a diagonal, the rule for encipberment is the same as that for horizontal two-square encipherment 

(e.g., ~=iiic and U"Ai>=m:c)J ~en both e~ and e~ happen to be in the same 

colunm, the. plaintext digrlqlhs ~· self~enoiphered, (e.g., MA'p::MAa and 

~~), a f~t which constitutes en imports.ht Weelmess of this method~lO 

This disadvantage is only slightly less obvious 1n the preceding case of 

Jlorizontal two-square methods -.,he~ein the. cipher equivalent Of eep con-

'f!11Sts merely of the pla1trtext letters in reversed order. 

'· d. One-sguai-e digraphic method.S, with a necessary· modification of - ' 

the method for finding equivalents, are also possible. The first of . this t~ to appear .as a practical military system 'was that known as the- 11 . . . . Playfair cipher. It was used for a number of ,ears as a field cipher .· by the British~' before and during World War I, and for a short time, - al.so during that war, by certain units of the American Expeditionary 

Forces. Figure 56 shows a typical Play:f'air square. The modification iii 

the method of f1~1ng cipher equivalents has been found usetu.l in 

M A, N u· F 

c T R I G. 

·"· 

,. 

. ' 

.B D E ij K 

~ 0 p Q s· 

w x y z .. " .. , ' ~ •• ; .. , • •• ~ ,., ·~ , r • , • ' ,', • .~ ~· •, r 

., ~ ' I tl1 I 

imparting a greate:r degree of security than that afforded in' the preced- . 

:l.ng small matrix methods. The usual method ot encipherment can be best 

·explained by e~les given under'·four categories: 

. . 

lO'see subpar. 7~ on Other enciphering conventions which remove this 

weakness • . · ' - . · · · 

. 11 This cipher w8.s really ·invented b7 Sir Charle~ Wheatstone but receives :I.ts name from Lord ·Playfair, who apparently was its sponsor before 

the British Foreign Office. See W~s Reid, Memoirs of Lyon Playtair, 

London, 1899. It is of interest to note that, .to students of electrical 

engineering, Wheatstone is. generally not known for his contributions to 

crnrtography but is tamed for something he did not invent--tbe so-called 

Wheatstone bridge", really in'Y'ented bY,Samuel H._~hristie. 

RESTRIOTED 

,, 

r • ~ l • 

. ' 
REB1?REC'fED REF ID:A66790 

( ) . . 1 2 . 1 Members of the plaintext pair, ep and ep,·are at opposite ends 

of the diagona.1.' of an imaginary rectangle define~ by· the two letters; . . I 

the members of the ciphertext pair, e~ and e~, le at tlie opposite ends 

~ the other diagonal. of this i~inary. rectangl,. Examples: MOp:ALc; 

MIP:ucc; LUP:~; Vlp=YCc• . . I 

(2) ep1 end ep2 are in the same row; the letter immediately to the • ·1 

right of~ ·forms e~; the letter immediately to the right.of e~·forms 

e~. When either 0~ or e~ is at the extreme ·rigbJ of the row'· the first 

. letter in the .row becomes its cipher equivalent. Examples: MA_p::Aic; 

Mffp=AFci AFp=iMc; ~=Mfic. 

(3) e~ and e~ are in the same column; the ~ett.er immediately below 

e~ forms e~, the letter immediately below 0~ fort e~. When either 0~ 

or e~ is at the bottom of the column, the top letter in that column becomes its cipher equivalent.. ],!:xamples: MCp:CB0 ; AWp~; WAp:.AT0 ; 

QUp=Yic• . . · 1 2 I (4) 0p and ep are identical; they are to bt; separated by inserting 

a null, usually the letter X or Q, and subsequen~ly enciphered by the 

pertinent rule f'rom above. For example, the word BATTI.ES vould be enciphered thus: 

BA TX TL ES 

DM RW CO KP 

The Playfair square is automatically reciprocal so far as encipheI'll"~nts' 

of type (1) above are concerned; but this 'is not~true of enciphermenta 

of type (2) and (3). 

e • It :!s not essential that the small matr ces used .Por digraphic 

subst'itution·be in the shape of perfect squares; 1recta.ngular designs will 

.serve equally well, with little or no modificat19n in procedure.12 For 

exal!lple, each section of, say, a four~square matriix could be constructed 

with four rows containing six letters each by haVjing Up serve for Vp, as 

I trell as Ip for Jp• Furthermore, it is possible ;o expand the sections of 

a digraphic matrix to 28, 30, or more characters 1by the follo'\Ting subterfuge, without introducing digits or symbols into rh• cipher text;.13 One 

12 llowever, because the terms "fotμ"-sguare mat~ix", "two-squar~ ?!1.atrix", 

and "Playfair sguare" have become firmly fixed in cryptologic literature 

an~ practice, they continue to_ be.applied to all 1such matrices, even 

when the "squares" of such matrices do not conta:ijn e.n equal nu.mber of 

rows and columns (that is, even when they are not square). ' . I . 13 The addition of any symbols such as the dig*s 1, 2, 3, •.•. into a 

matrix solely to augment the number of elements'~o, 27, 28, 30, 32, or 36 che.racte~s would not be considered practicable, Since such a procedure 

would result in producing cryptograms. containing intermixtures of letters 

a.1111 figures. 164 

REJS'FRIC'f'ED 
REF ID:A66790 

R:SS'f'RIO'f':SD 

of the letters of the alphabet may be omitted from the set of 26 letters, 

and this letter may then be replaced by 2, 3, or more pairs of letters, 

each pair having as one of its members the omitted single letter. The 

5x6 Playfair square of Figure 57a has been derived thμs; tbe letter K has 

been omitted as a single letter;-ana. the number of characters in the 

rectangle bas been.made a total of 30 by the addition of five combinations of Kwith other letters • .An interesting consequence of this 

w A s H I N . - G T 0 B c D 

-- ,____ 

E F J .KA KE KI i--·---- - --- KO KU L M p Q 

R u v x y z 

Figure 57!,• 

modification·1s that certain irregularities are introduced in any cryptogram produced through its use; for exam.pl~, (1) occasionally a plaintext 

digraph is replaced by ciphertext trigraph or tetra.graph, such as 

' 

3_:mruc a.nd EP'~KEKOc; and (2) variant values m~ appear--:BKE0 , DKEc/ 

KEPc, GP0, and T~c _all may be used to represent Cl\>• As far as the 

deciphering is concerned, there is no difficulty because anyK occurring 

in the cipher text 1.s .considered as invariably forming a ligature with 

the succeeding letter, taking the pair of lette~s as a unit; and, when a 

plaintext unit is obtained con.,.~ning one of the K-pairs, the letter 

after the K is di~regar~d; :f'o;- example, CKO is reS:d as .c~'! The fo~- • ) •"t"" \'" ),•\'..:.,:,~,·llj.:: ·~·~"l,.l~;'.,.(;~' '•,•/•l .. ..,.'.~J'>.,,r, .'....•:•,'• ':'t\!:•I 't\.-.".-' ~.~~ ',"~:1, .. ''•.-, '••1 11\·\•~1:• ::· ..... ,:- • .-~ I I ,.:; 

· ·aqua.re. matriX"'in··:t::t:g ... 5'7E, ·hS.s 'alsoll>eeri cdnstructed ilsing·'the foregoing 

RES'FRIO'l':SD 

e2 

c 

B 

I 

3 

7 

M 

u 

A 

G 

KI 

N 

Q.O 

u 

2 

g 

D 

H 

0 

v 

B 

H 

KO 

0 

QU 

.v 

/ 

E 5 

N A 

4 F 

8 J 

p Q 

w x 

c D 

I J 

KU KY 

p QA 

G.Y R 

w x 

R L A B c 

1 c G H I 

6 G KI KO KU 

(11 K N 0 p 

s T QO QU G.Y 

y z u v w 

E F M u N 

KA KE 3 R 8 

L M 2 D 4 

ow. QI 6 G 7 

s T L 0 p 

y z T v w 

Figure 57£· 

D E 

J KA 

KY L 

GA QE 

R s 

x y 

I 9 

A 1 

E '5 

J 0 

G. R 

x y 

F 

KE 

M 

QI 

T 

z 

c 

B 

F 

K 

s 

z 

e2 

p 

. . ... ., 

,' 
RBS'l'RIO'l:'l!ID REF ID : A6 6 7 9 ~ ' . - - l 

subterfuge. With this latter matrix, numbers i~.the plain text may be 

enciphered, still without producing cipher text\ containirig numbers; for 

example, the plain text "HILL 3406" would be represented by. the cipher 

QAB AT KUKI NQE, which would be regrouped irr~o group~ of fiye letters 

and sent as QABAT KUKIN Qt!. • • \ 

! 

f. Figure 58 shows a numerical four-square matrix which presents a - I 

;~;~~!n~~~~!!~o~:a;~eaf:r!~! i! :S~~q!~s~:r:heT~u:::~:~:;o: of 

message one proceeds as usual to find the numer~cal equivalents of a pair, 

and then these numbers are added together. Th~: 

Plain text: PR OC EE DI NG 

275 350 100 075 325 

9 13 24 18 7 

Ciphe1• text_: 2'8li: 363 12~ . 093 332 

A B C D E 0001025 05007S100 

T7-H"1_K_1251so 175 2otj'225 1--1---1---1----____ ,___ 

Sec. 1 (81 p) L M N 0 P 250 275 300 325

1

350 Sec. 3 (81 

0 } 

I--- I 

Q R S ___ T U 375400425450475 ,_ __ _ v w x y z 500525550575600 

--1===- -------

0 1 2 3 4 V Q L F A -------------

5 6 7 8 9 W R M G B 

---r-----1--1---1--+--H-, -1 

Sec. 2 (82 10 11 12 13 14 X S ~ H iC .,,) 

1-l-5-1--l-6-1-l 7- 18 19 Y T 0. I fD 

2o 21 22 23 24 zu r-1<~'\E I 

l!"'igure 58. \· 

I In deciphering, the greatest- multiple of' 25 conta:pied in the group of 

three digits is determined; then this multiple an4 its remainder are used 

to form the elements for determining the plaintext pair in the usual 

manner. Thus, 284:275 i' 9=PR. l - I 

~· Thus far all the small-matrix methods haifie involved only digraphic substitution. The two ma.trices together ~llustrated in Figures 

59a and b may be used to provide a system. for encipherment which is 

:partly trigraphic; the adverb "partly" has been usied because this particular system will yield trigraphic enc1pherment rpproximately 88.51> of 

the time in o~dinary text and digraphic encipherme~t approximately 11.5% 

of' the time.l In this case the cipher equivalentp of the trigraphs 

I 

14 These figures a.re based on the number of trig~aphs ending in one of 

the 15 highest-frequency letters (ETNROAISDLRCFPU)i and on the number of 

trigraphs ending with other letters. \ 

RES'FRIG'FEiD 166 
REF ID:A66790 

RElS'f'RIC'f'ElD 

- .. 

Hi H2 Ha H4_ Yi Y2· Ya Y4 Di D2 00 01 02 03 04 05 06 07 08 09 

Da D4 Bi R2 Ra R4 At A2' Aa A4 10 11 12 13 14 15 16 17, 18 19 

Ui U2 Ua U4 Li ~ La L4 Ii I2 20 21 22 23 24 25 26 27 28 29 

Ia I4 Ci C2 Ca C4 Bi B2 Ba B4 30 31 32 33 34 35 36 37 38 39 

Ei E2 Ea E4 Fi F2. Fa F4 G1 G2 4o 41 42 43 44 45 46 47 48 49 

Ga G4 Ki K2 Ka '.K.f Mi M2 Ma M4 50 51 52 53 54 55 56 57. 58 59 

N1 N2 Na _N4 01 02 03 04 P1 P2 60 61 62 63 64 65 66 67 68 69 

Pa P 4 Qi Q2 Qa Q4 s 1 S 2 s a s 4 70 71 72 73 74 75 76 77 78 79 

T 1 T2 Ta T 4 V 1 V 2 Va V 4 W 1 W 2 80 81 82 83 84 85 86 87 88 89 

Wa W4 X1 X2 Xa X4 Z1 Z2 Z3 Z4 90 91 92 93 94 95 96 97 98 99 

00 01 02 03 04 05 o6 07·08 09 Qi ~ Qa Q4 U 1 U 2 U a U 4 E 1 E 2 

10 11 12 13 14 15 16 17 18 19 Ea E4 81 82 Sa 84 Ti T·2 Ta T4 

20 21 22 23 24 25 26 27 28 29 Ii I2 Ia I4 0102 Oa 04N1 N2 

30 31 32 33 34 35 36 37 38 39 Na N4 At A2 Aa A4 Bi B2 Ba B4 

40 41 42 43 44 45 46 47 48 49 Li L2 La L4 Yi Y2 Ya :C4C1 C2 

50 51 52 53 54 55 56 57 58 59 Ca C4 Dt D2 Da D4 Fi F2 Fa F4 

60 61 62 63 64 65 66 67 68 69 Gt G2 Ga G4 H1 H2 ·Ha H4 Kt K2 

70 71 72 73 74 75 76 77 78 79 Ka .K4 M1 M2 Ma M4 P1 P2 Pa P4 

80 81 82 83 84 85 86 87 88 89 R1 R2R3R4V1V2VaV4W1W2 

. 90 91 92 93 94 95 96 97 98 99 Wa W' 4 Xi X2 Xa X4 Zi Z2 ·Za Z4 

Figure 59,!!:. 

1 2 3 4 

1 - ET N 

2ROAI 

3SDLR 

4CFPU 

Fig. 5~· 

(or digraphs, as the case may be) are·tetranomes. Encipherment is best 

illustra~ed by e.n example; this is given in the next subparagraph. · 

h. Let the text to be enciphered be a message beginning with the 

words -"REFERRING TO lOUR MESSAGE NUMBER FIVE STOP ••• II This is rawritten 

into trigraphs, with the proviso that the third letter of the trigraph be 

one of tbe letters contained in the small square in Fig. 59b; if the 

third letter is not one of these 15 letters, the pla.int~xt grouping is 

le~ as a digraph; then the grouping.into trigraphs (or digraphs) con- tinues.: Thus,· the foregoing 'plain text w0uld be written ·aa follows: 

REF ERR IN- GTO YOU RME SSA GEN UM- 'BER FI- VES TOP ••• 

In encipherment, it is to be noticed that Rp occurs four times in section 

· 1 (as do e.11· the letters) and Ep occurs four times in section 2; the 

proper combination of the 16 possibilities is determined by the coordinates of the third letter of the trigraph as indicated. in the small 

square, Fig. 59b· . Since the coordinates of Fp in this square a.re 42, 

then it is the li'.th occurrence oi' Rp in section l and the ~ occurrence 

of Ep in section 2 which are used to obtain the equivalent for the trigraph REF'p; this equivalent is 1905· When the plaintext unit as obtained above is only a digraph, it is the~ occurrence of 0~ which is used 

in section 1 and the ~ occurrence of e~ which is used in section 2; 

thus, "IN-" from the sample message beginning, above, would be enciphered 

2828. The encipherment oi' the plaintext example above is then · 

REF ERR IN- OTO YOU RME SSA GEN UM- BER FI- VES TOP 

1905 4081 2828 4719 07'2:7 1372 711-17 4118 2270 3807 4024 8806 8623 

RES'f'RIC 'f'ElD 
REF ID:A6679J 

I 

I. ftES'fRIC'f ED 

The cipher text could then be .transmitted in groiJ.ps of four digits., or, 

as a subterfuge to conceal the basic group lengt~, the transmission · 

could be in five-digit groups. In decipherment, i the ciphertext tetr.a.-

nome is deciphered in the manner of the usual foUr-sgua.r,e matrix, and 

the locatio~ of the particular values for e~ and\~ wli1 indicate ·~he identity of the third pla.intext letter, if arty. I . - I -

1. Now that the student has become familfar with the details of 

typicil polygraphic substitution systems, be is ·~eady to continue his . I cryptanalytic study with the treatment of method~ for recognizing polygra.phic substitution; these methods are descr1be4 in the next paragraph. 

. . , I - 67. Methods for recognizing EOlygra;phic · subs.titution.--_!. The 

methods used to determine whether a given cryptogram is digra.phic in 

character are usually rather simple. If there a.:de many repetitions in 

a. cryptogram or a set of cryptograms and yet the ;unili tera.1 frequency 

distribution gives no clear-cut indication8 of m0;noalpha.beticity; if _· 

most of the repetitions contain an even number of1 letters-and these 

repetitions for the most part begin on ·'he odd.le~ters and e~d on the 

even letters of the message, yet the cipher text does not yield to solution as a.'biliteral cipher when the procedures ~utline~ in Sections , 

VII and VIII a.re applied to it; :lf the cr;yptogrm$ usually contain an 

even number of letters (exclusive of nulls); and if the cipher text is 

in letters and all 26 letters a.re not present a.ndiJ or U are among the 

absent letters (or if the cipher is in digits and\ there is a-'limitation 

in the range of the text when divided into trinom~·s, this· range "U.Sual:ly 

beine; not greater than 001-676); then the enciphefinent ma.y be assumed to 

be digra.phic in nature. · , ! -

~. Al though· the foregoing general remarks m\-e true as fer as they 

go, occa.sions.lly they may be difficult to apply w~th any clear-cut . 

results unless a large volume of cipher text 'i;s available for ·study. To 

supplement them there are statistical tests which\maybe applied £or the 

recognition of digraphici substitution ... Just as ttje ~test and the A 

test may be applied to the uniliteral distributiotj. of a cryptogram to 

help determine 'Whether it is monoalphabetic'with ~espect to singleletter plaintext units, so may these same tests b~ applied to'the dieraphic distribution of a cryptogr~ for the purpdse of_detei-miningwhether the cryptogram in question is monoaJ.phabe~i~ 'When considered o.s 

a digraphic cipher. . • - I -

£• The basic ~of the 4' test i:s the same f.hcn applied to di-: 

graphic distributions as when applied: to monograph~c--tb.a~ is, U.."liliteral--distributions (see par. 27). It is only fhe plain and ra.T').do::n 

constants that change, and "N" in the formulas now pertai~ to . the number 

of dig~aphs under consideration, instead of the number of a1~~1e letters. - "\ ' "'"t> 

RES'FRJG'FED v 1 -
REF ID :'A66790 

·RES'f'RIC'fED 

To illus·trate this, the formulas for computing the "digra.phic phi plain 

(4'~)" and the "digra.phic phi random (+~)" ~!!' shown below:15 

+: : .oo69 N(N-1) 

~; : .0015 N(N-1) . 

The "digraphic phi observed (f~)" is calcul.ated in the usual manner, that 

is, by multiplying each f (which in this case is found in one of the 

cells of a. di.graphic distribution) by f-1, and then totalling all the 

values thus derived. -

. · _·, d. The f\2 test (~r the "digraphic blank-expectation test~) may be 

applied to e. digra.phic distribution just as easily as its monographic 

. count.erpart is applied to a uniliteral frequency distribution. For this 

purpose,. Chart 8 is given below, showing the average inunber of blanks 

theoretica'J.ly expecte4 in digraphic distributions for·plain text and tor 

random text containing various. numbers of digra.plls (up to 200 digraphs) • 

As .can be seen, the chart contairur two curves. The one labeled P applies 

to the average number •of blanks theoretically exl>ected in digrap'iiic 

distributions based upon normal _plaintext messages containing the indicated number c;>f digraphs • The other curve, la.be led _!!, applies to the 

~verage_ number of blanks theoretically expected in digraphic distri15 . ' ' 

The digraphic plain constant, ~0069 1 was obtained by smnming the 

squa:+es of the probabilities or digraphs in English plain text; the 

digraphic ·random constant, .0015, is merely the decimal equivalent of 

1/676. Further elaboration on the use of these constants, among others 1 

vill be given in Military Cr,ptanalysis, Part II. 

. , ' • ' ~ : ' • • I 

RES'l'RIC':PBD 

I :0., ~ .-
REF ID :A667901 ! 

I 

I TTTTITTTTmT"1T1TnmnnTmTTTTTTrnnrrmTTTm"1Tm1lTml 

RES'fRIG':PED 

620 • 

i.· 

:a 

.... 600 0 

~ 

1 

'1:1 

~-

580 

a- 560 

520 

500 

0 20 

.Number of digraphs in message, 

il40 

i 

40 60 · 2bo 

Cha.rt 8. 

i 

butions based upon perfectly random. assortments of i digraphs. In using 

this chart one finds the point of intersection of tJle vertical coordinate corresponding to the number of digraphs in th~ message, with the 

horizontal coordinate corresponding to the observed nl.Ullber of bianlUI in 

the digre.phic distribution for the message. If this point of !Lnter- 1 section falls closer to curve P tban it does to CUl;'Ve R, this is evidence - -

RESTRIC'fEB 

.170 
REF ID:A66790 

REBTRIO'l'ED 

..: 

that the cryptogram is digrapbic in nat~el6; if it falls closer to 

curve !! than to curve ·!1 'this is evidence that the cryptogram is not 

digre.phic in character. 

e. Although it may not be necessary. to resort to the- use of the 

+2 ~ A.2 test to determine whether or not a particular cr~ogr~ has 

been digraphically enciphered, it is well to know the application of 

these tests, since use has been· made of them in difficult cases in 

operational practice. They may be helpfully enq>loyed in cases where the 

cryptanalyst is uncertain as to whether or not e. single null has been 

added at the beginning of a ceyptogram suspected to be a digraphic 

cipher; and these tests niay also be found use:fUl. in tbe analysis. of com- . plex cases where the digraphic encipberment ·has been applied, not to 

adjacent letters of the ple.intext message, but to digrapbs composed of 

more-or-less separated letters in the message. Elaborations of' these 

ideas will be treated in ~litary Crypte.nal)'Sis, Part •II. 

