Classical Ciphers & Cryptanalysis

Every cipher in this entry is broken, and that is exactly why they are worth an hour: the classical lineage is the cheapest way to acquire the attacker's mindset — counting letter frequencies, exploiting structure, solving for a key from known plaintext — and it ends at the one scheme with a proof of unbreakability, whose failure mode (pad reuse) is still shipping in production systems today under different names.

The shift lineage: Caesar and Trithemius #

Number the alphabet $0..n-1$. The Caesar cipher shifts every letter by a fixed key $k$:

$$y = (x + k) \bmod n, \qquad x = (y - k) \bmod n$$

The keyspace is $n-1$ candidates — brute force by hand in minutes. Mathematically it is the special case $a=1$ of the affine cipher $y = (ax + k) \bmod n$. Its only surviving descendant is ROT13, used as a don't-spoil-me encoding, not encryption.

Trithemius makes the shift depend on the position $t$ of the letter in the message — e.g. a linear rule $k(t) = 3t + 2$:

$$L = (m + k(t)) \bmod N$$

The position-dependent shift masks single-letter frequencies, but a linear key rule has two unknown coefficients: two characters of known plaintext solve the whole system. Structure survives; only the disguise improved.

Polyalphabetic ciphers and gamma #

The general form — the gamma cipher family, of which Vigenère is the classic member — adds a key stream $\gamma_i$ (the gamma) to the plaintext, symbol by symbol:

$$c_i = (a_i + \gamma_i) \bmod N$$

With a keyword of length $M$, the gamma is periodic: the ciphertext is really $M$ interleaved Caesar ciphers. That kills naive frequency counting — the histogram of a Vigenère ciphertext is much flatter than the plaintext's — and it resisted attack for ~300 years. Then two tools ended it:

• Kasiski examination (1863): repeated plaintext fragments encrypted under the same key offset produce repeated ciphertext fragments; the distances between repeats are multiples of $M$. GCD the distances → key length.
• Index of coincidence (Friedman, 1920s): the probability that two random ciphertext letters match distinguishes a monoalphabetic column (English ≈ 0.066) from random (≈ 0.038), confirming $M$ statistically. Then each of the $M$ columns falls to plain frequency analysis.

The one that works: the one-time pad #

Make the gamma as long as the message, truly random, and never reused, and the gamma cipher becomes the one-time pad. Shannon proved (1949) it has perfect secrecy: the ciphertext is statistically independent of the plaintext, so an attacker with unlimited compute learns nothing but the length. It is the only cipher with such a proof — and the proof also shows the price is unavoidable: perfect secrecy requires key material at least as long as all traffic, exchanged out of band. That makes OTP a logistics problem, not an engineering solution, which is why it guards hotlines, not HTTPS.

The two-time pad: the failure mode that never dies #

Reuse a pad once and perfect secrecy inverts into near-total compromise:

$$c_1 \oplus c_2 = (p_1 \oplus \gamma) \oplus (p_2 \oplus \gamma) = p_1 \oplus p_2$$

The key drops out. The XOR of two natural-language plaintexts is highly redundant and yields to crib dragging — sliding a guessed word along $p_1 \oplus p_2$ and checking whether the complement reads as language.

1. 1940s Soviet OTP factory reuses pad pages under wartime pressure; the US Venona project exploits the reuse for decades, exposing the Rosenberg and Fuchs networks.
2. 1997 Microsoft PPTP (MS-CHAPv1 era) uses the same RC4 keystream in both directions of a session — a literal two-time pad.
3. 2001 WEP's 24-bit IV space guarantees keystream reuse within hours on a busy AP; related-key structure (FMS attack) finishes it off.
4. 2016+ Nonce reuse in AES-GCM and ChaCha20-Poly1305 recreates the same algebra — keystream reuse plus, for GCM, recovery of the authentication key (the "forbidden attack", found live on ~184 HTTPS servers in 2016).

Source claims audit #

Seeded from a university lab manual (Caesar / Trithemius / gamma labs). Status of its load-bearing claims: