ELEMENTARY CRYPTANALYSIS

Helen Fouché Gaines

Originally published in 1939 by American Photographic Publishing Co.

PREFACE

The word cryptography, properly speaking, embraces the entire field of secret writing, while that branch of the subject dealing with the solution and reading of cryptic messages is generally referred to as cryptanalysis.

Works on the subject of secret writing are comparatively numerous, if not always easily available, but works devoted purely to the analysis of such writing and the solving of its cryptograms have, until recently, been so rare as to be almost non-existent for the general reader.

Today we have two particularly excellent works, but both in foreign languages: Cours de cryptographie, by General Marcel Givierge, and Manuale di crittografia, by General Luigi Sacco. In English, we find a more elementary work, The Solution of Codes and Ciphers, by Louis C. S. Mansfield (Maclehose, London), which, the writer has been told, is to be a first volume. As to America’s contribution, we seem to find only small books such as Colonel Parker Hitt’s A B C of Secret Writing, covering three ciphers, or Colonel H. O. Yardley’s Yardleygrams.

There are, however, many works which deal most interestingly with the analysis and decryptment of some one particular cipher. Most of these are short works, published in magazines or incorporated into books of a general nature, and nearly always the one cipher dealt with is that type of simple substitution which appears with separated words in the puzzle section of our current magazines and newspapers.

One well-known gem of cryptanalysis, equal to any modern specimen, can be found in the story, The Gold-Bug, by Edgar Allan Poe. This, too, deals with the simple substitution cipher just referred to, but covers a case in which word-divisions are absent. Poe has also left us an essay called Cryptography.

Rosario Candela’s recent book, The Military Cipher of Commandant Bazeries, shows the unraveling of one particular cryptogram which, for many years, had baffled the best efforts of all amateurs, and, it is rather suspected, of some few who were not amateurs. The book contains a chapter on general cryptanalysis, and also some cryptograms for solution.

Secret and Urgent, by Fletcher Pratt, is primarily a history of secret writing (a most interesting one, by the way), but contains also a number of examples of cryptanalysis; it also shows a table which the writer has never before seen in published form: a list of English trigrams (three-letter sequences) and the frequency with which they are used in the language. Other examples of decryptment may be found in the Macbeth translation of Langie’s genial little book, De la cryptographie; the appendix to this translation contains the coveted Playfair demonstration, prepared by Lieutenant Commander W. W. Smith of the United States Navy.

Just why so absorbing a subject has been so neglected in a world full of puzzle lovers is hard to understand, especially since the analytic writer, in addition to entertainment, has something to offer of a more serious nature. It is true that trained cryptanalysts are not greatly in demand in peacetime, and that our present corps of cryptographers has a personnel more than ample for providing necessary codes and ciphers, scientifically selected to fit their individual purposes, and safeguarded with suitable protective devices. Yet of what value is the most excellent of ciphers if, at the time of direst need, this cipher, with all of its safeguards, must be placed in the hands of even one man who cannot appreciate its intrinsic value or imagine a need for extra precautions? At any rate, we make our feeble attempt to reach this “one man.” May he learn, at least, that there are reasons for his instructions!

In the planning of the present treatise, all purely historical aspects of secret writing were neglected, and many well-known ciphers whose interest is chiefly historical or literary have either been omitted or given but cursory treatment. Certain other ciphers, representative of types, have been treated at whatever length seemed advisable for bringing out principles; and, with each type discussed, a generous number of cryptograms has been provided, on which the student will be able to test his skill as he learns. The student who masters these fundamentals will be acquainted with the principal forms of cipher, and will be able to solve cryptograms prepared by means of these ciphers provided the cryptograms are of adequate length and based on a language which he understands, or of which he is able to secure understandable specimens. Within limits, he should also be able to analyze and solve such cryptograms without being told in advance what the cipher is. This, we believe, is the kind of text-book desired by the many who desire information about “ciphers.”

Its material, compiled by members of the American Cryptogram Association, has had to be gathered from a great many sources, both within the organization and elsewhere, making it impossible, at times, to give credit where credit is due. Our chief indebtedness, however, is to M. E. Ohaver for a series of articles published during the years 1924 to 1928 in the former Flynn’s Magazine and most unfortunately no longer obtainable from the publishers. Further acknowledgment should be made to Colonel Parker Hitt, whose Manual for the Solution of Military Ciphers, though not available for general distribution, can usually be consulted in large public libraries. We have also borrowed liberally from foreign sources, and members of the association have most generously contributed the results of their original research. For this collaboration and co-operation, the writer is particularly grateful.

CONTENTS

CHAPTER I
General Information

The subject which we are about to study is the analysis and solution of cipher, though not including code, which is a very special form of cipher demanding something more than elementary knowledge; nor shall we enter at all into the subject of invisible inks, certainly a most important aspect of secret writing, but belonging to the province of chemistry rather than to that of cryptanalysis. Cipher machines, also, are not within our present scope.

The term cipher implies a method, or system, of secret writing which, generally speaking, is unlimited in scope; it should be possible, using any one given cipher, to transform any plaintext whatever, regardless of its length and the language in which it is written, into a cryptogram, or single enciphered message. The process of accomplishing this transformation is called encipherment; the opposite process, that of transforming the cryptogram into a plaintext, is called decipherment.

The word decrypt, with its various derivatives, is being used here to signify the process of solving and reading cryptograms without any previous knowledge as to their keys, or secret formulas; thus the word decipher has been left to convey only its one meaning, as mentioned above: the mechanical process of applying a known key. Our word decrypt, however, is an innovation borrowed from the modern French and Italian writers, and is somewhat frowned upon by leading cryptologists.

The word digram is being used to indicate a two-letter sequence; similarly, we have trigrams, tetragrams, pentagrams, etc., to indicate sequences of three, four, five, etc. letters.

Ciphers, in general, fall into three major classifications:

1. Concealment Cipher
2. Transposition Cipher
3. Substitution Cipher

Minor types, such as “abbreviation,” are sometimes included, though, to the writer, these have never seemed to be truly of a cryptographic nature.

In concealment cipher, the true letters of the secret message are hidden, or disguised, by any device whatever; and this type of cipher, as a general rule, is intended to pass without being suspected as the conveyor of a secret communication.

In transposition cipher, the true letters of the secret message are taken out of their text-order, and are rearranged according to any pattern, or key, agreed upon by the correspondents.

In substitution cipher, these original text-letters are replaced with substitutes, or cipher-symbols, and these symbols are arranged in the same order as their originals. There may, of course, be combinations of types, or combinations of several forms belonging to a single type.

The aristocrat of the cipher family is code. This is a form of the substitution cipher which requires the preparation, in advance, of a code book. A series of terms likely to be used in future correspondence (that is, words, phrases, and even sentences) is first gathered into a vocabulary, or “dictionary”; and beside each of these terms is placed a substitute known as a code group, or code word. These substitutes may be groups of letters, or groups of digits, or actual words selected from ordinary language. Very common words or expressions are usually provided with more than one substitute; and nearly always there are substitutes provided for syllables and single letters, so as to take care of all words not originally included in the vocabulary.

No code presents any real security unless the code symbols have been assigned in a thoroughly haphazard manner. This means that any really good code would have to be printed in two separate sections. In one of these, the vocabulary terms would be arranged in alphabetical order, so that they could be readily found when enciphering (encoding) messages; but the code groups would be in mixed order and hard to find. In the other section, the code groups would be rearranged in straight alphabetical (or numerical) order, so as to be readily found when deciphering (decoding), and the vocabulary terms would be in mixed order. Just what is meant can be seen in Fig. 1, showing fragments from an imaginary code book.

A code of this kind, with symbols assigned absolutely at random, provided it is carefully used (never without re-encipherment) and a close guard kept over the code books, represents perhaps the maximum of security to be attained in cryptographic correspondence; and security, of course, is of prime importance in the selection of a cipher for any practical purpose.

But in considering the relative merits of the various ciphers, it is always necessary to take into account many factors other than security, each cipher being evaluated in connection with the purpose for which it is wanted: Under what conditions must the encipherment and decipherment take place? How must the cryptograms be transmitted? How much of the enciphered correspondence is likely to be intercepted? What degree of security, after all, is absolutely imperative?

A commercial, or other, firm, having a permanent base of operations, and in little danger of being blown to bits by an enemy shell, would not consider the first of these questions from the same angle as the War Department, and the War Department, though considering all of them from several different angles of its own, would still not consider them from the same viewpoint as the State Department.

If messages are to be sent by mail, or by hand, or by telephone, or pasted on a billboard, it is conceivable that a cipher which doubles or trebles their length could still be a practical cipher. For transmission by telephone, the presumption is that the cryptogram must be pronounceable, or, certainly, audible. For written communication, individual purposes have been served by means of pictures.

But when the cryptograms are to be sent by wire or radio, it must be possible to convert them into Morse symbols, either letters or figures, but not intermingled letters and figures. Here, length must be considered, involving questions of time, expense, and the current telegraphic regulations. Moreover, it is conceded that a meaningless text will not be transmitted with absolute accuracy, and a cryptogram which is to be sent by this means must not be of such a nature that ordinary errors of transmission will render it unintelligible at the receiving office.

A factor of particularly grave importance in the selection of a cipher to fit a given purpose is the probable amount of enciphered material which is going to fall into the possession of unauthorized persons. A criminal, who has had to send but one brief cryptogram in a lifetime, might reasonably expect that it will remain forever unread, no matter how weak the cipher. A commercial firm, transmitting thousands of words over the air, is more vulnerable; and the diplomatic office, or the newspaper office, which makes the mistake of publishing almost verbatim the translations of cryptograms which have been transmitted by radio, and thus has surely furnished the cipher expert with a cryptogram and its translation, might just as well have presented him with a copy of its code book.

As to just what constitutes the “perfect” cipher, perhaps it might be said that this description fits any cipher whatever which provides the degree of security wanted for an individual purpose, and which is suited in other respects to that individual purpose. Even a basically weak cipher, in the hands of an expert, can be made to serve its purpose; and the strongest can be made useless when improperly used.

In the present text, we are likely to be found looking at ciphers largely from a military angle, which, apparently, has a more general interest than any other. In time of war, the cryptographic service, that is, the encipherment and transmitting service, is suddenly expanded to include a large number of new men, many of whom know nothing whatever of cryptanalysis, or the science of decryptment. Many of these are criminally careless through ignorance, so that, entirely aside from numerous other factors (including espionage), it is conceded by the various War Departments that no matter what system or apparatus is selected for cipher purposes, the enemy, soon after the beginning of operations, will be in full possession of details concerning this system, and will have secured a duplicate of any apparatus or machine. For that reason, the secrecy of messages must depend upon a changeable key added to a sound basic cipher.

Speed in encipherment and decipherment is desirable, and often urgent; and the conditions under which these operations must often take place are conducive to a maximum of error. The ideal cipher, under these conditions, would be one which is simple in operation, preferably requiring no written memoranda or apparatus which cannot be quickly destroyed and reconstructed from memory, and having a key which is readily changed, easily communicated, and easily remembered. Yet the present tendency, in all armies, seems to be toward the use of small changeable codes, which are written (printed) documents; and, for certain purposes, small mechanical devices.

An enormous number of military cryptograms will be transmitted by radio and taken down by enemy listeners, and even the ordinary wire will be tapped. It is expected that the enemy will intercept dozens, and even hundreds, of cryptograms in a single day, some of which will inevitably be enciphered with the same key. With so much material, knowing the general subject matter, and often exactly what words to expect, or the personal expressions invariably used by individuals, it is conceded that he will read the messages. All that is desired of a cryptogram is that it will resist his efforts for a sufficient length of time to render its contents valueless when he finally discovers them. By that time, of course, the key will have been changed, probably several times, and even the cipher.

With these general facts understood, we may first dispose hastily of the concealment cipher, after which we will examine at greater length the two legitimate types, the transpositions and the substitutions.

CHAPTER II
Concealment Devices

Concealment writing may take a host of forms. Perhaps its oldest known application is found in the ancient device of writing a secret message on the shaved head of a slave and dispatching the slave with his communication after his growing hair had covered the writing. Or, if this appears a little incredible, the ancients have left us records of another device considerably more practical: that of writing the secret message on a wooden tablet, covering this with a wax coating, and writing a second message on top of the first.

In the middle ages we meet a development called puncture cipher; any piece of printed matter, such as a public proclamation, serves as the vehicle, and the cipher consists simply in punching holes with a pin under certain letters, so that these letters, read in regular order, will convey the desired information. It is said that this kind of concealment writing was resorted to in England at a comparatively recent period, to avoid the payment of postage. Postage on letters was very high, while newspapers were permitted to travel free, and the correspondents sent their messages very handily by punching holes under the letters printed in newspapers. Where the sender of a message may also control the preparation of the printed vehicle, any desired letters can be pointed out by the use of special type forms, misspelled words, accidental gaps, and so on.

But concealment cipher is not necessarily confined to written and printed matter. Ohaver, in his “Solving Cipher Secrets,” demonstrated the conveyance of messages in the shapes and sizes of stones in a garden wall, or in the arrangement of colored candies in a box; and we read, in fiction, of many similar devices, such as a series of knots tied in a string, or beads strung in imitation of the rosary. Again, we hear of cases in which the arrangement of stamps on envelopes is made to represent the terms of a miniature code. All such devices are, of course, combination-cipher rather than pure concealment, since the stones, candies, and so on, must first be made the substitutes for letters or code terms.

A method of pure concealment, said to have been used by Cardinal Richelieu, involved the use of a grille. Grilles are made of cardboard, sheet-metal, or other flat material, and are perforated with any desired number, size, and arrangement of openings. The Richelieu grille, of approximately the same size and shape as the paper used for correspondence, could be laid over a sheet of paper so as to reveal only certain portions, and the secret message was written on these. The grille was then removed and the rest of the sheet was filled in with extraneous matter in such a way as to present a seemingly continuous text. The legitimate recipient of this message, having a duplicate grille, simply laid this grille over the sheet of paper, and read his message through the apertures.

Concealment cipher goes by various names, as null cipher, open-letter cipher, conventional writing, dissimulated writing, and so on, not always with a difference in meaning, though “conventional writing” does convey somewhat the idea of a tiny code. (In this, casual words have special meanings.)

The name “null cipher” derives from the fact that in any given cryptogram the greater portion of the letters are null, a certain few being significant, and perhaps a few others being significant only in that they act as indicators for finding truly significant letters. To illustrate what is usually meant: Say that your very good friend, Smith, first complains about a radio which he has bought from your neighbor, Johnson, then asks you to take Johnson the following note: “Having trouble about loudspeaker. Believe antenna connected improperly, but do whatever you can.” By reading the final letter of each word, you will find out what Smith actually had to say to Johnson: GET READY TO RUN.