. !.• As· for the recognition of trigraphic substitution ciphers--1f' 

most of the repetitions are a nmltiple of three letters in length, if 

these repetitions for the most pa.rt begin (when the cipher text is 

divided into tr1gre.phs) with the first letters and end with the third 

letters of the trigre.phs, and if the length of ·the crwtogrems is for 

the" most part a multiple of three letters, yet the cipher text does not . yield to solution as a trilitera.l cipher, 'then the encipherment may be 

assumed to be trigra.phic in nature. . .i• Just as 'the + test may be used as an aid in the recognition of 

digraphicity, it may theoretical+,y be used for recognizing the trigra.phic, tetra.graphic 1 etc. 1 nature of' ceyptograms, but 1 ts use for 

these latter purposes is much more limited because of the 0large amount 

of text which would be required to permit a valid application of the 

pe~inent polygraphic + test • 

• ::., .... 

0

68., Gene;;B:f"Foce.lure in the 'identific~tion' e.na:analYBis. of poly~ gi;_aphic substitution ciphers.--,!. :Certain systems 'Which at first glance 

seem to be polygraphic, in that groupings of plaintext letters are 

treated as units, are on closer inspection seen to be only partly polygraphic in character. Such is true of' systems involving large tables of 

the type illustrated in Figs. 47,! and :!?1 ·ana. 48 (in par. 65; above), 

16 Unfortunately, sue~ would also be the case if' the cryptogram under 

consideration were a polyal.phabetic c;ipher imrolving two alphabets. 

However, to distinguish between a digra.phic cipher and a polyalphabetic 

cipher with, two alphabets, a digraphi~ distribution could be made noff 

the cut" 1 that is 1 JDS4e of' those ciphertext digraphs which ere formed by 

omitting the first letter of' text and then dividing the remaining text 

into groups of two letters.· If the system were digraphic, such a distribution would exhibit a poor +~; if' the system were a two-alpha.bet substitution s)'Stem, the +~would be as satisfactory· as that of the regular 

distribution, taken "on the cut". 

REB'FIUO'FED 

171 
RESTRIO'f'ED 

REF ID:A66790 

wherein encipherment is by pairs bμt one of the letters in each pair is 

enciphered monoalphabetically, making these systems only Eseudo-polygre.phic .. For example, using the table in Figure 48, any pla.intext digraph beginning with "At1 must be enciphered by a cipherlext digraph 

beginning with "W"; any plaintext digraph beginnipg with "B" must be 

enciphered by a ciphertext digraph beginning with! "E"; etc. A Cl'.yptogram involving the use of this table may then be identified as such 

.merely from a study of the uniliteral frequency distribution made on the 

initial letters of the cipher digraphs, since suqh a distribution would 

perforce be mon~alphabetic.17 i 

b. In.certain other systems--na.mely, the f'oUr-s.qua.re:, two-square, 

and Pla.yfair square systems of par. 66, above--the method of encipherment I • is by pairs, but the encipherments of the left-hapcl and righ~ .. hand 

members of the pairs show group relationships; this is not pseudo- ' polygraphic but / rather, partially-polygraphic • Cryptograms enciphered 

by means of systems of' this latter type may not b~ readily identified as 

such me~ely through an examination of their cipher text, but their solution may be effected rather rapidly as soon e.s a few correct plaintext I assumptions have been made therein. A more deta.i:).ed treatment of this· 

matter will be given in succeeding paragraphs of ~his section. ' .. . . . i . .. . . 

. .£• The, analysis of cryptograms which have b«i!en produced by di.-

graphic substitution is accomplished largely by the application of the . 8 ' 

simple principles of frequency of digraphs, 1 wit~ the additional aid of 

digra.phic idiomorphs and such special circumstances as may be known to 

or suspected. by the i:?rypt~alyst. The latter ref~r to pecul.iarities 

which maybe the result of the particular method ~mployed in obtaining 

the equivalents of the plaintext digraphs in the encrypting process, 

such as those mentioned in subpars. a and b, abciv~. In general, if' there 

is sufficient text to disclose the normal phenomena of repetition and I • • idiomorphism, or if cribs a.re available to be use4 as an entering wedge,. 

solution will be feasible. The foregoing general i statements will be 

expanded upon in the f'ollow~ng two subpe.ragraphs, :~ im~ ~· . 

~· When a· d.igraphic systeni is employed in ·regular' service, there· 

is little. doubt that traffic will rapidly a.ccUJIDllate to an amount more 

I tha.n su:fficient to permit of solution by simple principles of' frequency. I Sometimes only two or three long messages, or a h~lf'-dozen of average 

lenrrth, a.re sufficient. For with the identification o·f' only· a f'ew cipher I 

I 

I 17 . . i For this purpose, the simplest and most economical way to obtain 

the uni-literal distributions for the initial and final letters of digraphs is to make a digraphic distribution and then add the tallies in 

each rol-r to yield the distribution for the ini tia~ letters, and add. the 

tallies in each column to obtain the distribution!for the final letters. 

18 ; .. In this. connection, it irould be well for the 1

student to familiarize 

himself with that portion of Appendix 2 which con~ains digraphic frequency dBtta. 

RES'f'RIC'f'BD 

172 
REF ID:A66790 

REB'FRIO'i':SD 

digraphs, larger portions of messages maybe read because th~ skeletons 

of words formed from the' few high-frequency digraphs very· definitely 

limit the values that can be. inserte~ for the intervening unidentified 

digraphs • For example, suppose that the plaintext digraphs RE, IN, ON', 

ND~ NO, SI, N'l'I and TO ere ~ong those that have been identified by 

fre~ency ~onsiderations, corroborated by a tentatively ident:f.fie~ long 

repetition; ~d suppqse also that the enemy is known to be using· a large 

table of 676 cells containing.digraphs showing reciprocal equivalence 

between plainteXt and ciphertext digraphs. Suppose the message begins 

as.follows (in which the assumed values have been 'inserted): . . . 

XQ VO z:r tJC AP "OL zx .PV CK IK OL 'UK AT HN LK 

ND·· IN ~NT RE NT NO IN 

' Vt BN oz BZ DY TI: IE GI 

SI .ON TO .. 

The initial words SECOND INFANTRY REGD1ENT are readily recognized. 

Furthermore,. if~~' then.Gic:Cl<p 1 which suggests ATTACK as the la.st 

word in the messag~ beginning. · This fragment of the message may now 'be 

' completely recovered: SECOND INFANTRY REGDmNT Nor YET m POSITION TO 

ATTACK ••• •• . 

e .•. Just ·ae the choice. of probable ward& in the solution· of uniliteril systems· is aided or limited by the positions of repe~ted letters 

(see subpar. 49d), so, in digraphic ciphers, is the placing of cribs · 

aided or limited by the positions of repeated difgaphs. In this connection, several frequent words and phrases containing repeated digraphs 

have been tabulated for the student's aid, and this list of digraphi~ 

idiomorphs is. presented as Section D in Appendix 3 ( q. v.) • Thus, if one 

is confronted by a ciphertext message containing the following repea.t-ed 

sequence (therefore likely .to repres.ent an. entir.e .wo~) : 1

• .. _..,,..,.; ," .. ..... • •• • ••• :.,,· ". 

,:. . . .. ::..'.°·.-,.:.): :-::__,,.,}~::; -~.:/-:·:~.~:,;,,,~,.--..J--.,.~/- ~>/:.:"": .. -'.'.Y ··:V·.;-'_ .. :." . .-":·:_r:_~~::·~· . .i. :n~·::"t·i."ti/~·~>"-" · : · ·. ·. 

VI FW BM AZ .. FF FW RO 

he may refer to the appropriate section of Appendix 3 which will disclose, on the basi:s of the idiomorphic pattern "AB -- -- -- AB" starting 

with the second cipher digraph,. that the underlying plai~text word may 

be RE EN- FO RO ·EM EN T, among others • Once a good start bas been ma.de 

and a fe~ words have been solved, subsequent worlt is .quite s~le and 

straightfo~. A knaw·ledge of'. enemy correspondence, including data 

regarding its most common words and phrases, is of as much assistance in 

breaking down digraphic systems as it is in the solution of any other ~ 

crm'osystems. J 

!· In the case of trigraphic substitution, analysi~ _is made considerably more complex by the large .a.mount of traffic required, not only 

for t~e initial entries, but also for further exploitation of the entering wedges • In effect, the solution of a trigraphic system closely 

parall~ls the solution of the syllabary portion of a large two-part code; 

these techniques wi).l be discussed in ·Military Cry_pte.na1ysis, Pa.rt V. 

REB'FRIO'i':SD 

173 
REF ID:A66790 

RES'fRIC'fED r 

I 69. Analysis of four-squa.re matrix· sl!tems ·--.!!:· In all the small- . matrix methods illustrated in paragraph 66; the en~ ipherment is only 

partially digraphic because there are certain relationships between 

those plaintext digraphs which have common element~ and ~heir corresponding ciphertext digraphs, which will also have !common elements. For 

examp~, _!!! th.!!_f'o.!!!:-sq~e_!!atrix· given in F~. 2,l, it will be noted 

that AAp::FTc, AFp:F00 , ALp=FMc, AO-p::FLc, and AVp:F~. .In_ each of these 

cases when Ap is the initial letter of the plainteJft; pair, the initial ' • • "• I 

letter of 'the c iphertext equivalent is F c • This, of' course, is the . I 

direct result of' the method; it means that the enc~pherment is monoalphabetic for the first half of each of .these fiv~ plaintext pairs. 

This relationship holds true for four other groups !of five pairs beginning with Ap; in effect, there are-five cipher alphabets employed, not 

25. Thus, this case differs from the case discussJd under subpar. 68! 

only in that the monoalphabetic 1 ty is complete, not for half of a.l.l the 

pairs but only among the members of certain groups lof pairs. In a true 

digraphic system, such as a system making use of a 'j676-cell randOmizecrtable, relationships of'· the foregoing type are ent:l!rely absent, and for 

this rea:son such a system is cryptographically mor~ secure than small.-

matri.x systems • ! · · . --· l 

b. From the foregoing it is clear that when s,olution has progressed. 

sufficiently to disclose a few values, the insertidn of letters within 

the cells of the matrix to give the plaintext-ciph~rtext relationships 

indicated by the solved values inunediately leads t~ the disclosure of 

additional values. Thus, the solution of only a few values soon leads to 

the breakdown of the entire matrix. 1 

. • i ' 

c • The following example will serve to illustrate the. procedure. 

(1) I.et the me~sage be as follows:. · i . · ' 

1 2 8 4 6 

A. HF CAP 

B. Q G L C H 

c. X I F B E 

D. ~.JL! HM 

E. FL BU Q 

F., QI TX E 

G. F E E P I 

H. C B C Q L 

J. EZLQCI· 

K. 0 Y C R Q 

I,. I R C G G 

M. ..z L Q C I 

RBS'i?RIG'i'BD 

078910 

G 0 Q I L 

QB QB F 

X AF DX 

U E 0 R D 

F C H Q 0 

U QM L F 

DH PC G 

Q P N_F N 

A A I Q U 

Q DP RX 

G ND L N 

A A I Q U 

. I 

"! 

' 11121314111 18 17 18 19 31 21 22 23 2' 26 20 27 28 119 30 I 

BS PK M N·D UK E 0 HQ NF B 0 RUN 

I 

HMAFX S I 0 K 0 ~ Y F NS X MC G Y 

' I 

LPMXH HRGKG ~ K QM L FE Q QI• 

. I 

CL TU F E_Q QC G 9 N H.F.X I F B E X 

QM AFT XS Y CB ~PF NB S·P KN U· 

E Q Q I G 0 I E U E ~PI AN YTFLB-

"'fQIHB FHMHF.XCKUP DGQPN. 

P N I T 0 RTE NC. (i) B C ~ T FHHAY~ 

C H T P C B I F G W K F C"Q'S I L QM CB 

I 

F N Q_M--1...___E I_D G C € G I 0 G 0 I H HF I 

I 

0 Z T F G EE R'R P :t F·H ·o T FHHAY 

C H T P I 

'I 

I 

I 

174 I 

I 

I 

·e 
REF :ID:A66J90 

HES'FRIO'l'BD .. : 

---.. -- -- ·c2·) The cipher having been tested. for standard alpha.bets (by the 

method of completing the'plain-component sequence) and found to give 

negative results,. a uniliteral frequency distribution is made. It is as 

follows: 

(3) At f~st glance this may aI)pear to the untrained eye to be a 

monoalphabetic frequency distribution, but. upon closel' inspection it is 

noted that, aside from the frequencies of four or five letters, the 

frequencies for the remaining letters are not very dissimilar. There 

are, in reality, no very marked ·crests and troughs--certainly not as many 

as would be expected in a monoalphaoetic substitution cipher of equal 

length. The t test 1 if taken (this test 1 as a rule,. is not necessarp 

with samples of text of' sizes such as this) 1 WOu:ld show unsatisfactory 

results (+0 :6084, ~·against +p=7870 and +r=4543). 

(4) The message is carefully examined for repetitions of 4 or more 

letters, and all of them are listed: · 

Frequency 

TFBHAyzLQCIAAIQUCRTP (20 let'ters)........ 2 

QMLFEQQIGOI ( 11 letters) •• --. .. • • • • • • • • • • • • 2 

XIFBEX ( 6 letters ) ••••••••• ,. .. • •.• • • • • • • • • • 2 

J:'EQQ ••••• · ••••••••••••••••••• 1119 ~ •• 9:.!e •••• , • • 3~ 

Q)«..P' .................................... ·••• 3 

m'ml ••••••••••••••••••••• · •••• ·•••••••••••• 2 

BSPK •••••••••••••••••• I •••• I•·• •• ; • • • • • • • • 2 

GOIB •••••••• ~.~··•••••••••••••••••••••••• ·2 

Located in lines 

Hand L. 

C and F. 

C and D. 

.... 0 1 D, F •. . . c, ·:r, K. 

B and G. 

A and E. 

D and K. 

Since there are quite a few repetitions, tvo of considerable length, 

since all but one of them contain an even number of' letters, since these 

repetitions with but two exceptions begin on odd letters and end on even 

letters, and since the message also contains an even number of letters 

(344), the cryptogram is retranscribed into 2-letter grQUpS for further 

study. It is as follows : 

RES'l'RIO':FE?D 

175 

., 
I 

R:SB'fRIC'fE!D REF ID:A66790 

Message transcribed in pairs I 

I I 8 f S I 7 8 0 H ll U U U U 

A. HF CA PG OQ IL BS PK MN DU KE Oli QN• FB OR UN I 

B. QC LC HQ BQ BF HM AF XS IO KO- QY FN SX MO GY 

I 

C. XI FB EX AF DX LP MX HH RG KG ~ QM LF EQ QI • 

I • 

D.~ruL..IH MU EO RD CL TU FE QQ CG .. Q11. HF XI FB EX 

E. FL BU QF CH QO QM AF TX SY CB E~ FN BS PK NU 

F. QI TX EU QM LF EQ • QI GO IE UE HPi IA NY TF LB I 

I 

G. FE EP ID HP CG NQ IH BF HM HF XC · KU PD GQ PN 

H. CB CQ LQ PN FN PN IT OR TE NC C~ CN TF HH AY., 

J. 4ZL QC IA AI QU CH TP CB IF GW KFi CQ SL -~ CB 

I 

K. OY CR QQ DP RX FN QM LF ID GC cq IO · GO IH HF' 

I 

L. IR CG GG ND LN OZ TF GE ER· RP IF. HO 'TF. HH AY,. 

! M • ._ZL QC IA AI QU CH 'TP i 

- . It is noted that all the ~petitions listed above break up properly into 

digraphs except in one case, viz., FEQQ in lines C, i D, and F. . This 

latter seems rather strange, and at first thought one might suppose that 

e. letter was dropped out or was added in the vicinii;y of the FEQQ in · 

line D. But it may be assumed that the FE QQ in lif:l.e D has no relation 

at all to the .F EQ Q. in lines C and F and is mere~y an accidental repetition. i 

( 5) A digraphic distribution is made as :follws: 

... 

. • 

RSS'i?RIC'ff!JD / 

176 
f, 

REF ID:A66790 

~ ~ e ~ ~ 1 G u ·x J I L M I 0 p Q B s ' v v w x y z 

A !!. 7 

B J--t---t--r--t--i•~r.--f--F~=i==-f-l==.f=..j....-4--+-.-!i-..-.+-~.-~~.t--l-..J.-...-i......J:e-1--.1 6 

Ci !a 18 DFI -F--t-t-t--i-f:l-f:...+--t-+-=-~~-r.-t=--+-~~-f!!.·~-~..,...j.........-l--+.-~~,_-1-~ 3 

!; I ~~ .: .• ~-~ --~- .. -- - a • - • 9 

F 

11 

• m • - - - -- --- 10 

~ = 

CJ ':':._ -- • • s - '- 9 

B • = ·-""' - ,_.... ,,.., ~~ 

Is •~• a ..: ....... ,_ !D) 

I ·- r ' -

I t===t==t==t==-t==~._=r,_=-+==l===l==7'F==l===i-==l~~-"""""---i.......-1=-,..f-~.....J. .... ---1~+--1-..J--.i----il· 5 

Ii ... - • 8 Mt===F==f!!!!=t==F==ir-=·t===l==t==l===t===l==+,-=f-l!b+==~'-~~-==1-=~.._1--.i.-4--+.-i--4~~ •· - \- _'). 1- .. 

I ' 5 0 i==+=,~~-=r--==t===t===t===t==i==l===i'o:==:l==-l==l===F~==l~.~.+-.+---+-="9!!....j. ......... j.......+.-~·i!!!..-1--1 6 ·- __ .. Iii -- --· .... ___ --- -~- --- •-- -

p ,_, .... 7 t--+--t--F-:.....+--11--r·=-;-=-1--+--~-~f--+-~~~+-~-+--+-4-1--+--1--+--4---1~.1--1 

Q ,__;--tl!!F-:+-+--:t=-+-t-t=•'-+-:1=--t--11~=-=-=-t=•-i=-=--+-F= ... -+--f-l---¥!·~-l--+--l'-=---1--1 22 

R' 4 

s - 3 

'l - c • ·~ - .. 10 

u ..... 2 

v I • 

t--+--t--+-+--11--t--t--t---4-i-l--lf--t--l---+--11--+-+--+-41-----tt--tl--4-4--4---1 

w i ' 

X t--+--t--t--t-.,.-.+-;-----:-1-:-+--t---+--i--+--t....-l--+'--+--l--l-:....+--:il---+~Ll----i-H--+-~".l--I 

y 

- ·z 

' ~ a ·-.I ' 

• 

4 · 9 a 5 1 20 e 10 1 - 3 6 ·a ~ 9 9 12 5 3 i 9 - a =a rr .!L 

Fi~~ 60. 

(6) The appearance of the foregoing distribution for this message 

'4 

is quite characteristic of that for a digraphic substitution cipher. 

Although there are 676 possible digraphs, ·only 107 are present in the 

distribution; this parallels what is expected of normal plain text, since 

out of the 676 possible two-letter combinations (including "impossible 

plaintext digraphs" such as. ·QQ, JK, etc., which !night have been used for 

special indicators, punctuation marks 1 etc • ) only about 300 are usually 

used in the construction of plain text .19 The number of blank cells, 

19 The 300 most frequ~nt·aigraphs comprise 95~ of normal English plain e text (Appendix 2, Table 7-A'}·. 

RES'l'RIO'i'ElD 177 
I 

REB'FRIO'f'ED I 

REF ID:A66790 I. . I 569, closely approximates the 565 which would be: expected" in a distribution made on a sample of plain text.of this size, as shown by Chart 8. 

Furthermore, although there are many cases in which a digraph· appears 

only once,· there are quite a.few iu Which a.digraph app~ars two or three 

!~~'af~:r::e:P!!;! ~~v! !i::~ha::~:! 1!~i!:'1: ai:~=P~S.:;P!:rs six .times 0 All of the foregoing observations concerning the distribution 

are reflected by the 4 test: the.ObS~X,'Ved digraphic phi·Value, 2101 

compare"s very favorably with the expected. pla.in:i:BJ.ue (:.oo69 x 172 x 

171 : 203) as against the expected random value \:.0015 x 172 x 171 : 

44). Thus all indications point to a ~igraphic ~ubstitution system. 

-(7) Since neither the +o (1780) ~ f\ 0 (4) ;f'or. the initial letters 

of the cipher digraphs nor the +o (1496) and /\. 0 ; (2) for· the final . 

