The one-time pad is an encryption method invented by Gilbert Vernam, an American engineer at AT&T Bell Labs, in 1917.

Note: This post was translated from french with the help of AI. The original post was written with the knowledge of a younger me.

It is based on a much older encryption technique called the “ Vigenère cipher”.

The one-time pad was further perfected by the American general Joseph Mauborgne, who introduced the randomness of the encryption key.

It consists of encrypting a message with a key by adding the key to the message, element by element. The key must be used only once (hence the “one-time” or disposable). To decrypt, you subtract the key from the message.

Okay, history is nice but in practice, how does it work?

How it works

To understand the one-time pad, you first need to master (or at least understand) congruence (or modulo arithmetic).

The basics

We’ll start by using non-random texts for the keys. Note, this is just to start slowly because here security is zero.

We’ll take a Bigflo&Oli (french rappers) text as the message to encrypt and a Georges Brassens (french singer) text as the key.

The message is from “Alors alors”:

“Alors alors, On devait faire le tour de la Terre”

The key is from “Bancs publics”:

“Les gens qui voient de travers pensent que les bancs verts”

Got modulo in mind? Good, let’s start by assigning a number to each letter of our alphabet:

A=0, B=1, C=2, D=3, E=4, F=5, G=6, H=7, I=8, J=9, K=10, L=11, M=12, N=13, O=14, P=15, Q=16, R=17, S=18, T=19, U=20, V=21, W=22, X=23, Y=24, Z=25

So, for our 26-letter alphabet, we have numbers from 0 to 25.

Encryption

To encrypt, it’s simple, we add letters face to face. “Add letters, are you crazy?” you might say, but that’s why we’ve given them numerical equivalents, follow along. Since we haven’t assigned values to commas, we’ll remove them.

Let’s go:

"Alors alors On devait faire le tour de la Terre"

+

"Les gens qui voient de travers pensent que les bancs verts"

The “A” of “Alors” + the “L” of “Les” = A + L = 0 + 11 = 11 = L

Then “l” + “e” = l + e = 11 + 4 = 15 = p

So, little by little:

"Alors alors On devait faire le tour de la Terre"

+ + +

"Les gens qui voient de travers pensent que les bancs verts"

= = =

0 11 14

+ + +

11 4 18

= = =

11 15 32

= = =

L p ?

Indeed, for adding “o” and “s”, we get 14 + 18 = 32 and here is the problem, we don’t have a letter with value 32.

But remember, congruence (modulo, all that).

Since we have only 26 letters, we’ll use modulo 26 to stay in range.

Modulo 26 of 32 is:

$$ 32 \pmod{26} \equiv 32 -26 \pmod{26} \equiv 6 \pmod{26} $$

And 6 corresponds to letter G.

So, we can finish our calculation:

"Alors alors On devait faire le tour de la Terre"

+ + + ...

"Les gens qui voient de travers pensent que les bancs verts"

= = =

0 11 14

+ + +

11 4 18

= = =

11 15 32 mod(26)≡ 6 mod(26)

= = =

L p g …

In the end:

"Alors alors On devait faire le tour de la Terre"

+

"Les gens qui voient de travers pensent que les bancs verts"

=

"Lpgxw ndela Jb liitlx yrimi cw ishj hr eq Nicvw"

We have our encrypted message.

Decryption

To decrypt, we do the opposite: subtract the key from the encrypted message.

We have encrypted message “Lpgxw ndela Jb liitlx yrimi cw ishj hr eq Nicvw” and the key “Les gens qui voient de travers pensent que les bancs verts”.

So:

"Lpgxw ndela Jb liitlx yrimi cw ishj hr eq Nicvw"

- - -

"Les gens qui voient de travers pensent que les bancs verts"

= = =

11 15 6

- - -

11 4 18

= = =

0 11 -12

= = =

A l ?

Again, same problem as encryption, we have -12 with no corresponding letter.

