From the earliest written civilizations, rulers, generals, and diplomats have needed to send information beyond the places they directly controlled. Military orders, reports from spies, and instructions to ambassadors traveled by courier, and later by telegraph and radio, through territory where an opponent could intercept them. Encryption arose from the need to make a captured message unreadable while still allowing its intended recipient to read it.

Cryptography is the practice of communicating securely in the presence of adversaries. For most of its history, that meant just one thing: making a message unreadable to anyone who intercepted it. Caesar’s generals, Renaissance diplomats, and the German navy of 1941 all faced the same problem, and each generation’s solution was broken by the next generation’s mathematics.

The history of cryptography follows a cycle. A cipher conceals a message. Analysts search for patterns that the cipher failed to hide and find them. An improved cipher is designed to conceal those patterns but ends up exposing others, usually subtler ones. This cycle of analyzing and redesigning has driven the field for roughly 1,200 years and continues today.

We’ll start off by tracing that history from the earliest substitution ciphers through the systems in use at the end of World War I. The ciphers themselves are obsolete, but the operations they introduced, replacing symbols and rearranging them, are the same operations inside every cipher in use today. The ways they failed also established what a cipher must accomplish, and those lessons carried directly into modern designs.

Two disclaimers:

1. We’ll look at this history at a high level. Numerous ciphers have been created over the centuries and we will not even attempt to survey them. Instead, we will examine only a few that introduced key concepts.

2. Most of cryptography is lost to history. Until the late 20th century, most cryptographic algorithms were treated as military secrets. For instance, the United States government classified strong cryptography as a munition under the International Traffic in Arms Regulations (ITAR) and the Arms Export Control Act, disallowing its export.

Goals of Cryptography

Cryptography was developed to keep messages secret, and for most of its history that was its only job. Today it serves four goals:

1. Confidentiality keeps the contents of a message hidden from anyone who is not authorized to read it. An eavesdropper on the network sees only unreadable ciphertext.

2. Authentication verifies the origin of a message or the identity of a party. When a server proves to a browser that it really is the bank’s server, it is using cryptography for authentication.

3. Integrity ensures that a message has not been modified in transit. Cryptographic checksums and digital signatures detect even a one-bit change in a message.

4. Non-repudiation prevents a sender from later denying that they sent a message. A digitally signed contract ties the signer to that specific document.

The last three goals emerged with computers and networks, and they depend on tools that build on those introduced here. We will cover authentication, integrity, and non-repudiation in detail later. Our initial focus will be on confidentiality, the original goal.

Cryptography, Cryptanalysis, and Cryptology

The field has three names, and they are easy to confuse:

• Cryptography is the practice of designing systems for secure communication. The word comes from the Greek κρυπτός (kryptós, meaning “hidden” or “secret”) and γράφειν (gráphein, meaning “to write”). The literal translation is “secret writing.”

• Cryptanalysis is the practice of breaking those systems: recovering the message, or the secret key, without being given the key.

• Cryptology is the study of both.

It is tempting to think of cryptographers as the good guys and cryptanalysts as the bad guys (or vice versa). That thought is valid for much of history: you send a secret message and the enemy tries to discover it, or you try to decipher the enemy’s message.

However, that framing leaves out the role cryptanalysis plays in building trust. A cipher that nobody has tried to break cannot be trusted, and the algorithms we rely on today are trusted because cryptanalysts spent years (often decades) attacking them and failed. Cryptanalysis is the quality assurance department of cryptography.

Core Terms

The plaintext is the original, readable message. Encryption transforms it into ciphertext, which should look like random noise to anyone without the key. Decryption reverses the transformation and recovers the plaintext.

The algorithm that defines these transformations is the cipher. The cipher itself is usually not secret. What makes each use of it different is the key, a secret value that controls exactly how the cipher transforms the data. The same cipher with two different keys produces two completely different ciphertexts from the same plaintext.

A cryptosystem is the whole package: the cipher, the keys, and the procedures for generating, distributing, and using them.

In symmetric encryption, the same key is used for both encryption and decryption. All the algorithms we cover in this lecture are symmetric. We will cover asymmetric systems, where encryption and decryption use different keys, in detail later.

Cryptography provides tools, not complete solutions. Adding encryption to a system does not make it secure. Weak passwords, poor software design, and careless key handling undermine even the strongest algorithm, and most real failures of encrypted systems have nothing to do with the cipher.

Kerckhoffs’s Principle

The key is a secret. Whether the cipher itself should also be kept secret was a question settled in 1883.

Auguste Kerckhoffs, a Dutch linguist teaching in Paris, published a two-part article called La Cryptographie Militaire in the Journal des sciences militaires. The title says something about the era. Until the arrival of computers, cryptography was a tool of armies, governments, and spies. Civilian use was rare.

Kerckhoffs listed six requirements for a military cipher:

1. It must be practically, if not mathematically, unbreakable.

2. It must not require secrecy, and it must be able to fall into the hands of the enemy without inconvenience.

3. Its key must be easy to communicate and remember without written notes, and easy to change.

4. It must be usable for telegraph messages.

5. It must be portable and operable by one person.

6. It must be easy to use, requiring neither mental strain nor a long list of rules.

The second is the important one for modern cryptography. A cryptosystem must remain secure when the adversary knows everything about how it works except the key.

This idea is known as Kerckhoffs’s Principle. It sounds obvious today, but most designers of the time assumed the opposite: if the enemy does not know how the cipher works, how can they break it? Kerckhoffs’s argument was practical rather than mathematical. It is hard for algorithms to remain secret. Many ciphers in history eventually became known to their enemies through publication, captured instructions, stolen equipment, employees who changed sides, or analysis of the ciphertext alone. A military system used by thousands of people cannot depend on all of them keeping its method secret forever. A system whose security rests on the secrecy of its method is permanently broken the day the method becomes known. A key, on the other hand, can be replaced at any time.

An encryption algorithm may be built into millions of devices and stay in use for decades. Replacing it means new hardware, new software, and new standards. A key is a small secret that can be generated for a single user, device, or session and discarded when it is no longer needed.

The Lock Analogy

A common pin tumbler lock gives a physical analogy of why this principle is important. Inside the lock are several spring-loaded pins, each cut into two pieces. The pins block the cylinder from turning. The correct key lifts each pin to the exact height at which its split aligns with the cylinder’s edge, and only then can the cylinder rotate.

The mechanism is not a secret. Lock designs are published, locksmiths study them, and anyone can read how they work (or buy a similar lock and take it apart). The secret is entirely in the cuts on the key. Cryptography works the same way. The algorithm corresponds to the lock mechanism, published and analyzed, and the cryptographic key corresponds to the physical key. As long as the cuts stay secret, the lock holds no matter how well the burglar understands the mechanism. The analogy also shows why keys and algorithms have different lifetimes. A locksmith can rekey a lock, changing its pins and issuing a new key, without redesigning the lock. A flaw in the mechanism itself, on the other hand, calls for a new lock, just as a flaw in a cipher calls for a new cipher.

Openness has a second benefit. When designs are public, weaknesses are found and fixed, and users can make informed choices about which algorithms to trust. The alternative is hoping that flaws stay undiscovered. In 1853, thirty years before Kerckhoffs, the American locksmith Alfred Hobbs made this argument about locks, two years after publicly picking two British locks that had been advertised as unpickable:

“If a lock, let it have been made in whatever country, or by whatever maker, is not so inviolable as it has hitherto been deemed to be, surely it is to the interest of honest persons to know this fact, because the dishonest are tolerably certain to be the first to apply the knowledge practically; and the spread of the knowledge is necessary to give fair play to those who might suffer by ignorance.”²

Yes, people really wrote like that back then (don’t worry if you struggle to make sense of that quote). The openness of the mechanism (or cryptographic algorithm) allows us to understand its weaknesses and assess risk: is a $20 Kwikset lock good enough or do we need the $200+ Medeco lock?