That is the null cipher reduced to its elements, though naturally it can be more skillfully applied. Significant letters may be concealed in an infinite variety of ways. The key, as here, may be their positions in words, or in the text as a whole. It may be their distance from one another, expressed in letters or in inches, or their distance to the left or right of certain other letters (indicators) or of punctuation marks (indicators); and this distance, or position, need not be constant, or regular. Sometimes it is governed by an irregular series of numbers.

Similar devices are applied to whole words. We agree, say, that in whatever communications we send to our accomplice, only the third word of each sentence is to be significant. Desiring to send him the order, STRIKE NOW, we write him as follows: “The building strike is worrying our friends quite a lot. It has now extended to this part of the city.”

A purely concealment cipher may be enveloped in apparent ciphers of other types. The true message is concealed, as usual, in a dummy message, and the whole is enciphered in one of the legitimate systems. It is then hoped that the decryptor, satisfied with having solved the dummy, will look no further. Even more effective would be the device of concealing the message in what appears to be a cryptogram, but is not. It is easy to string letters together in such a way as to make them resemble most convincingly a transposition cryptogram, and in this case it would be hoped that the investigator’s full attention would be given to the hopeless task of decrypting the dummy.

Concerning the decryptment of concealment cipher, we regret to say that cryptanalysis has little help to offer. Fortunately, most of these ciphers depend absolutely on the belief that they will not be recognized as cipher, and once they are so recognized, they present no resistance. In those few cases where the secret message is not at once obvious, it is sometimes useful to arrange the words (or sentences) in columns, or in rows, for a closer inspection.

We have, for instance, an apparent memorandum in which the awkwardness of the wording, or some other factor, has drawn our attention to the possibility of cipher: “Inspect details for Trigleth — acknowledge the bonds from Fewell.” We arrange these words in column form, aligned by their initials, as in Fig. 2, and the third column promptly gives up the secret message STRIKE NOW.

The words of sentences can, of course, be treated in the same way, and where the alignment from the left gives no results, letters or words can be aligned from the right, or from the center. If columns give no results, diagonals can be inspected, or a zig-zagging line between one column and another.

Experience counts for most, and extensive reading is a vast help. Having seen methods in use, or read the descriptions of methods, we know of some definite thing to look for. Then, too, some of the concealment ciphers have transposition characteristics. This would be the case with the Legrand cipher, which is of the type called “open letter.”

This cipher used a numerical key, which, in turn, was based on a keyword in what seems today a rather odd manner: A keyword CAT, made up of the 3d, 1st, and 20th letters of the alphabet, gives the key 3 1 2 0. Before concealment takes place, a series of word-positions is marked off, and these vacant places are numbered (0 to 9, or 9 to 0), continuing to repeat the ten digits until there are enough of the digits 3, 1, 2, and 0 to accommodate the words of the secret message. This message is then written, word by word, below its digits, beginning with the first digit 3, then going on to find a digit 1, then a digit 2, then a digit 0, then another digit 3, and so on. After the secret message is written into its place, all of the blank positions are filled with connective matter, as in the case of Cardinal Richelieu’s grille-writing. Our later study of transpositions will show approximately how we should go about reading this, once we suspect its use.

So far, we have been considering pure concealment. Many of the classic ciphers, fundamentally of the concealment type, are also substitution ciphers, and their decryptment would follow substitution methods. Of these, perhaps the best known is Bacon’s biliteral cipher, summed up in Fig. 3.

Lord Bacon’s cipher presupposes that the encipherer may so control the preparation of his published work that he may prescribe the type to be used for each printed letter, and it is claimed that he actually used his cipher for the preservation of historical secrets, including that of his own parentage. Two fonts of type are required, the letters of one font differing (very slightly) from those of the other font. These we may speak of as the A-font and the B-font, and each letter of the alphabet is given a substitute composed of A’s and B’s, as shown in full in the figure. Before a message, as STRIKE NOW, can be concealed, it must be expressed in A’s and B’s, five of these for each of its letters, as shown, so that a message of 9 letters attains a length of 45. For its concealment, we may use any text whatever whose length is 45 letters, for instance, one whose obvious meaning is the contrary of the secret one: “Hold off until you hear from me again. We may compromise.” The first five letters, HOLDO, are to represent S, the next five, FFUNT, are to represent T, and so on; and the sole purpose of the A’s and B’s is to point out the kind of type which must be used in printing the corresponding letters. In the encipherment of the figure, letters taken from the A-font are indicated by lower-case and those of the B-font by capitals, though it is understood that no such emphatic difference is contemplated in the cipher.

While the average modern person would have no opportunity for employing Lord Bacon’s cipher as described, he has access to an unlimited number of vehicles other than type-difference. Anything, in fact, may serve the purpose, so long as the material is available in two distinguishable forms and in sufficient quantity. Our message of 29 A’s and 16 B’s could be expressed with a deck of playing cards if aces and face-cards are considered to represent B’s. It could assume the form of a fence with 45 palings, in which the B-palings are crooked, damaged, or missing. Ohaver once made use of a cartridge belt in which the A-loops contained cartridges and the B-loops were empty. There is an excellent opportunity here, too, for the compiling of “fake” cryptograms, with A-letters and B-letters distinguished as vowels and consonants, or by the part of the normal alphabet from which they have been taken.

With a biliteral or binumeral alphabet which requires 26 groups, we cannot have fewer than five characters to the group without making groups of different lengths. But another well-known cipher alphabet, devised by the Abbé Trithème for use in much the same way, is triformed, and thus permits that the group-length be reduced to three. The Trithème (Trithemius; Trittemius) alphabet, expressed in digits 1-2-3, was approximately that shown in Fig. 4.

This alphabet has had many applications, including the use of colored candy previously mentioned. One contributor to Ohaver’s column submitted a cryptogram of the open-letter type in which the digits 1, 2, 3, were indicated in the number of syllables of the successive words. A sentence, “Can you be sure of sufficient assistance from Mayberry?” indicates the digits 1 1 1, 1 1 3, 3 1 3; and, if the alphabet of Fig. 4 is the one in use, represents the letters A C U. This is of particular interest in that it is easily done without involving the awkward turns of language that so often betray the concealment cipher. (This same contributor, a Mr. Levine, evolved another cipher, accomplished by an arithmetical process, by which it was possible to make a cryptogram convey two separate messages!)

Many writers have shown alphabets of the biform and triform types applied to open-letter communications by making the significant factor the number of vowels contained in successive words. Thus, the sentence given above yields a series 1, 3, 1, 2, 1, 4, 4, 1, 4. Using a biform alphabet, these are usually considered simply as odd and even; with a triform alphabet, some disposition must be made of numbers larger than 3.

The subject is fascinating, and the literature of cryptography is rich with examples. However, we need not delve further into what, after all, is only the stepchild of a legitimate science. The matter of telegraphic transmission alone will bar these ciphers for most general purposes, or the fact that a cipher once betrayed will never serve again. Then, too, the censorship combats it by cutting out or rearranging or changing words, causing the open letter (or telegram) to convey only the information which it purports to convey.

Concealment cipher has, of course, the unique virtue of being able to convey messages under circumstances which make it seem that no communication has passed, and we have hardly touched upon the fact that the short message, prior to its concealment, may have been a well-enciphered one. But we rather suspect that, for the end desired, invisible inks are more convenient and practical.

1. By PICCOLA.
On peut être Napoleon sans être son ami, mes enfants!
2. By B. NATURAL.
FOR SALE: Spring coats. All fine Scotch serge, for ensembles. Stoat
trimmed, fashioned right. Black shirred lining, striped. Effective for
brides. Act quickly. - Abraham Batz, 522 Broad, Telephone Exchange 7104-R.
3. By TITOGI.
How about releasing Tony, the gang chief? He don't lie, and is not the
true slayer either. Let us be friends. I am all right. Ed Lehr.
4. By TRYIT.
To those friends considering, it is always news, but all filled ciphers
disturb happiness with varied answers!
5. By PICCOLA.
Do not send for any supplies before Monday, at earliest. Order once only,
as men in charge are feeling sore about your threat to encourage the
mutiny at Ford's. - Wilson.
6. By PICCOLA. (Why not, indeed?)
A W I T H A N Y S E N D F O R I T Y O U M U S T B E F E A R
T H E C A N H I T T R Y A B O U R E O U T I S E C H I Y O U
A N D M Y T I O N C U P C R E A S K T O C A N D Q.

CHAPTER III
Transposition Types

Transposition has already been explained as a form of cipher in which the letters of a message are disarranged from their natural order in accordance with any pattern, or key, agreeable to the correspondents. The fact that any plan may be followed will suggest the possible ramifications as to detail. Transpositions are, in fact, found in every conceivable degree of complexity. They are not even unanimous in their demand that there be two separate operations in the preparation of a cryptogram: (1) the writing down of the plaintext letters, and (2) the taking off of these letters.

Generally speaking, these ciphers follow two types, the regular (geometrical, symmetrical), and the irregular. The strictly geometrical type, sometimes called complete-unit transposition, is based on one comparatively small unit, or cycle, repeated over and over, every unit having exactly the same number of letters and exactly the same disarrangement as the rest. This type always demands an exact number of units, and when a plaintext message is not evenly divisible into units, it must either be cut down to fit, or lengthened by the addition of extra letters called nulls. Some of these keys are actual geometrical figures, such as triangles, diamonds, hexagons, etc., or conventional designs like crosses. Any figure of this kind provides a number of cells, or points, for the writing in of letters, and thus will serve as a mnemonic device, or key.

The two operations of writing-in and taking off may be governed by any agreed ruling, though the second of these must be made to result in five-letter groups if the cryptogram is to be transmitted by wire or radio. Fig. 5, in which an imaginary message has been represented as A B C D E . . . . . , shows only one of the many ways in which a simple cross could be used as the key for the writing-in operation, together with only two of the many cryptograms which could be taken off from this one arrangement. This figure shows also, in its two cryptograms (a) and (b), two fundamentally different plans for the taking off of transpositions. The unit here is 4, the first unit containing the letters A B C D, the next unit E F G H, and so on. In cryptogram (a), the letters of every unit are still standing together in a group, while in cryptogram (b), the letters of any one unit have been mixed with letters of other units. In this latter case, the two correspondents will have to agree upon a certain number of crosses per line; otherwise, they run the risk of having to decrypt each other’s cryptograms.

The most popular of the geometrical figures appears to be the square, with or without a series of numbers 1 to 25, 1 to 36, and so on. Any device or game, which will provide a square, is likely to be seized upon as the source of a transposition key. We find two widely-known examples of this in the “magic square” and the “knight’s tour.”

A magic square, as most of us understand this term, is made up of a series of numbers, such as 1 to 25, 1 to 36, which are so arranged in their cells (positions) that the added numbers of any row, column, or diagonal, will always give the same total. A square of given size will provide more than one magic square arrangement; and these numbers, being a series, constitute an order, which, once it can be remembered or reconstructed, will serve either for writing in or for taking off a unit of 25, 36, etc., letters.

The knight’s tour is based on the chessboard, a unit of 64 cells. In the game of chess, where each piece has certain prescribed moves, the piece called the knight must move diagonally across a 2 x 3 oblong. The “tour” consists in starting the

knight at one corner and carrying him completely over the 64 cells of the chessboard, causing him to touch every square exactly once without having made any other move than the one allotted to him. Fig. 6 will show one of the many such tours which have been published. Such designs will serve either for writing in or for taking out. In either case, the text is made to contain exactly 64 letters or a multiple thereof. For writing in, the first letter is placed in the cell corresponding to No. 1, the next letter in the cell numbered 2, and so on. For puzzle purposes, the 64 letters are usually left standing in the form of a square. As cipher, they would be taken off, by rows, or by columns, or otherwise. Or the 64 letters may first be written in simple order into the form of a square, and then taken out one by one following the route of the knight.

Other ciphers of the regular type merely employ a unit of so many letters, to be arranged in some specified order, generally in accordance with a numerical key. If, say, the unit has a length of six letters, which we will represent as A B C D E F, and the specified order for these is 6 2 1 4 3 5, this unit may be transposed to read F B A D C E. Each unit will be transposed to have exactly this pattern, except that semi-occasionally we find a final unit slightly different from the others, owing to the fact that nulls were not added to complete its length (Accurately speaking, this transfers the cipher to the “irregular” class). Units, once transposed in this way, may continue to stand intact, one after another; or they may remain intact, merely exchanging places with one another; or the cipher may be so planned that they do not remain intact, as was the case with our cryptogram (b) of Fig. 5.

Often, two ciphers will differ from each other only in the method by which their cryptograms are produced; oftener, there will be an actual difference, but one which is purely superficial. For instance, we have just mentioned a plaintext unit A B C D E F as having been transposed with a key 6 2 1 4 3 5 to result in the order F B A D C E. Identically the same numerical key, used in another way, will transpose this unit in the order C B E D F A. The two resulting cryptograms would be different, but the kind of cryptogram would not.

An extremely common form of complete-unit transposition is that indicated in Fig. 7, where a short message, LET US HEAR FROM YOU AT ONCE CONCERNING JEWELS QQ (38 letters plus 2 nulls), has been written into an oblong, or block, in one order and taken off in another. Both the writing in and the taking off follow a route, rather than a key and, for that reason, the cipher is often spoken of as route transposition, rather than rectangular transposition.

Three of the many possible routes are shown in the three (partial) cryptograms of the figure. In this connection, the American popular terminology seems to favor horizontals and verticals, rather than “rows” and “columns.” The writing in or

the taking out of a text is said to be done by straight horizontals, or by reversed horizontals (backward), or by alternate (or alternating) horizontals (written alternately in both directions). Similarly, we find ascending, or descending, or alternate verticals; and again the diagonal routes will be described as ascending, descending, or alternate. The route may also be a spiral one, and in this case it is said to be clockwise or counter-clockwise.

For all of these routes, the point of beginning is nearly always one of the four corners, except in the case of the two spiral routes, which are just as likely to begin with a central letter, particularly when the rectangle is a square. Colonel Parker Hitt, in his Manual for the Solution of Military Ciphers, shows the same series of letters written into forty different blocks, always beginning at one of the four corners.