0 

J 

letters are too satisfactory in their approximation to the values ex- · 

pected for monoalphabetic distributions ( tp:.1962 I and <h-=1133; A p=5 and 

I\ r:O), the possibility of a pseudo-digraphic sY,stem is ruled out.· There . I . . 

remain the possibilities of a partially-digraphi~ system employing a 

small matrix, or a true digraphic system employing a large,·randoniized -" ' I ' table. II.& one common type of small-matrix system, the Playf'air cipher, 

·one of the telltale indications besides the absence of (usually) the 

letter J is the absence of cipher doublets, that'is, two successive 

identical cipher letters. The occurrence of the .double letters GO, HK, 

and QQ in the message under investigation eliminates the possibility of 

its being a normal Playfair cipher •.. For want of :more accurate diagnostic 

criteria 20 at this stage,21 the simplest thing ~o assume, from among the 

various hypotheses that remain to be. considered, ;ts .that· a four-squ~~ 

· matrix is involved. One with normal alphabets (e,.s being the simplest 

case) in Sections land 2 is therefore set.down ~Figure 61a). I 

I 

I • I 

20 . i 

Even a medical practitioner o~en cannot su9cesstully-~iagnose a 

condition on the f~st visit. Cryp1;analytically 1spea.king, we are still 

.on our "first visit". Subsequent probing will, 1fe hope, reject o;r sub:-

stantiate this or that hypothesis or assumption, 1

1

'until the Fatient (t~e 

cipher text) is recovered ( 1.e., brought back to ,plain text) • 

· 21 However, see the treatment on the diagnosis ior various types of 

digraphic systems in subpar 73.J.. ~ 

RES'FRIG'FED 178 
REF ID:A66790 

REB'fRIO'fED ~ __ .::; ... ,.:~· .. :.-._ -··-.... -- k. 

A B c. D E ...;__ - - - ,_ - F G H I-J K 

- - - - - .L ld N 0 p .. ------ 3 

Q R s T u - - - - v w· x y z .., 'I' 

- - - . A B c D E ,. 

- - - r· G H I-J K 

- - - - - -. 

L M N 0 p 2 - - I~ - - Q R s T u 

--:- - - - - 1-

" .V w x y z 

Figure 61,!:• 

' (8) . The recurrence of the group QMLF, "tbi-ee time~, and at intervals 

suggesting that it might be a sentence separator, leads to the assumption 

that ·1t ~resents 1;he word STOP. The letters Q, M, L, and F are therefore inserted in t~e appropriate cells in.Sections 3 and If. of ~e diagram. 

Thus (F~g. 61~): . . . 

A B c D E . - - - - - - ·F G H I-J K 

, .. i:~· ;~y/1 . ,..., .1N .. o·,. ·:.p .. ... ,r /•. --'J.: · . ."'t. 'j .J -''1• :.-~ • f.t:~ ~ . ' ' 

...... " . 

-

Q R s T u ·Q 

v w x y z - - - - ,_ A B c D E 

F G H !...J K· 

F L M 

~o p ,-

-M Q R T, u ----,_ - v w y z 

2 

Figure 61'!?,. 

These placements seem rather good from the standpoint that keyword-mixed 

sequences 1118.J' have been use'd. in these two sections. Moreover, in Section 

3 the number of cells between L and Q is just one less than enough to . contain all.the letters M to P, inclusive; this .suggests that one of 

these letters,. probabl7 R or 0, is in the keyword portion of the sequence; 

179 
REB'FRIG'FED . 

I 

REF ID:A6679q 

I 

I 

tbtt 1:s,- near the top of Section 3. Without makilng a comitment in the 

matter, let us suppose the.t M follows L and that , precedes Q; then let 

both N and 0, for the present, be inserted in the; cell between M and P. 

Thus (Fig. 61c): . ; ... , I 

' A B c D E ' ! - - - - - .....,....... -: - F G H I-J K I 

,____ - - - -·· L 

l L M N 0 p ' IL 

- - :-- - -- .J...__ 3 

Q R s T u M n p Q I 

' - - - - - - - -·-- _1 _ 

v w x y z I 

I 

- - - - - .:-

A B c D IE 

I - - - - - - - F G H I-J !K - - - - _,_ - ':-:-- - . 

F L M N 0 ,p 

- - - -· _I_ 

M- _.Q R s T iu - - - - - ,L 

I 

4 2 

v. w x y \Z 

Figure 61£• I 

(9) Nov,· if. the ~ls.ceme~t ~t P in Section 3 ·i~ .corrict, the cipher 

equivalent of THp will be Pee, and the:! sh?ul.d b, a group of adequate 

frequency to corres~nd. Noting the.t PNC occurs three times, it is assumed to represent TRp and the letter N 1s insert~d in the appropriate 

cell in Section· 4. Thus (Fig. 6~): .I . . ! -

I 

A B c D E· i - - - - - - - F G H I-J K -1 - - - I• 

1 L' M N 0 p i:. 3 - - - - - I 

I 

Q R s T u M n p Q : - - - - - - - v w x y z :i - - - - - - - I 

A B c D E - - - - - - - I - N F G H I-J k - - - - - ·- I 

I 

4 F L M 

~~ p 2 

~- - -- I M Q R T u -- -- I 

I 

v w y ·Z 

i 

Figure- .61~. 

RESTRIC'f'E!D 

180 
REF ID:A66790 

REB'FRIO'f':SD I 

(10) It is about time to try out these assunied valu.es in the message. 

The proper insertions are ma.de, with the following results: 

I 2 8 ' a 8 7 8 9 ro " • H u u H 

A. HF CA PG OQ IL BS PK MN DU KE OH QN 'FB OR UN 

B. QC LC HQ BQ BF .HM AF . XS IO KO QY FN SX MC GY 

c. XI FB EX AF DX LP MX HH RG KG QK QM LF EQ--2!.+ 

ST OP . D. <.Go IH MU EO RD CL TU FE QQ CG QN HF XI FB EX 

E.· FL BU QF CH QO QM AF TX SY CB EP FN BS PK NU 

ST . F. QI TX EU QM LF EQ QI GO IE ·uE HP IA NY TF LB 

ST OP 

G. FE EP ID HP CG NQ IH BF HM HF xc ·KU PD GQ PN 

TH 

H. CB CQ LQ PN FN PN IT· OR TE NC- .. CB CN TF HH AY > 

TH TH 

J. , ZL QC IA AI gu CH TP CB IF GW KF CQ ·SL QM CB 

'ST 

K. OY CR QQ DP RX FN QM LF ID GC CG IO. GO IH HF 

ST OP 

L. IR CG GG ND LN oz TF GE ER RP IF HO TF HH AY I 

' 

M. , ZL QC IA AI QU CH TP 

(11) So fe:r no impossible combinat,ions e:re in evidence. Beginning 

with group H4 in the message is seen the following sequence: 

PNFN-PN 

TH •• TH 

Assume it to be THAT THE. Then ATp::Fic 1 and. the letter N is to be inserted in row 4 column l of Section 4~ But this is inconsistent with previo~ assumptions, since N in Section 4 has al!:!ad.Y been tentatively plac~ in row 2 col:umn 4. Other .!:!!,Sumptions for FNc are ma.de: that it 

is, ISP (THIS TB ••• ); that 1~ is ENp (THEN TH ••• ); but the same inconsistency is apparent. In fact the student will see that Fie must represent a digraph ending in F, G, H, I-J, or K, since Ne is t~ta.tively 

located on the same line as these letters in Section 2. Now FN'c occurs 

4 times in the message. The digraph it represents must be one of the 

following: -

OF, OG, OH, OI, OJ, 

TK, 

DF, DG1 DH, DI, DJ, DK 

IF, IG, IH, II, IJ, lK 

JF, JG, JH, JI, JJ, JK IF, E, lH1 YI, YJ, lK 

RES'FRIO'l'ED i81 
REB'fRiC'fED 

Of these the only one 

PNFNPN 

REF Itl:A6679QI 

I 

I 

likely to be repeated 4 times jis OF·, yielding I 

T H 0 F T H which may be a part of 

CQLQPNFNPNIT CQLQPNFNPNIT 

• N 0 R T H 0 F T H E :· or • ~ 0 U T H Q F T H E • 

In either case, the position of the F in Section.3 ~s excellent: 

F ••• L in row 3. There are 3 cells intervening l::!etween F and L, into 

which G, H, I-J, and K may be inserted. It·is not ~early so likely that 

G, H, and K are in the keyword as that I should be in it. Let it be . I 

assumed that this is the case, and let the letters q, H, andK be placed: 

in the appropriate cells in Section 3. Thus (Fig. 61e): 

1-

A B c D E I 

I - - - - - - F G H I-J K ~· 

' - - - - -r-- -

l L M N 0 ·p JF•· :& H K L 3 

'Q R s ·T u iN 'p Q ;o - - - v w x y I - - 'A .B .c D El - - -.--- - - - - N F ·.G H I-J K' I 

- - - - - - - - 4 F 'L M N 0 P1 2 - - - - - - M Q Q R s T. u - - ·--- - - - v· w x y z1 

Figure 61e. 

Let the resultant derived·vaiues be checked against;the frequency distribution. If the position of, H :in Se?tion 3 is co~ect, then the digraph ONP' normally of high frequency, should be represented s~veral 

time.::_by HFc •. Reference to Fig. 60 show~ ii'fc to ha.~e- a frequency of _4. 

And m·tc, with 2 occurrences, represents HSP. There : is nC? need ·to go . 

. through all the possible corroborations • ·. 

P N F :tl P N 

( 12) Going back to the assumption that T H • • T H is pa.rt of the · 

express ion ·: 

: . 

CQLQPNFNPNIT . CQLQPNFNPNIT 

• N 0 R T H 0 F T H E • or • S 0 U T H 0 F T H E ., I 

it is seen at once ·from Fig._§.1_! that tfie latter is~ppare.ntl:X c~rect and not the former, because LQ~ e<l1:lals OUP and no~ onp. ·If OSP:C~, this 

RES'FRIC'FED 

182 
REF ID:A66790 

RES'fRiC'ftlD 

means that the letter C o~ the digraph CQc must b~ placed in !OW 1 column 

3 or 'row 2 colunm 3 of Section 3. Now the digraph CBc occurs 5 times, 

CG0 , 4 times, CHc, 3 times, C~, 2 times. Let an attempt be :mn.de to 

deduce the exact position of C .in Section 3 and the positions of B, G, 

and H in Section 4. Since F is already placed in Section 4, assume G 

and H directly follow it, and that B comes before it. How much before? 

Suppose a trial be made. Thus (Fig. 61f) : 

' -

A B c ·D E C? 

- - F G ·H. ~-J K C? 

- - - - - -.-- - L M N 0 p F· G H K L 

1 - - - - - - 3. 

Q R S. T u ·M B p Q 

- - - - - - - v w x y z - - - - - A B c D E 

- - - - - - - N F G H I-J K 

- - - - - - - Bt Bt BT F G L M N 0 p 2 - - - - - - -. .H M Q Q R s T u - - - - - - v w x y z 

Figure 61!• 

By referring now to the frequency distribution, Fig. 60, after a very 

few minutes of expe~imente.tion it becomes apparent that the· following is 

correct: 

A B c D E c - - - - - - F G H I~ K 

- - - - - - - - 'l L M N -0 p F G H K L 3 - - - - - - -. 

Q R s T u M N 

0 p Q 

- - - - - - v· w x y z - - - - - - A B c D E 

- - - - - '.<. N F G H I~ K 

- - ·4 B F G L M N 0 p ·2 - - - - - H M Q .Q R s T u - - - - - - - - v w x y z 

Figur~ 61~. 

RESTRICTED 183. 
REF ID:A66790 

RES'fRIC'f ElD 

I 

I . 

(13) The identifications given by these placemen~s are inserted in 

the text, and solution is very rapidly completed. T~e final matrix and 

deciphered text are given below. ! 

... A.HF CAP 

0 NE HU 

B.QCLCH 

R 0 M P 0 

C. XI F BE 

WILL B 

D. G 0 IHM 

NGATT 

E. FL BU Q 

PA IDT 

F. Q I TX E 

RIG AD 

G. FEE PI 

LACE C 

H. CBC Q L 

ANDS 0 

_J. Z L Q C I 

Z ER 0 E 

K. O Y CR Q 

D WEST 

L. I R C G G 

ET EN P 

M. Z L QC I 

Z ER 0 E 

RES'fRIC'fSD 

A B c D E s 0 c I - - --- - - - - - F G H I-J K T y A B - - - - - - - - - 1 L M N 0 p F G H K - - - - - - - - - Q R s T u M N p Q - - - - - - - - - v w x y z u v w x 

-- - - E x p u .L A B c D 

- - - - - - - - - s I 0 N A F G H I-~ 

- - - --- - - - - 4 B c D .F G L M N 0 - - - - --- - - - H K M Q R Q R s T - - - - - I-- - - T v w y z v w x y 

Figure 61!;! • 

G O'Q I L BS PK M ND UK E 

NDRED F I R S T FIELD 

QB QB F HM.AF X S I 0 K 0 

S I T I 0 NS INV I C I N I 

XAFDX LPMXH HRGKG 

EI NG E NERAL s u P p'o 

U E 0 RD CL TU F E Q QC G 

ACK SP EC I AL ATTEN 

F CH Q 0 QMAFT XS Y CB 

0 ASS I STING AD VAN 

UQMLF E Q QI G 0 I E U E 

EST 0 P DUR IN GAD VA 

DH PC G NQIHB F HM HF 

0 NC EN TR AT I 0 NS 0 N > 

QPNFN -p N I T 0 RTE NC 

UT H 0 F TH AYE RF ARM' 

A A IQ U C H T P C BI F G W 

I G HT D ASHAA ND 0 NW 

QDPRX FNQML F I D G C 

THERE 0 F S T 0 P C 0 M M 

GNDLN 0 Z T F G EE RR P 

MS M 0 .K E W I L L BEUSE 

A A I Q U C H T P 

I G H T D ASHA 

184 

' 

E 

-

D 

-

3 L 

-

R 

-z 

-

E 

-

K 

-

p 

,_ 2 

u ,_ 

z 

0 HQ NF 

A~ TI L I 

Q~FNS I 

T Y; 0 F B 

QKQML 

R '].j S T 0 I 

I 

Q NH F X I 

.T l! 0 N W 

I 

E Pi F N B 

C Ef 0 F F I 

H P; I A N 

N C E I T I 

XQKUP 

W 0 0 D S 

I 

CBC NT I 

ANDHI 

KFCQS 

0 0 D SE 

c G I 0 G 

EN c IN I 

I 

I F H 0 T I 

D (!) N H I 

B 0 RUN 

LERYF 

XMCGY 

ARLO~-

FEQQI 

PD UR I 

I F B E X 

ILL BE 

SPKNU 

IRS TB 

YTFLB 

WILL P 

D G Q P N 

NORTH 

FHHAY 

LL SIX 

L QM CB 

AST AN 

0 I H H F 

GA T 0 N 

FHHAY 

LL SIX 
REF ID:A66790 

RFW.FRiC 'i?:SD 

~· In the solution of four-square cryptograms, ·advantage may be 

token not only of the general'type of digraphic,idiomorphs mentioned in 

subpar. 6~, above, but also of a special type of partial idiomorphism 

present in any four-square cryptograms involving the use of a matrix in 

·which the plain components cossist o·f normal alphabets normally inscribed.22 As an illustration, let the digraphs sa UT. (H.) be enciphered 

· by ·means of any four-square having, rio~l' alpha1>ets in Se~tions l and 2, 

and it w:ill ·.be found that 'in the encipherment the initi~l letter of the 

cipher d_igraph representing sop ·-will be identical to th: ~nitial letter . ' . of the cipher digraph represent;tng UTp, regardless of'how:tlie cipher components are constructed. On this basis, a brief list "of specialized 

single-letter patterns have been compiled for use in the solution of such 

a digr.aphic system; this list of "four-square digraphic idiomorphs" constitutes Section F of Appendix 3. .-

e • It is interesting to note how much s ini:p1er the ·technique of 

analysis is in the case.o~ so-called inverse four-square ciphers, which 

involve the use of.a matrix wherein.the ciphertext sections contain normal 

alphabets, the plain compone~s being mixed. . For ex$J>le, referring to 

Fig. 53, suppose that Sections 3 .. and 4 are used as the source of the 

plaintext pairs, and Sections l and 2 as the source of the ciphertext 

pairs; then 0Np=m'c 1 EIIp=GEc; etc. The simplici~y o~ the analytic procedure will be made clear by the following expositioi;i. . 

(1) To solve a message enciphered with an inverse four-square matrix, 

it ie necessary to perfonn t'Wo steps. '·First, convert the ciphertext pairs 

into their plain-component equivalents by "deciphering" th~ message with a 

matrix 1n which all four sections contain normal alphabets; this operation 

yie:lds two uniliteral substitution "ciphers", one composed of the odd 

letters, the other of the even· letters. The second step is' to solve these 

two monoalphabetic portions. 

(2) As an example, let us consider the following cipher text, known 

(or assumed) to have been encrypted with a trinome-digraphic23 system 

22 I:f any other known plain components were involved, the procedure of 

deriving a list o:f idiomorphic patterns would be modified to fit the 

particular case. 

23 I:f the cipher text were being examined "from cryptanalytic scratch", 

the limitations (003-595) of the cipher text when the latter is divided 

into trinomes for examination would have at once indicated that this 

grouping is the one which merits detailed analysis. The ~2 test would 

then give an indication of the digraphic nature of the underlying cryptographic treatment. 

RES':FRIC'i?ED 
I 

REF ID :A6.6790 I 

R:S.B'fRJC'f'ED 

incorporating a four-square matrix similai:' to that I illustrated in Fig. 58,, 

except that the plain-componen~ sections have been:changed: 

·20323 

2 7 8 3 5 

2 0 8 0 5 

46818 

2 4 3 0 2 

1 5 3 1 3 

4 6 5 3 6 

4 7 8 2 1 

0 8 7 0 3 

0 0 141 

8 5 0 8 1 

4 1 8 0 4 

74.135 

3 3 9 3 0 

8 3 8 3 2 

61041 

6 2 6 6 3 

7 3 9 3 3 

7 0 9 'l 4 

3 3 3 8 1 

8 3 4 5 0 

5 o-4 i 3 

3·5 4 7 3 

9 l 3 9 3 

2 8 3 5 9 

0 0 1 4 4 

4 4 0 0 7 

81193 

1 9 3 9 l 

3 3 5 9 3 

' 

2 7 9 3 4 . 1 i 5 0 3 

2 7 4 1 6 3 3 0 9 l 

·3 2 6 2 6. 9 i l 6 0 

4 i l 0 4 4 1 3 3 l 

3 8 0 2 2 6 i 0 4 3 

10101 82403 

l 8 3 4 5 b i 4 0 2 

4 7 9 2.4 0 ~ 0 3 2 

1 l 6 0 7 1 i 3 1 l 

3.9 3 4 0 6 3 5 3 l 

I 

09168 

0 1 0 9 2 

0 3 2 1 8 

17296 

6 9 l 3 0 

3 6 1 6 8 

8 8 l 5 2 

4 l 3 0 6 

5 3 5 9 5 

8 8 1 3 3 

(3) The first thing to be done is to construct a four-square matrix 

I vi th the Im.own ciphertext sections, and inscribe SJ!bitrary .alpha.bets in 

the plr · ;ext sectio~, as follows: · 

A B C· D· 000 025 050 075, 100 

F G H. I1 125 150· ·175 20~ 225 

L M ti· o, 250 275 .300 32$ 350 

Q R S: T 375 400 425 456 475 

v w x y 00 2 0 600 

l 2 3 A B c E 

5 6 7 8 9 F G. H K 

10· 11 12 13 14 L M N p 

15 16 17 18 19 Q R s u 

20 21 22 23 24 v w x z 

I 

(4) The cipher text is then written in trinomes, and these· trl.nomes· 

are "deciphered" by means of the.foregoing matrix, yielding the·oomre!t'!ted 

cipher text as follows: 

RES':FIUO'fED 186 

.e 
REF ID:A66790 

RES'J'FHC'J'BD 

A~, 

B 

c 

D 

E 

F 

5. 10 15 

203 238 5o8 183 450 279.341150 309 16~ 278 354 180 450 413 

ID IP .YF IH Q,D PB Kl' FB . PH IR OB PE FH' 0)) TM . . - . 

274 163" 309 101 092 208 657 413 53'5 4 73 :326' 269 116 :003 218 

PV Di PH BE CT II CH TM vM TY MD PQ BU DA 0IT 

468 183 393 091 393 411 044 133 117 296 243 028 383 228 359 

'IT m TQ BT TQ RM ER IF cu MW ru DB TF IE PK • I 

380 226 194 369 130 153 136 104 100 144 101 018 240 336 168 

QF GE EE PU FF IB GL EE AE KQ BE DQ FU . MO m • i 

465 366 266 344 001'.ie3 450 140 2aa 152 478 217 393 381 193 

'll' MU MQ PT CF m Q)) FQ OM HB TE RI' TQ RF IS . ' . 

479 240 403 241 3o6 087 037 091 419 391 ir6 077 137 153 595 

UE FU TB GU MH CO CM BT,. UR RQ. BU CD HL IB VY 

G 007 413 338 133 593 393 4o6 353 188 133 

CF TM 00 · IF lT TQ RG OE IN IF :. 