We apply modulo 26:

$$ -12 \pmod{26} \equiv -12 + 26 \pmod{26} \equiv 14 \pmod{26} \equiv o $$

We continue the calculation and recover:

"Lpgxw ndela Jb liitlx yrimi cw ishj hr eq Nicvw"

- - - ...

"Les gens qui voient de travers pensent que les bancs verts"

=

"Alors alors On devait faire le tour de la Terre"

Mauborgne in da house

Okay, that’s nice but not very secure. To improve security, let’s listen to General Mauborgne and use a random key (or at least a more random one).

After putting a pseudo-random generator (yes, I know, an incomprehensible term, we’ll come back to it in a future article) on my computer, rolling my head on the keyboard, and letting the cat walk on it for entropy (yes, another incomprehensible term), I got this key:

"snchfzrhqjlnveivpyonrkudrpqtpxptfwrildof"

We’ll encrypt the following message, again by Bigflo&Oli, from “Dommage”:

“Il croisait cette même fille, avec son doux parfum”

Encryption

Here we go again:

"Il croisait cette même fille, avec son doux parfum"

+ +

"snchfzrhqjlnveivpyonrkudrpqtpxptfwrildof"

= =

8 11

+ +

18 13

≡ =

0 mod(26) 24

=

a y …

We get the encrypted message:

"Il croisait cette même fille, avec son doux parfum"

+

"snchfzrhqjlnveivpyonrkudrpqtpxptfwrildof"

=

"ayeythjhycnroxmhtksszvfhrkuvhlcwtqoxlutze"

Decryption

I think by now you get it. One quick example.

Still with modulo(26), decrypt this message:

"irszlg k wiu ladw"

with the key:

"xjgzpyisqbjmplcxhwfpijqrstghighnhylshqza"

And tweet or post the result.

The Che level

So far we’ve been cute, now we tackle the hard stuff.

Che Guevara and Fidel Castro communicated with a cryptographic technique based on the one-time pad. However, there was an extra complexity.

They didn’t use a sequence of numbers like we did, but assigned arbitrary numbers to letters of the alphabet.

Here is their substitution:

A=6, B=38, C=32, D=4, E=8, F=30, G=36, H=34, I=39, J=31, K=78, L=72, M=70, N=76, O=9, P=79, Q=71, R=58, S=2, T=0, U=52, V=50, W=56, X=54, Y=1, Z=59

You might ask “how do you do congruence with this?”, hold on, it’s coming.

Actually, they transmitted numbers, not letters, and the key was itself composed of numbers. They used the most known modulo (the one we unknowingly use), modulo 10.

So, how did they do it? Let’s take an example.

Encryption

We want to encrypt the message:

“J’aime pas les framboises” (“I don’t like raspberries” in french, just an example, I do like raspberries)

We replace the letters with their numbers:

“J A I M E P A S L E S F R A M B O I S E S” becomes “31 6 39 70 8 79 6 2 72 8 2 30 58 6 70 38 9 39 2 8 2”

We encrypt this message with the key:

"4317892093088287991744997181628757157172"

We add the numbers face to face and apply modulo 10. To ease things, they first grouped digits in packets of 5.

So, the message:

"31 6 39 70 8 79 6 2 72 8 2 30 58 6 70 38 9 39 2 8 2"

becomes:

"31639 70879 62728 23058 67038 93928 2"

We add with modulo 10:

"31639 70879 62728 23058 67038 93928 2"

+

"43178 92093 08828 79917 44997 18162 87571 57172"

=

747 (7+3 ≡ 10 mod(10) ≡ 0) …

=

74707 62862 60546 92965 01925 01080 0

The encrypted message is therefore:

"74707 62862 60546 92965 01925 01080 0"

Decryption

We subtract the key from the message using modulo 10:

"74707 62862 60546 92965 01925 01080 0"

-

"43178 92093 08828 79917 44997 18162 87571 57172"

=

"31639 70879 62728 23058 67038 93928 2"

Then, we convert the numbers into their respective letters. And now you’re thinking, “But how can they tell the difference between the letter with value 2 and the letter with value 23? How can they know if it’s a one-digit or two-digit number?”