Secret Designs That Failed

Two consumer systems from the 1990s show what happens when a design is kept secret and then leaks. The GSM standard for digital mobile phones, adopted across Europe in 1991 and later in much of Asia, encrypted calls using two ciphers, A5/1 and A5/2, whose designs were kept secret. Researchers reverse-engineered both from phone firmware and published them in 1999. A5/2 turned out to be so weak that it could be broken in real time, and A5/1 fell to practical attacks within a few years. A stronger successor, A5/3, was standardized in 2002, but A5/1 remained the default on most networks for well over a decade because replacing it meant upgrading every handset and base station.

The Content Scramble System (CSS), which protected DVDs from 1996, used a secret 40-bit cipher. A Norwegian teenager and two anonymous collaborators reverse-engineered it from a software player in 1999 and released a decryption program, DeCSS. The cipher was found to be weaker than even its short key suggested, and CSS has provided no real protection since.

In both cases, secrecy bought a delay of a few years to a decade, and once the delay ended, there was no way to repair the system short of replacing it. The German Enigma cipher machine of World War II is the opposite case. Its mechanism was public, since commercial models had been sold openly for years. Its secret internal wiring was reconstructed by cryptanalysts, and the machine was broken anyway, for reasons that had nothing to do with secrecy.

Schneier’s Law

Bruce Schneier, a well-known cryptographer, writer, and security consultant, described the underlying problem in 1998:

“Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can’t break.”

This observation is known as Schneier’s Law. A cipher always looks strong to the person who designed it, because that person can only think of the attacks they already know. The strength of an algorithm is established only when people who did not design it, and who want to break it, fail to do so. Every modern algorithm has undergone years of scrutiny before anyone relied on it. Peer review in cryptography means teams of cryptographers and mathematicians around the world spending years attacking a design.

Substitution Ciphers

Before the twentieth century, cryptography was done by hand, and the ciphers of that era are now grouped under the name classical ciphers. Nearly all of them fall into two categories. A substitution cipher replaces each symbol in the message with another symbol. A transposition cipher keeps the symbols but rearranges their order. Both hide the message and are weak, but the reasons for their weakness are different.

Few ciphers from antiquity were written down, since the methods themselves were treated as a secret. One of the earliest recorded ones, Atbash, appears in Hebrew texts from around 600 BCE. It creates a mapping from the alphabet to its reverse, replacing the first letter of the Hebrew alphabet with the last, the second with the second-to-last, and so on.

It has no key, so anyone who knows the method can read every message. The earliest cipher on record therefore violates Kerckhoffs’s principle. A useful cipher needed a key that the sender and recipient could change without inventing a new encryption method. (Much early secret communication relied instead on hiding the existence of the message, a separate technique called steganography that we will cover later.)

The Caesar Cipher

Julius Caesar used a substitution cipher for military correspondence around 50 BCE. The Roman historian Suetonius, writing more than a century later, described it: each letter was replaced by the letter three positions further along the alphabet. The two parties have to agree on the direction and the amount of the shift, and that amount is the key. This is a shift cipher because every letter moves by the same fixed number of positions.

With a shift of 3:

Plaintext: MY CAT HAS FLEAS Ciphertext: PB FDW KDV IOHDV

The number three is the key in this example. The algorithm, shifting every letter by the same amount, does not change. The key selects which shift the algorithm uses. To decrypt, the recipient uses the same key and shifts each letter three places in the opposite direction.

This is a trivial cipher to break. A Caesar cipher has only 25 useful shift keys, so an analyst can quickly test every possibility. However, it was convenient to operate. The two parties needed to remember only one number. The alphabet stayed in its normal order, no table had to be copied or carried, and the work could be done mentally. The Caesar cipher traded security for speed and convenience.