The distributions of the letters constituting the initial letters and 

final letters of the converted digraphs are as. follmrs: 

(Initial Letters) 

(Final Letters) 

::. 

fl 

. ' 

-= - ~ = ; g -l~==~=e~- ~ ;i£s g== = 

A B C D E F G H ·I K L M N 0 P Q R S T U V W X Y Z 

\ 

= - ~~ = . = . ~. ~ 5!. . 

·- ~- ~ E iE - ~ - - = ~ -·= - ~= -~ ~ -- - ABCDEFGHIKLMNOPQRSTUVWXYZ 

(5)24using straightforward prj.nciples of frequency and partial idiomorphs, ·the plain text (beginning with·the opening·words'ENEMY 

RECONNAISSANCE ••• ') is recovered, and the following 'equivalents_ are obtained for the· converted cipher letters of the two alphabets:· · · 

(Initial Letters) C: AB C D E F G H I KL MN. 0 P Q. RS T UV W X Y Z .(f 

P: B R A H· M s· C D E ·F. I ·L N 0 P T UV Y. 

(Final Letters)· C: A B_ C D E F G H I K L M N 0 P Q R S T U V W X Y Z 

P: W A N E R B C D F .H I K L M 0 P Q S T U V Y 

24 Note the ABA pattern of the first word in the message (ENEMY), made_ 

patent by the two-alphabet conversion process. Also note the 3-fold 

repetition (!epresenting the plaintext word STOP) which, although hidden 

in the original cipher text, now comes to light. 

RE8TRIC':FED 
REF ID:A66790 

RES'J'RIC'fElD 

Keyword-mixed sequences directly manifest theD1$elies ~ecause the original 

enciphering matrix contained such sequences in se¢tions 1 and 2, inscribed 

in the same manner as were the arbitrary A-Z sequ~nces which were used for 

the conversion. In fact, the key words of the twq distributions might 

have been recovered from an analysis of the "prof~les" of the distributions 

above, as ·described in subpar. 54e. - i . - I I . (6) The original enciphering matrix is then :ireconstructed, thus: I 

B R A H M 000 025 050 075 100 

s c D E F 125 150.175 2~0 225 

G I K L N 250 275 300 325 350 

0 p Q. T u 375 400 425 450 475 

v w x y z 00 2 0 ' 600 

1 2 3 4 w A G It E 

5 6 1 8 9 R· B c D F I 10 11 12 13 14 H I K ], M 

16 18 I 15 17 19 0 p Q s ·T 

20 21 22 23 21+ u v x y z I 

i (7) llthough the example illustrated was tha"lf of a. numerical digraphic system, it is obvious that this teclmique:ot solution al.so applies 

to literal four-square systems in which the cipher components are known 

I 

sequences. It should be clear to the student the 1tremendous difference it 

makes when it is possible to convert a digra~hic ~ystem into a two-alpha.bet 

system; in a digraphic system, we are plagued by ~ potential 676 different 

elements in the cipher, whereas in a two-alphabet 1 system we still have 

only 26 elements (in each of two sets, it is truej in the cipher text to 

be solved. This principle of' conversion of ciphe~ text into a secondary 

cipher text has application in some of'. the most cqmplex types of cryptosystems; the student would do "t7ell to keep this ~ mind. . 

(8) As a further observation on inverse four4square systems, it is 

pointed out that where the same miXed alphabet is!present in Sections 3 

and 4, the problem is still-eaBier, since the let~ers resulting from the 

conversion into plain-component equivalents all belong to the same, sin~le 

mixed alphabet; thus such a digraphic system is reduced to an ordinary 

simple substitution cipher. · 

f. The solution of cryptograms enciphered by other types of small 

ma.trices is accomplished along lines ~ery sim.ilar·to those set forth in 

subparagraph c on the solution of a four-square cipher; this will be 

illustrated in subsequent paragraphs. There are, :unfortunately, f'ew means 

or tests which can be applied to determine in the;ea.rly stages of the 

analysis exactly what type of digraphic system is.involved in the first 

case under study. The author freely admits that -the solution outlined in 

subparagraph c is quite artificial in that nothing is demonstrated in step (7) that obviously leads to or warrants the e.ssumPtion tha.t a. four-square 

matrix is involved. The point we.s passed over wiih the quite bald Gta.tement that this was "from among the various hyr>otheses that remain to be 

considered"--and then the solution proceeded exac"¢ly as thotigh this· reere· 

hypothesis had been definitely established. For ~xa.mple, the very fi,rst I 

RESTRICTED 188 
REF ID:A66790 

results obtained were based upon assuming that a. certain 4-letter.repetition represented the word STOP and :tmmediatelz inserting certain letters in 

appropriate cells in a four-s~uare matriX with normal seguences 1n S~ction~ l and 2. Several more assumptions were "built on top of tha'.t, and 

very rapid strides were made. What if it had not been a. four-square 

matrix at all? What if it had been some other type of not readily identifiable digraphic system1 The ·only defense tbat can be made of what may 

seem to the student to be purely arbitrary procedure based upon the author'~ advance information or kliowledge is the following: In the first 

place, in order to avoid ma.king the explanat:i.on a too-long-drawn-out 

affair, it is necessary (and pedagogical experience warrants) that certain 

alternative hypotheses be passed over in silence. In the second place, 

it may now be added, after the principles and procedure· have been eluci .. dated (which at this stage is the primary object of this text) that if 

good results do not f.ollow from a f·irst hypothesis, the only thing the 

cryptanalyst can do. is to reject that hypothesis and f ~ate a second 

hypothesis. In actual. practice he may have to ~eject a second, third, 

fourth, ; •• nth hypothesis. In the end he may strike the right o:oe--or he 

may not. Tiie're is no assurance of success in the matter. In the third 

place, one of the objects of this text is ·to show how certain cryptosystems, if' employed tor military.purposes, can readily be broken down. 

Assuming that some type of digraphic system· is in use, and'tha.t Q.a.ily 

changes in key words are ma.de, it is possj.ble that the traffic ·of th.a 

first day might give considerable dif'f iculty in solution if the snecif ic 

type of digraphic system were not ·known to the cryptanalyst. But. by the 

t1.me two or three days• traffic had accumulated it would be ea.sy·to solve, 

because probably by that time the cryptanalytic personnel: would have successfully analyzed the cryptosystem and thus les.rned.:what type of matrix 

or table the enemy is using. 

70. Analysis of two-square matrix systems·---!.· Cryptosystems involving either vertical two-square or horizontal two-square matrices may 

be· identified as such and solved ~Y capit~izing on_the c:i;yptographic peculiarities ~ idiosyncracies of these systems. It·w~ll be noted that, 

considering the mechanics of the cryptosystems, in vertical two-square 

matrices employing the normal. encipher:irig conventions,25 exactly 20% of 

the 625 "possible" pla:l.ntext digraphs will be "transparent" (i.e., snlfenciphered) 1n cipher text; ;tn horizontal. two-~qua.re systems, exactly 2eo/o 

of the 625 digraphs will be·cbaracterized by an "inverse transparency" . . 

25 That is, for vertical two-square systems, digraphs are self-enciphered 

if' ~ and ~ fali in the same column in the matrix; and, for horizontal 

two-square systems., if ~ and e: are in the same row, the ciphertext digraphs are the reversed plaintext digraphs. 

REBTHlC'f'BD 189 
I 

REF ID:A667901 

I RES'fRIC'fED 

(i.e., enciphered by the same digraphs reversed).~ Therefore, if an 

examination of a cryptogram or a set of cryptogra.pts discloses a goodly 

portion of what appear to be direct transparencie• (cipher digraphs which 

could well be plaintext digraphs), it may then be: assumed that a vertical 

two-square matrix has been used for the encryption. On· the other hand, 

:lf a large number of cipher digraphs could be "gopd" plaintext digraphs 

it the positions· of the letters were reversed, ~en it may be ae.sumed that 

the cryptosystem involved a horizontal two-squarelmatr~. Sometimes 

skeletons of words or even of whole phrases are s~lt-evident in such 

cipher text, thus affording an easy entering wedg~ into the cryptosystem. I 

b. An example will best serve to illustrate! the techniques of - I I identification and subsequent solution of a two-s~uare matrix cipher. 

The following naval message is to be studied: 

I 

UODLC ENOAN SIG LB BE IR I R: C R G L NMOLC 

P T E F '1 RB BOE GPABQ WNNKS IjP CR M OORAP 

DEA 41 ANXRA IE DAI RMAGB E, K HS L CDDLC 

TQORE NDTMD TIAQF IEQTA N:NBFN ouoos 

SNNNR KTASE SNHLP ONNKS ! 1 P C R C EN 0 IS 

HLIRK PLONO NZUCT ALTO I r:HOCN OCERA 

OSDIN OEEKR LCUBR AO SDI I;PDAR COG GR 

OLNOC WDILP OILNQ XDIGL R;B B Q Y FSSRA 

VYOIQ RSLXX 

Preliminary steps 1n analysis are made acc~rding ~o the procedures already 

described in this text, and the hypothesis of monpgraphic, uniliteral encipherment (with either standard or mixed cipher alphabets) has been re- 1 jected. Multiliteral substitution, or digraphic substitution, comes next I 

I 

I 

26 . I · 

of di:;::~~:c~~~,;;o::!! ~: :i:i:t:~xtdi~~~h~h~ef~~!v:~~si~r!:~~:ity Furthermore, the frequencies of the plaintext dig!raphs actually used come 

into consideration, in conjunction with the locatiion of the letters of 

these digraphs in any particular two-square matrilt. Thus, from the cryptanalyst's standpoint, there are "excellent" two-s~uare matrices giving a 

high self-encipherrnent rate for high frequency pl~intext digraphs, and 

there are "poor" two-square matrices which have al potentially high selfencipherment rate only for those low frequency plaintext digraphs which 

may not occur at all in a given cryptogram. · 

RES'FRIC'fED 190 
REF ID:A66790 

RESTRlG':FBD 

• into consideration. The cipher text is written in digraphs, as follows: 

5 10 15 

A uo DL CE NO AN SI GL BB E:t RI RC -RG LN 11.0 LC --· 

B Pl' ER· GR BB OE GP AB ·QW NN KS · lP- .CR MO OR AP 

c DE AM HA rNX. 'RA IE DA m MA ~ EK HS LC DD LC . D TQ OR EN 'DT MD TI AQ Jr.I EQ TA :rm BF NO---UO. ·OS .. ~ .· - I • 

E SN NN RK TA SE SN m. PO NN KS IP. CR CE NO IS 

F m.·m KP LO NO NZ UC TA LT OI IH oc NO CE ~ 

G "-OS DI NO EE KR LC DB RA OS DI IP DA RC 00 GR 

< 

H OL NO cw DI LP. OI LN - QX DI GL RB. BQ Y.F ~S· BA 

J VY OI G~ SL xx 

Figure 62 •. 

Noting the 8-letter repetition 90 letters apart,· the 6-letter repetition 

e 16 letters apart, and the 4-letter repetition at an interval of 220 letters, and that those repetitions begin on odd letters and end on even 

letters, credence is given to the grouping of the cipher-text into pairs 

of letters. A digraphic distribution is then made, illustrated in.Fig. 

63. 

'' 

RES'FHIO'fED 

191 
I 

REF ID:A667901 

n.ES'FRlO 'FED j 

A B c D E - !_ -~-- _!_ _!__ -~ __ _!C_ -~ M 1' 0 p Q RI s . T u v 'W' x y z 

A 1---F---+--+~t--+--+--+--;~+--+--+--f=-F-+--F'-F=----!f-i--l-·-+--+--+~t---+--+--+--I ~ -

B 1--~·=-+----1-~-F=-il--+--+--+-+~+--~--+--+~1---t=--+-++--+~-1----1-~--1---1---1-~ 

c I 

Im I 

5 

4 

6 

D • !!! .__ 10 F---l-~--1'=-t=-+--+--+--+~+----l--l='-+--ll--+---+---+---l__,_+--l=--l--+~l---l--+---l----I 

E i- 6 

F 1 

G ' = ;;: 7 

H 4 .. I 111 i.. _ 8 

J l--+---+---+---11--+--+--+-+-=-i--+---+---+---l~+--+--l---+~l---l---+---+---1'--+--+--l---I 

IC -·. 

s t---+--+--+--IF-+--t--+--f=-i--4--1='-+--IF-+---+---+--+l---!=---l-~-+--1--+--+--+---I = 

T !! 

F--+--+--+--ll--+--t--+--l':::.._i---l---+---+--l'----l--+--F=-41--1---1-~-+--ll---l--+--+--I 

u 1---F--l=-+--ll--+--+--+-+~l--+---+---+---ll---l"'--+--+--+-'-+----l-~-+--11---1--+--+--I - v t---t--+--+----11--+--t--+--+~l---t--+--+----ll--+--+---+---4-'-+--+--+--+--il--+--F--+---I 

w t---t--+--+----11--+--t--+---f~l--+--+--+----ll--+--+---+---4-'-+--+--+--+--il--+--+---+---I 

x i---+--t--+--1--+--t--t--t~t--+--t--t---l~+--+--+--+-++---+--+-...;..+---il---F--+--l---I 

y t---+--U--+--l---F--t--+-t~+--+--+--+--lc---l--+--t---+_,...,+---+--+--+--11--+--+--+--I 

z J. 

11 6 8 2 8 2 2 a. 12 - 2 7 1 10 13 . 7 4 11 8 3 - - 2 3 1 l 

Figure 63. 

c. The t~, 152, is most satisfactory when cbmpared with ~~ (107) 

and ~~ (23). Since the cryptogram has all the earmarlrn of a digre.phic I 

1 

1 

cipher, and no manifestations are found to supporjt the hJpothesis of a 

multiliteral system, the next problem is the speclific determina.tion of the 

particular kind of digraphic system involved. Itl 'ffl.ay be noted that there 

e.re quite a few digraphs in the cipber text whichi resemble good plaintext 

digraphs, proportionally more so than, for instanpe, in the cryptogram. in 

subpar. 69c; the cryptologic finger points to the: possibility of a twosquare system. However, since the words "good di~raphs 11 are semantically 

RES'fRfC'f:ED 192 
REF ID:A66790 

RFJE'T'RIC'f'FJD 

elusive, let us attempt to determine statistically whether or not a twosque.re system might be involved· and, if a two-square, whether it is more 

probably a vertical or a horizontal two-squa.re.27 

.!!· First, for the purpose of determining whether "direct transparencies" or "inverse transparencies" predominate in this cryptogro.m, the 

digraphs of the distribution in Fig. 63 will be set down in tabular form, 

with e.n indicat:ton of their frequency 1:0, the "cryptogram, and with data. · relative to the' probability of these digraphs as plaintext" di~raphs, and . as plaintext digraphs when reversed. l'.n'.the table on page 19 , col. (1) 

is a listing of the ciphertext digraphs; col. (2) is the frequency·of the 

ciphertext .digraph as it occurs, in the cryptogram.;' col. (3) is the logarithm of the theoretical plaintext frequency or· the particular digraph 

(from Table 15, Appendix 2); col. (4) represents the products· of the 

entries in cols. (2) and (3); col. (5) is the logarithm of the.~heoretical 

plaintext frequency of the reversed digraph (from Table 15, Appendix 2); 

and coi. (6) represents.the products.of the entries in cols. (2) e.nd (5).· 

From this, the sum of the values in col. (4), 58.34, is taken to be the 

"dir..ect transparency" ·value, and the sum of the values in col. (6), 63.02, 

is taken to be the "inverse transparency!': value. Thus, since this par- ,.. ticular cryptogram has en "inverse transparency" value which.is' higher 

27 The test to be described in the following subparagra~hs ·is based on 

an evaluation of those instances wherein the observed frequency of any 

particular ciphertext digraph ~pproximates the frequency with which the 

particular digraph, or its reversal,. would be expected to occur if con- sidere~ as a plaintext digraph. Any such correlation which occurs.in a 

four-square or Playfair cipher, or in a cryptogram. produced by a large 

randomized.digraphic table,·is purely accidental because'it is not a 

result of the mechanics of the system. However, in two-square crYi>tograms 

such corr~lation is caused by the mechanics of the system in.the e~cipherment of 2o'{o'of the-possible plaintext digraphs, and these causal. instances 

of correlation occur in addition to any accidental insta.rices .'1lhich may · 

arise in the 'encipherment of the remaining 8ocfo. ·Thus, if a digraphic 

cipher exhibits merely the random expectation of correlation.both when the 

particular ciphertext digraphs are considered as they are and when their 

reversals are considered, the cryptogram may be assumed to-rilvolve a 

system other than two-square. If a digraphic cipher exhibits more.than 

the random expectation of correlation, either when.the particular digraphs 

are considered direct or when considered reversed, it ma.y be assumed to 

involve·two-square encipherment; and the·particul.a.r consideration--th~t of 

the digraphs direct or that of the digraphs reversed--which gives r~se to 

the greater degree of correlation indicates, whether t.he cryptogram.. involv~s 

a vertical two-square or a horizontal two-square, respectively. 

RSS'f'RiC 'f'FJD 193 
REF ID:A66790 

RBSTRIOTED 

{1) (2) (3) (4) (5) (6) (1) (2) (3) (4)' (5) (6) (1) . (2) ~) (4) (5) (6) 

AB 1 .• 45 .0.45 . • 38. o. 38 HA 1 • 67 o.67 • 25 0.25 OR 2 • 89 1.78 • 74 1.48 

AM 1 • 61 o.61 • 7S o. 7S HL 2 ,13 o. 26 .13 .0.26 OS 3· .61 1.83 .62 1.86 

AN 1 .89 0,S9 • 72 o. 72 HS 1 • as o.a8 • 72 o. 72 PO 1 •• 64' o.64 • 72 1 0. 72 ~AP 1 .58 o.58 .61 0.61 IE 1 ,59 o. 59 • 73 o. 73 Pr 1 • 51 0.51 • 25 0.2i 

AQ 1 • 00 o. 00 • 00 o.oo IH 1 • 00 o. 00 • 77 o. 77 QW 1 • 00 o. 00 • 00 o.oo 

BB 2 • 00 o. 00 • 00 o. 00 IP 3 .48 1.44 .45 1.35 QX 1 • 00 o.oo • 00 -; 

o.oo 

BF 1 • 00 o.oo • 00 o.oo IR 2 • 73 1.46 • 75 1.50 RA· 4 .. 80 a.20 .• 82 3,28 

BQ 1 . ) o.oo .oo o. 00 IB 1 • 78 o. 7S .• 77 o. 77 RB 1 .25 0.25 • 25 0.25 

CE 3 • 16 2.28 • 76 2.28 KP 1 • 00 o.oo • 00 o .. 00 RC 2 • 53 1. 06 • 38 o.76 

Cl\ 2 .as o. '16 .53 1.06 KR l • 00 o.oo .13 0,13 :RG 1 .48 o.48 .42 o.42 

cw 1 .13 0,13 • 00 o.oo KS 2 .13 0.26 .13 0.26 RI 1 • 75 0.75 ~ 73 0.73 

DA 2 • 76" 1.52 • 73 1.46 LC 4 • 33 1. 32 .:42 '1.68 RK 1 .13 0.13 • 00 o.oo 

DD 1 • 51 o.51 .51 o.51 LN 2 .13 0.26 .42 o.84 SE 1 • 84 o. 84 .• 86 0,86 

DE 1 • 77 o. 77 • 88 o.88 LO 1 • 59 o. 59 ,67 o.67 SI 1 • 77 o. 77 • 78 o. 7S 

DI 4 • 73 2. 92 ,45 1.80 LP 1 • 33 0.33 ,59 o.59 SL 1 .25 0,25 .45 0,45 

DL 1 .33 o. 33 .• 53 0.53 LT 1 .51 0,51 .42 o.42 SN 2 .as 0,76 :71 1.42 

DT 1 .6~ 0.62 .45 0.45 MA 1 • 78 . o. 78 • 61 0.61 · SS 1 • 67 o.67 • 67 o.67 

EE 1 • Sl o.s1 .81 O.Sl MD 1 .13 0.13 .42 0,42 TA 3 • 74 2.22 .S3 2.49 

EI 1 • 73 o. 73 .• 59 o.59 MO 2 • 55 1.10 • 72 1.44 TI 1 • S2 o.a2 ~ 7.3 o. 73 

EK 1 .oo o. 00 .45 0,45 NN 4 .51 2.04 • 51 2.04 TQ 1 .13 0,13 '00 o.oo 

EN 1 • 9~ o. 99 .87 o.87 NO 7 .66 4.62 • 92 5, 74 UB 1 • 33 0,33 .25 0,25 

EQ 1 .58 0.58 • 00 o.oo NX 1 .oo o. 00 .13 0,13 UC 1 • 33 0,33 .as o.38 

ER 1 • 94 o. 94 • 96 o. 96 NZ 1 • 00 o.oo .oo o. 00 uo 2 .13 0.26 • 79 1.58 

FI 1 .so o.ao ~55 o.55 oc 1 • 51 o.51 .so o. so VY 1 • 00 o.oo • 00 o. 00 

GB 1 .oo o. 00 .oo o.oo OE 1 • 33 o.33 .58 o.58 xx 1 • 00 o.oo • 00 o. 00 

GL 2 • 2.5 0,50 .13 0.26 OG 1 • 25 0.25 .45 0.45 YF 1 .56 ~ .13 0.13 

GP 1 .25 0.25 • 00 o.oo OI 3 .42 1.26 .so 2.40 125 58.34 63.02 

GR 3 .42 1.26 .48 1.44 OL 1 • 67 o.67 ,59 0.59 

(l') Identity of cipher digraph appearing in the cryptogram. 