Very simple, the digits used for one-digit numbers are never used to start a two-digit number.

In fact, if you encounter 3, 7, or 5, you know it’s a two-digit number and so you must group the following digit with it.

In our case, we start with a 3, so we know it’s a two-digit number, we join the 1 to the 3.

"31 639 70879 62728 23058 67038  93928 2"

Next, the 6 is not in (3,7,5), so it’s a one-digit number:

"31 6 39 70879 62728 23058 67038  93928 2"

And so on:

"31 6 39 70 8 79 6 2 72 8 2 30 58 6 70 38 9 39 2 8 2"

Finally, we replace the numbers with their corresponding letters:

"J A I M E P A S L E S F R A M B O I S E S"

There you go!

The Perfection of the Cipher

Claude Shannon (more name-dropping, but this one is the flagship of cryptographers) mathematically proved that the one-time pad is considered cryptographically secure, or unconditionally secure, during World War II. That is to say, the system cannot be cracked even if the adversary has unlimited resources or unlimited time, as long as they do not know the secret key.

Claude Shannon proved that the one-time pad is “perfectly secret,” meaning that if you have a ciphertext encrypted with the one-time pad, there is absolutely no way to guess anything about the original plaintext.

This means it is also resistant to brute-force attacks. If you try every key in the universe, you will get every possible message in the universe, so you have no way to know which one is correct.

I won’t redo the mathematical proofs here. This article is meant for broad, easy-to-understand dissemination.

But to achieve this perfection, there are some challenges.

The Difficulties

The difficulties to overcome to achieve a perfect one-time pad are as follows:

Key Size and Quantity

For every exchange, you need a new key. For every exchange, that is, each person you communicate with and each message you send to them.

So, if you exchange 2 messages with 2 people, that makes 4 keys. 3 messages with 3 people, 9 keys…

Moreover, the key must be longer than the message.

Because if it is shorter and repeated to complete the encryption, you increase the probability of certain letters appearing and you can see patterns emerge giving clues about the message. This problem is similar to the need for randomness in creating keys.

This poses problems for securely storing keys, as the cipher collapses if the key is recovered by the adversary.

The Randomness of the Keys

In French, the letter “e” is the most commonly used letter, then “a”, then “s”…

And patterns like “le”, “les” are frequent. The key, when repeated, increases the chances of encrypting the same patterns in the same way.

The attacker can spot these patterns and deduce when the key is repeated.

Gradually, they can reconstruct the key or even manage without it.

An example:

Imagine the key “Wesh”, the attacker doesn’t know it but has found its length is 4 by analyzing the frequencies of recurring patterns.

They can cut the ciphertext into groups of 4 letters: “Uedl lsll ysfk wqfl myaz kvlp newu zsmj a” and subtract the groups from each other:

Uedl - lsll = X? + “Wesh” - (Y? + “Wesh”) = X? - Y? + “Wesh” - “Wesh”

= X? - Y?

The key disappears and we have two texts which are no longer random subtracted from each other. We analyze the letter frequency and form hypotheses. The letters resulting from the subtraction, the most frequent ones, are more likely to correspond to an “e” in one of their base letters, etc.

Step by step, by multiplying hypotheses, possibilities reduce and one can find the key or decrypt messages without it.

In conclusion, if you do a frequency analysis running your computer for three days, you will get the following message:

“Y’a le pote condamné qui sortira en douce,” always Bigflo & Oli, excerpt from “Comme d’hab”

This seems obscure, incomprehensible. Don’t worry, a future article will clarify all this with examples.

So, to ensure every letter has the same probability of appearing, you need randomly generated keys. But that is very hard to do. We can make pseudo-randomness but as its name indicates it’s not truly random, the probabilities of letter appearances are not exactly equal.

Key Transmission

Key transmission is not a problem for very small keys (an article will soon explain how).

But it becomes very complicated once keys must exceed a certain size (the current minimum size is 4096 bits or, in some crazy cases, 8192 bits, that is 1024 bytes, 1 KB for IT folks).

