Manual / Guide · 1939
Military Cryptanalysis, Part III: Simpler Varieties of Aperiodic Substitution Systems
SIS training text, Part III (64 pp); complements writer B's Part I
Manual / Guide · 1939
SIS training text, Part III (64 pp); complements writer B's Part I
Reslrict.ed ...,----:·--~~~===========~ WAB DEPAR1'l·IEN"r I Ol'FICE 01' TRI (!.HJ.Rr smNAI. orncRa lb ~IILI'l1ARY CRYP'fAN ALYSIS J Ii p ~~ ! ;. \\ ASRJ~G"J'O!lil PART Ill ;f =~o! ~ .... ...,... _ ....,_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _.... ·········- ... . ··----------------- Rest1 ictt:tl WAR DEPARTMENT OFFICE OF THE CHIEF SIGNAL OFFICER WASHINGTON MILITARY CRYPTANALYS IS Part III SIMPLER VARIETIES OF APERIODIC SUBSTITUTION SYSTEMS By WILLIAM F. FRIEDMAN Principal Cryptanalyst Signal Intelligence Service PREPARED UNDER THE DIRI;CTION OF THE CHICF SIGNAL OFFICE!~ UNITED ST.ATES GOVERNMENT PRINTING OFFICE W .ASHINGTON 1939 MILITARY CRYPTANALYSIS. PART III. SIMPLER VARIETIES OF APERIODIC SUBSTITUTION SYSTEMS CONTENTS Section Paragraphs Pages I Introductory------_____ ----------------------------------------------------------------------------------------1-4 1-4 II Solution of systems usmg constant-length keymg uruts to encipher variable-length plamtext groupings, 1-------------------------------------------------------------------------------------------- 5--9 5--7 III Solution of systems usmg constant-length keymg uruts to encipher variable-length plamtext groupings, IL------------------------------------------------------------------------------------------ 10--13 8-13 IV Solut10n of systems usmg constant-length keymg uruts to encipher variable-length plamtext groupings, IIL _____________________________________________________________________________ ----------- 14--16 14-18 V Solut10n of systems usmg variable-length keymg umts to encipher constant-length plamtext groupings------------------------------------------------------------------------------------------------ 17-22 19-27 VI Review of auto-key systems--------------------------------------------------------------------------------23 28-29 VII Solut10n of cipher-text auto-key systems --------------------------------------------------------------- 24--29 3o--43 VIII Solution of plam-text auto-key systems __ ------------------------------------------------------------ 30--33 45-49 IX Methods of lengthemng or extendmg the 1.ey__ ------------------------------------------------------- 34--36 50-52 X General principles underlymg solution of systems employmg long or contmuous keys______ 37-40 53-57 XI The "comcidence" or "ic test"----------------------------------------------------------------------------- 41-44 58-72 XII The "cross-product" or "x test"--------------------------------------------------------------------------- 45--48 73-78 XIII Applymg the cross-product or x test-------------------------------------------------------------------- 49-51 79-93 XIV The "monoalphabeticity" or "<I> test"-------------------------------------------------------------------- 52-53 94-96 XV Concluding remarks_ ----------------------------------------------------------------------------------------- 54--55 97 AppendJx 1 Additional notes on methods for solvmg plam-text auto-keyed ciphers-----------------1-7 98-116 Index----------------------------------------------- __ ----------------------------------------------------------------------------- 117-118 Analytical key for Part IIL-------------------------------------------------------------------------------------------------119 <m> SECTION I INTRODUCTORY Paragraph Prehm1nary remarks ------- --------- _____ __ ----------------------- --------- ---------- __ ---------------------------------General remarks upon the nature of cryptographic penod1c1ty _ _ ----- ----------- __ --------- ------------------Effects of varymg the length of the pla.m-te"rt. groupmgs________ ---- _ ___ ------- ----- ----------------------------Primary and secondary periods, resultant pcnods __ --------------------- ------- ------- -------------------------------- 1 2 3 4 1 Prehmma.ry remarks -a The text munedmtely precedmg this devoted itself almost exclusively to polyalphabet1c subst1tut10n systems of the type called repeatmg-key ciphers It was seen how a regulanty m the employment of a lnmted number of alphabets results m the mamfestat10n of penod1c1ty or cyLhc phenomena m the cryptog1.un, by means of which the latter may be solved The drlficulty m solution is directly correlated \\-1th the type and number of cipher alphabets employed m specifk examples b Two pioceJures suggest themselves fox wnsiJe1J.t10n \\hen the student c,ryptanalyst realizes the foregomg oicumstances and thlnks of methods to ellli1mate the weaknesses mherent m tlus cryptographic system First, notmg that the <Lffkulties m solution mcrease as the length of the key mcreases, he may study the effects of employmg much longer keys to see if one would be "\\-arranted m placmg much trnst m that 111ethod of increasmg the secunty of the messages Upon second thought, hO\ eve1, rm .e1~iliermg il at as a general rule the first step m the solution consists m asLertammg the number of alphabets employed, it seems to him that the most logical thmg to do "\\-ould be to use a pioLedme "\\-lu1.,,h "'ill avoid penod1c1ty altogether, "Will thus ehmmate the cydic phenome'la tLat axe normally manifested m cryptograms of a penod1c constru1,t10n, and thus pre"ent ::m enc!ny cryptan<llybt from taking even a first step toward solut10n In other woiJs, he "\\-1ll 11h e5tlga.