(2) Frequency of the particular digraph as it occurs in the cryptogram.1 

(3) Logarithm of theoretical plaintext frequency of the particular digr~ph (from Table 15, Appendix 2). 

(4) Product of entries in columns (2) and (3). I ' 

(5) Logarithm of theoretical plaintext frequeney of the digraph's rever'sal (from Table 15, Appendix 2). 

(6) Product of entries in columns (2) and (5). ! 

RES'i'RIG'f'ElD 

194-
REF ID:A66790 

REP'l'PlC'fED 

than the "direct transparency" value, it may be ass~d28 to involve a 

horizontal twoDsqua.re--if'., indeed, t.wo-square encipherment ha~ been employed. It is now for us to estab1ish whether or not this latter is the 

case, and this will be done by determining whether or not the foregoing 

observed value, 63.02, is· representative of the degree of transparency 

which may be expected in a horizontal tvo1..square cipher. (If the "direct 

transparency" value had be1m thci! higher of the two, then it -would have · 

been i:nore probable that a vertical tw'!-square were involved, and it would 

be necessary to determine whether or not this observed value was representative of the degree of transparency expected in a·vertical. two-square 

cipher). 

e. The observed "inverse transparency'' value (selected in this case 

because it is the higher observed .value) will be compared with the value 

eXI>!cted from-_a horizontal two-square.cryptogram of t~e same size, and if' 

this observed value is as great as or greater than the transparency value 

expected for horizontal two-squares, the cryptogram may· be considered to. 

be a horizontal two-square cipher; if the observed value ia·iower tban 

the expected two-square value, decision will-have to be suspended.29 The 

transparency- value expected in a·horizontal two-square.cipher containing 

N digraphs is computed by multiplying N by .3388, which- m this case 

~ ' Actually, i-f tp~ t:wo-sq:uare hypothesis is made, the difference. be:-

tween the horizontal two-square value and the vertical t'Wo-square value 

will indicate the degree of probability of the higher score over the • 

lower. !.n this. case, the difference of. 4.68. {: 63.02 - 58.34), which 

represents a difference of 105 sco~es, is eq~ive.lent to a.n ovenihelming 

ratio of 100 billion to l (i.e., 2244·

68 to l) in favor of the hypothesis 

of a horizontal two-square. The foregoing computation involves a:n aspect 

of mathematics which will be given detailed treatment in Military Cryptanalysis, Part III. . 

29 For the benefit of the stude~t with a background in s~atistics, it 

is pointed out that by abiding by the stipulation ·"as great or greater", 

some cryptograms which actually !!! the result of two-square ~cipherment 

may be reJected by this stipulation, but it will insure that only a rela- . tively few non-two-square cryptograms will be accepted. A better approach 

of a statistical nature would involve; first, computing the expected 

value for non-two-aqua.res as well as that for two-squares. Then, any 

observed vBI:Ue falling below the expected two-square value could be 

expressed in terms of the number of standard d.eviations ( 1. e. , the 

sigmage) from this expected two-square value and~from the expected~­

two-square value. Finally, the particular expected value which would be 

considered as signi:f'ics.nt would be the· one from which the observed value 

differed by the smaller number of standard deviations. The concept of 

standard deviation will be treated in Military Cryptanalysis, Part III. 

RES'FHIG':FED 195 
I 

I 

REF ID:A66790 

REB'FRIG'FED 

yields 42.35 (: .3388 x 125).3° The observed value for the cryptogram, 

63.02, is much higher than the expected value, 42.,35; Thus, it has been 

proven statistically that the cryptogram at hand ~nvolves two-square 

encipherment, particularly, horizontal two-square iencipherment. 

f. Having now proved that the'" cryptogram at lhand is a horizontal 

two-square cipher, the next step is to assume s~ plain text in the 

message, guided by probabl~ inverse transparencies, (inverse because the 

system has been identified as a horizontal two-sqtiare) in the cipher text. 

Referring to the work sheet in Fig. 62, the repeat'.ed sequence at B9 and 

E9 is assumed to represent the plain text TA SK Fd RC (E-) , on the bas is 

of Ki0=Bip, and CRc::R~. The plaintext-ciphertext, values are now 

I 

I 

30 In the case of vertical two-squares, N would ibe multiplied by the 

constant .3610. The mathematical considerations Underlying this test and 

their J>1""10fs (involving Bayes' theorem and Ba.yes' tactors) are beyond the 

scope this text; however, for the benefit of' tb!e mathematician, the 

derivation of the foregoing constants is explained! below, along with the 

derivation of the constant used for computing the ~xpected transparency 

value for 2-two-squares. In the formulas, below.I ~ . AB : the summation over all digraphs AA- , . I 

FAB : the. frequency of a given digraph AB !as found in Table 6A, Appendix 2 . ' 

. i 

«AB = the logarithm (to the base 224) of the frequency of a given 

digraph AB as found in Table 15, ApPiend.iX 2 

For vertical two-squares, 

k : ~ .c. [.8o( .0015) + ·2° F AB,_ AB AB 5000 jFor horizontal two-squares, 

• <" [ ( ) .20 FAB]- j k - '- Cl( .8o .0015 + - .3388 

AB BA 5000 

For ,!!2!!-two square digraphic systems, 

cxAB - k : 676 - .2737 

RES'f'RIC 'f'ElD 
RES'f RiC'f ED REF ID:A66790 -•• ., ... _._ - ........ ._........, I~ 

31 recorded in a skeleton re~onstructibn diagram as illustrated in Fig. 

64!. At A3, the assumption of (-:ft) ~ ON NA IS SA K! . (E-) is tossed otf 

without muc!i ado~ since four of the six digraphs concerned are transparent. The plain-cipher relationships frpm this assumption are added 

to the reconstruction diagram, as shown in. Fig. 64b. Continuing in this 

vein, the pl~in teXt (-A) m ·c:a AF. (T-) is inserted at Al~, e.nd the plain I ' 'I 4 , 

-

-i 

' T N 

~ 

~ 

A -

s K 

0 ' T fll 

L ""· A & 

s ~ I< 

- F I : 

I 

p 0 I 

I 

R c-. I 

~---- --

F ' l 

I ..... p 0 

E' .It 8 c 

' l 

. s 

'•' ' --- Figure 64b .• ''I ' - t. 

text (-B) AT TL ES HI (P-) is inserted at J3; the successive cumulative 

reconstruction diagrams for these two asstimptions are shown in Figs. 642, 

'• 

0 T N 

.. A c i L N A 8 s R .. s ~ I< 

F • ' 

I 

p 0 

e It 8 E c. 

~ F 

- - . - ------ - ... --· 

· Figure 64,£. . .. 

31nur1ns t~ re~orist~tion of the s-es. of the ma~ix, the student 

should keep clear in his skeleton diagram. which letters are in the same 

row, and whic;h are in th~ same column. It will be found expedi~ious to 

draw a dividing line (either horizonta1 or vertical, depending on the 

type of two-square matrix involved) on the page to keep the elements of 

the two _squares independent, recordi~ the values which are. :i.n the same 

row or column and writing down the letters as the7 are assumed. In the 

early stages of this process the student must exercise care in recording 

the letters so that no false relationships are formed; 1D other words, 

the values should be written down so that the7 are not in the same row or 

column with 8!lY' letters other than those with which they are llcnown to be 

related. This will entail spreading the work rather widecy over the page 

initially, then gradually telescoping and reducing the size ot the reconstruction diagram as the. work progresses, until in the end it wil1 be 

reduced to a concise matrix of two 5x5 squares. 

RES'l'RlO'l'ElD 197 

\ 

l 

l 

j 

l 

I 

I 

t 

I 
REF ID:A66790 

RESl'RIOl'ED I . ,. 

I ' 

I 

0 T " I .. L I 

I .. 

A c. t ' L N A. .s & I R.. T ., 

-I ' . - s Ga I<. l ,I 

I 

I 

H F ' I 

E tt. p & E I 

~ c 

Cit I F i I· . ' _ ......i~---

I - - - . 

Figure 64d. I . - ) 

and 64d below• It is to be noted tha·t at J7,0C,;=P!P; but .s,!!!ce in 

Fig. 6li'.~ it has already been determined that 010 =9Sp, then OC0 must equal 

PS1 9.k~ng the word BATTLEEHIPS rather than in the singular. 

I• At this point the partially filled-in work sheet will look as 

follows: ~ 

I I. 

5 l(i) 15 I 

I 

A uo DL CE NO AN SI GL BB EI· RI RC :RG LN MO LC 

.. :R EC ON NA IS SA NC EA m CR AF T- E- ! • 

B Pl' ER GR BB OE GP AB QW NN K8 IP CR MO O:R AP 

RE ·E NC EO -E NE TA s~ FO RC E- :RO -E 

! 

c DE AM HA NX RA IE DA m MA a;· EK BS LC DD LC 

AR -0 -0 -:E. 

D TQ OR EN Dr MD TI AQ FI EQ it NN BF NO uo OS 

RO BA IT -:R TA ON I 

I 

E SN D RK TA SE SN BL PO NN K8 IP' CR CE NO IS 

NS TA AT IO NS TA SK FO RC EC ON I 

I 

F BL IR 

-o 

KP LO 

OL 

NO 

cm 

NZ UC 

-B 

TA 

AT TL 

LT ES' 

0[ 

'HI 

m . 

oc 

PS -·oN 

NO CE 

EC ~ AR 

I 

I OG. G '4 OS DI NO EE KR LC UB :RA OS D[ IP DA RC GR .. ON EE AR FO CR -E 

I 

H OL NO cw DI LP OI LN QI{ DI G;L · RB BQ 'YF SS RA 

-s. cm ES T- s~ N- L..: AR I 

J VY OI GR SL xx 

ES -E LS 

RE!S'f'RIC'f'ED 198 
REF ID:A66790 

REf.!':FRIC'fED 

Skeletons of additional plain text, such as the word OUR at Al, PRESEl~CE 

OF ENEMY at Bl, PROBABLE at Dl, ATTACK ON OUR INSTALLATIONS at DlO, 

CARRIER at Fl4, and VESSEIB at Jl, may now clearly be.seen. The complete 

recovery of th~ plain text followsJ and the reconstruction diagr,am is . completed and telescoped into the form show in Fig. 64e • S:l:nce phenomena· of keyword-mixed sequences are observed~ the rows and columns of 

QMOKTN-QLP 

AICLNABSRT 

GDFSHGKIFH 

UEPRBECODM 

Y-xv .. wzy .. x 

Figure 6~. 

REPUBDEMOC 

L I C A ?t R A 'I' f? B 

S D· F G H F G H I K 

K·M 0 QT L NP Q, U 

VW"XYZVWXYZ 

Figure 64f. · - . 

Fig. -64e are permuted to yield the original two-square matrix as shown 

in Fig.-64r. . . . . · h· The sol:u.~ion of vertical two':"squar_e systems follows analogous lines; with the necessary modifications of the reconstruction-0.ie.gra.m in 

consonance ·with the difference in mechanics between horizontal and vertical two..-squa.re systems. · .-

1. A few additional remarks concerning the test applied in s'UQpars. 

d e.nd-e,· above, -are in order. Ffrst, the exceptionally high transparency 

value ohserved in this. cryptogram is a direct result of t.he. very favor~ . able manner in which the'keyword-mixed sequences in the two squares interact; in the foregoing cryptogram, 47 of the 125 digraphs present (approx. 

38%) were inverse transparencies. It is also pointed out that, although 

some actual two-square cryptograms mey be rejected by that portion of the 

test which was described in suopar. e, the other phase of the te~t (de- · scribed in subpe.r. d)--by which one iiia.y determine whether a cryptogram is 

more probably a vertical two-square enciphennent or more probably a horizontal two-square encipherm.ent--is extremely sensitive and: highly accurate. The foregoing statistical method is not merely valuable ~r ~ as 

an application. of cryptomathematics in the analysis of two-square matrix 

systems, but is included as being illustrative of the general principl.es 

of s:pecial techniques that may be deveioped in the attack on a.ny particular cryptosystem, the mechanics of which are known to the cryptanalyst. 

The field of actual operational cryptanalysis is replete with special 

methods of attack of this nature. · 

. . 71. Analysis of Playfair cipher systems.-'"'!.• Of all digraphic 

cryptosystems e:μyploying small matrices, the one which has been most 

frequently encountered is the Playt'air cipher. Certain variations of 

this cipher have bee~- incorporated in several complex manual ciphers 

used in actual operational practice; because of this it is iin:porta.n·t that. 

the student gain familiarity with the methods of ~elution of the cJJ;i:,..ssic 

Playfair system. · 

RES':FR:IC'i?BD 199 
REF ID:A66790 

RES'fR1C'fED 

b •. The first published solutions32 for thisl cipher are quite 

similar basically and vary only in minor details •. The earliest, that by e 

Lieut. Mauborgne (later to become Chief Signal Officer of the· U.S. Army), I - used straightfo~d principles of frequency to e~tablish the values of 

three or four of. the most frequent digraphs. Then, on the assumption 

that in most cases in which a keyword appears on ~he first and second rows 

the last five letters of the normal alphabet, VWXJYZ, will rarely be disturbed in sequence and will occupy the last row of' the square, he "juggles" the letters given by the values tenta.tivelYl established from 

frequency considerations, placing them in variousl positions in the square, 

together with VWXYZ, to correspond to.the plainte~-ciphertext relation-· I ships tentatively established. A later solution ]bY Lieut. Frank Moorman, 

as described in Hitt's manual, assumes that in a Pla.yfair cipher prepared 

by means of a square in which the key word occupi~es the first and second 

rows, if a digraphic frequency distribution is ma!de, it will be found 

that the letters having the greatest combining pcf'er B.J:"e very prob~bly lette· 1f the key. A still later solution, by Uieut. Commander Smith, 

is peinaps the most lucid and systematized of the' three. He sets forth 

in definite language certain considerations whic~ the other two writers . I certainl~ entertained but failed to indicate. j . 

c. The following details have been summarized from Smith's solution: 1 

(1) The Playf'air cipher may be recognized bYi virtue of the fact that 

it always contains an even number of letters, and that when divided into 

groups of two letters each, no group contains a ~epetition of the same 

letter, as NN or EE. Repetitions of digraphs, tr:igraphs, and polygraphs 

will be evident in fairly long messages. 1 

(2) Using the squa.re33 shown in Fig. 65, th~re are two general cases 

to b~ considered, as regards the results of enci~herment: 

B A N K 

D E F G 

I-J L M 0 

u p T c 

s v w x 

Figure 65. 

R 

H 

Q 

y 

z 

: 

., 

! 

32 I Mauborgne, Lieut. J. o., U.S.A. An adve.nce4, problem in C!'YPtogra.phy 

and its solution, Leavenworth, 1914. I Hitt, Captain Parker, U.S.A. Manual for th~ solution of military 

ciphers, Leavenworth, 1918. : . , Smith, Lieut. Co.mrnander W. W., U.S.N. In Cryptography by Andre 

La.ngie, translated by J.C.H. Macbeth, New York, 1922. 

33 The Playfair square accompanying Smith 1 s soiution is based upon the 

key word BANKRUPTCY, 11 to be distributed between the first and fourth lines 

of the square". This is a simple departure from! the original Ple.yfa.ir 

scheme in which the letters of the key word are ''1I'itten from left to right 

and in consecutive lines from the top downward. I 

I 

! RSS':FRIO'f':SD · 200 
REF ID:A66790 

RESTIHCTED 

· Case 1. Letters e.t opposite corners of a rectangle. The following 

illustrative relat~onship~ ar.e fo~d: · 

~=!!c 

~~ 'Y]'v"P =!!&: 

F .1.p:H'I'c 

Reciprocity e.nd reverEtibility.34 

Case 2. Two letters in the same row or column. The following illustrative relationships are found: 

~=~ N.Ap:I<Nc 

But ~ does not : ANc, nor does Kip=NA.c. 

Reversibility only. 

(3) The foregoing gives rise to the fol1owing: 

Rule I. (!,)·Regardless of the position of the letters in the 

square, .if 

l'. 2:3 • 4, then 

2.1:4.3 

Tb.is _rule is of particular aid in selecting probabl.~ words in the 

solution of Playfair ciphers, as will be shown shortly.3) 

(!?_) If 1 and 2 form opposite corners of a rectaDgle, the 

following equations obtain: 

i.2:3.4 

2.1:4.3 

3 .4:1.2 

4.3:2.1 

34 By way of explaining what is meant by reciprocity and by reversibility, ,!!! t~ case 2!_ d,!g,raphic systems, the following examples are 

given: THp=YFc and lFp:THc constitute a reciprocal relationship; 

Tlrp::n'0 and HTp:FYc constitute a revers-ible relationship. 

35 In this connection, a list of frequently-~ncountered·words and 

phrases which contain reversed digraphs (so-called "ABBA patterns") ha.a 

been compiled and is included as Section E, "Digraphic· idi<;>morphs: 

Playfair", in Appendix 3. . . 

REBTRIGTED 201 
REF ID:A66790 

R:BS':FRIO':F:SD 

(4) A letter considered as occupying a position 'in a row can be combined with but four other" letters in the same row;! the same letter considered as occupying a position in a colunm can b~ combined vrith but four 

other letters in the same column. Thus, this let~er can be combined with 

only 8 other letters all told, under Case 2, above. But the same letter 

considered as occupying a corner of a rectangle cJ.n be combined with 16 

I other letters, under Case 1, above. Smith derives from these facts the 

I conclusion that "it would appear that Case 1 is twice as probable as 

Case 211 • He continues thus (notation my own) : 

"Now in the square, note that: 

also 

''From this it is seen that of the 24 equations that can be formed 

when each letter of the square ·1s employed either/as the initial or final 

letter of the group, five will :l.ndicate a repetition of a corresponding 

letter of plain text. j 

"Hence, Rule II. After it has been determined, in the equation I 

- - I 1.2:3.4, that, say, Ef\,:FAc, there is a probabili~y of one in five that 

any other group beginni.!§ wigh F c indicates Eep, ~d that any group 

ending in Ac indicates 0Hp.3 i 

"After such combinations as ~' <>Rp, and EN;t, have been assumed or 

determined, the above rule may be of use in discovering additional digraphs and partial words". ! 

I 

I 

I

I 

36 

There is an error in this reasoning. Take, for example, the 24 equatioJs having Fas an initial letter: 

Case Case Case J Case 

1. FB.=DND 2. FE=ED 2. FT=NM I 1. FX=GW 

I 2. FD =EH 1. FL=EM 2. FW=NT I 1. FR=HN 

1. FI =DM 1. FP=ET 1. FK=GN 2. FH=EG 

1. FU =DT 1. FV=EW 2. FG=EF ti 1. FQ=HM 

1. FS =DW 2. FN=NW 1. FO=GM 1. FY=HT 

1. FA =EN 2. Fl4=NF 1. FC=GT 1. FZ=HW 

Here, the initial letter F. represents the following initial letters of plain-tex~ digraphs: 

De., Ee •• Ne., Ge0 , and He.. 1 

It is seen that F. represents 0 0 , N0 , G0 , H11 4 times each, and E0 , 8 times. 1 Consequently, supposing that it has 

been determined that FA.= END, the probability that F. will represent E0 i~ not -1 in 5 but 8 in 24; or 1 in 3; but 

supposing that it has been determined that FW0 =NT •• the probability that f. will represent N •is 4 in 24 or 1 in 6. 

The difference in these probabilities is occasioned by the fact that the fir~t instance, FA0=EN0 corresponds to a 

Case 1 enciphermeut, the secoud instance, FW.=NT 0 , to a Case 2 encipherment. But there is no_ way of knowing 

initially, and without other data, whether one is dealing with a Case 1 or Case 2 encipherm,ent. Ooly as an 

approximat.ion, therefore, may one say that the probability of F0 representing a given e. is 1 in 5. A probability 

of 1 i~ 5 ~s of almost t.rivial importance in this situation, since it representlllsuch a "long shot" for success. The 

following rule might be preferable: If the equation 1.2=3.4 has been establ~shed, where all the letters represented . I 

RES'fRIC'fED 

202 I 

i 
REF ID:A66790 

R:SS'FHIG'fEJD 

Rule III. In the equatiob 1.2:3.4, 1 and 3 can never be identical, 

nor C$11· 2 and 4 -ever be ·1~entf.£!.l. Thus, ANP could E,£t possibly be 

represented by AYc, nor co~d ~be represented by KRc• This I_"ule is 

useful in_ elimination.of certain possibilities when a specific message 

is being studied. ; · . · · · . . 