Caesar’s messages did not mark the spaces between words. Encrypted messages continued to omit spaces or replace them with the letter X well into the twentieth century because spacing reveals word lengths, and word lengths give a cryptanalyst a great deal of information.

The Caesar cipher is a monoalphabetic substitution cipher because one fixed mapping applies to the entire message (one substitution alphabet). Every plaintext A becomes the same ciphertext letter. Atbash has the same property, although its mapping cannot be changed.

Monoalphabetic Substitution

The Caesar cipher is a special case of a more general idea: replacing the alphabet with any scrambled version of it. The entire scrambled alphabet is the key. One possible key begins as follows:

The set of all possible keys is the keyspace, and trying every key in it until one produces readable text is a brute-force search. There are \(26!\), or about \(4 \times 10^{26}\), ways to rearrange 26 letters, so a brute-force search is out of the question. Testing a billion keys per second would take about \(10^{10}\) years, roughly the age of the universe. For comparison with modern ciphers, \(26!\) is slightly more than \(2^{88}\), so the keyspace is a little larger than that of an 88-bit binary key.

That number of possible keys does not translate into security. Atbash, the Caesar cipher, and a general scrambled alphabet differ greatly in keyspace, but all three preserve the same weakness: one plaintext letter always maps to one ciphertext letter. The larger keyspace makes exhaustive search harder. It does not hide the structure of the language, and the attack exploiting that structure was the first great discovery in cryptanalysis.

Frequency Analysis

An analyst never has to search the keyspace, because letters do not occur with equal frequency in any language. A fixed substitution changes which symbols appear but preserves the frequency of the underlying plaintext letters.

The exact percentages vary with the author and subject, but a large sample of English text will have a distribution close to this one:

Pairs of letters, called bigrams (or digrams), also occur unevenly. TH, HE, IN, and ER are the most common bigrams in English, and some pairs, such as QZ, never occur at all. THE and AND are the most common three-letter sequences, or trigrams. One-letter English words are usually A or I, and Q is normally followed by U.

A monoalphabetic cipher replaces every e in the plaintext with the same ciphertext letter, wherever it appears. If the intercepted message shows the symbol Q about 13 percent of the time, Q is probably e. If the pair QJ shows up repeatedly, QJ may be er or es. Once a few letters are identified, short words become recognizable, each guess confirms or corrects the others, and the rest of the alphabet falls into place quickly.

This method is frequency analysis. The earliest surviving description of it is by Abu Yusuf al-Kindi, a scholar working in Baghdad in the ninth century, in a manuscript titled On Deciphering Cryptographic Messages. He explained that an analyst who knows the language of the plaintext should begin with a long sample of ordinary text in that language and count how often each letter appears. The most frequent ciphertext symbols are then matched to the most frequent letters. This manuscript was rediscovered in an Istanbul archive in 1987.

Why Frequency Analysis Works

Trying \(26!\) keys is unnecessary because the attacker never has to search the keyspace at all. The substitution relabels the symbols without changing their statistics, so the uneven letter distribution of the language survives encryption intact, and the ciphertext reveals most of the key.

Users of substitution ciphers knew some of this and tried to make the analyst’s job harder. Three modifications were common, and none of them defeated the attack:

• Removing spaces hides word boundaries, but the letter and bigram frequencies are untouched.

• Inserting meaningless symbols, called nulls, distorts the counts, but a long message still contains repeated letters and repeated sequences.

• Deliberate misspellings remove some clues, but a clerk who misspells the same words the same way every day creates a new habit for the analyst to learn.

Scrambling the substitution alphabet increased the number of keys without removing the patterns that frequency analysis used. The next design goal was to prevent one plaintext letter from always producing the same ciphertext letter.

Polyalphabetic Substitution

A cipher that changes the substitution alphabet during the message, so that the same plaintext letter encrypts differently depending on where it appears, is a polyalphabetic cipher.