~e the possibilities of aperiodic systems first and if the results are unsatisfacto1y, he "'ill then see what he ran do with systems usmg lengthy keys c Accordmgly, the first part of tlns !:e'i..t "Will 1:,e devoted to an exanunat1on of certam of the very srmple vaneties of apenod1c, polyalphabetic substitution systems, after tlus, methods of extendmg or lengthening short mnemoru<., keys, and systems usmg lengthy keys will be studied 2 General remarks upon the nature of cryptographic period1c1ty-a When the thoughtful student considers the matter of p&1.odicity m polyalphabetic substitut10n systems and tries to ascertam its real nature, he notes, with some degree of mterest and surpnse perhaps that it is composed of two fundamental factors, because there are m reality two elements mvolved m its production He has, of course, become qmte familiar with the idea that penochc,ity necesSitates the use of a keymg element and that the latter must be employed m a cychc manner But he now begms to realize that there 1s another element mvolved, the s1gmficance of which he has perhaps not fully appreciated, viz, that unless the key is apphed to constant-length plam-text groups no penod1city w1.ll be manifested externally by the cryptogram, despite the repetitive or cyclic use of a constant-length key This realization is qmckly followed by the idea that possibly all penod1city may be avoided or suppressed by either or both of two ways (1) By usmg constantlength keymg units to encipher vanable-length plam-text groupings or (2) by usmg vanablelength keymg uruts to encipher constant-length plam-text groupmgs b The student at once reahzes also that the penod1c1ty exhibited by repeatmg-key ciphers of the type studied m the precedmg text 1s of a very Simple character There, succesSive letters of the repetitive key were apphed to succesSive letters of the text In respect to the employment of the key, the cryptographic or keymg process may be said to be constant or fixed m character This ternunology remams true even if a smg~ keymg unit serves to encipher two or more letters (1) 2 3 at a trme, provided only that the groupmgs of plam-text letters are constant m length For example, a smgle key letter may serve to encipher two successive plam-text letters, 1f the key is repetitive m character and the message is sufficient m length, per10d1c1ty will still be mamfested by the cryptogram and the latter can be solved by the methods mdicated m the precedmg text 1 Naturally, those methods would have to be modified ill accordance with the specific type of groupmg Involved In this case the factonng process would disclose an apparent key length twice that of the real length But study of the frequency distributions would soon show that the 1st and 2d distnbut10ns were similar, the 3d and 4th, the 5th and 6th, and so on, dependmg upon the length of the key The logical step 1s therefore to combme the distnbut10ns m proper prurs and proceed as usual c In all such cases of enc1pherment by constant-length groupmgs, the apparent length of the period (as found by applymg the factormg process to the cryptogram) IS a multiple of the real length and the multiple corresponds to the length of the groupmgs, that is, the number of plam-text letters enciphered by the same key letter d The pomt to be noted, however, is that all these cases are still penod1c m character because both the keymg uruts and the plam-text groupmgs are constant m length ' 3 Effects of varying the length of the plam-text groupmgs -a But now consider the effects of makmg one or the other of these two elements variable m length Suppose that the plam-text groupmgs are made vanable m length and that the keymg uruts are kept constant m length Then, even though the key may be cychc m character and may repeat itself many times m the course of encipherment, external per10dicity 1s suppressed, unless the law governing the variation in plain-text groupings is itself cyclw in characterJ and the length of the message is at least two or more times that of the cycle applicable to this variable grouping b (1) For example, suppose the correspondents agree to use reversed standard cipher alphabets with the key word SIGNAL, to encipher a message, the latter bemg divided up mto groups as shown below (2) The cipher text m this example (Fig 1) shows a tetragraphic and a pentagraphic repetit10n The two occurrences of QUWUG (=COMMA) are separated by an illterval of 90 letters, the two occurrences of ARQN ( = IRST) by 39 letters The former repetition ( QUWUG) , 1t will be noted, is a true per10d1c repetit10n, smce the plam-text letters, their groupmg, and the key letters are ident1c,al The IDterval ID this ca<>e, if counted m terms of letters, is the product of the keymg cycle, 6, by the groupmg cycle, 15 The latter repetit10n (ARQN) is not a true per10dic repetit10n ID the sense that both cycles have been completed at the same pomt, as IS the case ID the former repet1t10n It 1s true that the cipher letters ARQN, representmg IRST both times, are produced by the same key letters, I and G, but the enmphermg pomts m the groupillg cycle are different m the two cases Repetitions of this type may be termed partially periodic repetit10ns, to distmgmsh them from those of the completely periodic type c When the mtervals between the two repet1t1ons noted above are more carefully studied, especially from the pomt of view of the mteractIDg cycles which brought them about, it wtll be seen that countmg accordmg to groupings and not accordmg to smgle letters, the two pentagraphs QUNUG are separated by an interval of 30 groupmgs Or, if one prefers to look at the matter m the light of the keymg cycle, the two occurrences of QUWUG are separated by 30 key letters Smee the key is but 6 letters m length, this means that the key has gone through 5 cycles Thus, the number 30 is the product of the number of letters m the keymg cycle (6) by the number of different-length groupmgs m the groupmg cycle (5) The mteract1on of these two cycles may be conceived of as pai takmg of the nature of two gears which are m mesh, one dnven by the other One of these gears has 6 teeth, the other 5, and the tc.>eth are numbered If the two gears are ad1usted so that the "number 1 teeth" .11e adjacent to each other, and the gears are caused to revolve, these two tePth will not come togethPr agam until the larger gear has made 5 rcvolut10ns and the smaller one 6 Durmg this tune, a total of 30 meshings of individual teeth will have occurred But smce one revolut10n of the smaller gear (=the groupmg cycle) represents the encipherment of 15 letters, when translated ID terms of letters, the 6 complete revolut10ns of this gear mean the enc1pherment of 90 letters This accounts for the period of 90, when stated ID terms of letters d The two occurrences of the other repet1t10n, ARQN, are at an IDterval of 39 letters, but m terms of the number of mtervenmg groupmgs, the mterval 1s 12, which is obviously two times the length of the keymg cycle In other words, the key has m this case passed through 2 cycles e In a long message enciphered according to such a scheme as the foregomg there would be many repet1t10ns of both types discussed above (the completely penodic and the partially periodic) so that the cryptanalyst might encounter some difficulty ill his attempts to reach a solut10n, especially if he had no mformat10n as to the basic system It is to be noted m this connect10n that if any one of the groupIDgs exceeds say 5, 6, or 7 letters m length, the scheme may give itself away rather easily, sIDce it is clear that 'IJ.Jl1hin each grouping the encipherment is strwtly monoalphabetic Therefore, m the event of groupmgs of more than 5 or 6 letters, the monoalphabetic eqmvalents of tell-tale words such as ATTACK, BATTALION, DIVISION, etc , would stand out The system is most efficac10us, therefore, with short groupmgs f It should also be noted that there is nothing about the scheme which reqmres a regularity m the groupmg cycle such as that embodied m the example A lengthy groupmg cycle such as the one shown below may 3ust as easily be employed, it bemg gmded by a key of its own, for example, the number of dots and dashes contamed m the Internat10nal Morse signals for the letters composmg the phrase DECLARATION OF INDEPENDENCE nnght be used Thus, A ( -) has 2, B (_ ••• ) has 4, and so on Hence s I G N 1 12 A 123 L 1234 12345 s I G 1 12 N 123 1234 12345 1 12 123 1234 12345 1 12 123 A L s 1 123 12 I G 1234 12345 c OM MAN DING GENER A LF IRS TARM s SU EDO RDER SEFFE g uw UGT KFAH UWNWJ L HN ARQ NGPU YHASI PGNVF I TR OPE RFER OCBBC N A L s I G N A L s I G N A L 1 12 123 1234 12345 1 12 123 1234 12345 1 12 123 1234 12345 c TI VET WENT YFIRS T AT NOO NDIR ECTIN G TH L HS QHS WOFZ KDARQ N NU NMM YIDU OQZKF c NZ ATT ELEP HONES NUU WPWL EXYHT s I G N A L s I c OM MAS WITC HBOAR D SC OMM g uw UGO RFUL TZMAJ I AQ uww CRYPTOGRAM QUWUG OCBBC UWPWL TKFAH LHSQH EXYHT UWNWJ SWOFZ QUWUG LHNAR KDARQ ORFUL QNGPU NNUNM TZMAJ PGNVF MYI DU IAQUW ITROP OQZKF w ERFER CNZNU l!'IOUBll 1 1 In this connection, see Section Ill, Militar11 Cryptanalyaia, Part 1r, ---~----- - - - - - - - DE CL AR AT I 0 N0 F I NDE P E NDE NCE a 1 • • 2 a 2 i 2 a 2 a ~ 2 2 a 1 • i 2 a i 2 • 1 4 The groupmg cycle is 3+1+4+4+2 , or 60 letters m length Suppose the same phrase 1s used as an enc1phermg key for determmmg the