:R:W.e IV. · In'.the equation l.~.:3.4c, j,t' .2 a.nd 3 are identical, :the 

letters are all in the same row or column,. and in the relative order 

1-2-4 from left to right 9r top to bott0I1;1, respectively. In the square .. 

shown_,~=NKc and the absolute- 9rder is ANK. The relative order 1-2-4 

includes five absolute 9rders which a.re cyclic permutations. of one 

another. Thus: ANK •• , NK •• A, K •• AN, •• ANK, and .ANK •• 

Rule v. In the equation l·2p=3.40 , if 1 and !ii are identical, the 

letters are all in the same row or column, and in the relative order 

2-4-3 from left to right or top to bottom. In the square shown, K:Np=RKc 

and the absolute order is NKR. The relative order 2-4-3 includes five 

absolute orders which are cyclic permutations of one another.. Thus 

NKR •• , KR •• N, R •• NK, •• NKR, and .• NKR •• 

Rule VI. "Analyze the message for group recurrences. Select the 

groups of greatest recurrence and assume them to be high-frequency di~ 

gra.phs.37 Substitute the assumed digraphs throughout the message, testing the assumptions in their relation to other groups of the cipher. The 

reconstruction of the square proceeds simultaneously with the solution of 

the message and aids in hastening the translation of the cipher". 

by 1, 2, 3, and 4 are different, then there is a probability of 4/5 that a Case 1 enoipherment is involved. Consequently, if at the same time another equation, 3.6=5.2,..has been established, where 2 and 3 represent the same 

letters as in the first equation, and 5 and 6 a1-e different letters, also different from 2 and 3, there is a probability 

of 16/25 that the equation 1.6=5.4 is valid; or if at the same time that the equation 1.2=3.4 has been determined, 

the equation 1.6=5.4 has also been established, then there is a probability of 16/25 that the equation 3.6=5.2 is 12 14 88 12 18 It 

valid. (Check this by noting the following equations based upon Fig. 25a: CE=PG, PH=YE, CH=YG. Note 

the positions occupied in Fig. 2Sa by the letters involved.) Likewise, if the equations 1.2=3.4 and 1.6=3.5 

have been simultaneously est.ablishcd, then there is a probability that the equation 2.5=4.6 is valid; or if the • 

equations 1.2=3.4 and 2.5=4.6 have been simultaneously established, then there is a probability that the 12 8.& ld 88 91 48 

equation 2.5=4.6 is valid. (Check this by noting the following equations: CE=PG; CA=PK; EK=GA; note the 

positions occupied in Fig. 25a by the letters involved.) However, it must be added that these probabilities are 

based upon assumptions which fail to take into account any considerations whatever as to frequency of letters 

or specificity of composition of the matrix. For instance, suppose the 5 high-frequency letters E, T, R, I, N all 

happen to fall in the same row or column in the matrix; the number of Case 2 encipherments would be much 

greater than· expectancy and the probability that the equation 1.2= 3.4 1-epresents a Case 1 encipherment falls 

much below 4/5. 

37 . '· 

A more accurate guide to the:dete:r:mination of the plaintext equivalents of high-frequency cipher digraphs would involve the consideration 

of the.difference .in frequency of a particular digraph and its reversal. 

Thus, an example. of a high-frequency eep which is also high-frequency in 

its reversal, is REp; an ex8.mp1!_of a high-frequency ~ which is ra.rei.y 

found in its reversed form, is T~. 

RES'f'RiC'f'ED 203 
I 

REF. ID :A6.6790 I 

RES'FRIO'F:SD I 

d. (l) When solutions for the Playfair ciphbr .system were first ~ devel0ped, based upon the fact that the letters we~e inserted ·in the • 

cells in keyword-mixed order, cryptographers thougP,t it desirable to 

place stumbling blocks in the path of such solution by departing from I strict, keyword-mixed order. One of ·the simplest methods is illustrated 

in Fig. 65, wherein it will be noted that the last! five letters of the 

keyword proper are inserted in the fourth row of the square instead of' I the second, where they would naturally fall. Anotller method involves 

inserting the letters within the cells from left tp right and top downward but using a sequence that is derived from a cp1umnar transposition 

instead of a keyword-mixed sequence. Thus, . using ~he keyword BANKRUPTCY: . ' . 

2 1 5 4 7 9 6 8 3 10 

BANKRUP·TCY 

DEFGHILMOQ 

svwxz 

I St.-.,...ience: A E V B D S C 0 K o· X N F W P L R R Z T M U I Y Q I 

I 

The Playfair square is as follows: 1 ! 

AEVBD 

SC 0 KG 

XNFWP 

LRHZT 

MUIYQ 

Figure 66!:. 

(2) Note the following three squares: 

ZTLRH 

YQMUI 

BDAEV 

KGSCO 

WPXNF 

Figure 66E_. 

OKGSC 

F W .PX N 

HZTLR 

IYQMU 

VB DAE 

Figure 66£_. 

' 

~FWPX 

RHZTL 

I 

JJIYQM 

·~6~~~ 

I 

Figure 66d.. 

I -

At first glance they all appear to be different, bht closer examination 

shows them to be cyclic permutations of one anothe~ and of ~he square in 

Fig. 66a. They ~~eld identical cryptographic equiyalents in a11 cases. 

However-; if an attempt be made to reconstruct the briginal key word, it 

would be much easier to do so from Fig. 66a than ftom any of the others, 

because in Fig. 66a the original keyword-mixed sequence has not been 

disturbed as much as in Figs. 66b, c, and d. In worlcing with Playfair 

ciphers, the student should be on the lookout for ~uch instances of 

cyclic permutation of the original Playfair square;, for during the course 

of solution he will not know whether he is buildin.g up the original or an 

RES'FRIO 'FED 204. 
REF ID:A66790 

REB'FRIG'f ElD 

equiva.lent cyclic permutation of the original matrix; tlsually only after 

he has completely reconstructed the matrix will he be able to determine 

this po int • · 

e. (1) The steps in the solution of a typical example of this 

cipher will now be illustrated. Let the message be·as follows: . . . 1 2 8 41 II 8 7 8 9 10 11 12 13 14 111 10 17 18 19 20 · 21 22 23 24 23 20 Z1 28 211 30 

A.VT Q ,EU HI 0 FT CH XS C. A K.T LI' RA Z E V TAG A E 

~· 0 x· T Y M H C R L Z Z T Q T D- UM C Y C X C T G M T Y C Z U 

C. S N 0 P D G X. V X S C A K T V T ·P K P U T Z ·P T W Z F N B G 

n: p T R K ·x I x. B p R z 0 E p u T 0 L z E K T. T .c s N Ii c Q ·M 

. E. V T R K M W C F Z U B H T V Y A B .G I P R Z K P C Q F N L V 

;tr. 0 X 0 T U Z F A C X X C P Z X H C Y N 0 T Y 0 L G X X I I H 

G. T M S M X C P T 0 T C X 0 T T C Y A T E X H F A C X •x C P Z, 

H.4 X H -y; .. c T X W L Z T S G P Z T V Y W C E T W G C C M B H M 9 

J. Y X Z P W G R T I V U X P U M Q R K M W C X T M R S W G H B. 

K. X C P T 0 T C X 0 T M I P Y D N F G ·K I T C 0 L X U- .E T P X 

L. X F S R S U Z T D B H 0 Z I G X R, K I X Z P. P V Z I I> U H Q 

M. 0 T K T K . c c H x x 

(2) 'Without going through the preliminary tests in detf3'il, with 

which it will be assumed that the· student is now familiar,~ the conclusion is reached that the cryptogram is digraphic in na~ure, and a 

digraphic f~equency distribution is-made (Fig. 67). 

38 See par. 69.£· 

RES'f'RIC'f'Eo 

205 
REF ID:A66790 

REB'l'RiO'!BD 

A BCD E F 0 Bl J KL M N'O P Q ~ s· TU V W X Y Z 

Al -- --- - -- r;---· -- r---r-----r---·-- -1--.---.---.---r---r----.--- I 

B r--11--.+--+---i=--t--t=•:......-+-•--1-

C I= 

=l''-1---11--+--F-+:=:......+~F•'-l---.,t--+--r-F=-t---t---t--t-'-t=-t--;--·l--7";---t--i=-i---r----i---; D! • --i=--1--+---l---f-----~--+-·l---+--+--+---il""--t---1--r---t-;-+--t--+--t---;--;>---+--+--< El 

Fi --+-r- ·-+-r--'+--r--l----il--+---t--t----t-+--t--t--t-~1---r--1-------~-+--+-~ 

~-i--- ----t--t--1 --+---+---+-·--+- l--+-__,1---i=•:::.......,1---1----+--+--+-+--t=---+--+---+---t-+---+--l 

G 

: l---!=-l---t---1----~+-+---t---+--t----t---T--T--T=--t.-ci-t---t--t---t-· --<l---l---;__.;_1---1 

1---t--, --<--+---+- -+---+---<--t-·l---+-~-+-1=--1=--+---+-+-+-+--·-+--;=-+--.,i=--+--+---l 

J ,. l---+-~--1---t--+-+--+--+ 

K I -t--+--i--+-~--.=----4-+--+--+---l·~l=-+--+-'!-l---t==--+--+-+---+-~-+--l L 

M L-l--+-· .---1-:-t---t--1·---11--+--t--+--0 -+-j-~ = ~ -L _ ___.,___,_____.__,_ ... ___,. ______ _ N I . I 

o I • - '-"·- 1"'- -- ·1+-i -l--+-+--1---+-+--t--t---I 

- --t-·r-- _J~: :- = = = 

p ~- --- - , -r-f--i-+---+'"--'i=--l=--1---i=--+==--+=.,... 

--+--t--+--·-t--1---l-- ---

Q 1---+--+--1--r--+-----1--~----1--1- ~ >----~]-- -1- 1-+--t----- R e j · sf- = --1--1-~-~:-+---+---t=-;--+--1--1--f---.I 

T 1--~~"--l>---+--+--1=--+--~--+--+--!-F=-+-~1~+---+---+---t-+---+--l~='-+~l--+=-1~-l u l---t--t--+---i-+--+--+--+-t-+---~-+---t---t~>--1--t--+--+---t-t---t--t=-+---i--I 

v I 

I 

z 

Figure 67 

it-

' - I 

-----i---t--1 

Since there are no double-letter groups (termed "doublets"), the 

conclusion is reached that a PlEl\Y'fair cipher is involved and the message I is rewritten in digraphs. 

RES'FRIC'FED 206 
\ 

REF ID:A66790 

RES TRIO q:':SD 

. l · '.'I•' 8 t · I. ; 0 't " 8-' t . 10' · U 111 · 1i . ' H lG 

A. VT QE UH :'IO FT CH .. xs' CA KT VT RA' ZE VT AQ. AE 

B. OX. ,TY .MH.. CR LZ ZT, QT DU MC. YC .. XC . TG MT YC· ZU 

c. 

D. 

SN 

PT 

OP DG· 

RK XI 

xv XS CA KT 

XB PR ZO. EP 

VT PK PU TZ PT WZ FN BG J • \ • • • • 

UT OL ZE KT '.J.'C SN HC QM 

E. 'VT RK MVt:. CF':.,· ZU. BH· TV YA .·BG"'· IP RZ KP·. ccf FN\. LV 

. F •. ox. 'OT.:. UZ· ,-FA-. ex ·XC PZ ·XH .. CY .. NO, ·:~Y Qt,. GX XI~ IH, 

G .. 'TM" SM xc' PT. ClT. ex OT TC .. YA TE XH FA . c~ . .. ~?~ 

H .• XH YC TJ( WL .. ZT • SG pz' TV . YW CE TW" GC . CM a1r··'MQ. 

J. YX ZP ·WG·: RT·· rv· .·ux Ptt" Mei· ru< : .MW:· ex '.I'M ·:RS· ·we· ·Ha; 

K. xc. PT :;.Q.T .ex OT' MI .. PY DN FG °KI· '. !J.'.C . OL XU .. ET· PX· (

0

4, I • • • , • , • 

"L. ~- ·SR su· :zT" ·DB ... HO ·zr· Gl( RK". IX' 'ZP ~v . ZI.' QU HQ' r .. \ • • • I ', ' .. ' . "' ... 1. _ : .. • ~ ' 

.M .. ~ ·air. .... KT_ .;Kg . cH· XX- .

1

• • • •• :· , • 

. (3) 'The" fdJ:lowing:·three- fairiy .. 1engtey repet~ti~~s are noted= .. . ~ , .f 'I , : •.,-.. ). / '~·''11.1 •• ' " I • ' • ' • ' .. ' l ·! ' • ' . 

. , . ' . ·, ' LI ~ ··t .• . , . . . . _! ' ' ' ,< ••. ' ' •' · ·• nee·.., · • ··-" · ·' 

: : ·. -. · .F. OT·· .. OZ' ,.'FA'.. tX · XC ·· PZ: .KH· •CY· 'NO 

· ... · · "; ·a1:· if-E ·"x8 ~·FA 6X , .. ie pz · xi{"yc ''rx .. , ·' ., '> T • • ...~.... , ~ • - o Oo ,, :. '' • / t' C,' • .. ,,, 

'.--:;·~·; .. ~.' ~;'1_¢ '·'qlfl. ~~ .. ~~ ... K'.1' V~ RA_,,~ZE 

"' C.-: DG XV. XS' CA KT · VT PK": •P.U " 

· .. · G.". TL!°" :S~.r ·xc" :PT o.r·· ex OT Tc : ._ '• ·, \ ' ' ti • ~ I • ' ' 

K. ~ ~ E n ~ a ~ ~ I 

0 

'" • :_ t .. ' 

0 

• ~ H"" 

1

,. ~ - • 

. ··. 

W I~ 

.. 

,,. .. , . -

' . . .. ~ ' 

,, • : -~· •• 1. 

. , - . .• ... :: . .. ' . ., , . ' . ~ ... • r • ,• '"' '• • J t 0

., "' - _.,..... 

. .. " 

The first long .rep,et.ition, with .the sequent reversed ~igraphs .. CX a.D;d XC 

immediately. suggea~s., the 'word. BATrALION ·.c se~ -$ection "E·~· Appe¢ix 3),, ... : .. split Up into' -B: !\.T ~A? Ll' ON and the,~· ~eqtience cdnta~ing' :this _repetit:l,~p. 

in l'ines F and._G become.a.· as :follows: -- · · · _- '. · · · ,-, · " ' ., 

Line F . ..... ' :.~.J •. -.... : ox CY.r uz FA ex -XC· :.pz- XH' CY NO TY 

B ::AT TA LI ON .. Line G ·• .. • . • •.I YA TE ·XH :FA ,ex XC · PZ XH YC- ·TX WL. 

B . AT TA· LI ON· .. 

(4) Because of.~he'!requen~ uae !:>~ ,ziumerai~ bef__o~e the wor~ BATTALION·(as mentioned in Section B of Appendix 4) and be¢ause of the appearance of o~ before this word in line G,'the'possibility suggests · 

itself that the word before BATTALION in line .G is either ONE or SECOND~ 

The id~nticeJ. cipQ~r.digraph FA -in both cases gives a hint that the word 

BATTALION in line F may al.so be pre~eded by a n'l.;IIllera.1; if O~ is correct 

'4 • • • 

RES'i'RIC'i'ED .~. ' 

207. 
REF ID:A66790 

RESTHlO'fED. 

I 

in line G, then .T.ffRE! is possible in line F. On ~he other·hand, ii' 

SECONE_ is correct in line G, then THIRD is possible in line F. . - I. • . Thus: I 

Line F ........... OX OT U'Z. FA ·ex xc FZ XH ·CY.; NO 'TY 

let hypothesis •••• -- TR RE EB AT TA LI ON 

: 

2nd hypothesis •••• TH IR DB AT TA 11.I ON·.· 

' 

Line G ...•.....•• YA TE XH FA ex xc· I 

PZ XH ·ye TX WL I 

let hypothesis •••• ON EB AT TA 

I 

L.I ON 

2nd hypothesis· •••• -s EC .ON DB AT 

I 

TA l].I ON I 

. ' ! - -· ... First, .. '".e that if either hypothegs is true, thEfn OTc:THp •. The 

frequel..-.f distribution shows that OT occurs 6 times .and ·is 1)1 fact the . I • 

most :frequen1_.di£aph in jd!e ~ssage. Mo~over ~ li>Y. ~ule I of subpaz:agraph !?_,if OTc=THp then TOc=HTp· Since HTp is a!very rare-digraph in 

- I normal plain text, TOc should either not ,9ccur e.t 1·a.ll in so short a 

message or else it should be very infrequent. The frequency distribution I shows that it does not occur. Hence, there is nothing inconsistent with 

the supposition that the worq ~~·front of BATl'ALIQN in line F is THREE or 

THIRD, and there is some evidence that it is actue.J.J,.y one or the other. 

'. . , ·.. I . 

(5) But can evidence be found for the suppor~· of one hypothesis 

against the other? Let the ·frequency distribution be examined with a ~ view to throwing light upon this point.· If the first hypothesis is true, 

then UZc::REp, and, by Rule I, ZUc~· The freq.u~ncy distribution shows - I - but one occurrence of UZc and b~t two occ~ences of ZUc· These do not - . - ,I . look very good for RE and ER.. On.:t.he other hand,: if the second hypothesis 

is true, then UZc=IRp and: by Rule I, ZUc:Rip· T~e frequencies are much· • • . - I . •. 

more favorable in this case; Is there anything .inconsistent· with the 

assumption, on the be.sis. 9f the sec9nd ·hypothe~i~., tha.t"TEc=E~? The · 

frequ!:,!!CY distribu~ion shows no incon~fstencr,, fof TEc..2.cc~s .once ~d 

ETc(:CEp, by Rule I) occurs once. As regards whe~her FAc::E:ap or :mp, 

both hypotheses are tenab1e; possibly the second };iypothesis is s shade 

bette!_than the firs!J._ o~the followi!IB_ reasoning~ By Rule· lz. ·ti· ·.JAc::EBp 

then AFc=BEp, or if FAc=DBp then AFc::.BDP. The fa~t that no KFc occurs, 

whereas at least one~~ may be expecte~ in this ~essage, inclines one to 

the second hypothesis, since BDp is very rare. : 

(6) Let the 2nd hypothesis be assumed to be correct._ The additional 

values are tentatively inserted in the text, and li.n lines ·0: 'anO. K two 

interesting repeti-:ions &·e noted: · · · ·-

Line G . • . • . TH 'SM xc PT 0:; ex OT- TC y~ ~ ~H. FA C'...C xc PZ XII 

TA ':!:.a J.T 'ri{ -s EC OH DB A"r TA LI 011! I . 

Lina K . . WG FIB xc PT· OT ex OT 1-il pY D:~ PG XI TC or. XU ET 

TA 'l'H :~·Ti·II , e 

R;gSTRlCTED r:o8 
r,. 

REF ID:A66790 

RES'fRIG 'i'ElD 

Thi.s certainly loo~ like ~TATE THAT. THE ••• , which would make 'l'Ep:PTc. 

Furthermore, in :iine G the sequence STATETHATTHE •• SECOi\JDBA'l1TALim~ c~.n 

hardly be ~hing else __!ha!!_ STAT,E THA'.!'_. THEIR SECOND BA'.ITiμ.;IOH, which 

would make 'l'Cc=E1:P and YAc=RSP. Also SMc=-sp. · · 

(7) It is ~erhaps high time. that, the whole. ;u.st _of tentative equtvalent_ va~ues be. studied in relation.tp their -~orisistenc~ with the positions 

o-r letters in ·the Playfair sq~e; mpreoyer, .'by so hci9.':i:pg', 'Eiddi tional · . 

values may be obtained in the process~ The complete lls"t or· va,lues is 

as follows: ·'· 

Assumed values Derived b~ Rule I 

,_ ~:Cxc .TA;p:l@c ... !4;p:PZ0 _!f:p:ZFc' 

Q!p:X!!c BQp:!!&: 

T!!p:OTc .HTp:TOc .. .!!!p:UZc . fil;p =~!fo .· ~:FAc ~=~c ~:TEc ~:ETc· 

~:PTc ~:TPc 

filp:TCc ~.:CTc 

.~:YAc " '-~:AYc· 

-Sp:SMc S-p:MSc .., . ~-

(8) By ~ule V, the equation-~:O":t'c: means that H, o, and Tare all 

in the same row or column and in the absolute order HTO;,similarly, c, E, 

and T are in the same row or column and in the absolute order CET. 

Further, E, P, and T are in the same row and column, and their absolute 

order is ETP. That is, these sequences must occur someplace in the square, 

in either rows or columns, taking into consideration of course the probability of cyclic ~isplacements of these sequences .within the square: . ... . .. . 

, (a) lt°T 0 (b) C E T . {c) E T.p·: . · ... 

(9) Noting the common ietters'E and·T.in the ·second and ~hird sequences, these two sequences may be combμied into one sequence ·or four 

letters, viz., c ET P. Sine~ ~nl.Y one posit~on.remains to be filled in 

this '!:!!:!' Iir column) of the square; and noting iri the list of equivalents 

that EI.n:TCc, it is obvious that the letter I_belongs to the c.E T P 

sequenci; th~ complete sequence is therefore C E T P I. . . . 