So, often, keys are exchanged physically beforehand. This is not practical and becomes very complicated when sending many messages to many interlocutors.

Uniqueness of Use

We return to the same problem as with key size and randomness.

If you reuse a key, you lose the randomness and the ciphertext becomes again vulnerable to frequency analysis.

The problem is even more serious because uniqueness of use implies destroying the key after use and there is no easy way to ensure that your correspondents do not keep the keys in a corner at risk of being stolen later (in 5 years, 10 years…) or reuse them for other messages on their side.

Message Poisoning

The last possible problem is key poisoning but this can be easily fixed (at least temporarily) in IT.

Since the one-time pad is immune to brute force (all keys in the universe produce all messages in the universe), an attacker can mess with the ciphertext to give it a different meaning.

They can also modify the key without necessarily knowing it and thus alter the plaintext.

Example:

Let’s take our famous message again:

“J’aime pas les framboises”

which we encrypt with the key:

“nzhtjplgpggsefirksxohsbyhkazsb”

using modulo 26 (thus without the apostrophe), we get:

“N zrry rrg yef eytvqzohky”

The attacker only knows this secret message but can modify the encryption key. They replace the key by:

“ezjfuqjcltbmtcvihgdtgefirksxohsbyhkazsb”

And that gives the following plaintext:

“Jaimebienlesfraisiers” ("I like strawberry bushes" in french)

So, not at all the original message.

To prevent this, in IT, you can sign and hash the message and keys so a user can verify that the message they receive was indeed created by the correct key and that the key they use is still the correct one.

We will come back to how signing and hashing work in future articles.

I think we have already well exceeded 2000 words. Let’s stop here.

Contrary to what its name suggests, the Vigenère cipher seems to have been invented by Giovan Battista Bellaso, an Italian cryptographer from the 16th century.

Nevertheless, it is the Vigenère cipher that endured, not Bellaso’s.

Blaise de Vigenère introduced his cipher 20 years after Bellaso, with some improvements.

This encryption method began to be called the Vigenère cipher from the 19th century onwards, without regard to Bellaso. Moreover, Bellaso was quickly forgotten in favor of Porta.

Lots of names. Ah, history!

Of course, this cipher is not secure and was broken as early as the 19th century.

Note: This post was translated from french with the help of AI. The original post was written with the knowledge of a younger me.

The Key Instead of the Shift

The Vigenère cipher introduced a major innovation compared to the Caesar cipher: the concept of a key.

This difference classifies this cipher as polyalphabetic rather than monoalphabetic. It is no longer “one plaintext letter gives one and only one ciphertext letter,” but a plaintext letter can produce two different ciphertext letters, and a ciphertext letter can come from two different plaintext letters.

Therefore, multiple substitution alphabets are used (different letter shifts within the same message), unlike the Caesar cipher. Hence the term “polyalphabetic.”

The substitution rules (how you switch from one alphabet to another) are given by the letters of the key and a substitution table.

Don’t quite get it? We will illustrate this with examples in the following chapters, no worries.

Also, another article will cover the classification of ciphers.

The Cipher Itself

Let’s get to the heart of the matter. There are two ways to represent the classic Vigenère cipher (with variants being another story).

Table Representation

For the table representation, we need a table (yes, really), or rather a substitution matrix. Here it is:

It may look dense but it’s not so complicated. If you look at the rows, you see the Latin alphabet shifted by one letter per row. Similarly for the columns.

The cipher works by taking the letter at the intersection of the plaintext letter (columns) and the key letter (rows). That intersection letter is the ciphertext letter.

Example:

Encryption

Take the message: “J’ai plaqué mon chêne” (excerpt from “Auprès de mon arbre” by Georges Brassens)

And the key: “Una mattina” (excerpt from “Bella Ciao”)

Look at the intersection of each letter:

Column “J” and row “U” give “D”, column “a” (ignoring the apostrophe for now) and row “n” give “n”, column “i” and row “a” give “i”, etc.