selection of cipher alphabets Smee the phrase contams 25 letters, the complete penod of the system would be the least common multiple of 25 and 60 or 300 letters Tlus system might appear to yield a very lugh degree of cryptograpluc security But the student will sec as he progresses that the secunty is not so high a~ he may at first glance suppose it to be 4. Primary and secondary periods, resultant periods -a It has been noted that the length of the complete period m a. system such as the foregomg 1s the least common multiple of the length of the two component or mteractmg periods In a way, therefore, smce the component periods constitute the basic element oi the scheme, they ma} be designated as the basic or primaT?J periods These are also hidden or latent peuods The apparent or patent penod, that is, the complete penod, may be designated as the secondary or resultant period In certain types of cipher machmes there may be more than two pnmary penods wluch mteract to produce a resultant period, also, there are cases m '"hich the latter may mternct with another pnm'lry penod to produce a tertiary penod, and so on The final, or resultant, or apparent period Is the one wluch is usually ascertamed first as a result of the study of the mtervals between repetitwm This ma.y or may not be broken down mto its component prrmary penods b Although a. solution may often be obtained without breakmg down a resultant penod mto its component pnmary penods, the rcadmg oI many messages pcrtammg to a widespread system of secret commurucat1on is much facilitated when the analysis 18 pushed to its lowest level, that is, to the pomt where the fmal cryptogr.lpluc sc,heme has been icduced to its srmplest terms Tlus may mvolve the discovery ol a m,ilt1phc1ty of sm1ple clements which mteract m successive cryptograpluc strata SECTION II SOLUTION OF SYSTEMS USING CONSTANT-LENGTH KEYING UNITS TO ENCIPHER VARIABLE-LENGTH PLAIN-TEXT GROUPINGS, I l'.i.r<\llnph Introductory remc>r1.s _ _ _ _ Aper1od1c enmpherment produced by groupmgc; accordmg to word lengths _ ____ _____ __ __ __ _ _ Solution when direct standard cipher alphabets an employed ___ ----- __ ------ _ _ _ _ _ _ _ __ __ __ _ Solut10n l\hrn rc'\eised &tandard c1phc.r alphabets are 1:,mployed ------ __________ ----- _______ ------ __ _ CommLnts 011 fo1Lg01Pg ca~cc __ _____ _ __ _ ____ _ _ --------- ------ _ ___ ____ ___ _____ __ __ ___ _ .5 b 7 8 9 5. Introductory remarks -a The system descnLed m p.i. agraph 3 abo\ e is ob nously riot to be classified as aprnod1r Ir nature, dci.p1te the IDJect10n of a vnuahle factor \Vlnch mthnt case \\a.s based upon megula1 1ty m the leugtb of one of the two clement':! mvolvcd m pol)a.lphabetic substitution The v:muble factor WJ.s there suhJect to a In.\\ \\lnch m itself was por1ochc m character b To mnke such a sy<Jtcm trnly aper1od1c m character, by elaborating upon the ba':!lC scheme for pr0ducn•g v1111,1ble-leni;th plam-text grouping,,,, would be posb1ble, but unpractical For example, usmg the E>ame rneth0d as is r;1ven m pa.ragr.1ph 3} fo1 determmmg the lengths of the groupmgs, one might employ the text of a Look, and If t},p httcr 1s longer than t1'e messag~ to be enciphered, the l'rvptogram would ccrtamly show no period1c1ty as regardi. tl1 e mtervalb between repetitions, '\\h1ch \vould be plentiful IIoweV"er, as already md1cated, E.uch a <,chcme would not be very practical for regular commumcation between a large number of correspondents, for reasons wluch are no doubt apparent The book would have to be safeguarded as would a code, enc1phenng and demphermg would be qmte slow, cumbersome, and subJect to erro1, and, un1co:s the same key kll.t weie u~ed for all messages, methods or md1cators would have to be adopted to show exactly where enc1phe1ment begms m each message A slmpler method for producing constantly cl.ang:mg, npcnod1c plum-text groupmgs therefore, is to be sought 6 Aperiodic enc•phern:.ent produced by groupings accordmg to word lengths -a The simplest method for prodl1cmg aperiodic pla.n-text groupmgs is one which has doubtless long ago presented itself to the ~t 1dl'nt, viz, cnc1pherment accordmg to the actual word lengths of the me"'sage to be enciphered b Although the average number of letters composmg the words of any alphabetical language is fall'ly constant, succPss1ve word'> compn<;img plam text vary a great deal m this respect, and tlus vanat1on is sub1ect to 110 law 1 In telegrapluc English, for example, t1e mean length of words is 5 2 letters, the words may contam from 1 to 15 or more letters, but the succ,ess1ve words vary m length In an extremely irregular manner, no matter how long the text may be c As a consequence, the use of word lengthi. for detcrmlDIIlg the number of letters to be enmphered by each key letter of a repetitive key commends itself to the mexpeuenced cryptographer as soon a<1 he {'Orne~ to tmdcrstand the way m which repeatmg-key ciphers are solved If there is no penod1c1ty m the cryptograms, how {'an the letters of the cipher text, Wl'ltten m t It 1s true, of course, that the d1ff<'ren!'r'I h<'t\\c <'n two VI ritLrs m re'lpect to the lengths and characters of the words contamcd m their personal vocabt'latws arc oft"n m'lrk<'d and Mn be measured The'!L d fferonces may be subJect to ccrtam l.i.Vls, but the latter arc not of thL t)'pP m wluch VIC ar<' rntcie<ikd, bemg J>'lycho1og1cal rather th'ln mathematwal m character See Rickert, E, New Methods for the Study of Literature, Umvers1ty of Chicago Press, Chicago, 1927 (5) j 6 7 fi-letter groups, be distributed mto their respective monoalphabets? And if this very first step is 1mposs1ble, how can the cryptograms be solved? 