(10) Sine~ the sequence HTO has a common letter (T) with.the sequence 

CETPI, it follows that if the ll'l'O sequence _occupies a rmf, then the 

CETPI sequence must occupy a column; or, if the HTO sequence occupies a 

column, then tbe CETPI sequence must occupy a row; and they may be combined by means of their common letter, T, !.!!·: 

RES'FRIG'i'ElD 

,-----------· ; H : 

le E T P Ii 

: 0 : L-·-··-·----1 

or 

209 

·-----... : . c : 

: 'E l 

:HT o: I . ' I 

I P t • 

: .. ______ I : .. 

... 
REF ID:A66790 

R:SS'fRIC'fED 

The proof of whether the CETPI sequence, for example,· properly belongs as 

a row or a column of the Playfair 'square lies in the establishment of a · rect~ular relationship, instead of the· linear r~lationships constru~ted thus far. ' i _ (!!,) We note that, from_1he_!,ssumptions in su~par. ~(6), AT~:CXc 'and 

ONp:XHc· The relationship ONP:XHc migh~ ?~ eith~r a rectangular one, such 

as OXX' or it might be linear, !!:,·,···HTOXN or:H. Since hqwever 

1T 

H N lo ix IN 

I 

ATP:CXc ~be a rect8.ngular relationship, then fnlY the configuration 

·---------.. I c A I 

I E I I I 

~H T 0 A HI I p I 

I l 

I I I L---------.J 

will be valid, since the alternative 

satisfy the equation AT~:CXc· 

I 

I ' 

I 

I 

·----------... l H ; 

lC E T P 1: 

: 0 !will not 

:A X : , I _________ N -· ~ 

(12) The fragmentary. Playfair square39 

of its 25 possible cyclic permutations, as 

has been established, .in one 

C A 

E 

HTOXN 

p 

I 

Scanning the list of plain-cipher equivalents giv~ri in subpar. d(7) in 

order to iilsert possible additional letters, none! is f'ound.. But seeing 

that several high-frequency letters have already ~een inserted in the 

matr:fx, perhaps reference to the.-cryptogram itseljf in cqnnection with 

value's d~rived from these inserted let:ters may y:l,leld further clues. Fm." 

example, the vowels A, E, I, and 0 ~re a..;tl in po~ition, as are the very f~equent consonants N and T. The.following comb:ilnations may be studied: 

r 

I 

39 I . · In actual practice, it. i~ more usual to sta.:qt witr. ·a much larger 

diagram than a simple 5x5 square; as relat~onships develop, t:ie diagram 

is gradually condensed, ui;itil finally o. 5x5 squai:e .::;.:...o:re;es. This procedure is quite similar to tha.t employed ·:tn the· ~eco:r:.3t:;:·uction di03r;:i.ms 

for two-square ma.~rices. ! 

I 

I 

'RESTRlC'F:SD ·210 
. REF ID :A66790 

RFJS'FRiO'f'ED 

ATP( =cxc), ~Ap( =Xcc), O'N1,(':Xiic), TE°p( =PT'c) and ~( :T.Pc) have already 

been inserted in the text. 'Of the others, only OXc(=TOp) OCC~B two 

times, and this value can be at once inserted in the text. But can the 

equiv!!_ents of AN', EN', or IN be found from f!!:_quency considerations? _ 

Take E~, for example; it is_!.epresented by @Tc. What combination of 0T 

is most likely to represent ENP among the fo~lowing cahdidates: 

r.rc (4 times); by Rule I, NEp would : TKc (no occurrences) 

VTc (5 times); by Rule I, ~ would : TVc (2 times) 

ZTc (3 t:1,p1es); by Rule I, ~P would,~ Tl~ (l t~) 

VTc certainly lopk~ good: it begins. the message, suggesting the Word 

ENEMY, and the sequence PZTVc, in line H, would become the p_laintext 

sequence LINE. Let this be'assumed to be correct, and le~ the word 

ENEMY also be assumed to be correct. Then EM_p:QEc. and the partial square 

then becomes as shown herewith: 

p 

I 

C .A 

VMEQ 

NHTOX 

~ Figure ~8!_. 

(?-3) In line E is seen the following sequence: · · 

Line E • • • • • VT RK MW CF ZU BH TV YA BG IP RZ KP CQ FN LV 

EN · RI NE RS PT . -E 

' The plaintext sequence ••• RI •• NERS •• PT ••• suggests PRISONERS CAPTURED, 

as follows: 

MW CF ZU BH TV YA BG· 'IP RZ KP 

P RI SO NE RS CA PT UR ED 

This~iV!!, the following new values: 9Pp=CF c; SOp:BHc; ~:BGc; URp=RZc; 

and EDp=KPc· The letters Band G can·be placed·in position in the 

partial square at once, since the positions of C and A are alre~ known. 

The insertion of the letter B :Immediately permits the placement of 'the 

lett!!, S, froin the equation 'SOp:filic. Of' the reinaining equations only 

JIDp:KPc ·can be ll:8ed. Since E and P are fixed and ar~ in the same column, 

D and K must_be in· the same c~lumn, and mo~over the K must be in the 

RES'FRfC':FED 

211 
REF ID:A66790 

RES'fRIO'fED 

. I 

same row as E. There/is' only one possible positidn for K~ viz., 

e.tely after Q, This. automatically fixes the position of D.The • I is now e.s shown herewith: 

p D 

1· 

GS CB A 

VMEQK 

NHTOX 

Figure 6~., 

1mmed1-

square 

(14) A review of all equations, including the ~ery first ones es- 1 - - - - tablished, gives the following which may now be us;ed: :QBn::FAc; R~:YAc. 

The first permits the imniediate placement of F; th'.e secona, by elimi:.. 

nation of possible positions, permits the placemedt of both R and Y. 

The sq J is· now ·as shown herewith: ' · 

PFD 

YI R 

GS CB A 

VMEQK 

NHTOX 

F igul."e 68.£. 

Once more e. review is made of all remaining_2!Iluse~ equations. L~=Pzc e 

now permits the placement of L and z. Dlp=UZc now: permits the placement - - I of u, which is confirmed by the equation ~:RZc tirom the word CAPTURED. 

There is then only one cell vacant, and it must be occupied by the only 

· letter left unplaced, viz., W. Thus the whole sqJa.re has been reconstructed, and the message can now be deciphered. 

LWPFD 

ZYIU~ 

GSCBA 

VMEQK 

NHTOX 

Figure 68~. 

!· Reconstruction of the square in Pla.y'fair 1ciphers is normally 

carried on concurrently with the synthesis of the !plain text, once a few 

correct assumptions have been made. Now, having just reconstructed the ·. 

square as shown in Fig. 68d., the question to be atjswered i~ whether this 

square is identical with the originaJ. encipherlng'matrix or whether it I is a cyclic permutation of the originaJ. square (which may have contained, 

say, a transposition-mixed sequence). Even thougli the cryptogram in 

subpar. 7le has been solved, this point is still qf interest. - . 

RES'fRIC'fED 

212 
REF ID :·A66790 

RSSTFHC':FED 

. (1). The square that is derived may not necessarily be the original 

enciphering square; more than likely it will be one of the 24 possible 

cyclic permutations of the original square. If the Playfair square consisted of a ke~~~~rd-mixed sequence, a permutation of the square w~ll 

cause no di~ficulty in recovering the original matrix and hence the key 

word. For exa.."::ple, if the square derived in some other instance is 

Q T L N 0 then the square P Y R A M is easily recovered because of tAe 

XZUVW IDSBC 

AMP YR EFG HK 

BC IDS LNOQT 

HKEFG UVWXZ 

tell-tale letters UVWXZ occurring in a row of th~ derivative square. But 

when the Pla.jrfa.ir .square consists of a transposition-mixed sequence, then 

a differen~ procediire must be ad0pted. · _ 

. (2) As an example, let ·us take the transposit~on matri.X 

5 8 6 1 4 3 2 7 from which AF T D ·K is the original square. Using the 

PYRAMIDS WIHVM 

B C E.F G HK L GU P .B N 

U 0 f./, TU V W X ZR E·Q S ~ LXYCO 

methods illustrated in par. 51g, ·scanning successive rows of the sguare 

will disclose sequences of letters which could have appeared as columns· 

in the transposition matrix. For example, discovery of the columns, I D S 

HKL 

vwx 

will afford rapid recovery of the key word •. But if instead of the original 

square we had one of its permutations such as Q S Z R E, then treatment 

COLXY 

DKAFT 

VMWIH 

BNGUP 

of the "columns", e.g., FIVlOILIQ, of the tentative transposition matrix 

TMLXS . .VWXYZ 

(assuming' that Some ~r all 0.~ the '.!-e'tters VI WI X1 ·y, Z are. in' the 'le.st 

row of the transposition matrix) will be without significance; therefore 

the procedure above.is inapplicabl~·without a slight modification. 

-- · --- 'c3) Since it wili be noted 'tb8.t a permut~ti~n-of the rows will.. not 

affect the procedure of keyword recovery, then we construct a 9x5 rectangle Q S ZR E Q S ZR which eontains the five squares which.result 

C 0 L·X Y C 0 L X 

DKAFTDKAF 

v M w i H v M w·r 

BNGUPBNGU 

simply from successive peI'lln.ltations of the columns. A 5x5 cut-out square 

will be found convenient in testing each permutation in ·turn. Af'firmative results ~ill be obtai~ed when the correct permutation is reached, 

. R:SS'f'RIC'f'BD 

213 
REF ~D :A6.6790 

· .. 

which in this ca:se -is' .the third square in the rectangle, namely' I Z R E Q s. .After. r~covery of the key word from ~his permuted square it 

LXYCO , 

AFT ·n K 

WIHVM 

GUPBN 

"' ' • • t • 

is probable th~n that the original enciphering square must have b~~n. 

AFT DK. 

WIHVM 

GUPBN 

ZREQS 

LXYCO 

'· 

(4) -In the case of the square recovered in Fig. 68d, it is found 

that, following the procedure outlined in subpa.rf. (l) ,-(2), and (3) 

above "1e ~ey word is based on COMPANY, recover~ble from the following 

diagrdJn: · ! 

2 5 3 6 1 4 7 

COMPANY 

BDEFGHI 

KLQRSTU 

vwxz 

The orig~ ~qua.re·. must have been this: 

.. ' 

AGSCB 

KVMEQ 

XNHTO 

DLWPF 

RZYIU 

Figure 68~. 

~· Continued p~actice in the soluti<?n of PJ.~air ciphers will make 

the student qU'ite ~xpert in tRa matter and will enable him to solve 

shorter and shorter, ~ssages. Al.so, with praeitice it will become a. 

matter of indifference to him e.s to whether the letters e.re inserted in 

the square with any sort of regularity, ~uch as !simple keyword-mixed 

order,, transposition-mixe4 .order, or in a purelY: random order. 

~· It may per~ps seem to the student tha~ the foregoing steps are 

somewhat too artificial, a bit too "cut and drie'd. 11 in their accuracy to 

portray the process. of_ analysis'as it. is applied in practice. For 

example, the .critical. student may well ob'ject td some 0£ the assumptions 

and the reasoning in subpa.r. ~ ( 5) , above·, in which the words TEREE and 

,, 

.. i 40 The author once. had a student who·"specialized" in Playfajr ciphers I 

and became so adept that he could solve messages containing as few as 

50-60 letters within'30 minutes. 

REJS'f'RIC'f ED 

214 
REF ID:A66790 

RESTRIC'FSD 

ONE (1st hypothesis) were re,jected in favor of the words 'l'HlR.Q_and SECm1D 

(2nd hypothesis). This rested largely upon the rejection of REn and ERp - .- l .- p;;_ 

a.s the equivalents or UZc and ZUc, and the o.dopt:i.on of IRp and Hip as 

the:tr equivalents. Ind.eed. if the student wilil. examine the f:l.na1 message , I 

with a critical eye, he will find that while the bit of reasoning in step 

(5) is perfectly logical, the assumption upon.J!hich it is based is in __ 

fact wrong; for it happens that in this case ~ occurs only once and REp 

does not occur at all. Consequently, althoughimost of the reasoning 

which led to the rejection of the first hypothesis and the adoption of 

I the second was logical, it. was in fact based upon erroneous assumption. 

In other wo~ds, despite the fact that the assu4I.Ption was incorrect, a 

correct deduction was made. The student shoul~ take note that in cryptanalrsis situations of this sort are not at all unusual. Indeed they are 

to be expected, and a few words of explanationlat this point ma.y be useful. . 

i. Cryptanalysis is a science in wM.ch deduction, based upon ob- - I servationa.l data, plays a very large role. But it is also true that in 

this science most of the deductions usually reJt upon assumptions. It 

is most often the case that the cryptanalyst i~ forced to make his assumptions based upon a quite limited amount ofltext. It cannot be expected that assumptions based upon statistical generalizations wil.l 

always hold true when applied to data comparatively very much smaller in 

I quantity than the total ·data used to derive the generalized rul.es. 

Consequently, as regards assumptions made in sP,ecific messages, most of 

the time they will be correct, but occasionally they will be incorrect.41 

In cryptanalysis it is often found that among the correct deductions 

I there will be cases in which subsequently discovered facts do not bear 

out the assumptions on which the deduction was ~ased. Indeed, it is 

sometimes true that if the facts had been known before the deduction was 

ms.de, this knowledge would have prevented makirtg the correct deduction. 

For example, suppose the cryptanalyst had some~ow or other divined that 

the message under consideration contained no RE, only one ER, one.JR, and 

two RI's (as is actually the case). He would dertainly not have l;>een 

able to choose between the words THREE and ONE l<1st hypothesis) as 

against THIFD and SEC~ (2d l~thesis) • ...!'ut recau~ he assumes that 

there should be ~re ERp 's and_REp 's than mp' sl and Rip 's in the message, 

he deduces that UZc c~not be REp, rejects the ~irst hypothesis and takes 

the second. It later turns out, after the probQem has been solved, that 

t~e deduction was correct, al.though the assus,>tlion o!Lwhich it was based 

(expectation of more frequent appearance of Imp and ERp) was, in fact, ~true in this particular case. The cryptan8.llyst can only hope that 

the ntunber of times when his deductions are correct, even though based 

~~~~e~s~~p!~~=rw~~c~~:!e!h!~~i~u!e~~c~~o~~r~=o~~~~l!v:~~~~~Y based upon assumptions which later prove to be borrect. If he is lucky, 

4l See footnote 13 on page 52. 

RES'FRIC'f'ED 

'215 
REF ID:A66790 

RES'FRIO'FED 

the me.king of an assumption which is really not true will· make no difference in the end e.nd will not delay solution; but if' he is specially I favored with luck, it ma.y a.ct'l.le.lly help h:lm solvi the message--as was the 

.case in this particular e~le • 

.J.· Another comment of a general ne.ture me.y be made in connection' 

with this specific example. The student may ask jwhat woulcl have been the 

procedure in this case if the message had not contained.such a tell-tale 

repetition as the word BA'ITALION, which formed tl'l.e point of depart'lire 

for the solution, or, as it is often said, permitted an "entering wedge" I to be driven into the message. The answer ·to hi~ query is that if the 

word BATTALION had not been repeated, there woul~ probably have been some 

other repetition which would have permitted the same sort of attack. • If 

~~~~d~~ta!~a~~~k~s~~~~u~e~!b~i~~t ~~~~~;:~,w~~:1'~~~ . sidered a branch of mathematics by some, is not ~ science wh::l.ch has many 

"general solutions" B\\Ch as are found. a.nd expected in mathematics proper. 

It is inherent in the very na;l;ure of cryptenalyt~cs that, as a rule, I only general. principles can be este.bU.shed; theilj practical appJ.ication must take advantage of peculiarities and particular situations 