Rectangular transposition, when used as cipher and not simply as a puzzle, requires that one dimension of the oblong be fixed, the other dimension being entirely dependent on the length of the message to be conveyed. In the figure, the pre-arranged width of the block, called its key-length, was 5, and the filling of the block required 8 complete units. These were written one by one as simple bits of plaintext, and were then broken up in the method of taking off. Occasionally it will be the vertical dimension of the block which is fixed, and the plaintext will be written in by columns, beginning at the left or at the right. But there is so little difference in the results of the two procedures that a decryptor may solve and read a cryptogram without learning which of the two was actually followed. Ordinarily, it is the simple operation which comes first, the writing in of intact units one after another. Sometimes the opposite is true, the operation of writing in being made very complex, so that the whole block is the unit, the taking off being done by simple rows or columns. Frequently both operations are complex. This kind of transposition belongs rather to the category of puzzles than to cipher; any reasonably intelligent person can decrypt it, knowing what it is. However, it has not infrequently been applied to serious purposes, and a decryptor, encountering an unknown transposition, would not overlook the possibility of simple rectangular encipherment.

Decryptment, here, is merely a matter of trying out the known routes, and it would never be actually necessary to write out the entire forty-plus blocks, or even half of these, for any one rectangle. The decryptor begins by counting the letters of his cryptogram and factoring the number of these, to find out what oblongs are possible. A 36-letter cryptogram, for instance, might mean dimensions 6 x 6, or dimensions 4 x 9. It could, conceivably, represent dimensions 3 x 12, or 2 x 18. But key-lengths are hardly ever shorter than 5, or as long as 18. He would seize upon the square as the object of his first investigation, writing the cryptogram into that block by various known routes, and also reading by various known routes, diagonally, horizontally, vertically, backward, or upside down, until he begins to find words. As a rule, this does not take him very long; often the very efforts of an encipherer to achieve complexity will result in an easier task for the decryptor. However, a spiral will sometimes give trouble.

The examples appended to this chapter are all of the complete-unit type, and require little knowledge of cryptanalysis for their solution.

Passing on to irregular types, we find these in all degrees of difficulty, from the very simple “rail fence” to the formidable “U. S. Army” double transposition.

The “rail fence” family is outlined sketchily in Fig. 8. The writing in of the plaintext follows a zig-zag route, downward by so many letters, then upward to the line of beginning, as indicated by the series A B C . . . . . , and the taking off of the cryptogram is done by straight lines. In explanation of the character &, this has been used here as a signal to show the ends of the straight lines. No such signal is needed if a proper understanding exists between correspondents as to the construction of the “fence” and the length of it which may occupy one line of writing; and in some cases the straight lines are all equal in length.

In Fig. 9, we have a suggested grille-transposition, of a kind described by Mario Zanotti as “indefinite.” This kind of grille, we believe, is the invention of General Sacco. To picture it complete, we may imagine a flat surface, such as a piece of cardboard, marked off into squares, having dimensions 12 x 6, and turned sidewise. Assuming this to be shown in full, we are looking at 12 columns, and each column has 6 of the small squares, or cells. To convert this piece of cardboard into an encipherment grille, we clip out three squares from each one of its 12 columns, always in the most haphazard manner possible. The resulting grille will thus have 36 openings, and, if placed over a sheet of paper (preferably also marked into cells), enables us to transpose the first 36 letters of a message by writing them one at a time into the 36 apertures in some one order and taking them off in another. The original plan was the reverse of the usual: write the letters by columns and take them off by rows.

In the figure, a 9-letter message, STRIKE NOW, has been written into the first three columns of such a grille, and, taken off by rows, comes out in the order N, SO, TI, K, RE, W. While the figure shows this cryptogram regrouped in the usual fives, the original method, as prescribed with the device, would have grouped it in threes, that is, to correspond with the number of apertures per column. This

would facilitate the operation of decipherment, which is as follows: Count the number of letters in the cryptogram and divide this number by 3, in order to find how many columns were used. Cover (or ignore) the unused portion of the grille, write the cryptogram by straight horizontals into the uncovered portion, then read, or copy, by descending verticals. The recipient of the present cryptogram, for instance, finds nine letters, divides this number by 3, thus ascertaining that three columns were used, covers up the other nine columns, then, proceeding by straight horizontals, places one cryptogram-letter wherever he sees a hole. Having thus restored all letters to their proper columns, he has the plaintext message before him. It will be noticed that an encipherer uses only the number of columns that he needs. His last column does not have to be completed with nulls, as in the case of complete-unit ciphers.

As this grille has just been described, its full capacity is 36 letters, and it has a repeating cycle of that length, presuming that, after the transposition of the first

36 letters, another 36-letter unit is to be transposed by the same grille standing in the same position. But this grille, reversed, provides a new pattern; and the opposite side of the grille provides two additional patterns. These positions may be numbered, thus providing for the encipherment of 144 letters, even assuming that the positions are to be used in 1, 2, 3, 4 order and without varying the method of use. Add to this that the cryptographic offices may have provided half-a-dozen different grilles to be used interchangeably and not always in exactly the same way, and it becomes plain that such an encipherment, in the hands of an operator who knows his business, could be made to furnish a very effective form of transposition.

Zanotti, and others, have also described mechanical devices of a patentable type for accomplishing very involved transpositions. The principle on which most of these operate can be seen in Fig. 10. A certain number of pointers, or narrow sliding rulers, all carrying the same progression of numbers, are so attached to a framework that they can be set, by means of a numerical key, to project at irregular lengths over a sheet of quadrille paper cut to fit into the frame. Thus, each pointer indicates a certain number of empty cells, as nine on the first line, six on the next, and so on. In the example of the figure, presuming that each pointer carries only ten numbers, and that the full number of these pointers is seven, the numerical key would be the column of numbers at the extreme left: 2-5-0-7-3-4-7. The message here is written in the usual horizontals, with a null (not strictly necessary) completing the last line. It could be taken off by columns: L, EC, TEN, UFCI, etc. The decipherer, having a duplicate apparatus, would set this according to the pre-arranged key, copy the cryptogram by columns, and read it by rows. The exact method, of course, can be varied.

Some attempt has been made, too, to evolve cipher machines which will produce effective transpositions, but our understanding is that these have never been accepted as worthwhile. The accomplishment of transposition by mechanical means is far from new. In fact, the oldest transposition cipher of which we have any record was accomplished by means of the Lacedaemonian scytale. The Spartan general, departing for foreign conquests, carried with him a rod, or scytale, of exactly the same diameter as one retained by the administration. When it was desired to communicate matter of a confidential nature, the sender, using a narrow strip of parchment, wound this carefully around his scytale with edges meeting uniformly at all points, and wrote his message lengthwise of the rod. When the strip was unrolled, the message appeared as a series of short disconnected fragments, one letter, or two letters, or portions of one or two letters. It was presumed that no person would be able to read the message without being possessed of a duplicate scytale on which to rewind the strip. We are left to suppose that this presumption was justified by fact, though the decryptor of today would make short work of such a system. The scytale, we believe, is the oldest known cipher of any kind, and is still serving today as the emblem of the American Cryptogram Association.

Before leaving types, it should be mentioned that any of the transpositions ordinarily used for disarranging single letters can also be used for the transposal of entire words. The popular name for this is “Route Cipher” — possibly because it is rather cumbersome to accomplish by any other than a “route” transposition.

We have said little concerning decipherment. This, in practically all cases, is a mere matter of performing inversely the two encipherment operations. For either process, the operator begins by setting down his key or design, or adjusting his mechanical device in the agreed manner. The encipherer “writes in” a plaintext, and “takes off” a cryptogram; the decipherer “writes in” a cryptogram, and “takes off” (or reads) a plaintext. If the encipherer, by agreement, has written the text in rows and taken it off by columns, then the decipherer must do the reverse: write his text by columns and take it off by rows.

Before entering into the subject of decryptment, the student should acquaint himself with the significance of the various tables appended to this text, in order that he may consult these or similar tables for information as to frequencies, and sequence. Every written language has its individual characteristics in these two respects, and, to learn just what these are for each language, various cryptologists have, from time to time, counted the letters, the short words, the combinations, and so forth, often on extremely long texts, afterward arranging these data in the form of charts, or tables, or lists. Two such counts are never duplicates, and there may be a noticeable difference, say, between results obtained from literary text and those obtained from military or telegraphic text; yet results for any one language are surprisingly uniform. Finding, for instance, an unexplained cryptogram in which a count of the letters shows that about 40% of these are vowels (with or without Y), we may classify it, not only as a transposition, but as one enciphered in English or German, since one of the Latin languages can hardly be written with so low a vowel percentage. Then, if we note the occurrences of the letter E, and find that this makes up about 12% of the total number of letters, we may discard the possibility of German, in which the letter E is far more likely to represent 18% of the text. Or, if the vowel percentage is high enough to point to one of the Latin languages, French would be distinguished from the others by the outstanding frequency of its letter E, sometimes as great as that of the German E, while the Spanish, Portuguese, or Italian language will not always show it as the leading letter, its place having been taken by A. In the Serb-Croat language, the letter A always predominates, and in Russian the letter O.

As to sequence, and considering English combinations only, certain digrams, such as TH, HE, AN, etc., very consistently predominate over all others. These almost never show identical percentages in any two digram counts (as the single letters sometimes will), and seldom, if ever, are ranked in exactly the same order, aside from the fact that TH invariably comes first. But in all counts, the same fifty to sixty digrams (out of 676) are always found at the top of the list. Thus the Meaker digram chart differs from similar charts made by many others; yet any digram chart is the most valuable weapon we have for attacking a cipher. The Carter contact chart contains the same general information expressed in another way for special use in transpositions. (This was not figured from the Meaker chart, but from an earlier one by Ohaver, made on the same kind of text.)

One very useful phase of frequency data is seen in the group percentages. Single letters, especially in short texts, may vary greatly from their normal percentages, while certain classes, taken as a whole, maintain a fairly constant percentage no matter how short the text. Such classes, or groups, listed under the general heading of English Frequency and Sequence Data, can be memorized as having roughly approximate percentages: Vowels, 40%; selected high-frequency consonants, 30%; extreme low-frequency group, 2%; the five most frequent letters, mixed, 45%; the nine most frequent letters, 70%. This final group of nine letters, E T A O N I S R H, hardly ever varies appreciably; the shorter groups will sometimes vary as much as 5% one way or the other.

Very useful in code decryptment is a list of the commonest words. Trigrams have also been investigated, the favorite positions of individual letters in their own words, average word-length, patterns, and endless other information, some of which is indispensable, and some merely convenient. It will not be possible, in the space at our disposal, to point out all of the uses to which this kind of information can be put; the student is urged to take his cue from the occasional short references made in connection with examples.

All ciphers are decrypted by the general methods suitable to their type, and a transposition cryptogram may involve factoring, examination of the vowel distribution, and anagramming, either singly or in combination. These are best explained in connection with examples, which may themselves have special methods, and we have selected for general discussion four ciphers, two belonging to the complete-unit type and two to the irregular. A careful study of the methods used in individual cases should furnish the student with a basis for analyzing other ciphers and evolving other special methods to suit particular cases.

Concerning the paper work, which, admittedly, is onerous in most forms of cipher investigation, much reference may be found, in the matter which follows, to “paper strips.” These are old stand-bys. Most decryptors prefer to do all of their work on cross-section (quadrille) paper, since the writing of the letters into cells enables them to obtain an accurate spacing both laterally and vertically, and this paper is easily cut apart along the separating lines. But for the kind of cryptograms we are likely to see here, many persons prefer to work with a set of anagram blocks. These can be prepared at home from cardboard squares, or may be bought in sets with frequent letters represented in approximately the correct proportions.

7. By TITOGI.
T S S N I H A Y S T I N T P I S E R O O I A A S N.
Also this: S H C V I E O L E A E W E R M.
8. By G. A. SLIGHT. (Something found in every school-book - IF found!)
T G H M R R I A Y E X N U E E S D E X S H M T I D E Q U O A Y R O A U
N P U E T G T I T E S Y S N O A Q N X A T U A D S I S H X.
9. By PICCOLA.
W I N T A H D A E S W H L E T Y L W A I L H O Q L A S S S A S Q.
10. By NEMO. (Magic Square).
L E A S U L T S G M S L O E I E O I M E A R N S A S R C D E K I U S U
H E M A Q L Y S P R M E O A.
11. By THE ADMIRAL.
B S P N T E A E F T V V O A N E Y A P U Z S E T P T H M N A T A E E R
S D S S K P S J E S T Y S E A L R H I A S K S N T T E Y W O F T H M W
Y K E F E N N H C I E H H U M I H I T E O H G E S U C G D I O O W E A
S A S N E R H M A A S S L E R G S M N E D T H K E M L U A E T V M F O
R A I W P A Y A M A E Y A D.
12. By THE ADMIRAL.
A A F R S R T N E A R B N E E O H S R L T I A P D U E O S I I T T A T
G L F O T S O U S H H E P N Y.
13. By DAN SURR. (Received from General Headquarters following a skirmish).
F A A T R M N O A T I L V I S Y G U C F F I O O E P S N K L T O I N V
R T T O A H N D N E E R E N N B M P U N P O R R K A U O M E A N A I E
T S S B N R G T G S T T I E E I C T H R.
14. By PICCOLA. (This is serious advice!)
F F L T A A R N I E U O R N T O T D L A N R W S O I A T T E Y B A N T
M E H S K O G R Z E P S R E I O A O A M S S S M A L P I L Y S.
15. BY FRA-GRANT. (This might have been a little easier. Still - ?)
Q Y T E Y O F U B U Q E H I H T E C H T H S A U A O N S I T I T T T I
E T T E L L S E A P L T N T.

CHAPTER IV
Geometrical Types — The Nihilist Transposition

In the [preceding chapter], we glanced at the most elementary form of columnar transposition: a text is written into a block by rows and taken off by columns in such a way that even though all or part of the columns may be reversed in direction, these columns are always left standing one after another in regular order. Columnar transposition becomes less crude when the order for taking off the columns is an irregular one, governed by a changeable numerical key, the length of this key governing also the width of the rectangle. This process can be examined in Fig. 11. In this figure, the numerical key, 4 1 6 5 3 2 7, was first derived from a keyword, HALIFAX, according to the following very common plan: The two A’s, taken from left to right, receive the first two numbers; the third number, in the

absence of B, C, D, and E, is assigned to F; and so on, following the alphabetical rank of the letters present, and taking repeated letters from left to right. The presence of seven numbers implies seven columns, and it is said that the key-length is 7. When a text has been written into a block of that width, with a key-number standing above each column, these columns can be taken off in the order shown by the numbers, and not in regular sequence.