7 Solution when direct standard cipher alphabets are employed - a Despite the foregomg rhetorical quest10ns, the solut10n of tlus case is really qmte simple It merely mvolves a modificat10n of the method given m a prev10us text, 2 wherem solut10n of a monoalphabetw cipher employmg a direct standard alphabet is accomplished by completmg the plam-component sequence There, all the words of the entire message come out on a smgle generatrix of the complet10n diagram In the present case, smce the mdiv1dual, separate words of a message are enciphered by different key letters, these words will reappear on different generatrices of the diagram All the cryptanalyst has to do Is to pick them out He can do this once he has found a good startmg pomt, by usmg a little 1magmat10n and followmg clues afforded by the context b An example will make the method clear The followmg message (note its brevity) has been mtercepted 8. Solution when reversed standard cipher alphabets are employed -It should by this time hardly be necessary to md1cate that the only change m the procedure set forth m paragraph 7c d m the case of reversed standard cipher alphabets is that the letters of the cryptogram mu cit converted mto their plam-component (direct standard) eqmvalents before the complet10n sequence is applied to the message 9. Comments on foregoing cases -a The foregomg cases are so simple m nature that the detailed treatment accorded them would seem hardly to be warranted at this stage of study However, they are necessary and valuable as an mtroduct10n to the more complicated cases to follow b Throughout this text, whenever encipherment processes are under d1scuss10n, the pair of enc1phermg equat10ns commonly referred to as charactenzmg the so-called Vigenere method will be understood, unless otherwise md1cated Thls method mvolves the pair of enciphering equations e 111 =8i, 12 , 0p 11 =0c 12 , that is, the mdex letter, whwh is usually the m1tial letter of the plam component, is set opposite the key letter on the cipher component, the plam-text letter to be enmphered is sought on the plam component and its eqmvalent is the letter opposite it on the cipher component 3 c The solut10n of messages prnpared accordmg to the two precedmg methods is particularly easy, for the reason that standard mpher alphabets are employed and these, of course, are denved from known components The significance of this statement should by this trme be qmte obvious to the student But what if IDIXed alphabets are employed, so that one or both of the components upon which the mpher alphabets are based are unknown sequences? The srmple procedure of completmg the plam component obv10usly cannot be used Smee the messages are polyalph11bet1c m character, and smce the process of factormg cannot be apphed, it would seem that the solution of messages enciphered m drlferent alphabets and accordmg to word lengths would be a rather difficult matter However, it will soon be made clear that the solution is not nearly so difficult as first rmpress1on lllght lead the student to 1magme TRE CS YGE T I LU V WV I K MQ I RX SP J SVAGR XUXPW V MT U C SY X G X VHF F B LLB HG c Subm1ttmg the message to routme study, the first step is to use normal alphabet strips and try out the poss1b1lity of direct standard alphabets havmg been used The complet10n diagram for the first 10 letters of the message is shown m figure 2 d Despite the fact that the text does not all reappear on the T R E CS YGE T I same generatrix, the solut10n Is a very simple matter because the US F DT Z HF UJ first three words of the message are easily found CAN YOU GET VT GE UA I GVK The key letters may be sought m the usual manner and are found WUHFVBJHWL One may proceed to set up the remammg letters of to be REA X V I G WC K I X M the message on slidmg normal alphabets, or one may a-;sume YWJHXDLJYN var10us keywords such as READ, REAL, REAM, etc , and try to Z X K I Y E MK Z 0 contmue the dempherrnent m that way The former method is AYLJZFNLAP easier The completed solut10n is as follows B Z MK A G 0 MB Q R CAN TRE E YOU CSY A GET GET D FIRST ILUVW E REGIMENT VIKMQIRX R BY SP S RADIO JSVAG D I G E S T OUR RXU PHONE XPWVM NOW TUC OUT SYX OF GX COMMISSION VHFFBLLBHG e Note the key m the foregomg case It is composed of the