Alberti’s Cipher Disk

The first known polyalphabetic cipher was designed in 1467 by Leon Battista Alberti, a Florentine architect, painter, and author who also worked for the papal court in Rome, where diplomatic correspondence needed protection. His device was a pair of concentric copper disks that rotated independently. The larger, fixed disk carried the plaintext alphabet. The smaller, movable disk carried a scrambled cipher alphabet. Turning the inner disk to a new position set a new substitution alphabet.

The sender and receiver agreed on a starting alignment, such as outer A against inner G, and the sender encrypted several words under that alignment. In the disk pictured, outer R maps to inner M, so plaintext R becomes ciphertext M. After a few words, the sender rotated the inner disk to a new position, signaled the change by inserting a marker letter into the message, and continued with the new alphabet.

One plaintext symbol could now map to many ciphertext symbols depending on its position in the message. Both parties had to have identical disks. Alberti suggested changing the alignment at irregular intervals to make the switching harder to detect. He described the disk in De componendis cifris, the earliest known Western treatise on cryptography, which also explained frequency analysis to its readers.

The disk solved the mechanical problem of switching alphabets. It left open the question of when to switch and by how much. The two parties needed a rule, and a rule that produced a predictable sequence of alignments gave an analyst a pattern to find.

The Vigenère Cipher

Alberti’s system had three secrets to protect: the physical disk, its starting alignment, and the rule for rotating it. A better polyalphabetic cipher would need no device and would specify the alphabet for every letter of the message with a single secret that is easy to share, such as a word.

The best-known polyalphabetic cipher is the Vigenère cipher¹. It uses a shared keyword to select the substitution alphabet for each letter of the message. Each keyword letter specifies the Caesar shift to use at the corresponding position. It could be used with a table, so the two parties no longer needed a cipher disk.

For example, suppose the key is the secret keyword LEMON. Because it is shorter than the message, the sender repeats it until there is one key letter for every plaintext letter:

Plaintext:  ATTACKATDAWN
Keyword:    LEMON
Keystream:  LEMONLEMONLE

A keystream is a sequence of values applied one by one to successive units of plaintext during encryption. Depending on the cipher, those values may represent letter shifts, bits, or bytes. In the Vigenère cipher, repeating the keyword LEMON produces the keystream LEMONLEMONLE. The number of letters before the keystream repeats is its period. This keystream has a period of five because the five-letter keyword repeats. That repetition is the weakness analysts will exploit.

Each keystream letter identifies a shift. A means shift 0, B means shift 1, and L means shift 11. Encryption by hand used a printed table called the Vigenère square, or tabula recta, a 26-by-26 grid in which each row is the alphabet shifted one position further than the row above. The following portion of the table contains every row needed for the keyword LEMON.

             Plaintext letter
        A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Key A | A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
...
Key E | E F G H I J K L M N O P Q R S T U V W X Y Z A B C D
Key L | L M N O P Q R S T U V W X Y Z A B C D E F G H I J K
Key M | M N O P Q R S T U V W X Y Z A B C D E F G H I J K L
Key N | N O P Q R S T U V W X Y Z A B C D E F G H I J K L M
Key O | O P Q R S T U V W X Y Z A B C D E F G H I J K L M N
...
Key Z | Z A B C D E F G H I J K L M N O P Q R S T U V W X Y

To encrypt a letter, find the plaintext letter along the top and the keyword letter down the side. The ciphertext letter is at the intersection of the row and column.

The first four lookups show the process:

Continuing the lookups produces:

Plaintext:  ATTACKATDAWN
Keystream:  LEMONLEMONLE
Ciphertext: LXFOPVEFRNHR

The first A becomes L, while the second A becomes O because the two positions use different keystream letters.

To decrypt, select the row for the keystream letter and find the ciphertext letter within that row. The plaintext is the column heading above it.