The key, used exactly as described, is a “taking off” key, and this is the common way of using one. It can, however, be used for “writing in” the successive units, placing the first letter of a given unit beneath number 1, the second letter beneath number 2, and so on until the seventh letter has been written below number 7, afterward beginning with the first letter of another unit below number 1 again. Under this plan the first unit of our figure, L E T U S H E, would have been written in in the order U L H S T E E. Since all units would follow exactly the same pattern, the resulting columns would be identical with those of the present block; the only essential difference would be that the new columns are already transposed, and can be taken off in straight order. The two resulting cryptograms, however, would not be the same. The unit which was written in in the order U L H S T E E, would have been in the order E H S L U T E had the method been that of taking out (or “off”).

The Nihilist transposition is ordinarily accomplished by “writing in,” and its numerical key is applied to both columns and rows. Thus its major unit is a square, and the seven-letter keyword HALIFAX, applied to both dimensions of a rectangle, demands a unit of 49 letters, while the shorter word SCOTIA, key-length 6, requires a unit of 36 letters.

Theoretically, this cipher is a double transposition, requiring two successive operations as shown in Fig. 12. But in practice, these two transpositions can take place simultaneously as pointed out in Fig. 13. The operator, having laid out his key-numbers at top and side of his square, begins his writing in the cell at which the column headed by number 1 crosses the row headed by number 1. He writes in his first unit, proceeds to the row numbered 2 for the writing in of his second unit, then to the row numbered 3, and so on, taking rows in the order shown by the numbers at the left, and placing the letters of his unit by following the numbers across the top. Thus, with only a little concentration, he has the entire major

unit at one continuous writing. The decipherer, too, having restored his cryptogram unit to its block and written his two series of numbers, may read, or copy, continuously. The decipherer, in fact, uses the exact method which would produce a Nihilist cryptogram if a key were used in the “taking out” manner. What we have described is the encipherment of a single major unit; and all cryptograms must contain an exact number of these major units.

The second operation, that of taking off the cryptogram, is not always done by straight horizontals as we have shown this under (c) of Fig. 12. This, of course, is the expected way; but the Nihilist square is quite frequently taken off by some other one of the forty-odd routes possible to rectangular transpositions. The decipherer, knowing this route, merely writes his units back into their blocks; but the decryptor is often faced with a preliminary problem of discovering how they were taken off. Sometimes he must also discover how many units a cryptogram contains.

To understand how such problems are solved, it is necessary to pause and consider the make-up of ordinary written plaintext. English vowel-percentage, as mentioned, is about 40%, and practically never varies out of its limits 35%-45%. Each 40 vowels are fairly evenly distributed throughout their 100 letters. Take any English text whatever, not composed of initials or otherwise distorted, and, beginning where you please, mark it off into ten-letter segments and count the vowels in each of the segments. You will find that the majority of these have exactly the normal number of vowels, which is 4. Others will have 3 or 5, which, though outside of the limits 35%-45%, are the closest variations possible. It will be a rare segment indeed which contains fewer than 3 vowels or a greater number than 5.

But suppose, having marked off such a text into ten-letter units, or segments, we take each of these segments individually and mix up the order of its letters, though still allowing it to stand where it is. And suppose, having done this, we erase the original division-marks and, beginning at some point in the midst of a former segment, we again mark off a series of ten-letter units, and count the vowels of these new segments. This time, we are just as likely as not to find seven or eight vowels in one segment and none at all in the next, depending on just what we did to the old units, and still we have not actually mixed the units; we simply have our division marks in the wrong places. Imagine, then, how the vowel distribution can vary when a transposition is one so planned as to break up units and scramble their letters.

This fact of uniformity in vowel distribution is of enormous assistance in dealing with the simpler transpositions. For instance, it may be that what we want to know is the length of the units, and that what we have is a cryptogram of 144 letters, which could be a single square, or a series of 36-letter squares, or even a series of

16-letter or 9-letter squares. We may start at the beginning of this cryptogram and mark it off into equal segments of any length we like, afterward counting the vowels per segment. If every segment shows approximately a 40% vowel count, the chances are that we have a series of intact units, each one merely transposed within itself; but if one segment shows 50%, another 30%, another 28%, and so on, we may be quite sure that our division marks are in the wrong places.

Returning, now, to the Nihilist cipher, suppose we consider the make-up of its major unit, that is, of any one block. This major unit is a series of minor units, and each of these minor units, at the time of encipherment, was written by itself on its own line. In the beginning, it was a small fragment of plaintext, presumably conforming closely to a 40% vowel count. It is true that we placed it on the line in transposed order, but we did not remove any of its letters or add any new letters. Even in the transposal of the lines themselves, we merely removed a number of intact units from one place to another. There has never been a time, throughout the entire encipherment, when we took any letter out of its original minor unit and put it with some other unit. Thus, as we first see our completed Nihilist square, we still have, on each horizontal line, a small fragment of an English sentence in which all of the original vowels are still present. If such a block is now taken off by straight horizontals, it is no more than a series of intact units. To break up these units, we must at least take it out by verticals; and they will, of course, be much more thoroughly mixed when taken out by diagonals or spirals.

The decryptor, hoping for the best, writes his cryptogram into a square (or series of squares) by straight horizontals and counts the vowels per horizontal line. If his block is wide, he may estimate the actual number of vowels represented by 40%; if it is narrow, he may only roughly approximate the number; but in either case what he hopes to see is evenness of distribution. More than half of his units must be exactly normal, and any which are not exactly normal must show the smallest variation possible. If he finds that this is the case, he assumes that his block arrangement is the encipherer’s original square, with only the minor possibility that half of his lines may be written in the wrong direction. If his distribution is not uniform, he counts the vowels per column so as to find out what kind of distribution he would get from a vertical arrangement (ascending or descending). If this, too, fails to show him a uniform vowel distribution, he writes out a new block by the route of alternating verticals (or gets this count from his first block; this is possible, though a little confusing). Afterward, he may go on to the diagonals and spirals until finally he reaches the arrangement in which more than half of his horizontal lines show a 40% vowel count, and the rest a minimum variation.

Now let us consider a concrete example of decryptment. The (purely imaginary) history of the cryptogram shown as Fig. 14 is meager. It was taken from the body of an unnamed man, killed in attempting to dynamite a bridge in an American town called Baysport.

To begin with, the cipher appears to be transposition. Its cryptogram shows 37½% of vowels, very close to the number expected of English or German. It is

too short to provide any reliable distinction between these two languages, but the source of the cryptogram points to English. Again, the encipherer, although he has grouped his message in the usual fives, has neglected to complete his final group with a null, and from this we judge that 64 letters is the actual length of the message. The fact that 64 is a square is promptly noticed. But it is also the sum of several smaller squares, and the unit might be 16. To investigate this possibility, we may mark the cryptogram off into four equal segments of 16 letters each, and count the vowels per segment. The normal number of vowels in a 16-letter segment should be about 6, and segments of this length are long enough to afford reliable information, so that we may promptly discard the possible unit 16 when we find that the first segment shows 5 vowels (31%), the second, 7 vowels (44%), and the remaining two, respectively, 4 and 8. Such a distribution does not prove that the unit 16 is a total impossibility, because many things are not average in single examples, but it is an extremely bad one and would never be accepted. On the other hand, a satisfactory distribution does not prove absolutely that a given unit-length, or block arrangement, is correct. Here, had there been no question of the ever-present square, we might have been led astray by the unit 32, which divides the vowels of the present cryptogram into two equal halves. In this connection, we can only say that the decryptment of any cipher, even the simplest, will at times include a number of wanderings which we shall have to overlook in demonstrating principles.

Assuming, then, that the large unit, 64, is correct, we must get it back into its block — presumably square — in the encipherer’s original arrangement. Fig. 15 shows the same cryptogram written into two different blocks. For an 8-letter unit, the normal number of vowels is about 3 (actually 3.2). In block (a), a count taken on the horizontal lines shows half of the units normal, two of the others with the smallest possible variation, and two greatly outside the 35%-45% limits. When the unit is so short, and when the line containing only one vowel may be the one which was completed with nulls, and most particularly when we have no other units to act as a check, we cannot confidently discard a block of this kind. In practice, we might waste some time giving it a trial, or we might look for something better. Notice that its distribution is “ragged.” We expected to find even distribution, with more than half of the units exactly normal. This block (a) is the simple horizontal arrangement. To find out what the simple vertical arrangement would give us, we have only to examine the columns of this. Here the count is obviously bad.

In block (b), we have one of the diagonal rearrangements from which two sets of vowel counts can also be taken. Here, the horizontal lines have given us exactly what we hoped for: Evenness of distribution, more than half of the units normal, and only one unit outside of limits. This, almost surely, is the encipherer’s original block, in which every line contains one intact unit.

From our meager history of the case, we do not, of course, know that this is specifically the Nihilist cipher. It becomes a case of considering the various ciphers

with which we happen to be acquainted, and a columnar transposition of the general kind shown in Fig. 11 is an exceedingly common case. Moreover, a series of juggled columns is suggested here in the fact that intact units are standing on their own lines and still have not resulted in plaintext.

In Fig. 16, we have the successive steps which would be taken in order to investigate this probability. At (a), the diagonal rearrangement of our cryptogram, selected as the most likely of those which were examined, has been repeated with its eight columns set wide apart, and consecutively numbered for identification. These presumed columns are now cut apart, and thus we have eight paper strips which can be moved about and rearranged in various manners in the hope of causing words to form on some of the lines.

Since we lack that most powerful of decrypting tools, a probable word, we are forced to begin with probable letter-sequence. If the magic letter Q were present, we should look for a companion U, and after that for a vowel to follow QU. But this, too, is lacking.

Familiarity with English digrams (or, in the case of the beginner, an inspection of the digram chart or the list of digrams) shows that TH is by far the most frequent combination used in the language, and that HE and HA, also including an H, are very prominent among the leaders. Further than this, the list of trigrams informs us that both THE and THA are of outstanding frequency. Of the four letters included, three are so frequent, and appear in so many different combinations, as to be confusing; but H, though belonging to the high-frequency group, does not appear in many different combinations, and is less frequent than the other three.

Looking, then, for H, we find it twice in our present cryptogram, once on the second row and once on the seventh; and, since the seventh row shows two T’s and the second only one T, suppose we try the second row, placing together the two columns (strips) which are headed by the numbers 6-5 in order to set up a digram TH on the second row, as shown at (b).

The formation of this digram TH on the second row has automatically set up a digram NG on the top row, a digram RI on the third row, and so on; and we find, upon examining these newly-formed digrams, that the whole series is made up of good English combinations. Thus, it looks as if our combination 6-5 is correct, and we will proceed with a possible HE or HA, attempting to complete a trigram THE or THA on the second row.

Both E and A are present on the second row, and we may observe at the steps marked (c) and (d) in the figure just what would be the result of adding strip 7 or strip 3. At first glance, it appears that combinations 6-5-7 and 6-5-3 are about equally probable. But it so happens that both set-ups have formed a sequence YO on the fifth line, suggesting YOU; and when the only U on that line is tried in both places, it becomes evident that combination 6-5-7-4 is going to give better results than combination 6-5-3-4, where we find poor sequences like KEFH. At this point, or earlier, a decryptor will probably proceed on the left side of his set-up, completing the syllable ING and the series of column-numbers 1-6-5-7-4, as shown. When this setting together of columns automatically brings out on the third row a sequence BRIDG, we have our first suggestion of a probable word, since the man who had this cryptogram on his person had just attempted to blow up a BRIDGE. After this, all is plain sailing; the necessary E happens to be on the same line, and even if it were not, we have only three strips left, and these may be placed by trial. Thus our eight paper strips arrive at the stage indicated on the left-hand side of Fig. 17.

If we have previously met the Nihilist transposition, we can see now what the cipher is, and, if it is a true Nihilist, we can finish the reconstruction by decipherment with the key. To do this, we simply number the rows from 1 to 8 and then disarrange these rows so that their numbers will reproduce the series of column numbers. This is shown on the right-hand side of Fig. 17, where the plaintext is easily read: “By the drawing of lots, it falls to you to take the first move. Viaduct bridge.” The gentleman required three nulls, and thriftily made use of them as punctuation. If we have not previously met the Nihilist encipherment, or if this cryptogram is of a kindred type but governed by two separate keys, one for columns and another for rows, the only difference is that we may have to experiment a little with rows before finding their correct order.

In completing our solution, we have obtained a key, 2 1 6 5 7 4 8 3, shown in the series of column-numbers, and should other cryptograms be intercepted having the same key as the first, we need merely decipher them with our key. It is, however, a “taking out” key, while the Nihilist, as we have seen, is ordinarily written in. Having either of the keys, we may find the other easily enough as suggested in the figure. Simply “number the numbers” and put them back in serial order. The new set of numbers, now disarranged, will show you the other key. It would not be impossible for the student who is a good guesser to find the keyword on which our present writing-in key was based. This kind of work, with paper strips, is much more rapid than it probably seems, and is often done at random. The keen eye needs no digram list for the spotting of HT, merely reversed, with GN above it.

Speaking now of the ordinary columnars (Fig. 11), one minor point should perhaps be brought to the attention of the very new student. Quite often, a digram, such as the QU of Fig. 18, is not written on a single line, and it may be necessary to match this valuable digram in the manner shown at (b) of that figure, coming out in the end as at (c). In such event, we can later on transfer columns 5-6-7 to the other side of the block, raising them all by one position. (Column numbers, in this case, are for reference only.) The same would not apply to a Nihilist block in which the whereabouts of the “next” row is unknown; the digram QU would have to be abandoned in favor of something else.

We mentioned briefly, too, the possibility of finding alternating horizontals, so that only half of the rows can be “anagrammed” together. Such minor problems, and they are numerous, can all be ironed out easily enough once the student is familiar with his type, and columnar transposition, encountered frequently and in all sorts of disguises, is surely the most fascinating of all types. In [Chapter VI] we are to meet it again, this time with an incomplete rectangle.

16. By PICCOLA. (Ordinary columnar).
O E E H E A T F L S V A S Y C I O A E D Q O H D F M C M T C P O G E O
R E U G M I E F U O G C Y W G D Q U U I A L S I E R N O R N R R A T O A Q.
17. By KRIS KROST. (Nihilist).
T C I G R H N L A G T L I S A A O M O R N R I M N N E T R N K S A O E
I S D L E I K H H H E R D F T A S O I E T I H N E B T K E.
18. By MERLIN. (Nihilist. Its keyword has been used as a word-spacer).
T O L F P T E E R B I V O P S N R E W O R L I T T E S E N E T O O H O
F H H E H N Y H I O P F O S T G I P H E I E E T K I N U I B N R A A Y
R R E E W L S T H T E E R D T S E A I R S R E A E R R E P E U E U R S
S U I R R O F E S T R P O P A O R R B E E O N T T E E R T A H E R A R
L A D I O E E Z E L Y A O A Y M S L U L W I Y N N O O S S T G T S H L
W E Y M D M E A R E E U R I Y T P P R N Y N T Y O.
19. By SLEEPY. (Nihilist "route-cipher").
Wants Little Wish Should Long Muster But The Man And Gold Wants If Me
Many Below Mint For Not A So And Nor Of More With Score In Song Wants
Were I That Told Exactly Are Here A Long 'Tis Many 'Tis My But Each
Still Little Would So!