successive key letters of the phrase READERS DIGEST f The only difficult part of such a solut10n is that of makmg the first step and gettmg a start on a word If the words are short it is rather easy to overlook good poss1b1lit10s and thus spend some time m frmtlecis searchmg However, solution must come, If nothmg good appears at the begmmng of the message, search should be made m the mter10r of the cryptogram or at the end 1 Military Cryptanalysis, Part I, Par 20 CANL BHP NC R D B 0 MC I Q 0 D S ECPNDJRPET FDQOEKSQFU GERPFLTRGV HFSQGMUSHW IGTRHNVTIX J H U S I 0 WU J Y KI VT J P XVKZ LJWUKQYWLA MKXVLRZXMB NLYWMSAYNC 0 MZ X N T B Z 0 D P NAY0 U CAP E Q0 B Z P V D B QF R P C A Q WE C R G SQDBRXFDSH F'IGUllJ: 2 b: a Seem tlus connection, Military Cryptanalysis, Part Il1 Section II, and Appendix 1 9 d With these assumed eqmvalents a reconstruction skeleton or dmgram of cipher alphabets (fornnng a portion of a quudncular table) is estabh<ihed, on the h1 pothes1s that the cipher alphabets have been de11ved from the sl1dmg of a mi'\.ed component agmnc;t the normal sequence First it is note<l that smce 0 11 =Rc both m the wo1d DIVISION and m the \\Old OCLOCl{ their cipher eqmvalents must be m the same nlphabet The rnconstI uct1on skeleton IS then as follows Si.CTION III SOLUTION OF SYSTEl\ilS USING CONSTANT-LENGTH KEYING UNITS TO ENCIPHER VARIABLE-LENGTH PLAIN-TEXT GROUPINGS, II Paragraph Solution \'\hen the or1gmal wm cl lengths are retamed m the cryptogram __ _ __ _ __ -------- ____ -------------Solution when other types of alphabets aie employed ------- __________ ------- _____ _______ ----------- __ -------Ibomorph11;,m aud itt. 1mpo1 tauc,c m cryptanal)' i1Ls __ __ ------- __ _ __ ----------- ____ ----- -------------- -------Illustr.i.t10n of the apphLat1ou of phLnomena of 1'lomorph1~m m solvmg a cryptog1am _ _ ______ ____ __ __ 10 11 ll 13 10 Solution when the original word lengthc;; are retained m the cryptogram -a This case will be discussed not because it is encountered m practical nnhtnry cryptography but because it affords a good mtroduct1on to the case m which the origmal w01<l lengths are no longer m evidence m the cryptogtam, the latter appea.rmg m the usual 5-letter groups b Reference is made at this pomt to the phenomenon called idiomorph1sm, and its value m connection with the apphcat10n of the prmmples of solut10n by the "probable-word" method, as explamed m a prcv10us te"Ct 1 When the original word lengths of a message are retamed m the cryptoffl'am, there is no diflkulty 1'1 senrchmg for and locatmg i<l1omorphs and then makmg comparisons between these id.10morrl11c c;cquenccs m the message and special word patterns set forth m hsts ma.n tinned for till' purpose For eJ..nmple, m the followmg message note the underlined groups and study the letters withm tl1esc groups A B Division, '=- - 1= - '-= ·= - - I = - - - I = - -- - - - - - - ·-= ·= - - I E o'clock _____ (l) D R w z H 0 p ,_ - - - - - - - ,_ - -- - - - -- - - - - - - - - - T v Battahon ____ (2) R A K N 0 F ,_ - ,_ - - - - - - - ,_ - - - - - - - - - - - - - - p Artillery _____ (3) s F J u D x FlGUBB 3a e Notmg that the mterval between 0 and Rm the firc;t an<l second alphabets is the same, direct symmetry of poc;ition is assumed In a few moments the firc;t alplmbet m the skeleton becomes as follows XIXLP EQVIB VEFHAPFVT RT XWK PWEWIWRD XM NTJCTYZL OAS XYQ ARVVRKFONT BH §...L..4DUUXFP OUVIGJPF ULBFZ RV DKUKW ROHROZ c D E F G H I J K L M N 0 p Q R s T u v wx y z A B - - - - - - - - - - --p I R A u x z H D s T v w (1 ) N 0 - - - - - ,_ - - - - -- - - T v N 0 K F (2 ) R A - - - -- - - - - - - - - - F J D u (3 ) s x - MESSAGE c D E F G H I J K L MN 0 p Q R s T u v wx y z - - - - - I- ·- ·- ~-- - - E F ,___ ,___ - J K - ,___ - p IDIOMORPHIC SI< QUENCES ( 1) PWEWIWRD -:...._;-'--""- (2) A R v••v R K F 0 NT -...____, (4) R 0 H R 0 Z '--"" (3) s E J Du U XE P J The key word upon which the rmxed component is based is now not difficult to find c Reference to hstc; of words commonly found 111 rmhtary text and arranged accordmg to their 1diomorph1c pattern., or formulae soon gives suggest10ns for these cipher groups Thus (1) (2) 1 PW E WI WR D D I V I S I 0 N -'-7"-7 (3) AR VVR KF 0 NT B A THT A L I 0 N S '--"" (4) S F J DU U X F P ART I L L E RY - - -7 ROHROZ 0 CL 0 CK -"----"" - Military Cryptanalysis, Part I, Par 33 a,-d, mclut.1vc (8) J!lGUP.lll 3b HYDRAULIC g (1) To decipher the entire message, the sunplest procedure is to convert the cipher letters mto their plam-component eqmvalents (setting the HYDRAULIC Z sequence agamst the normal alphabet at any pomt of comCldence) and then completmg the plam-component sequence, as usual The words of the message will then reappear on different generatnces The 10 11 key letters may then be ascertamed and the solution completed t h e d1agram 1s as follows Th us, ior z t h e fi rst three words Plam_________________ A B C D E F G H I J K L M N 0 P Q R S T U V W X y z Cipher_______________ H Y D R A U L