Breaking the Vigenère Cipher

For three centuries, the Vigenère cipher was called le chiffre indéchiffrable, the unbreakable cipher. It flattened the single-letter frequencies that had defeated every earlier cipher in common use, and no one published a general method for attacking it. A clerk with a keyword and a printed square could produce ciphertext that the best analysts of the 1700s could not read.

The weakness is the period. With the keyword LEMON, positions 1, 6, and 11 of the message are all shifted by L, positions 2, 7, and 12 by E, and so on. The ciphertext consists of five interleaved Caesar ciphers, and an analyst who knows the period can separate them. The method for finding the period, the Kasiski attack, was published in 1863 by Friedrich Kasiski, a retired Prussian infantry officer.

Suppose a common word such as the appears twice in the plaintext, and the distance between the two occurrences happens to be a multiple of the period. Both copies then align with the same keystream letters and encrypt to the same three ciphertext letters. An analyst who finds repeated sequences in the ciphertext and measures the distances between them can guess the period, because it divides most of the distances. If repeated sequences occur at distances of 15 and 30, for example, the period is likely 3, 5, or 15.

For example, encrypt the same plaintext, ATTACKATDAWN, with the shorter keyword CAT:

Plaintext:  A T T A C K A T D A W N
Keystream:  C A T C A T C A T C A T
Ciphertext: C T M C C D C T W C W G

The plaintext AT appears at positions 1 and 7, six positions apart, and both times it lands under the keystream letters CA. Both encrypt to CT. In a long message, the analyst finds many such repeats, and their distances are dominated by multiples of 3.

Once the period is known, the cipher is finished. Every third letter of the ciphertext was encrypted with the same shift, so the ciphertext splits into three interleaved streams, each of which is a Caesar cipher. Frequency analysis solves each stream separately, and the three shifts spell out the keyword. The cipher hid the letter frequencies of the whole message, but it recreated them inside each stream.

A cipher that was considered unbreakable for three hundred years was broken by finding repeated sequences in the ciphertext and measuring the distances between them. The flaw was that the key was shorter than the message and had to be reused. A key that never repeated, one as long as the message itself, would have no period and nothing for Kasiski to count. That idea returns later as the one-time pad. Its cost is a fresh secret key for every message sent.

Transposition Ciphers

A substitution cipher changes the letters while leaving their positions in place. A transposition cipher leaves the letters unchanged and rearranges them. The ciphertext has exactly the same letter counts as the plaintext, which makes the language obvious to an analyst, but the words are gone. On its own, transposition is weak. Combined with substitution, it produced the strongest cipher of World War I.

The Scytale

The Greek historian Plutarch, writing in the first century CE, describes a device the Spartans used to send military orders around the fifth century BCE. A scytale (the word rhymes with “Italy”) was a wooden staff of a particular diameter. The sender wound a strip of leather around it in a tight spiral, wrote the message along the staff’s length, and then unwound the strip. Read as a strip, the letters were out of order. The recipient wound the strip around a staff of the same diameter, and the message reappeared. The diameter of the staff was the key.

A staff that fits four letters around its circumference works like a grid with four columns. The message MEET AT THE TEMPLE, written across the rows, looks like this:

M E E T
A T T H
E T E M
P L E X

Reading down the columns as the strip unwinds gives MAEP ETTL ETEE THMX.

The message did not fill the grid, so an X was added at the end. Filler added to make a message fit a required size is called padding. It is still part of modern ciphers, which often need the plaintext to be a multiple of some block size. Padding is added before encryption and removed after decryption; poorly designed padding can leak information. Here, the trailing X tells an analyst that the message was padded to fill the grid exactly, so the sixteen letters were arranged in two, four, or eight columns.

A scytale offers little security. There are only so many plausible diameters, and an interceptor can try them all. Its significance is that it shows the idea of rearranging letters to hide a message is at least 2,500 years old.