20. By TITOGI. (Ordinary columnar).
T W E I S I A H O D S P O D E R I T O N J E U T A I A S Y S H N T S T
K D N R S W U.
21. By PICCOLA. (Ordinary columnar).
T E E P H B M E F E B N T U X A V E H A R D W X I E L N C V E V R O I
T A F U L B O R O N T H M T M U E F S H O E T T L E D A K E E G D N L
E E N N I O O E B E E E R S T N R Y D C N X O N O E N E X.
(And now try this. Probable word: EXAMPLE).
H E L K L T I P N W H S E S I A X S R R E E A C M C P L T L T E O S D
R A O E E X T I H Y E U H N G E M Y T A S L M A A D S C.

CHAPTER V
Geometrical Types — The Turning Grille

The well-known turning grille, also known as the rotating, or revolving grille, is said to have been originated by an Italian, Girolamo Cardano (or Cardan). Such grilles can be prepared from any substantial material capable of being made into sheets and marked into cells, and may take the form of any geometrical figure which happens to be equilateral. The number of cells to be clipped out, so as to form apertures for the writing of letters, is based on the shape of the grille, as: one-third of the total number for a triangle, one-fourth for a square, and so on; and the writing of the letters is done on a section of paper of the same size and shape as the grille, and preferably ruled off into cells which correspond to those of the grille. After such a grille has been placed on its corresponding section of paper, and a letter has been written through each aperture, the grille is turned a certain number of degrees to a new position on the same section of paper, so as to cover from sight the letters already written, and expose another series of blank cells for the writing of new letters; and this continues until the grille has taken its full number of positions and every cell has been accounted for on the section of paper beneath it. The preferred grille is a square, based on square cells, and takes four positions. Usually it is based on an even number of these cells; otherwise, the full number of cells is not evenly divisible into quarters, leaving an extra central cell which has to be omitted or specially dealt with.

The grille called “Fleissner,” after an Austrian cryptologist, Eduard Fleissner von Wostrowitz, is the perfected Cardan grille as described by Jules Verne in his story, “Mathias Sandorf.” Colonel Fleissner’s grille is a square, taking four positions, and is always based on an even number of cells. In preparing this grille, it is easy enough to select apertures at random in such a way that each one governs its own four cells on the paper beneath, causing each of these to be uncovered exactly once. But concerning the preparation of the grille, there is a phase which affects the value of the cipher itself: unless the grille can be constructed at will, in accordance with a key which is “easily changed, communicated, and remembered,” it requires the keeping on hand of a material apparatus which can be stolen or copied, or which cannot be destroyed in case of emergency.

There are, of course, many ways in which a key could be applied. The method used here is one published several years ago by Ohaver, and can be studied in Fig. 19. First, as shown at (a), we have a quick mechanical method for selecting apertures that cannot conflict. The square is divided into four quarters, and each quarter, treated as if it were the one occupying the upper left-hand corner, receives its consecutive cell numbers, 1 to 9 (or 1 to 4, 1 to 16, 1 to 25, 1 to 36, etc.). If the route of writing-in is made exactly the same for all four of the quarters, it becomes possible to clip one each of the numerals 1, 2, 3, 4, 5 . . . . . . . etc., taken absolutely at pleasure, and each resulting aperture will expose only its particular four cells. This can be seen at (b).

The grille shown at (b), however, was based on the key-phrase FRIENDLY GROUPS, and the method can be studied at (c), following Ohaver’s plan, even to its minute details. The fact that the square is based on 6 is told in the initial letter of the key-word, F, 6th letter of the alphabet. This key-word must yield nine letters, one for each proposed aperture in the grille. A short word, such as FRIEND, can be lengthened by a partial repetition, as FRIENDFRI, while a longer word is cut off after its ninth letter, as it was in Fig. 19. This literal key is next converted to a numerical key, as explained in the [preceding chapter], and the nine resulting numbers are divided as evenly as possible into four sections. Finally, considering the four quarters of the grille in some definitely agreed rotation, each section of key-numbers will show what numerals are to be clipped from a given quarter. In the figure, the numerals 3 and 8 were clipped from the first quarter, numerals 5 and 2 from the second — proceeding in a clockwise direction, — numerals 7 and 1 from the third quarter, and numerals 6, 9, and 4 from the remaining quarter.

Figure 19 - Preparation of a Grille (a) (b) (c) F R I E N D L Y G 3 8.5 2.7 1.6 9 4 1st Q: 3,8; 2d: 5,2; 3d: 7,1; 4th: 6,9,4

Another method for selecting cells, proposed by Edward Nickerson, dispenses with numerals, using in their places the letters of a key-word which must be without repetitions, as FRIENDLY G happens to be. If these nine letters, all different, be written into the nine cells of each quarter, following exactly the same route in each case, it becomes possible to clip one each of the letters F, R, I, E, N, D, L, Y, G, taken wherever desired. The choice can be made as follows: Taking the four quarters of the grille in the agreed rotation, follow the normal alphabet, clipping A, (when present,) from the first quarter, B, (when present,) from the second quarter, C, (when present,) from the third quarter, and so on. Or, to insure a more even distribution, rearrange the nine letters in alphabetical sequence: D E, F G, I L, N R Y, and divide as in the former plan, clipping D and E from the first quarter, F and G from the second, and so on. While it is possible to provide key-phrases of sixteen letters, without repeating, it is probably more convenient to take whatever number of letters is needed from a key-mixed alphabet of the following type: F R I E N D L Y G O U P S A B C . . . . . . W X Z f r i e . . . . . .

In Fig. 20, at (a), (b), (c), (d), we have a detailed picture of the operation of this grille on the 36-letter plaintext unit: MISFIRE ON VIADUCT JOB X RUSH INSTRUCTIONS. One definite edge of the grille must be designated as the top, and there is a right and a wrong side. Taking precautions in these respects, we place the grille over a sheet of paper and mark its outline with a pencil (or otherwise make sure of maintaining this one location). We write the first nine letters as at (a), and give the grille a quarter-turn to the right. We add the second nine letters as at (b) — where the newly-written letters are the capitals; the others, in lower case, are presumed to be hidden from sight by the solid portion of the grille. Another quarter-turn makes ready for the next nine letters (c), and a remaining quarter-turn completes the revolution (d). The writing-in, at all times, is straight ahead: cells taken from left to right, and lines taken from top to bottom.

Figure 20 - Four Stages of Encipherment (a) (b) (c) (d)

In the Jules Verne story, the three units of his cryptogram were left standing in their blocks. Verne’s heroes were clever enough to unearth a ready-made grille, and, by laying this, in its four successive positions, above each of the three blocks, were able to read the message through the apertures. Today, such blocks would be taken off in five-letter groups, and possibly by a devious route. A little concealment can be afforded, too, by completing the last five-letter group with nulls, or, better, by adding these nulls at the beginning of the cryptogram. It is also possible to make the final 36-letter unit incomplete by blanking out its bottom cells before putting in the letters.

A grille can be used in other ways. Negligible changes can be produced in its cryptograms by altering the customary order of its four positions. A more substantial change is introduced by departures from the straight horizontal direction of the writing-in. It is possible to revolve the paper instead of the grille, setting the letters right-side-up at the time of their taking off. And in all of these cases, the grille is still serving as an instrument for writing-in; there would be corresponding cases in which it is used as an instrument for taking out the letters of a prepared block. Each variation, perhaps, would require its own separate analysis before its individual inherent weaknesses could be spotted and used as the basis for a special method. If the student, after observing some special methods applied to ordinary grille encipherment, cares to try his hand at analyzing some one of its variations, we suggest that he take a series of numbers, 1 to 36, 1 to 64, etc., and carry these through a complete encipherment to see what becomes of each one.

Grille transposition, like the Nihilist, involves a major unit composed of minor units. But here, the four minor units are never left intact, and if the type of encipherment is not known in advance, the decryptment of a single block will give somewhat more trouble than the decryptment of a single Nihilist block, for the reason that the decryptor usually exhausts the simpler possibilities before trying the complex. With grille encipherment known, or suspected, we have a cipher bristling with points of attack.

The strictly horizontal writing-in of each minor unit has had to be done within a fairly short compass, and no two consecutive letters of this unit can have been placed very far apart without causing other letters to draw closer together. Their average distance apart is four cells. For the decryptor, this actual distance apart of letters is made shorter by his knowledge that for each letter considered, there are three others which cannot have been written into the same unit with it, and that he knows definitely what these three letters are.

Particularly interesting is the assistance he receives from the symmetrical pattern into which the letters of his four units are written; position 3 is position 1 reversed, and position 4 is position 2 reversed. Thus, having tentatively selected the letters of a probable word, or fairly long sequence, he can check the correctness of his observations by examining another sequence which would automatically build up, traveling in the opposite direction, in the reverse position of the grille.

For a clear understanding of these matters, suppose we consider the decryptment of the block just enciphered, on the assumption that we suspect the presence there of the word VIADUCT. Fig. 21 shows a 6 x 6 block carrying consecutive cell-numbers, which are also the serial numbers of the cryptogram letters, as these appear in a separate block beside the first. It is understood that our first move would be that of ascertaining whether or not the seven letters of this word are all present. It must be remembered, too, that a long word is not necessarily altogether in one unit; the grille might have been turned before the word was completed.

In the present case, however, our first letter, V, is found near the top of the square, and only once, so that if the word VIADUCT is present, a substantial portion of it must have been written before the grille was turned. We expect to find letters I, A, D, U, and so on, following the letter V in just that order, and without any very great distance between any two of them; and if, approaching the bottom of the square, we find it necessary to proceed backward for U, C, or T, then the grille was surely turned before that U, C, or T, was written.

Now, considering together the two blocks of Fig. 21, we find that our first letter, V, occupies cell No. 7. In imagination, we revolve a grille in which the only aperture has been cut in cell 7, and find that this aperture exposes the cells numbered 5, 30, and 32. These three cells, then, were surely covered from sight when the letter V was written into cell 7, and regardless of what the letters are that occupy these three cells, it is definitely impossible that any one of the three could have been used in the same minor unit with the V of cell 7.

Looking for a letter I, we find several within a very short range. But the block contains only one A, and since we cannot proceed backward after selecting the I, the position of A (cell 10) tells us that only the I of cell 9 is possible. We accept, then, the I of cell 9, and, again revolving an imaginary grille with its only aperture cut in cell 9, we eliminate the letters found in cells 17, 28, and 20. Similarly, accepting A of cell 10, we eliminate whatever letters are occupying cells 23, 27, and 14. So far, none of the letters eliminated have been wanted for the development of the word VIADUCT; but notice that the fourth letter, D, found only once in the block, occupies cell 15, thus eliminating the letters of cells 16, 22, and 21, one of which is U, the next letter needed. Thus, we are not forced to make a decision as between the U of cell 16 and the U of cell 18.

We have put together, then, the letters V I A D U in the only manner which is possible at all, and their cell-numbers, taken in order, are 7-9-10-15-18. If the grille is reversed, these same openings, named in the same order, will uncover cells 30-28-27-22-19; these new cells, however, will not be seen in reverse order; they will be in straight order like their letters. If, then, our sequence V I A D U is correct, the five letters found in cells 19-22-27-28-30, taken in normal order, should form an acceptable English combination. A glance at the right-hand block of Fig. 21 will show that this check-sequence is T I O N S.

When we selected V, we automatically selected S of cell 30 as its check-letter. When we added I on the right-hand side of V, we obtained with it the N of cell 28 on the left side of S, giving the check-digram as NS, entirely acceptable. With A, we added the O of cell 27, giving the check-trigram as ONS, still acceptable; and so on to IONS, TIONS. Our complete word VIADUCT produces the check-sequence UCTIONS. It must not be objected that the fact of having only one each of letters V, A, D, has too greatly facilitated the search. This is an entirely legitimate expectation in a case where we deal with one unit, and the decryptor, when possible, chooses his probable word with this in mind. In the absence of a probable word, we are never without probable sequences: the list of frequent trigrams, and the various common affIxes, such as -TION, -MENT, -ENCE, -ABLE, CON-, PRE-, etc. For the first three or four letters, where decisions are sometimes uncertain, it is more satisfactory to work directly on the square (prepared in ink), so that impossible cells may be canceled in pencil, and the pencil marks erased when wrong; but once well started, a paper or celluloid grille can be prepared to fit the block, and the chosen cells actually cut out as they are selected. Having found seven out of nine apertures, we may, if we like, turn the paper grille and experiment with its other two positions. The letters, in this case, will show gaps in sequence, and may indicate by these gaps just where the new openings ought to be cut. With one full unit determined, we have the grille for reading the others. The only remaining problem would be that of deciding the exact sequence of these four units, with their context as a guide.

For the case in which it is necessary to begin with letter-sequences, particularly if driven back to the digram list, the device shown in Fig. 22 may prove of considerable assistance: The cryptogram is written in both directions, and thus pairs every letter with its check-letter, so that check-sequences here would be written backward. This idea is adapted from General Givierge’s Cours de cryptographie.

Working with digrams is tedious, but will, in the end, give results. Considering, for instance, Fig. 22, its first letter is B. Of letters standing immediately to the right of B, the first one which would form a good digram with it is the R of cell 4. But consideration of a possible digram BR, cells 1-4, shows the check-digram as JN, cells 33-36, and this latter digram is so rare in the language that Meaker did not find it even once in his 10,000-letter text. The next letter known to have an affnity for B is the U of cell 6, but a possible digram BU, cells 1-6, cannot be considered, for the reason that cells 1 and 6 are uncovered by the same opening in the grille. The distance away of the next letters to which B is partial proves frightening, and B is abandoned (it is actually followed by the X of cell 5).

Beginning over, with T of cell 2: The first frequent digram noticed is TR, cells 2-4, and shows the check-digram as JO, cells 33-35. We accept this at once,

because the letter J must presumably be followed by a vowel, and the only vowel immediately available is this particular O. To extend the accepted TR, we require a vowel. The first one is U, cell 6, and extends the check-digram to TJO, cells 31-33-35, acceptable if T is the final letter of a word. To extend the supposed trigram TRU, we experiment with C of cell 8 and obtain a check-sequence CTJO, cells 29-31-33-35, which is still encouraging. We must know, of course, that no two of the chosen cells are in conflict with each other. The unit we have partially reconstructed is the second one of Fig. 20, and the check-sequence is the fourth unit.