I C B E F G J K M N O p Q S T V W X z XIXLP YHYGS ZIZHT AJAIU BKBJV CL CKW EQVIB KTWHJ LUXIK MVYJL NWZKM 0 XAL N D MD L X P Y B M0 E N E MY Ap=S 0 QZ CNP RAD0 Q S BEP R T C F QS VEFHAPFVT WKLAESLWV XLMBFTMXW YMNCGUNYX ZNODHVOZY A 0 P E I Wp A z B P QF J X QB A C QR GKYR CB DRS HL Z S DC E S T I MA T E D U D GR T VE HS U WFIT V X G JU W YHKVX Z I L WY A JM X Z BK NY A CL 0 ZB D MP A C E NQB D F 0 RCE FIGURE 4 (2) The key for the message is found to be SUPREME COURT and the complete m as follows essage ts SOLUTION S U P RE M E C o u ENEMY FORCE ESTIMATED AS ONE DIVISION OF INFANTRY AND TWO XIXLP EQVIB VEFHAPFVT RT XWK PWEWIWRD XM NTJCTyzL OAS XYQ R T S U PRE M BATTALIONS OF ARTILLERY MARCHING NORTH AT SEVEN OCLOCK ARVVRKFONT BH SFJDUUXFP OUVIGJPF ULBFZ RV DKUKW ROHROZ h In case the plam component is the reversed normal sequence, the procedure is no different f~om the foregomg, except that m the completion diagram the reversed sequence is employed a ter the cipher letters have been converted mto their plam-component eqmvalents i No doubt the student realizes from his previous work that once the primary mixed component has been recovered the latter becomes a kno'IJYn sequence and that the solution of subsequent messages employmg the same set of derived alphabets, even though the keys to md1vidual messages are different, then becomes a sunple matter ' 11 Solution when other types of alphabets are employed -a The foregomg examples mvolve the use either of standard cipher alphabets or of mixed cipher alphabets produced by the shdmg of a illlXed component agamst the normal sequence There is, however, nothmg about the general cryptographic scheme which prevents the use of other types of derived, mterrelated, or secondary mixed alphabets Cipher alphabets produced by the shdmg of a rmxed component agamst itself (either direct or reversed) or by the shdmg of two different mixed components are very commonly encountered m these cases b The solution of such cases mvolves only shght modificat10ns m procedure, namely, those connected with the reconstruct10n of the pnmary components The student should be m a position to employ to good advantage and without difficulty what he has learned about the principles of mdirect symmetry of position m the solut10n of cases of the kmd described c The solut10n of a message prepared with nuxed alphabets derived as mdicated m subparagraph b, may be a difficult matter, dependmg upon the length of the message m quest10n It might, of course, be almost impossible if the message Is short and there is no background for the apphcat10n of the probable-word method But if the message is qmte long, or, what is more probable with respect to m1htary commumcat10ns, should the system be used for regular traffic, so that there are available for study several messages enciphered by the same set of alphabets, then the problem becomes much easier In add1t10n to the usual steps m solut10n by the probable-word method, gmded by a search for and 1dent16.cat10n of 1d10morphs, there is the help that can be obtamed from the use of the phenomena of isomorphism, a study of which forms the sub1ect of discussion m the next paragraph 12. Isomorplusm and its importance m cryptanalyt1cs.-a The term 1d10morphism is fam1har to the student It designates the phenomena ansmg from the presence and posit10ns of repeated letters m plam-text words, as a result of which such words may be classified accordmg to their compositions, "patterns,'' or formulae The term isomorphism (from the Greek "1sos" meamng "equal" and "morphe" meanmg "form") designates the phenomena arismg from the existence of two or more 1diomorphs with identical formulae Two or more sequences whwh possess identical formulae are said to be isomorphic b Isomorphism may exist m plam text or m cipher text For example, the three words WARRANT, LETTERS, and MISSION are isomorphw If enciphered monoalphabet1cally, their cipher eqmvalents would also be isomorphic In general, ISomorph1sm is a phenomenon of monoalphabet1c1ty (either plam or cipher), but there are mstances whcrem it IS latent and can be made patent m polyalphabet1c cryptograms c In practical cryptanalysis the phenomena of isomorphism afford a constantly astomshing source of clues and aids m solution The alert cryptanalyst is always on the lookout for s1tuat10ns m which he can take advantage of these phenomena, for they are among the most mterestmg and most rmportant m cryptanalytics 13. IDustrat1on of the use of isomorphism -a Let us consider the case discussed under paragraph 10, wherem a message was enciphered with a set of mixed cipher alphabets denved from shdmg the key word-mixed prlillary component HYDRAULIC XZ agamst the normal sequence Suppose the message to be as follows (for s1Illphc1ty, ongmal word lengths are re tamed) CRYPTOGRAM V C L L K I D V S J D C I 0 R K D C F S T V I X H MP P F X U E V Z Z FK NAKFORA DKOMP I S E C S P P H Q K C L Z K S Q L P R 0 J Z WB C X H 0 Q C F F A 0 X R 