Columnar Transposition

A stronger method was in use in Europe by the nineteenth century and remained in military use into World War I. Columnar transposition writes the message in rows under a keyword and then reads the columns out in the alphabetical order of the keyword’s letters. The keyword is the key. It determines both the grid width and the order in which the columns are read.

With the keyword ZEBRA, the letters are numbered alphabetically (A is 1, B is 2, E is 3, R is 4, Z is 5), and the message is written beneath them:

Z E B R A
5 3 2 4 1
M E E T A
T T H E T
E M P L E

Reading the columns in numbered order gives ATE, EHP, ETM, TEL, and MTE, so the ciphertext is ATEEHPETMTELMTE.

Breaking Transposition

Because transposition preserves the letters, the first thing an analyst learns from a frequency count is that the ciphertext is a transposition of English.

The width of the grid is the next thing to find, and there are only a few plausible ones to try. For each width, the analyst looks for pairs of columns that, placed side by side, produce common English bigrams down their length, and rebuilds the column order from the pairs that fit. This is tedious by hand but entirely feasible against long messages, and it was done routinely during World War I. Double transposition, with two different keywords, made the work harder and was used well into World War II, but it never made the work impossible.

Bigram Substitution and Combined Ciphers

Substitution preserves letter frequencies and hides the letters. Transposition preserves the letters and hides their positions. By the nineteenth century, designers had found two ways to resist frequency analysis, both of which are used in every modern block cipher.

The first was to substitute larger units for single letters. The Playfair cipher, invented in 1854 by Charles Wheatstone and used by Britain through World War I, encrypted pairs of letters. Each pair of plaintext letters was replaced by a pair of ciphertext letters chosen from a 5-by-5 grid built from a keyword. Single-letter frequencies disappeared, and an analyst had to count bigrams instead. English bigrams are just as uneven as English letters, but counting them requires much more ciphertext. With enough ciphertext, the same attack worked on the larger alphabet. Enlarging the unit of substitution raises the cost of frequency analysis without removing it. Modern block ciphers extend the idea and operate on 128 bits at a time.

The second technique was to combine substitution and transposition so that each would cover the other’s weakness. The German ADFGVX cipher of 1918, the most sophisticated field cipher of World War I, first replaced each letter with a pair of symbols, then scrambled the order of all the symbols using a columnar transposition. The transposition separated the two halves of every pair, so an analyst could not even find the pairs to count.

The Germans considered it unbreakable. Georges Painvin, a French artillery officer, broke it in June 1918 by comparing messages that had been sent under the same key and shared the same opening words. One message he solved told the French where the next German attack would fall, and they stopped it. Combining the two operations hides far more than either does alone. Every modern block cipher alternates substitution and transposition many times over. (More discussion of these ciphers, along with the Painvin story, is in the appendix. Numerous websites also cover these ciphers in more detail.)

Lessons from Classical Cryptography

The classical ciphers established several ideas that survive in modern designs:

• A large keyspace is not enough. The monoalphabetic cipher had \(26!\) keys and was broken by counting letter frequencies. An attacker seeks to avoid searching the keyspace, so a cipher must be judged by the best attack against it, not by the size of the space.

• Ciphertext must not preserve the statistics of the plaintext. Every classical cipher failed because some regularity of the language survived encryption: letter frequencies, bigram frequencies, or repeated sequences.

• Repetition is fatal. The Vigenère keyword was repeated, and the repetition revealed its length. A key that is reused leaves a pattern.

• Substitution and transposition are stronger together than apart. Modern block ciphers alternate the same two operations, many times over.

• The cipher is only part of the system. Security depends on the algorithm, the key, the format of the messages, and the procedures of the people who use them, all together. ADFGVX was sound as a cipher, but it was broken because two messages encrypted with the same key shared a beginning.

• Hand operation limits complexity. A cipher that a clerk can run with pencil and paper is a cipher that an analyst can attack with pencil and paper. The next step was to build machines.

Next: Part 2: Mechanized Cryptography