A method somewhat resembling the foregoing consists in writing another block beside the first, in which the letters of the cryptogram are strictly in reversed order. The pattern of the check-sequence will then follow exactly that of the sequence under examination, merely with its letters in reverse order. Still a further suggestion was made by Herbert Raines: In the preparation of the two blocks, one in straight order and the other in reverse order, the writing should be done vertically, with all columns containing four letters. The symmetry can still be found, and any two consecutive plaintext letters are more nearly at their original distance apart — the average 4.

So far, we have been dealing with an isolated unit. In Fig. 23 we have a longer cryptogram, suspected of being a reply to the first. We have set it up in its three blocks, expecting to decipher it with the same grille, but find that something is wrong. To see quickly how the presence of several units modifies the case, suppose we consider some sequence, right or wrong, which is easily examined, such as the AVE on the second row of the first block. Regardless of what the transposition is, if all three of these units are enciphered alike, each of the additional blocks contains a corresponding trigram in exactly the same location as the one under consideration; here we have NES in the second block and ANK in the third. But if the transposition is specifically that of the grille, each one of the three trigrams AVE, NES, ANK, has a check-trigram in its own block. Thus we have the six trigrams listed with their cell-numbers in Fig. 24. Since all of these are acceptable, we should, in practice, be encouraged to accept them; thus, it may be well to say here that, in dealing with all ciphers these false beginnings will quite frequently pitch the decryptor headlong into a solution, through no act of wisdom on his own part.

Now, in order to arm ourselves against the larger grilles, which are somewhat more troublesome, and for investigation of cryptograms which may or may not have been accomplished with a grille, suppose we take a look at Ohaver’s mechanical method — that is, his use of paper strips. Picturing any block of 36 cells, numbered consecutively as we saw these in Fig. 21, let us imagine that there is a grille placed over this block, and that this grille has only one opening. If the cell that shows is No. 1, then, at the first turn of the grille, we uncover cell No. 6; at the next turn, cell No. 36; and, at the final turn, cell No. 31. We will call this series of cell-numbers an index, and say that the index for this particular aperture is 1-6-36-31. In the first block of the new cryptogram, the letters which follow this index are R O P T. In the second block, the same index governs the letters U B V L, and, in the third block, A E X H. But if the single opening in our hypothetical grille has exposed cell No. 2, then its index, discovered in the same way, is 2-12-35-25, and the corresponding letters, in the three blocks of this cryptogram are, respectively, R U E A, E I T X, and G S E R. Similarly, each one of the other seven apertures possible in this quarter of the grille has an index, expressible in cell-numbers, and governs a certain series of letters in each cryptogram block. If the grille is the Fleissner, the index for any aperture, in a grille of any size, will always contain four numbers, and will govern four letters per block.

If the grille is a 16-letter one, there will be only four of these indices, beginning in cells 1, 2, 5, 6. If it is a 36-letter grille, there will be nine, beginning in cells 1, 2, 3, 7, 8, 9, 13, 14, 15. A 64-letter grille will have 16, beginning in cells 1, 2, 3, 4, 9, 10, 11, 12, 17, 18, 19, 20, 25, 26, 27, 28; and so on to grilles of 100, 144, etc., letters. After one grows accustomed to the swastika-like route of the open cell, such indices are not at all difficult to prepare at the moment of need; however, many solvers prefer to make them up in sets, once for all, and have them ready as they happen to be wanted. As to the finding of the four letters per block which follow any one index, it is sufficient to remember that the cell numbers, arranged in the manner shown, are also the serial numbers of the letters belonging to any one unit. Thus it is not necessary to write the units into their squares; we need merely number the letters of a unit from 1 to 36, and select those having the desired serial numbers.

Returning, now, to our cryptogram: Our unit appears to be 36, since a division of this kind distributes the vowels uniformly; and a unit of 36 may have been produced with a grille. If so, this grille had 9 apertures, and we need 9 paper strips, one for each aperture. On each strip we are to have: the four index numbers, the four corresponding letters from the first block, the four corresponding letters from the second block, and the four corresponding letters from the third block. But since, in each case, the first three cell-numbers or the first three letters must be repeated, our strip will actually contain seven numbers and twenty-one

letters. These nine strips are prepared all in one set-up, the details of which can be examined in Fig. 25. In Fig. 26, the strips of Fig. 25 have been cut apart and rearranged in such a way as to bring out plaintext on the top row of every block; this is, of course, the first full row, as pointed out in each case by the four asterisks. It will be noticed that the top row of cell-numbers is arranged in strictly ascending order (our strictly horizontal route of writing-in). If the third row be now examined (as pointed out by two asterisks), it is found that this, too, carries plaintext, merely written backward, and that here the cell-numbers are arranged in strictly descending order.

Now, to read the cryptogram: Each full row of numbers includes all cell-numbers belonging to some one of the four units, and any one of these four rows of numbers is a key to the grille, since it shows exactly what cells were uncovered when the corresponding unit was written in. To obtain the grille, we have only to select some one row of numbers, as 12-36-10-16-34-9-26-32-13, and clip out these particular cells in a square numbered as we saw it in Fig. 21. The student who cares to know what “instructions” were being sent might also satisfy his curiosity as to whether or not this new cryptogram could have been deciphered rather than decrypted.

Concerning the grille cryptograms which follow, it seems not impossible that the student who has seen his principles applied only to a unit of 36 might find some difficulty in adjusting them to grilles of other sizes. A tip, then, on [Example 22]: Instead of the regulation nulls, its single unit was completed with a common Spanish phrase beginning with Q. And if it still resists: the author’s own name was used as the key for constructing the grille.

In adjusting his paper strips (when this is the method he prefers) it makes no particular difference what plan he follows, so long as it works. Some decryptors prefer to concentrate altogether on the strictly ascending series of cell-numbers, allowing letters to form their own sequences. Others will always have before them the set-up of squares, noting there some possible letter-sequence, finding (by means of their cell-numbers) the strips which contain these letters, and then observing results in other blocks. If the given strip cannot be found, then the cell must be already in use.

The shortest road is that of the probable word. For instance, the set-up shown as Fig. 26 was actually initiated by the solver at the letter J of the second block, this being a rare letter and almost invariably followed by a vowel. Of the several vowels immediately in sight (in the square) the correct one was promptly suggested by the sequence so plainly in sight, OB, suggesting the word JOB, one already used by these people in discussing their mysterious activities. The corresponding cell-numbers, 20-29-30, were found to be on three separate strips — a necessary condition — and when placed together brought out the straight sequences RID and OLE, with reversed sequences AVE, NEU, and AND. Another very probable word was suggested by the check-sequence AVE (HAVE), and the necessary H was found with cell-number 33, bringing solution to the point suggested roughly in Fig. 27, where attention was promptly focussed on the tetragram RIDG, suggesting BRIDGE, another word previously used. There were two strips carrying the desired E, but both refused to fit; and here the cell-numbers came into play. The last one found, 33, was large and suggested that its letter, G, might be the last letter of a unit; afterward, the building was continued on the left, with B.

22. By PICCOLA. (Probable word: CRYPTOGRAMS).
T S T H E T T U S H O E D G F R D O E O G R I S A A M S N M Q E U G I
B R I E L N O S T H S I C L S E T S W A T H A B R Y P A E.
23. By DAMONOMAD and POPPY. (Probable word: RIGHT FLANK).
A E K D S P V T O O N N A A O N R O N P R O C T I E H T R E H N E T I
A F G S R H T N I L O V T E F F A L M K I E C L A A S N M.
24. By DAMONOMAD and POPPY. (Probable word: SPECIAL MESSENGER).
E Y U I S S N S F P A O P E R I S C O A M N R A I R G A A T A L I M N
E G E E I S O S N O S A D N B E I T N O N G U E P R H T E E W S R U A
S S K V Y P I T O N O U E Y S O C M W O T N S T E U O B D G.
25. By SAHIB.
R N I I I N G T F L A I L N N D E E T D R V E U S E S T H R E I G E Y
F I A N O U R R D L G Y T N H A E O N R N E K C D E E I S E Y B S E F
W Y P G R L O L O E U O F H P A T V E R E H E R A E D G M I T R H N E
E I S Y T Q T S I I S A U S G I E A I C A S L L K L L T T X H V H E A
R X A X.
26. By NEMO.
I K O T H N N E H N E E I R C R A G E L O R N O H K T W T C H O H E I
E S S W W T N E T R H A R E O L S P L A A G E A E R L D B R Y E U I T
R T R E N I D T H E I A D E I E N D P D A B R A E C R K E M T A O A U
T O T S Y N B P E S N U H E S R A H E S U P D.

27. By DAN SURR.
O L T L A L I G E R T I V H E L L E R K I E A E I J F E I Y Y O O U U
S T H E A V A S G Y A S A W C K E P L U E Z T I Z O S I T.
28. By PICCOLA. (This is not a grille. It's a serious matter!)
H S O E S N P T A E T O H I S T W L E D T T F A I B T Y U Y O T C E O
I I T R C Y S B T R A H B T E I D O U S C I U O K R O Q N.

CHAPTER VI
Irregular Types — Columnar Transposition

Square units, in actual use, are less convenient than those rectangular encipherments in which only one dimension of the block is restricted, thus permitting that a single key govern messages of many different lengths. We have a more practical cipher in the columnar transposition of [Chapter IV], and this can be rendered somewhat safer if care be taken to avoid completing the rectangle. The preparation of such a block is illustrated in Fig. 28, where the key-word PARADISE is being used to encipher the following text: REGRET CHANGE IN SYSTEMS BUT THOUGHT ADVISABLE ACCOUNT INCREASED VOLUME SENT BY AIR.

First, let us understand the purpose of the four nulls. It is customary, when cryptograms are to be transmitted by wire or radio, to make them evenly divisible into five-letter groups. This usually means the addition of from one to four nulls, and since the nature of the cipher makes it inadvisable that additional letters be added to the enciphered cryptogram, any desired nulls must be added in the block before the columns are taken off. Another precaution usually recommended is the avoidance altogether of key-lengths which are divisible by 5, so that an encipherer is practically never compelled to add a complete five-letter group in order to leave his rectangle incomplete. It might be added that our use of letters XXXX is for emphasis only; a better series would be one of the nature AAEO.

The decipherer’s only problem is illustrated in Fig. 29. Knowing the key, the decipherer knows that there must be eight columns. The number of letters, 75, divided by 8, results in 9, with remainder 3; thus, the short columns are to contain nine letters, and there will be three which contain ten letters. He lays out an 8 x 10 block, cancels the last five cells, writes his key-numbers across the tops of the columns, and then begins to copy letters, filling the column numbered 1, then the column numbered 2, and so on, finally reading his message by straight horizontals.

The cryptogram from this block is shown as Fig. 30, and illustrates the manner in which the decryptor will number the letters of practically all cryptograms in order that he may quickly locate any desired letter, or learn, by subtraction, the distance apart of any two letters. The decryptor, of course, does not know how many columns the cryptogram contains, and even after he finds out the key-length, he still does not know exactly the point at which any one column ends and another begins.

This form of transposition is among the most fascinating of decryptment problems, and we shall look at it from several angles. The simplest case is that in which the decryptor correctly assumes the presence in his cryptogram of some word or phrase whose length is greater than that of the key; if this probable word is long enough, he is able to learn, not only the key-length, but the order in which to write his columns. Our present cryptogram, for instance, has key-length 8, and contains

two nine-letter words, ADVISABLE and INCREASED. These two words, repeated in Fig. 31, will show what happens when a word is long enough to overlap the block. With the word ADVISABLE, the final E falls below the initial A, and when this column is taken off, the letters A E will stand in sequence in the cryptogram. Similarly, the word INCREASED will provide, in the cryptogram, a digram ID. Should the decryptor suspect the presence of either of these words, he would look at once for sequences of this kind in his cryptogram, and the presence of AE (or ID) would tell him that the key-length is probably 8, which is the distance apart of the two letters in his probable word.

The ideal case is that in which the probable word is long enough to furnish more than one of these overlapping letters, as shown in Fig. 32 in connection with the “word” INCREASED VOLUME. Suppose that we have suspected the presence of this expression in our cryptogram, and have ascertained that the necessary letters are present for forming it. We consider its letters one by one, in the order I, N, C, R . . . . and go through the cryptogram, underscoring (or otherwise noting) all cases in which the given letter is followed immediately by another of the letters found in the same probable “word.” But, in considering any one letter, say the letter N, we ignore such sequences as NT, NB, NX, whose second letters, T, B, X, do not occur in the expression INCREASED VOLUME. Fig. 33 shows exactly what digrams of this kind can be found in connection with letters I, N, C, R, E, and also the distance (or distances) apart of the two given letters as found in the probable word. Notice that in connection with every letter there is one digram in which this distance is 8, the correct key-length of our present cryptogram. And when these digrams are selected from the tabulation, and set up vertically with top letters in the order I N C R E, the lower five letters prove up in the order D V O L U. In actual work, the tabulation must sometimes be made, though ordinarily it will suffice to start directly with the “proving up.”

Now let us go ahead and solve the cryptogram, as shown in Fig. 34. We will assume, to begin with, that our cryptogram has been prepared at the top of a sheet, and that our various trials are being made on the blank space beneath it. We will assume also that, having discovered key-length 8, we have divided this cryptogram roughly into eight segments, three of which contain ten letters and the rest nine.

First, we are in possession of a series of embryo columns, shown at (a), and these can be set up without looking at the cryptogram at all. Having done this, we turn to the cryptogram, find each one of the sequences again, and lengthen the columns of our beginning block by adding to each pair of letters a few of the letters which immediately precede and follow it. Thus, our block begins to build up as at (b); and, for each time that a partial column is set up in (b), the segment which contained it is promptly circled out of the cryptogram itself, which now begins to assume the appearance indicated at (c). Thus some words have automatically formed on the new lines which tell us plainly that the final column must contain a sequence L T E, followed by S or W, and the appearance of the cryptogram tells us plainly where to look for it; the final segment is the only one having enough letters to furnish another nine- or ten-letter column.