If the message is longer than the key, repeat the key. Consider “ê” and “é” as “e”.

We get: “D ni bltjcr mia ctegx”

Decryption

For decryption, for each row corresponding to the key letter, find where the ciphertext letter is located and take the letter at the top of that column, which is the plaintext letter.

So, taking the key: “Una mattina” And the ciphertext: “D ni bltjcr mia ctegx”

In row “U”, letter “D” is at the 10th position, so column “J”, in row “n”, letter “n” is at the 1st position, column “a”, etc.

We recover: “J ai plaque mon chene”

Congruence Representation

The second representation is mathematical: congruence. If you don’t know this word, check this article.

To use congruence, substitute letters with numbers using the rule:

A=0, B=1, C=2, D=3, E=4, F=5, G=6, H=7, I=8, J=9, K=10, L=11, M=12, N=13, O=14, P=15, Q=16, R=17, S=18, T=19, U=20, V=21, W=22, X=23, Y=24, Z=25

To encrypt, add the key to the message. To decrypt, subtract the key from the message.

Example:

Encryption

Take the message: “J’ai plaqué mon chêne” And the key: “Una mattina”

Align the message and key (removing apostrophes and accents) and repeat the key to cover the message:

"J ai plaque mon chene"
+
"Una mattina Una matti"
=
9
+
20
=
29

There’s no letter with value 29 (max is 25), so we use congruence modulo 26 (numbers 0 to 25).

Thus,

$$ 29 \equiv 29-26 \pmod{26} \equiv 3 \pmod{26} = D $$

We continue calculating:

"J ai plaque mon chene"
+
"Una mattina Una matti"
=
9
+
20
=
29
≡
3 mod(26)
=
D

And so on. We get the ciphertext: “D ni bltjcr mia ctegx”

Decryption

To decrypt, subtract the key from the ciphertext, again using congruence.

"D ni bltjcr mia ctegx"
-
"Una mattina Una matti"
=
3
-
20
=
-17
≡
-17+26 mod(26)
≡
9 mod(26)
=
J

Step by step, we return to: “J ai plaque mon chene”

Variants

The Vigenère cipher has known many variations. Here are a few:

The Bellaso Precursor

Before Vigenère, there was Bellaso. But the poor man was overshadowed by another Italian, better known in his time, Giovanni Della Porta, and later by Vigenère. So sometimes it’s called the Porta/Bellaso cipher.

This cipher uses the following table:

The left column contains the key letter, and the right column contains the substitution.

A quick example to show how it works:

Encryption

Take the message: “Trois Anneaux pour les Rois Elfes” (excerpt from Tolkien’s “The Lord of the Rings” in french)

With the key: “La République Galactique” (excerpt from Lucas’s “Star Wars” in french)

The first key letter is “L”.

Look for this letter in the first column; “L” is in the sixth row with “K”.

The first letter of the message is “T”. Find “T” in the second column on the sixth row.

You see that “T” is below “L” (in the two lines present in each second column row), so the ciphertext letter is “L”.

Next, the second key letter is “a” (to make sure you’re following).

It is in the first row of the first column. The second plaintext letter is “r”.

In the second column of the first row, “r” is below “e”, so the ciphertext letter is “e”.

Then:

• “R”: 9th row: “o” becomes “j”,
• “e”: 3rd row: “i” becomes “t” (“i” is above “t”),
• etc.

The ciphertext is: “Lejtm qafnsem fbme xvb ijyh zyxpm”

Decryption

Use the key to find the row and match. So:

With the key: “La République Galactique” And ciphertext: “Lejtm qafnsem fbme xvb ijyh zyxpm”

• “L”: 6th row: “L” becomes “T”,
• “a”: 1st row: “e” becomes “r”,
• etc.

You recover the message: “Trois Anneaux pour les Rois Elfes”

Beaufort

We’ll quickly cover this and the next variant. The only difference from Vigenère is that instead of adding the key to the message to encrypt, you subtract the message from the key.