0 Y X A N 0 E MD MZ MT S T Z F V U E A 0 R S L AU P AD DE R X P N B X AR I GH F X J X I 12 13 b (1) Only a few nnnutes mspection discloses the followmg three srts of isomorph<1 (a) (1) Y:.Q!:d,~KIQY:SJQ.Q! (a) I ~ H M _E .E F ~ U (b) HQQCEEAQX (a) NAKFORA ROYXANO -, FF"""- ! T'-- [ T 11 J ! (b) (<') .Q § .E .E H Q. K .Q L Z K § Q. (2) PADDERXPNBXAR T f (3) L I l I (b) which gives the sequence the appearance of bemg the latter half of a keyword-rmxed sequence runrung m the reversed direction, let the half-cham be reversed and extended to 26 places, as follows 1 2 a ' s e 7 s 9 w u u u ~ u u u ~ ~ m n ~ ~ M z z J ._ E (2) Without stoppmg to iefar to \\Old-pattern lists m an uttempt to identify the very str1kmg id1omorphs of the first set, let the student p10Leed to bwld -up partial bequences of eqmvalents, as though he \\ere dealing \\Ith a c..c1.se of mdir~ct symmetiy of pos1t10n Thus 2 From ibomorphs (1) (a) and (1) (b) V-<>C, cos. LoP, K=e-H, IoQ, D=e-K, s=e-L, Joz, from which the followmg partial sequences are con<1tmcted (a) VCSLP (b) DKH (c) IQ K N P S V X H coP, soA, PoD, HoE, QoR, K<>X, LoN, Z-<>B, from which the followmg partial sequences arc constructed (g) HE (h) QR (i) KX (J) LN (k) ZB V=C-P, CoA, Loo, KoE, IoR, o=e-x, S<>N, JoB, E BE FK from which the followmg partial sequences are constructed (m) VP (n) CA (o) KE (p) IR (q) SN (r) JB Noting that the data from the three ISomorphs of this set may be combmed (VCSLP and CPD make VCSLP D, the latter and LOX make VCSLP D X), the followmg sequences are established (1){ ~ c s L p (2){ ~ 2 3 Q " R (3){~ z 2 2 3 3 4 5 6 7 8 9 10 A N D K H 4 13 12 11 x E 5 5 B c (1) The fact that the longest of these chams consists of exactly 13 letters and that no additions can be made from the other two cases of isomorphism, leads to the assumption that a "half-cham" is here disclosed and that the latter represents a dec1mat1on of the ongmal pnmary 1 component at an even mterval Noting the placement of the letters V • The symbol ¢o is to be read "is equivalent to " 2 3 S C (3) The sequence H D R A L I C soon suggests HYDRAULIC as the key word When the rmxed sequence is then developed m full, complete corroboration will be found from the data of 1somorphs 2 (a) (b) and 3 (a) (b) Thus 1 2 a 4 a o 7 s o w u H a u ~ w u ~ ~ m n ~ ~ M z z HYDRAULICBEFGJKMNOPQSTVWXZ S COMMUNICATION VCLLKIDVSJDCI From 1somorphs (1) (a) and (1) (c) (1) LOX L (2) The data from the two partial chams (JZ Band IQ R) may now be used,and the letters mserted mto their proper poSitions Thus 1 2 s ' a e 7 s a w u u a u u u u a ~ m n ~ ~ M z z E JK N PQS V XZH ORA LICB [Key STRIKE WHILE THE IRON IS (f) SA A (4) From 1d1omorphs (2) (a) and (2) (b), the mterval between H and I lS 7, it lS the same for 0 and X, Q and H, C and M, etc From 1d1omorphs (3) (a) and (3) (b) the mterval between Rand Nis 13, it is the same for 0 and A, Y and K, etc d The message may now be solved qwte readtly, by the usual process of convertmg the cipher-text letters mto their plam-component eqwvalents and then completing the plam component sequences The solution lB as follows (d) JZ From 1sornorphs (1) (b) and (1) (c) (e) CPD D 4 5 P 6 7 N 8 9 K , W THROUGH NAKFORA T WITH ORKD H CORPS DKOMP R FIRST CFSTV I AND ISE (HOT?}] I ARTILLERY IXHMPPFXU K WILL EVZZ L COMMUNICATION CSPPHQKCLZKSQ E WITH LPRO T H E I SECOND JZWBCX ARTILLERY HOQCFFAOX THROUGH ROYXANO DIVISION EMDMZMTS R 0 N I S SWITCHBOARD NO COMMUNICATION AFTER TEN TZFVUEAORSL AU PADDERXPNBXAR IGHFX JXI e (1) In the foregomg illustration the steps are particularly Blllple because of the followmg Cll'Cumstances (a) The actual word lengths are shown (b) The words are enciphered monoalphabetically by different alphabets belongmg to a set of secondary alphabets (c) Repetitions of plam-text words, enciphered by dt1ferent alphabets, produce 1S0morphs and the lengths of the 1Somorphs are definitely known as a result of cJ.rCumstance (a) (2) Of these facts, the last is of most mterest m the present connection But what If the actual word lengths are now shown, that lB, what If the text to be solved is mtercepted m the usual 5-letter-group form? 1811122-89--2 SECTION IV SOLU'l'ION OP sr:rii~:.~~~~';'~:=~i:i::gs~~TS TO ENCIPHER General remarks ____ __ _ _ Word separators __ _ V~iat1ons and concludmg re~~;k; ~~-;.~;g~ing ~y~tf'ms Paragraph - ------ - - -- -- -- _ ___ _ ___ 14 ---- -- - -- - - ------ -----------------· ·- --- 16 - - ---- ----- --- -- --- --- 15 14. General remarks -a The (,a<>es de.-,t.nbed th f the cryptanalyst has before hun th l us a1 aie piu ticulaily easy to solv-e because military cryptography this is seldon: =~:~~~st~ tie.tr true or ongmaI word lengths But in what more difficult by ieason of the fact that tli'c;e~:S~ot~e problem is therefore made someencipherment by successive keyletters However th 1 g to mdzcate defuntely the lumts of pe.runentation m tlus case than m the pre d , The so ut1on merely necessitates more exrepetitions which may serve to "blo