At stage (c), we are practically in possession of the numerical key, and to show this, the cryptogram segments have been numbered. The first one, containing V C C O T X, has been set up in the partial block as column 3; thus the third column of (b) should have key-number 1. The second segment, containing S O E U Y E, has been set up as column 5, showing that the fifth column of (b) should have key-number 2. And so on with the rest, until the eight key-numbers are standing in the order 4-6-1-7-2-3-5-8. This is shown at (d), and directly below this, at (e) is the encipherer’s original key. It can be seen that we are now in very much the same position as the legitimate decipherer; by making a few trials, each time shifting one key-number from the left side to the right, we need do little more than decipher. Usually, however, it is quicker simply to go on and rough out the block we have already started, and then make the necessary adjustments, approximately as shown in Fig. 35. Having noted, in the cryptogram, that there are some unused letters,

E N T H, on the left side of segment 1, we assume temporarily that all other unused letters belong to the segment which follows them, and add them all, indiscriminately, at the top of the block. Where this is shown, at the left side of Fig. 35, the true key-numbers, as found in the cryptogram, have been added above the original reference numbers, and similarly with the adjusted block on the right.

With the block roughed out, and knowing that a cryptogram of 75 letters using key-length 8 cannot have columns of any other length than 9 and 10, the first obvious maladjustment is seen in column 1 (key 4), which has only 8 letters. Since this is the 4th segment of the cryptogram, its remaining letter (or its remaining two letters) will have to be found at the end of the third segment or at the beginning

of the fifth (keys 3 and 5), that is, at the bottom, or at the top, respectively, of the columns originally set up as columns 6 and 7. The selection of H from the bottom of column 6 leaves this column too short, while the top row of the block shows a gap in sequence, and evidently needs the E at the end of the second segment. The lone R which remains at the bottom of column 7 is then erased and written at the top of column 2, and thus we arrive at the adjustment shown on the right side of the figure, where the only remaining operation will be that of transferring the misplaced nine-letter column to its own side of the block. This final adjustment shows us the segments of the cryptogram in their key order: 6-1-7-2-3-5-8-4.

Having seen the ideal case, the student will understand how the less perfect example would be handled, or the case in which the probable word is not long enough to overlap at all. For the latter, he would attempt to find some word like CRYPTOGRAM, in which there are letters such as C, Y, P, G, M, not likely to appear more than once or twice in a short text. We need not discuss this latter case, since we are to see something very much like it before the present chapter ends.

Now, as a preliminary to those cases in which we are unable to find a probable word, suppose we turn to the back of the book, and make an inspection of the tool chest. First in importance, and valuable in ciphers of all kinds, is the digram chart which O. Phelps Meaker has been kind enough to prepare especially for this text. To learn how often he encountered any given digram in his 10,000-letter count, note its first letter in the horizontal alphabet, at the top of a column, then note its second letter in the vertical alphabet, at the beginning of a row, and observe the figure which occupies the cell at the intersection of this column and row. If the digram is TH, its frequency was 315; if the digram is JN, the cell is blank. This does not mean that the digram TH will appear exactly 315 times in any other 10,000-letter text, or that JN will never be found (occurring, say, as initials). It merely shows that the digram TH is of remarkably high frequency, while a digram JN is so rare that it practically never appears. The most commonly occurring digrams of this chart have been listed on another page in the order of decreasing frequencies. A list of the principal reversals is also given, with other data which will be found useful in the majority of ciphers. Meaker’s digram chart shows also the frequencies found for single letters in the same text. These are shown at the extreme right, and were obtained by adding the figures found on the 26 rows of the chart proper. When such counts are made, every letter in the text is considered to be the first letter of a digram, and no attention is paid to the separations between words. Thus the single-letter frequencies can be found by totalling either the columns or the rows, which, except for minor discrepancies, will check against each other.

So much for frequencies. Now let us take a closer look at sequence. Certain letters, ordinarily those of lowest frequency, are peculiar in their contacts with other letters. The shining example, in most languages, is the letter Q, followed, almost 100% of the time, by U plus another vowel; and if it seems, in the present text, that the significance of QU is being overlooked, this is simply because the individuality of this digram, like that of the German CH (CK), is so well advertised that even the novice encipherer finds a way to avoid using it. It is impossible, however, to avoid all letters having individual preferences. We still have J and V, practically sure to be followed by vowels, and Z, almost as sure. We have X, nearly always preceded by a vowel, but more often followed by a consonant. If these are missing from the cryptogram, we may have letters like K, B, and P, which confine an enormous percentage of their contacts to vowels; or to vowels and liquids; or to letters from the high-frequency group E T A O N I R S H. Even among the high-frequency letters themselves we find that H is followed about 75% of the time by either E or A, and that it is preceded largely by T, with S, C, and W as the next favorites; or we find that N is inordinately fond of vowels on its left, though with some preference for consonants on its right. All information of this kind is present in the digram chart, and usually is known to the decryptor without recourse to a chart.

For the beginner, however, who might like to have it in a more visible form, another chart, of a kind which we believe has never before been published, appears on [page 220]. This is F. R. Carter’s contact chart, on which every letter of the alphabet has been listed in the center of the page, with its favorite contact-letters beside it. The arrangement here is from the center outward; the letters shown on the left of any given letter are those which most often precede it, with percentages as found in Ohaver’s digram chart; letters shown on the right are those which most often follow, with percentages from the same digram chart. This information was not completed to the end for every letter, since the only information wanted is the actual preferences of each letter, or the fact that it has none. However, the outermost columns will show the complete percentages of vowel and consonant contacts for all letters as these were found in one 10,000-letter text. With such a chart before us, it becomes very easy, in the absence of Q, and other particularly vulnerable letters, to make good use of whatever letters we happen to have; and it is hoped that this new “contact chart” will prove sufficiently valuable to justify Carter’s labor in having compiled it for us. As to the other data in the [appendix], the student will do well to look it over. The list of trigrams is that of the Parker Hitt Manual, where THE was shown as having been found 89 times in 10,000 letters, the others graduating downward to MEN, found 20 times. Now let us return to our columnar transposition.

When a digram QU is actually present in a text, or when it is fairly certain that some other digram may be present, such as the YP of CRYPTOGRAM (that is, one composed of two infrequent letters), it is possible to discover (or limit) the key-length by observing the distance apart of these two letters in the cryptogram. To approximate such a case, using the foregoing cryptogram (Fig. 30), we will make use of the digram VI, and, in order to be brief, we will assume that the letter V, position 5, is the only one in the cryptogram, and that the only I’s present are those at positions 46 and 61. In one case the interval which separates V from I is 41, and, in the other, 56. As a preliminary step, we may discard all key-lengths which are factors of 75: 3, 5, 15, 25. In addition, we may discard, for the time being, the key-lengths 10, 20, etc., which are multiples of 5. Of those left, any very short length, as 2 or 4, is very improbable. We may consider, then, possible key-lengths of 6, 7, 8, 9, 11, etc., as far as we care to take them.

To make ready for the investigation, we first prepare a sheet of the kind shown as Fig. 36, where each possible key-length has been used as a divisor in order to learn the column-lengths for each one in a 75-letter cryptogram.

Now let us picture any text written into any block, as in Fig. 37, where long columns have five letters and short columns have four. Considering any digram in the text, as QU at the beginning, its two letters are separated by exactly one column of length, provided the letters are counted straight down the columns and columns are taken in one straight direction, or provided the counting is done strictly upward with columns always taken in one direction. In the case of QU, this column of separation is a long one (five letters), while, in the case of AF, on the right-hand side of the block, it is a short one (four letters), but in both cases it is a full column. This is true, also, of the digram FE, which is on two different lines, presuming that, having counted all the way to the end of the last column, we start again with the first. If both letters are in short columns, the interval which separates them is that of a short column, and if both are in long columns, this interval is that of a long column. But if one letter is in a long column and the other in a short column, the separating interval may be long or short, according to whether the columns are taken in straight order or in reverse order.

If the columns of Fig. 37 should be cut apart, and placed in some other order, then other columns might be placed between the one containing Q and its neighbor containing U, but these would be full columns, never fractional columns, so that the interval from Q to U would always be an exact number of full columns.

This is what happens in columnar transposition. If the digram VI, which we intend to consider, was actually present in the original encipherment block, then, in the cryptogram, its letters V and I are separated by an exact number of columns, long or short or mixed. Also, if the column containing V was taken off first, the distance from V to I may include the full number of long columns permitted by the key-length, but must fall one short of including all of the short columns; but if the I comes first, the opposite is true. Now, assuming that the only V’s and I’s in our cryptogram are those appearing at positions 5, 46, and 61, we find that if the first of the I’s is considered, the distance from V to I is 41, while, if the other is the one considered, then this distance is 56. We will investigate, first, the interval 41.

If V and the first I stood in sequence in the encipherment block, either as VI or as IV, then the interval 41 represents a certain number of complete columns, and if the digram was VI (since the V-column was evidently taken off first), this interval 41 must not include the full number of short columns, but may include the full number of long ones.

Consulting Fig. 36, we find that key-length 6 calls for columns having 12 and 13 letters, and it is impossible to divide an interval 41 into columns of such lengths. The key-length 7 calls for columns having 10 or 11 letters, of which only two columns may have the shorter length; an interval 41 can be divided into the right lengths, but only if three of the columns are short. Thus, if the first I is the correct one, the key-lengths 6 and 7 are totally impossible, as is also key-length 8. The key-length 9, however, calls for columns having 8 and 9 letters, of which six have the shorter length. An interval 41 can be divided to produce four short columns and one long column. Again, the key-length 11 calls for columns having 6 and 7 letters, of which two columns may be short; and an interval 41 will provide five long columns and one short column. These two key-lengths, then, 9 and 11, are possible, presuming that the first I is the one which actually followed V. When the other I, interval 56, is investigated in the same way, it is found that the only key-lengths possible are 8 and 11.

So that if the digram VI is present at all, the key-length must be 8, 9, 11, or something longer. Since the key-length 11 is possible in both cases, this is the one which tempts; when it fails, the remaining two can be tried. The student may decide for himself whether a trigram IVI is possible, considering the distance apart of the two I’s. It will be readily understood how this method, in combination with the one first explained, could be used, say, in a cryptogram where the suspected word is CIPHER, with the low-frequency letter P occurring only once.

Totally aside from analysis, there are many ways in which the key-length can become known, or suspected. If the correspondence is a military one, it may have been learned by espionage, perhaps through careless talk on the part of an enlisted man; or, because of careless habits on the part of the authority providing the keys, in having confined himself always to certain lengths. Knowing the key-length is two-thirds of the battle. It enables us, as in our former case, to mark off the cryptogram into its approximate column-lengths, making it easier to know the approximate whereabouts of any several letters supposed to form a sequence. It even enables us to prepare a block, which, cut apart to form paper strips, will effect a mechanical solution almost as easily as in the case of the completed unit.

Such a block, for our foregoing cryptogram (Fig. 30), can be studied in Fig. 38, and is explained as follows: An 8-unit key, used on a 75-letter text, calls definitely for three 10-letter columns and five 9-letter columns, and these columns have become eight segments in the cryptogram. If all three of the long columns were taken off first, then the arrangement shown at (a) has every letter in its proper column. And if all three of these were taken off last, then the arrangement shown at (b) has every letter in its proper column. With blocks shown for the two extreme cases, it can be seen that the block at (c) is a combination-block, in which one of

Figure 38 Preparation of Strips for a Known Key-length (a) Long Columns at Left (b) Long Columns at Right E R I T B S G C E X Y A X I X X N E S A H T E S N R E H T R G C T M G E B D O U T E I Y N A G S H U A I N A I T H M S T B S E U V S U D S N C L V U G A H T O T C O A E E V R T C S A E B D I L C E M X I N L E C O U I N A C T O U A T R X B S O E A D S N R E T Y H N A G X R T U M E E V L S X E Y N B R (c) Combination Block (d) Matching Strips

the two extremes has been superimposed upon the other, so that every column in block (c) shows every letter which it could possibly have contained. By concealing the letters of the “cap,” we have a duplicate of block (a); and by changing the alignment, so as to bring all of the topmost letters into the same row, we have block (b), with a “cap” attached at the bottom.

Comparing block (c) with the two above it: If the first column of (a) was actually a short one, then its last letter, X, belongs at the top of the second column. The making of this transfer would cause the second column to have eleven letters, so that it would become necessary also to transfer the last letter of the second column to the top of the third; this third column would then have too many letters, and its last letter would have to be transferred to the top of the fourth, which at present has only nine and may have another. But if the second column was also short, then there are two of its letters which belong at the top of column 3. And if this column, too, was a short one, it has three transferable letters at the bottom.

To prepare such a block, first write the cryptogram as at (a), and mark off its transferable (uncertain) letters by the following rule: One for the first column, two for the second, and so on, until the number is equal to the number of long columns, which is the maximum number possible. But if the final row is more than half filled, the maximum will not be reached, and a check may be made by marking off letters from right to left: zero for the last column, one for the next-to-last, two for the third-to-last, and so backward to the number which equals the number of long columns. Having marked off the transferable letters, form the “bonnet” by copying these, in each case, at the top of the following column, preferably making some clear distinction to show the duplication. For this latter purpose, many solvers use red ink. In this kind of work, as we saw in a previous case, the spacing must be accurate both laterally and vertically, since many of the letters belonging to the same sequence are not found on the same row. A few of the strips cut from block (c) have been matched at (d), where the beginning was made from the common suffix -ABLE. The duplicated letters A H Y have shown up plainly, partly by the style in which the letters are written, and partly, too, by the fact of consecutive column-numbers, 3 and 4. This same thing is true of the letters X T N, column-numbers 4 and 5. These numbers, it must not be forgotten, are also the serial numbers of the cryptogram segments, and thus are the key-numbers. With the eight strips correctly matched, and any misplaced columns transferred to their own side of the block, the strip-numbers as they stand across the top will reproduce the numerical key.

The matching of strips is generally a purely mechanical process, in which impossibilities are not considered. However, having before us a block (a) or (b), it is possible to apply the principle used with our former digram VI, and find out in advance whether certain letters found on two strips can possibly have stood in sequence. Nor is the cutting apart of the strips really necessary; it is merely a convenient method for dispensing with mental effort.

Now suppose we consider this same cryptogram on the theory that its key-length cannot be determined, or restricted to certain possibilities. Our first step is to select, somewhere in the cryptogram, a segment which is to be set up vertically on a sheet of paper to act as a trial column. If we select it from the body of the cryptogram, we shall have to make it a rather long segment, since we are uncertain as to whether it represents one column or parts of two. We should do this, however, if the body of the cryptogram shows Q, or any other letter or series of letters likely to be vulnerable. Otherwise, we know definitely that one of the columns begins with the first letter of the cryptogram, and that another column ends with the final letter of the cryptogram, and one or the other of these two segments is usually chosen, preferably the one containing the largest number of vulnerable letters. If we have a probable word, and find that its letter P, or M, or G, is the only one in the cryptogram, we select the segment which contains this P, or M, or G.