So to decrypt, subtract the ciphertext from the key:

Key – Message = Ciphertext ⇒ Message = Key – Ciphertext

Of course, this is in the congruence representation.

German Variant of Beaufort

For this variant, it’s the opposite. Subtract the key from the message to encrypt.

To decrypt, add the ciphertext to the key:

Message – Key = Ciphertext ⇒ Message = Key + Ciphertext

Disordered Alphabet

You can shuffle the letters of the alphabet. If both correspondents have the same table, the system works.

Of course, each letter must appear only once per column and row.

Also, all letters must appear in every column and row.

For example, consider these values:

C=0, E=1, A=2, Z=3, B=4, D=5, F=6, G=7, H=8, I=9, J=10, K=11, L=12, M=13, N=14, O=15, P=16, Q=17, R=18, S=19, U=20, T=21, V=22, W=23, X=24, Y=25

Expanded or Different Alphabet

We worked with a 26-letter Latin alphabet but nothing stops you from expanding it to include extra symbols or using a different alphabet.

For example:

A=0, B=1, C=2, D=3, E=4, F=5, G=6, H=7, I=8, J=9, K=10, L=11, M=12, N=13, O=14, P=15, Q=16, R=17, S=18, T=19, U=20, V=21, W=22, X=23, Y=24, Z=25,!=26,?=27

In this case, we have modulo 28 instead of 26.

Bellaso Variants

We used Bellaso’s original table but nothing prevents modifying it.

You could have three letters in the first column instead of two and reduce the number of rows accordingly.

Or have a different number of letters per row.

Or change the alphabet substitutions in the second column.

The only requirement is that your alphabet’s number of letters/symbols is even so each symbol has a match in the second column.

Weaknesses

Frequency Analysis Attack

As mentioned in the historical preamble, this cipher and its variants were broken in the 19th century.

It suffers from the same weakness, though much more resilient, as the Caesar cipher.

Languages do not use letters with the same frequencies. For example, in French, the letter “e” is much more frequent than others.

An attacker can exploit these frequency differences to guess the message or the key.

But unlike Caesar’s cipher, there is a preliminary step.

The attacker must first try to guess the length of the key. This allows segmenting the ciphertext into equal-length segments.

To do this, they look for patterns in the ciphertext — groups of three letters or more that appear regularly.

Languages also have common patterns: for example, “les” appears frequently in French.

It’s more likely the same part of the key falls on the same plaintext pattern, encrypting it the same way, than by pure chance.

By spotting these patterns, the attacker estimates the key length and can segment the ciphertext.

Each plaintext letter in a segment is encrypted by the same key letter, allowing frequency analysis.

This might seem obscure or confusing. Don’t worry, a future article will clarify this with examples.

The Vigenère cipher is halfway between the Caesar cipher, from which it takes the substitution rule, and the one-time pad, which is the perfect algorithm, appearing only at the beginning of the 20th century.

The Caesar cipher, despite its name, was apparently already used by the Spartans, so well before Julius Caesar.

It’s a variation of shift cipher, which is a substitution cipher. Complicated words for simple concepts, you’ll see.

Augustus used another variant of the Caesar cipher.

It’s very possible that it inspired the Vigenère cipher.

Note: This post was translated from french with the help of AI. The original post was written with the knowledge of a younger me.

The big picture: substitution

Let’s start with the broadest concept. Substitution ciphering consists of replacing one letter with another. Plain and simple.

This technique is the most widespread in history and it is different from permutation, which consists of changing the order of the letters in a text.

Modern algorithms use both methods at once because substitution alone is not very secure cryptographically (except in the very specific case of a one-time pad).

The medium picture: the shift

Among substitution cipher methods, the simplest is the shift method.

It’s a monoalphabetic ciphering method (another complicated term for a simple concept). That means that one letter is associated (during encryption/decryption) with exactly one other letter. Two different letters cannot result in the same letter after encryption/decryption, and likewise, one letter cannot produce two different letters after encryption/decryption.

For mathematicians, this is a bijective relation.