which ere noted in specific metJsages. This j_s e~pecial.ly true in a text 

on the subject. The illustration of a general priinciple requires a 

~~~~~!i~h~~ ~dd1~~e!:~~e~r~~s!ri;:f' ~~~;s:!~~~if'~ ~~~a~;~- TALION was not purposely repeated in this exampld in order to make the 

demonstration of solution easy; "it just happened! that way". In another 

example, some other entering wedge would have bee'n found. The student A . can be expected to learn only the general princi;dies which will enable ~ him to take advantage of the specific characteriS:tics Ill8Ilife~ted in 

specif'ic cases. Here it is des:i.red to illustrat~ the general principles 

of solving Pla.ytair ciphers end to point out the ~act that entering 

wedges must and can be found. ·The specific na.tur!e of the entering wedge 

varies with specific examples. 

72. Analysis of polygraphic systems involving large tables.--!!:. The 

analysis of systems incorporating large digraphic\ tables is accom:plished 

by entering, within the appropriate cells of a 26~26 chart, data corresponding to the ple.in-ctpher relationships of assub.ed cribs on 26x26 

charts, and examining the charts for evidences ofJ symmetry or systematic 

construction in their compilation. The inj.tial pilaintext entries may, 

in the absence of cribs, be made on the basis of aigraphic frequency 

considerations, aided by idiomorphisms and repetifions. 

b. In pseudo-digraphic systems, such as those incorporating tables 

similar to Figs. 47a. and b, and 48, the identific~·tion of the monoalphabetica.lly-enciphered component of cipher digraphsJw111 greatly accelerate 

plaintext entries, Jince advantage ma.y be taken of this monoalphabeticity. Tables with a feature of reciprocity, suchJas the example in 

Fig. 50, may be exploited on the basis of ~ wef.kness, even if the reciprocal pairs a.re assigned at random. Tables sufh as that in Fig. 49 

and the one f.or trinome iigraphic encipherment shown in Fig. 51 may also I be exploited with facility, once enough plain text has been correctly 

RES'f'RiC'f".:ED 216 
REF ID:A66790 

RBB'FR:IC'fED 

assumed and inserted to disclose their systematic construction. A word 

of warning i~ inserted here against making incautious assumptions con- ' 

cerning the exact internal composition of tables such as that in Fig. 49, 

since their unusual construction could easily mislead the analyst who 

jumps to premature conclusions. In the case of a table such as Fig. 51 

wherein the trinomes have been inscribed in straight horizontals (or for 

that matter, any other known inscription), if the dimensions of the table 

have been correctly assumed the simplest solqtion involves a reduction to 

two alpha.bets, reflecting the sequences of letters for the side and top 

of the matrix; this solution closely parallels that of the numerical 

four-square system described in subpar. 69!. 

c, Because the foregoing principles are rather straightforward, it 

is not considered necessary to illustrate their application with examples. 

Of course, when digraphic tables of random construction have been used, 

no refinements in solution are poss:tble. However, the recording of as 

few as 225 d.lfferent plaintext digraphs and thej.r ciphertext equivalents 

will theoretically enable the automatic decryption of approximately 92% 

of the cipher digraphs of messeges,a.nd the recording of 335 plaintextciphertext values will enable the automatic decryption of 98i of the 

cipher digraphs; thus el.most every message may be read in its entirety 

without recourse to further assumptions. Actually, it should be pointed 

out that having only 122 matched plaintext-ciphertext equivalencies will 

theoretically enable the decryption of 75~ of the cipher digraphs, a.nd 

enough skeletons of pla~~ text may then be manifest to permit the decryption of the complete me,ssage texts • , 

d. It might be well to point out in connection with large digraphic tables that there exist literal types which give rise to monoalphabetic distributions for both the initial letters and final letters 

of pairs. Such a table is illUStra.ted in Fig. 69 below: 

RElS'±'illO'FSD 217 
REF ID:A6679~ RES'FRIG'FED 

A B C D E F G R I J K L M .If 0 P Q R S T U. V W X Y Z 

A~~~~~~W~~~~~~~~~~~~~~~ft~~~ 

BEWOO~~wwro~~wrooomm~w~ru~~rowwmm 

c~~~~~~IBE~~un~~~~D~~~~~W~Dm 

D HS m. DS RS AS us IS IS cs BS :ES FS GS JS KS re NS ps PS QS .ss TS vs ws XS ZS 

E Hr YT DT RT AT UT LT IT CT BT Br Fl' GT JT KT Mr BT PT Pl' QT ·ST TT V'l' W,r XT ZT 

F HI Il DI RI AI UI LI II CI BI EI FI GI JI, KI MI NI pl PI QI SI Tl VI WI XI ZI 

o~moooo~oororo~oooo~oo~m~oo~~~oorowwmro 

H~m~~~~mm~Mnrnoomm~D~~~~~w~m~ 

I~DMMM~UU~MllUMBn~MhU~Mnu~nu 

J HB YB DB RB AB UB IJ3 IB CB BB EB FB GB JB KB MB IB·©B PB Ql3 SB TB VB WB XB ZB 

K HL YL DL RL AL UL LL IL CL BL EL FL GL JL KL ML NL qL PL QL SL TL VL WL XL ZL 

tnnm~onun~~~nMn~~M~n~~nn~n~ 

M RC ?C DC RC AC UC LC IC CC BC EC FC GC JC KC ~ NC OC PC QC SC TC VC-·WC· XC zc. -. 

N~ww~~mwm~~~rnoom~~~$~~~~ww~~. 

o~w~~MW~D~M~w~~~~~~w~~~ww~~ 

PmEooooMwrorooowmrooo~mmm~ro~oorowwmro 

Q~m~~M~mm~~rnn~~m~w~~~~~wwmm 

R HJ YJ·DJ RJ AJ UJ LJ IJ CJ BJ EJ FJ GJ JJ KJ MJ NJ °'J PJ QJ SJ TJ VJ WJ XJ ZJ 

S~~M~-~~ll~~~~~~~~~~~~~~~~~~ 

T~TM~m~~TMTM~~~m~~m~~~~~~TMw~mm 

u~~~~~w~~~~~~~~~~~~w~~~nw~~ 

v~mMMAA~~m~~~noo~~~~~ffi~~~n~m~ 

www~~MW~D~~~n~n~mm~~~~wwwn~ 

X~NW~~WTMN~WTMN~~~~w~~~~~ww~~ 

Ymnm~a~un~~~n~n~~~~n~~~u~~~ 

Z HZ 'XZ DZ RZ AZ UZ LZ IZ CZ BZ EZ FZ GZ JZ KZ MZ NZ O~ PZ QZ SZ TZ VZ WZ XZ ZZ 

Figure 69. I . 

In effect, encipherment by means o:t' such a system yields the equivalent 

of a two-alphabet cipher, with a transposition wiyhin each of the pairs 

CYf letters. The cipher text produced by such a system may be characterized by a large number of repetitions which begin\with the initial letter 

of digraphs and end on the final letter of digraphs and which are preceded by digraphs having repeated initial letters\or which are followed 

by digraphs having repeated final, letters; for eXE+JllPle, ciphertext 

passages of the fallowing type might often arise: \ SF BD GB me e.nd , SQ BD ClB WK (wherein the repeated plain text is act'Ually represented by 

SDBBGK, a.f'fected by the tran~position). This sys~em is included here as 

being illustrative of many simple systems which are capable of leading 

the student very much astray; in this instance, it\ one were unaware of 

the transposition feature involved end were to attrropt whe.t appears to 

be the simple task of fitting plain text into the ~wo monoalphabetic 

portions on the basis of single-letter frequency cpnsideratjons, he could 

spend a great deal of time without success--probably without any idea of 

what was causing his difficulties. \ 

e. A pseud.o-trigraphic cipher involving a table such as that in 

~;:~h ;n~h:;e~e:ii~~=c~~n!~~~ :st:~~~'a:!n~~e!t~d !~!~~p~b=:~~a~~~~ If three separate uniliteral frequency distributiorts a.re ma.de--one for 

each of the three letters of the cipher trigraphs-1two of the distributions should be inonoalphabetic. Then, exploiting the monoalphabeticity 

RES'fRIC'fED 218 
REF ID:A66790 

RES'f'RICTED 

{i.e.; the Eoaitional monoalphabeticity) thus disclosed in the cipher 

text, plain text can be fitted to the cipher on the basis of singleletter frequency considerations; in addition, advantage ms.y be ta.ken or' 

partial idiomorphisms, if these idiomorphisms involve the particular 

positions of the trigraphs which have been treated m.onoalphabetically. 

f. Fortunately, it is unlikely that trigraphic systems other than 

the foregoing pseudo-trigraphic type will be .. encountered, because they 

a.re difficult ta manipulate without extensive tables ·or complicated rules 

for encryption. 1 The subject ~~ be passed over with the simple statement that their analysis requires much text to ~ermit of solution by the 

frequency method,--and blood, sweat, and tears. 2. 

73. Further remarks on polygraphic substitution systems.--_!· In the 

treatment of the.cryptography of tha various digraphic ~ystems in this 

Section, the nU.es for encryption and deQryption which have been illustrated are the "standard" rules (i.e., the rules extant in cryptologic 

literature, or the rules moot. cormnonl.y encountered in operational practice). Needless to say, however, there is no cryptologic counterpart of 

the Gerieva Convention making these rules sacrosanct, nor forbidding the 

use of other rules for enciphering aiid deciphering. · 

b. In two-square systems and Playfair systems there are possible 

(and,-in fact, there have been encountered in operational practice) modifications of the usual e"cipbering and deaiphering rules which, if not 

suspected, may pose difficulties :f.n the identif,ica.tion of such systems 

and in their cryptanalysis. For example, ·in a vertical two-square system, 

when two plaintext letters fall in the same column, their cipher equivalents might be ta.ken as the letters imm.ediatel.y to the right of or immediately below these plaintext letters. Similarly, in a horizontal twosquare system, if two plaintext letters are in the same row, their cipher 

equi\Talents might be taken as those immediately below, or to the right of 

these letters. In Playtair cipher systems, two plaintext letters in the 

same row might be represented by the letters :lmmediately below; two 

plaintext letters in the same column might be represented by the letters 

immediately to the right; a plaintext doublet might be represented by a 

ciphertext doublet formed by doubling the let.ter immediately to the 

right, or below, or diagonally to the right and below, thus removing one 

of the identifying ciphertext characteristics of the normal Pla.yfair 

system. In one case encountered, instead of the normal Play.fair linear 

relationship ABp:::BCc, the rule was changed to ABp=CBc (thus allowing a 

41 .... However, see in this connection Appendix 8; "Lester S. Hill algebraic encipherment", which gives a mathematical treatment of true polygraphic encipherment for polygraphs of any size. (See also subpar. 73h). 

42 If a trigraphic system is encountered in operational cryptanalysi;, 

special solutions would be made possible by the application of cribs, the 

aid furnished by isologs (not only in the same system, but also between 

systems)' , etc . 

RESTRICTEB 219 
REF ID:A66790 

RElS':PR:lCTED 

letter to "represent itself"--an ''impossibility" in Playf'air encipherment); eyen this simple modification caused diff'~cUlties ·in cryptanalysis e 

because variant rules for encryption had not been considered. 

I 

c. The placing of cribs in small-matrix di.graphic systems may be. 

guided by the cryptographic peculiarities of these systems, when the 

general system is known to, or suspected by the dryptanalyst; conversely, I the placing of a known crib may as~ist in the de~ermination of the type 

of cryptosystem, or in the rejection of other types or systems •. For 

example, cribs may be placed in Pleyf'air ciphersjon the basis of the 

"non-crashing" feature of the normal Ple.yfair; tut is, on the basis 

that in the equation 1.2:3.1~ neither l and 3 norj2 and 4 can be identical. 

In horizontal two-square systems, if .ape. = • .r.p, trurn 'Pc must equal (Jetpi 

and if•Pc= p_ P' then•f!c must equalpatp· If,,by placing a known cri'Q 

JE. a_.£ryptogr!!1, ~idence of ~-reciprocity is ~isclosed (e.g., if 

ABp=CDc, but CDp=XYc), the ~cryptogram. may be ass~d to be other than a 

vertical two-square cipher, since vertical two-square encipherment yields I complete reciprocity. In either type of two-square system, if one of the 

two squares is lmown (for example, a vertical twp-square might be emp1oyed 

in which the upper square is always a normal alphabet), the placement of 

cribs ie materially facilitated. I ~· The t test performed separately on the ~nitial letter and final 

!~!;~~co!y~~~!:r!~~i ~~;~sr!~~t~~~~~~~~l~~~~~~e~i!~ ~~::t~~~ diplain text, nor close to that for random text. j.I'he reason for the comparative "roughness" or pronounced differences among the rel.ative fre- A 

quencies in these distributions, e.s contrasted ~1th the "smoothness" • 

expected of random, is that small-matrix digre.pl:iic systems are only 

;partially: digre.phic in nature and that the encrYit>tion involves characteristics s:lm:l.lar to those of monoalphabetic subst~tution with variants. 

I Tb.is roughness of the uniliteral ~requency.distriibutions for the prefixes 

end suffixes, and, for that matter, for the overi-all cipher text, reflects the partially digraphic nature of the encipherment. I 

e. If the cipher letters v, w, X, Y, and Z are of very low fre- • - I quency in the over-all unilitereJ. frequency distribution of a digraphic 

cryptogram or set of cryptograms, this may be tJ.ken as evidence that the 

cryptosystem is a small-matrix digraphic systemjemploying keyword-mixed 

sequences in the matrix or matrices. Furthermore, in small•ma.trix 1 I - systems involving keyword-mixed squares, if ec ~f 00c is one of the 

1 - I let~ers VWXYZ, the ep of the corresponding S0p is likely to be one of 

these same letters. Similarly, if e~ is one of the letters VWXYZ, then e~ of the corresponding eep is likely to. be one of these letters. 

!.· In trinome-digraphic systems employing 11arge tables, the trinomea may run from 001 to 676, as in Fig. 51, or any consecutive set of 

676 trinomes :l.n the sea.le of 1000 possible trinbmes may be used. For 

I 

I· 

.. --- . --· e 

REB'fRfC'f'ED 220 
REF ID:A66790 

RES':FRIC'f'ED 

that. nio.ttet', the ent,ire S);)en of t.ririomes 000-999 mieht be '1sccl in such c-. 

table, with occasional gaps, to hide the limUations of this system. As 

another mea.ns of dlsguj_sfog the limitat:i.on of 6r(6 trinomes jn such a 

system, three of tbe initial digits of the trinomes mieht have one variant each--thus no llmitati.on would exist in the f:irst position of trinomes ~ The OOJ., or other starting pofat in the cyclic sea.le, ne~d not.. be 

a.t the upper laft-ha.nd corner of the table. The 676 trinomes in such 

tables may be inscribed in straj_ght horj_zontals (Le., in the normal: 

manner of writing) as jn l!.,ig. 51, or they might be inscribed 'according 

to some other route; they probably would not be inscribed in e. random 

me,nner because clumsy "deciphering tables "'Would then be necessary. It 

is also poss:i.ble that the tTinomes jn a trinome-digraphic system might be 

converted into tetra.nomes by the addition of a SUln-check {to assist in 

error-correction). · 

~· The crypta.na.lys:i.s of tetra.nome-trigraphic systems with matrices 

similar to that illustrated in Fig. 59 involves a modification of the 

technique used in solvi~g inverse four-square systems. If the pla.incomponent and cjph~r-component sections of the large square have been 

inscribed accordj_ng to the normal manner of writing (or eny other manner, 

if known), the first two elements of the trigraphs may be reduced to a 

pair of cipher alphabets, and these two monoalphabetic substitutions may 

be aolved as indicated in subpar. 69e. The applicability of :l.nverse 

four-square solution principles to this tetranome-trie;raphic system of 

course rests on the fact'that the ciphertext sections are known or assumed to contain the dinom~s 00-99 in numerical ord.cr, inscribed in th;e 

normal manner of wr:i.ting; the conversion of the first two elements of the 

trigra.phs depends upon the knowledge of the manner of inscription of the 

letters of the plain component sections, in order that the rour occurrences of the initj_al letters and the four occurrences of the final 

letters may be correctly combined. into two monoa.lphabetic distributions. 

Of course, if the composition of the small square (for the third element 

of trigraphs) is known, the third letter of trigraphs ma.y be automatically deciphered. If the composition of the small square is not 1~::10-wr., 

a consideration of the frequencies of the converted dinomes for the ; .. m::i.11 

square {i.e.; the coordjnates of the square to indicate the third m:·.,.~'!:ier 

of trj_graphs) may be used to obtain an entering wedge into this third 

monoalphabetic substj_tution. 

h. There are but a very limited number of known cipher mechanisms 

which employ the polygrapM.c encipherment principle in c:n.y form. U.S. 

Pa.tent No. 1515680 issued to A. Henkels in 1924 and U.S. Po.tent No. 

184591-1-7 issued to Weisner and .Hill in 1932 describe two such mechanisms 

which produce poly~raphic substitution. The latter, that of Weisner and 

Hill, is of particular interest because it is based on a rather siill.)?le 

mathematical process which can yield true polygraphic encipherrrent fer 

polygraphs of any size. The und.erlyiDgir.a.theinatical process, invented 

by Prof.. Lester S. Hill of Hunter Coller;e ar.d described in the "American 

Mathematical Monthly" in 1929 (Vol. XXXVI, 'P· 306) and 1931 (Vol. 

XXXVIII, p. 135), is treated briefly, below; a. more detailed treatment 

is contained in Appendix 8, "Lester s. m.11 algebraic encipherment. 11 , 

whjch also includes rema.rlcs on the cryptena.?-ysis of this method of enciphermcnt. 

RES'T'RfC'i'ED 221 
REF ID:A66790 

RE8TRICTED 

(1) Since Professor Hill's system is mathema 1ical in nature, the 

first step in its use involves the conversion of the plaiiltext letters 

into numbers by means of a conversion alphabet wh~ch shows a correspondence between the 26 letters of the alphabet e.tid the 26 numbers from 

O to 25, such as the following: · 

A B C D E F G H I J K L M N 0 P Q R s· T U V W X Y Z 

0 9 3 5 24 6 18 8 11 1 21 14 15 12 4 10 25 17 7 19 20 2 22 16 23 13 • 

(2) The numbers obtained through the convers~on of the plaintext 

·letters a.re .next treated arithmetically +,hrough t~e application of algebraic linear functions, th.is treatment· being perf'drm.ed by means of mod 26 

arithmetic. 43 The numerical results yielded by t~e algebraic treatment I 

are then converted back into letters by means of t 1

1

he conversion alphabet., 

to yield the cipher equivalent of the original plain text. 

(3) For example, suppose that the message "ii~HING TO REPORT" is to 

be en~iphered by trigraphs, and that, for this purpose, the enciphering 

keys44 are 1, 2, l; 5, 11, 3; 2, 4, 13. The messaSe would be divided 

into trigraphs NOT-HIIi-GTO-REP-ORT and the letters! which result from the_ 

following operation would be taken as th~ cipher e~uivalent of the. first 

trigraph: · · 

Using the conversion alphabet in (1), above, (N 0 T) is converted 

into (12 4 19); then the foregoing keys are applier--

1• 12+ 2>< 4-t:-1x19 = i2 ... a+·19 = 13+1(26) = z 

I .-

5 IC 12+111< l~ + 3 1< 19 = 8 + 18 + 5 = 5 + il. ~ 26) = D 

2Jt 12+4x4+13.c 19 = 24+16+13 = 1+2(26) = J 

~ 

Thus, NOTp is enciphered as ZDJc. I 

(4) A large number of sets of enciphering an~ deciphering keys can 

be constructed. It is even possible to construct keys which yield reciprocal encipherment, and it is this possibility kl hich makes practicable 

.the construction or a machine or device to acco1np]ish the enciphering and 

deciphering. I 

43 Using "mod 26 arithmetic", one considers as 'tjhe sum or product of 

two numbers, the number from 0-25 which is obtaine1d by 'subtracting 26 

(or a multiple of 26) from the ordinar;Y arithmeticlal sum or product of 

the numbers. 

2 

44 Enc ipherm.ent of polygraphs containing ~ lettelrs requires the use of 

n keys. Thus, 9 keys are necessary•for trigraphilc encipherment; digraphic encipherment requ~res only 4 keys, whereas tetragraphic and 

pentae;raphic encipherment necessitate the use of r6 and 25 keys, respectively. The nunmers selected for use as keys mu~tl be chosen according 

tQ rather definite rules based O::l the "theory of determinants"; otherwise, cryptographic ambiguity may result when deci!~herment is attempted. 

Appendix 8 contains more on this matter. -

lt'E'S'l'RECTED 222 
REF ID:A66790 

RE8'PRIO':PED 

!· Attention is called here to the applications of Table 13 ("Four-

. square individual frequencies") of Appendix 2; this table has been reproduced here for convenience. If the cryptanalyst has at hand a fairly 

(Table 13, Appendix 2) 

(Tln1ml on a count oi 6,000 dlgrnph•I 

A B c D E 244 225 37G 394 197 

F G H I J K 125 98 198 271 95 

L M N 0 p 229 199 188 350 251 

Q R s T u 148 162 258 427 295 

v w x y z 42 12 34 91 97 

212 317 358 308 249 A B c D E 

120 108 216 256 85 F G H I J K 

216 t4.0 152 435 269 L M N 0 p 

206 121. 306.. 364 284 Q· R s T u 

38 29 21 147 43 v w x y z 

large volume of cipher digraphs produced by encipherment wi·th a normal 

four-square, he may use Table 13 es e..n aid in placing the initial letters 

and final letters of the cipher digraphs into the appropriate cells of the 

cipher component sections on the basis of their uniliteral frequen~!£::!· 

Thus, if a distribution made of the initial letters of cipher pairs in a 

particular example shows ~' Ic, and Cc to be the letters of predQ~inantly 

high frequency (listed in descending orde,r of' frequency), ·and if the 

distribution of the final lette~s shows Fe, Qc, aJld Pc as the letters of predominantly high, frequcnc~ .. .(in d'??scending order of ."'r ~quency), these 

letters may be tentatively pla,ced in:to a skeleton four-square matrix as 

follows (Fig. 70), based on the location~ Qf the highest frequencies as g~ver, in Ta~le 13: · 

REiS'f'HIO'f'ElD 223 

'. 
REF ID:A66790 

REB'FRIC 'f:ED 

A. & c I) £ c I I 

F ~ M I I<. I 

L M ,_. O· p I 

Q ft s ,. u -! 

I 

I 

v w )( "( .. I 

I 

, " & c t> £ 

I 

" F ~ H I tk I 

I 

F L M ~ 0 Pi 

~ Q ,. !a T u 

I 

v w x y I: I 

Figure 70; 

.J.· In attempting to diagnose the underlytilg c ryptosystem in any 

particular polygraphic cipher, the student may ga:in some assistance from 

the following recapitulation: I 

even(!~~ ~~~~!;.c~s..!:' i::~~r~.~~t~t~~ ~ i::: ~st part begin on the first letters of pairs and end on the last letter£ of p~irs. The majority of repetitions in trigraphicl ciphers will be some 

multiple of three letters apart and these repetit11ons should for the most 

part. begin on the first letters of trigraphs and end on the last letters 

of trigraphs. I 

'(2) Digraphic ciphers may be revealed as such by the digraphic phi 

test, with additional support being given by the ~igraphic blank.-

expectation test; the presence of a null letter a~ the beginning of the 

cipher text might be disclosed by applying the two foregoing tests to a 

distribution of the digraphs which are formed wheh the first letter of 

the text is omitted. 

(3) If either the uniliteral frequency distribution for the initial 

letters or for the final letters of the digraphs in a cryptogram exhibits 

monoalphabeticity, the cryptogram is probably'a·pseudo-digraphic cipher 

involving a large table of the type in Fig. 4 7 orl 48. If both of the 

foregoing uniliteral frequency distributions reflrct monoalphabeticity, 

the cryptogram' may involve the use of a table of fhe type in Fig. 69. 

(4) If the "decipherment" of a cryptogram byl means of a four-square 

matrix containing four normal alphabets yields twp•monoalphabetic ~ubstitutions--one for the initial letters an~ one for ~he final letters of the 

pseudo-decipherment--the cryptogram may be assume~ to be !1Il ~nverse foursquare cipher. I 

(5) If an ocular inspection or statistical eraluation of the cipher 

text or a cryptogram reveals e. large number of "tiransparencies", the 

cryptogram probably involves a two-square system. 

224 
REF ID:A66790 

(6) If e. cryptogram contains several. cipher doublets, all of which 

are broken up when the cipher text is divided into digraphs, the cryptogram may well involve normal Playfair enciphe1inent. 

(7) If the cipher text of a cryptogram exhibits a;n.y invariable e.:ffinity of one of the letters J, K, Q,·x, or Z for vowels (or, for that 

matter; another cluster of 5 or 6 letters), the cryptogram probably is 

in a smaJ.i-matrix system employing sections consisting of more than 25 

ietters. 

k. If a particUl.e.r four-square cryptogram involves the use of a 

matrix in which either the plain component sections or the cipher component sections are normal alphabets, the matrix will be recovered 

through cryptanalysis in its original form, even when ~he components 

which are mixed have been derived by a transposition method or by no 

method at all. In Playfair cipher solution, the rnatriX can be recovered 

in its original form as long as the original matrix has been mixed in 

some systematic manner. Heyever, in the case of two-square solut:ion, 

there is no guarantee that the matrix can be recovered in its original 

form unless the original matrix has been keyword-miXed; if the original 

has been transposition-mixed, for example, the matrix which he.s been 

recovered through crypte.na.lysis--while being cryptographically equivalent 

to the original--will undoubted1y involve a permutation of the rows and 

columns of the original • 

. ,. .!.· When four-square systems are encountered in which the matz:ix 

consists of four differently~mixed sections, reconstruction of the mat.rix 

is accomplished in a manner similar to that used in the analysis of twosquare ciphers. If the sections are composed of keyword-miXed sequences, 

the original matrix may be recovered. Otherwise, the reconstructed 

matrix will in all probability be a permutation of both the rows and the 

columns ·of the original matrix, and there may be no'we.y of recovering or 

or proving the original matrix. 

m. In passing, it might be well to mention that nn.:r two-s:q~.iare 

system can be solved as a four-square system in which tl'..!': me.tr:!X. :iisi 

composed of four mixed sections; upon the realization, fr~ pJ:lellbE:lmena m" 

the matrix reconstruction, that a two-square matrix is invo\vad3 ~lie 

proper conversion can then easily be made. 

R:SSTREG'FED 225 
REF ID:A66790 

RES'fRIC'fEfl 

(BLANK) 

R:SB'l'RIC'FED