Wherever the trial segment is taken, there is always the question as to how many letters ought to be included. In Fig. 39, the decryptor has decided to take the beginning segment of the cryptogram, and has started with 15 letters. He has written beside it another 15-letter segment, chosen because of NG, HO, VI, and is attempting to tell, by the appearance of his digrams, and their frequencies as taken from two different digram charts, just about how far his digrams are uniformly good. If the nulls in use are actually XX, he knows immediately that this is the end of his two columns; otherwise, his digrams are acceptable throughout. If he sets down beside each digram its frequency as taken from Meaker’s chart, he might decide that his digrams are

good as far as UT, depending somewhat on the letters represented in our XX. Using Ohaver’s frequencies, he would feel sure that his digrams are good as far as OL. In many cases the frequencies shown for the lower digrams will grow so erratic as to be plainly unlikely; and in other cases, more difficult than the present one, a check on the probable column-length can be had by preparing a similar set-up for the end-segment of the cryptogram, in which the lower digrams are excellent, while those extending upward may grow erratic. This decryptor is safe, however, in accepting as much or as little of the length as he likes; there will be a more definite line of demarcation when he attempts to write beside these a third column of 15 letters. The only cases which ever give trouble are those in which a short text has been enciphered with a long key. Key-lengths, generally speaking, hardly ever run outside of limits 5 to 15, that is, lengths which come from single words. Thus a tentative key-length 10, 11, 12, lying half-way between these extremes, is always safe to try. The key-length 10, applied to 75 letters, gives columns of 7 or 8, and, in the discussion which follows, the tentative column-length was fixed at 8 letters.

Usually these trials are made by setting up the trial column (in pencil) several times in succession, so that several of the possible combinations can be seen side by side, in order to determine which is best. Sometimes this can be decided by simple observation. Otherwise, the combinations can be subjected to a digram test. This is made by setting down beside each digram, as formed by each pair

of columns, its frequency as taken from a digram chart. These figures are then added in each of the set-ups, and the supposition is that the combination furnishing the highest frequency-total will be the correct one, provided this high total has been produced by all of its digrams collectively, and not by some one or two individual digrams. With short columns, such tests are never conclusive, but with as many as ten or twelve digrams they are nearly always dependable, and even with only five or six digrams they will often select a correct combination.

It was decided here to choose as the trial column the first eight letters of the cryptogram: E N T H V C C O. This column is filled with consonants, indicating that those which follow or precede it might contain a number of vowels; and of the six consonants present, practically every one could be called a “vulnerable” letter, or, as we say in the Association, a “clue-letter.” If we wish, for instance, to choose a column which will fit well on the right-hand side of this trial column, we can search the rest of the cryptogram for two consecutive vowels to follow, respectively, H and V, and these two vowels we should expect to find followed, either immediately or at interval 2 by some letter (usually a high-frequency one) which will follow at least one of the C’s. This kind of pattern, unfortunately, was found eleven times. In practice, we should probably abandon it rather than copy down

and test eleven combinations; here, however, the eleven set-ups can all be seen in Fig. 40, accompanied by serial numbers to show the order in which their second columns were taken from the cryptogram. Some of these have not been tested. Of the five retained, particular attention is called to the fact that the one having the very lowest total is actually the correct one, as may be seen by turning back to the encipherment block. But when a single row of corresponding digrams (HE in the first four set-ups and HO in No. 11), has been subtracted throughout, it is seen that No. 11 moves upward toward its proper rank, having now the second highest total. In practice, it might even be selected in preference to No. 8, which grows erratic after its fifth digram (frequencies of 0, 55, 0). But the column-length 5, in practice, is not unlikely, so that a test made on the right-hand side of our trial column has not been at all conclusive.

Postponing the decision, then, let us take a fresh sheet of paper and make some tests for columns which can be fitted on the left-hand side of our trial column. Here, we find that the best “clue-letters” are N and H, standing at interval 2. To precede N, we should like to find one of the vowels of which it is so fond, and to precede H, we hope to find either T or one of the letters S, C, W. That is, we hope to find a pattern in the rest of the cryptogram in which some vowel, other than Y, is followed at interval 2 by one of the letters T, S, C, W. This time we find only four segments, and when the test is made for these, as shown in Fig. 41, the resulting totals point decisively to the correct combination, which is No. 3. Notice, in both of these tests, that results are identical whether the frequency-figures are those counted by Meaker or those counted by Ohaver: In the test of Fig. 40, the five combinations (using either chart) are ranked in the order 8, 11, 10, 1, 9, while the test of Fig. 41 has ranked its four combinations in the order 3, 2, 4, 1. Selecting, then, combination No. 3 of Fig. 41, let us return to the doubtful tests of Fig. 40 and attempt to effect a combination between our No. 3 and some one of the five previously considered worth retaining. Thus we can make an observation of trigrams, as shown in Fig. 42.

Here, we must be guided by our judgment, since trigram tests, even with figures available, would never be feasible on columns of this length. The acceptance of No. 3, evidently, would mean the cutting of our column-length to 5 letters, which, as we have said, is not at all unlikely in an actual case. The two highest tests from Fig. 40, however, are those included in Nos. 2 and 5. With reference to No. 2, where the right-hand digrams have the higher total, it is not impossible that the trigrams ACD and VOX were actually in use, or that the set-up should be

cut, above the trigram ACD; but No. 5 is the one which carries word-suggestions all the way to the end.

With the adding of other columns, which can be done on either side of the set-up, further digram tests can be made (taken only on the two extreme right-hand or left-hand columns), but in most cases no further tests are needed. Considering, for instance, that No. 5 is the combination tentatively accepted, we need a segment from the cryptogram containing the U which ought (apparently) to follow THO, then the S or C which ought (apparently) to follow DVI; that is, we want to find a sequence US or UC in the rest of the cryptogram; and this (apparently) should be followed by two vowels in succession, to fit after the sequences ACC and NCR. In other words, we know exactly what kinds of letters ought to make up the column which can be added on the right side of combination 5, and even the specific letters. Or, if it is the left side on which we have chosen to fit the new column, we need a segment containing the A of the apparent ADVI, followed at interval 2 by the vowel, probably I, which ought to precede a trigram NCR.

In Fig. 43, the three segments of set-up No. 5 have been circled out of the cryptogram (to prevent further use of their letters), and the segment chosen to fit on the left side of set-up No. 5 has been underscored, ready to be circled out in case it is found to fit. It is now possible to see the suggested nine-letter words, ADVISABLE and INCREASED, the guessing of which would permit us to apply the easy method first described.

With or without these guesses, the rest of the solution, as outlined in Fig. 44, is now plain sailing. At (a), the underscored segment of Fig. 43 is in place. At (b),

the column containing the desired US and following vowels has been set up on the right, where we seem to need the E or A of ADVISE or ADVISABLE, followed immediately by the U or R of ACCOUNT or ACCORD. At (c), we have found the segment, and at (d) (usually earlier), we are introduced to the actual lengths of our columns.

This latter can be seen by looking at the cryptogram (e), where all segments, as soon as selected, have been circled out. In finding a column which would complete the very evident word SYSTEM and, at the same time, furnish a letter suitable to precede HA, we find that this is the end-segment of the cryptogram, and would leave only two letters — far fewer than the number needed for furnishing another column.

At (f), we have extended the rest of the columns by two (and one) letters, except that there is a gap in sequence on the next-to-last line. At (g), we have transferred the letter which will fill this gap, leaving a misplaced X at the top; and, at (h), we have placed this X where it belongs and are now ready to transfer the two misplaced columns and recover the key. This key, as before, is found by numbering the segments of the cryptogram, and assigning these key-numbers to the correct columns in the adjusted block. It is usually possible to go further, and learn the long words on which such keys might have been based.

Concerning digram-tests, Ohaver suggests another which is more quickly made than the frequency test, and which the writer, so far, has found fully as reliable. Using “C” for “consonant” and “V” for “vowel,” he speaks of this as his VC-CV or “mixed” test. A digram like HA is a cv digram, one like AT is a vc digram, and others are vv and cc digrams. His theory is this: Since almost two-thirds of the digrams used in the language will be of mixed formation, that is, either vc or cv digrams, it stands to reason that the set-up containing the largest number of “mixed” digrams would probably be the correct choice. The student may look it over in Fig. 45.

As to possible variations, a cipher with a new name is not necessarily a different cipher. Fig. 46 shows a cipher originated many years ago by the cryptologist

E. Myszkowsky, and advertised by its inventor as non-decryptable. The key-word here is repeated often enough to furnish one key-letter for each text-letter, nulls being added, when necessary, to prevent the complete unit which would result if key-word and text were allowed to end at the same point. This long series of key-letters is then treated as a single word, and is converted to a numerical key in the usual way, all A’s receiving the first numbers, all B’s the next numbers, and so on. The message of the figure is very short: REGRET CHANGE IN SYSTEMS. Try enciphering this in the ordinary columnar transposition, using first the key-word CURTAIN, which contains no repeated letters, and afterward the key-word PARADISE, which has a repeated letter A. In the second case, what happens to the two columns belonging to the A-numbers? Suspecting a Myszkowsky encipherment, how could you go about unscrambling the two? Suppose there were three?

Fig. 47 plays another variation on the columnar theme. This cipher, originated by a member of the American Cryptogram Association, follows the rules of columnar transposition in all respects except that pairs alternate throughout with single letters (The text is: CHIEF WANTS YOU TO INTERVIEW SMITH). Can you pick out at a glance the really vulnerable feature of this cipher, and formulate a special method for its solution?

29. By NEMO. (A military message).
A O T O I N E H T C T O T L I I A W G E L P R V L R I I R I U A D E O
W L R R R L C M E O N P E P T A V T S O H O E E N L S N P S S B Y T S
L R O P D R G E T S S T S Y A W N E.
30. By PICCOLA. (Hostilities?)
T A M L R I T E D W E E D H H N P W O S W R S H C N O I E D O H I L T
C S T N I W A A R C D H H D A I E T P T R L R O W A S E E T A K F P W
G M A T X E K A H D P I L E O F H W G I N H A K S F S S A A A H E H N
D H H E H.
31. By AMSCO. (The "AMSCO" Cipher).
N W L E L N T L C S L W D L Y L N S O O I D F I N R U C H A L N D C B
S I D E A I T E T I K S T B E E O U T J A T I L I A C O R E A Y E E G A O.
32. By PICCOLA. (Can you recover this nice long keyword from the numbers?)
Y K I E T N T H H E X I A E N U B A K E E W S C S I H T N L N E N E A
K I E O B O L I E E A M C I F T I N A H S K A N I D L G S O E E I T T
S W H L L E U A D H F S H A B E O E N O A N O S C P H S N O D H T X R
N H R E A.
33. By PICCOLA. (An easy Myszkowski. Probable words: SOLVE, CIPHER, COLUMN).
V I N S R C F E A E O O H S E F H L E T F H U N S T N C L T S L C I A
E E S H R H S I R E T T M T S E T E P D T S O I N M R T T H T L O L R U B E.
34. By PICCOLA. (Nothing like a bit of "philosophy" - oyeah?)
E L O S W E A H X P N N T R N H L W I E G E I G E A E Q A G L E A R R
Q L O N K E S Q L O R N X A R S P X S E E A E I P A G L R E P R Y M T
H N K S E I X X A Y.
35. By PICCOLA. (Not so easy; still, it's just another columnar).
H R O T E T E T E H I W E O T T D A O D K G DT C E R A I W O S Y N H
Y R H T W.

CHAPTER VII
General Methods — Multiple Anagramming, Etc.

In the past few chapters, we have been looking at all of the general methods for decryptment of transpositions. We have seen the use of factoring, which determines, for the geometric cipher, what key-lengths are possible, and, for the irregular one, what key-lengths are not. Vowel-distribution has enabled us, in some cases, to determine the length of major units, or has assisted in the restoration of minor units to their original intact groups. Anagramming has been seen throughout: the matching of letters and columns with or without the application of language statistics.

So far, we have been materially assisted by advance knowledge as to what the cipher is. Where the type is unknown, and cannot be promptly identified, and assuming, of course, that the decryptor has no probable words, transpositions, taken as a whole, present confusing problems in the very multiplicity of their possibilities. General Givierge, in his Cours de cryptographie, remarks of this case that novices, as a rule, display a tendency to recoil from the cryptogram as if uncertain “which end to pick it up by.” He adds that the best advice he can give is to pick it up somewhere and do something, rather than be satisfied to sit all day long and admire the cryptogram!

As to how a type may sometimes be identified, the difference between the regular and irregular types is ordinarily suggested by the number of letters contained in the cryptograms. Irregular types, intended for practical purposes, are nearly always seen in complete five-letter groups, where the geometric cipher usually results in a broken group at the end of its cryptogram. This, of course, is never mandatory upon the encipherer; it merely happens because the only persons making use of such ciphers are those who do not realize the advisability of doing otherwise.

Among the irregular types, a columnar formation can usually be spotted by the “bunching” of vowels at intervals throughout the cryptogram. Then, too, we are still to see those cases in which the exact type of the cipher may not become apparent until after solution is well started.

It is usually well, when a new system is encountered, to analyze it and find out what the transposition finally does to the letters. This can be done by preparing actual cryptograms in which the plaintext letters are serially numbered; or, if the question of vowel-distribution is not involved, by using the serial numbers without the letters, as suggested in . Many ciphers, of course, will not require even this amount of analysis, even though their type, accurately speaking, is irregular. For example, the one shown as Fig. 48, whether or not its rectangle is to be completed, is merely another route, so that once having seen it, we might try to follow this route again. But the student who cares to give this cipher his careful consideration must notice that its longer cryptograms would be full of reversed plaintext segments; that these would grow longer and longer with a constant rate of increase, and would always alternate with incoherent segments which, in their turn, would grow shorter and shorter; also that these incoherent segments, if set up as columns, would show plaintext.

The complete-unit cipher, generally speaking, can hardly present any real complexities. Consider, for instance, the following variation on a Nihilist encipherment, which was proposed by Geo. C. Lamb, the author of [Chapter X]: The key-length, to begin with, must be divisible by 3, but this is not used for writing-in. The plaintext is written into its block, not in straight order, but following a route which begins in the upper left corner and goes forward for the first three letters, drops down to the second line and runs backward for the next three letters, drops to the third line to run forward for another three, and so on back and forth until the first three columns have been filled with trigrams written alternately forward and backward. It then moves over to the second three columns, beginning this time at the bottom and “snaking” upward to the top. For the third three columns it moves downward again, and so on until the square block has been filled. After this very devious primary transposition, the unit is taken off by means of the key, on the Nihilist principle of transposing both columns and rows with the same key.