The shift method therefore consists in shifting a letter within the alphabet.

The small picture: the Caesar cipher

Nowadays, the term “Caesar cipher” refers to all these shift cipher methods, but more precisely to a shift by 3.

Let’s take the Latin alphabet, the one used by Caesar (even though it seems he preferred the Greek alphabet for his secret messages), and assign values to the letters:

A=0, B=1, C=2, D=3, E=4, F=5, G=6, H=7, I=8, J=9, K=10, L=11, M=12, N=13, O=14, P=15, Q=16, R=17, S=18, T=19, U=20, V=21, W=22, X=23, Y=24, Z=25

We apply a shift of 3:

A=0+3=3=D

B=1+3=4=E

…

However, you can see that if we do:

X=23+3=26

we don’t know what letter 26 is, unless we use congruence. If this word is unfamiliar, read this article.

We’ll consider the Latin alphabet in modulo 26. So, if we redo the calculation:

X=23+3=26 ≡ 26-26 *mod*(26) ≡ 0 *mod*(26) ≡ A

So, in the Caesar cipher, A becomes D, B becomes E, X becomes A, Y becomes B, Z becomes C…

We’ve shifted the letters by 3 positions.

An example:

Consider the message: “CAVE CANEM” (“Beware of the dog”, in Latin)

We apply the Caesar cipher:

“C A V E C A N E M”

=

2 0 21 4 2 0 13 4 12

+3

=

5 3 24 7 5 3 16 7 15

=

“F D Y H F D Q H P”

Here’s your encrypted message. And to decrypt it, we do the opposite: subtract 3 from the letters of the encrypted message.

It’s simple, isn’t it? And you can see we’re at cryptography level 0.

But at the time, it seemed good enough.

Variants

Of course, variants of this cipher have been developed throughout history.

ROT13

This variant consists of shifting by 13 letters instead of 3. “ROT” is short for rotation, because a shift with a modulo can be seen as a rotation.

This shift is special because it’s symmetric for a 26-letter alphabet (13 being half of 26). That means that if you encrypt a message twice with this shift, you get the original message back.

Example:

First encryption:

“C A V E C A N E M”

=

2 0 21 4 2 0 13 4 12

+13

=

15 13 34-26 17 15 13 26-26 17 25

=

15 13 8 17 15 13 0 17 25

=

“P N I R P N A R Z”

Second encryption:

“P N I R P N A R Z”

=

15 13 8 17 15 13 0 17 25

+13

=

28-26 26-26 21 30-26 28-26 26-26 13 30-26 38-26

=

2 0 21 4 2 0 13 4 12

=

“C A V E C A N E M”

Tadaa, we recover “Cave Canem”.

Augustus

I said earlier that the Caesar cipher was useless. Wait until you see this one. Forget about modulo, that’s too complicated, and counting to 3 is also too complicated—just count to 1, that’s fine.

Augustus (Caesar’s nephew) used a shift cipher of 1. Yes, you read that right—1. Oh, and what about “z”? Remember, no congruence. So “z” becomes “aa”—yes, two “a”s.

Do I really need to give you an example?

7up, K9

Of course, there are also ciphers based on wordplay, invented for children’s games.

“7up” is a shift of 7.

“K9” is a reference to the robot dog from Dr Who (and also a very good mail app for Android…). It’s a pun on the word “canine” of course. It’s a shift of 1 backward (25 forward).

Extending the alphabet

You can, of course, use an alphabet other than the Latin alphabet, or even take an arbitrary order of symbols. All that’s required is that the symbols be ordered.

Example:

Let’s take this fictional alphabet:

“: ; ! , t 2 5”

If we apply an increment of 3, we get:

“, t 2 5 : ; !”

How bad this is

By now you understand just how bad this system is. Let’s look at two methods to break a cipher made with this technique.

Frequency analysis

Every language has letters that appear more frequently than others. For example, in French “e” is (by far) the most frequent letter. So, an attacker just needs to analyze the frequency of symbols in the message. If the encrypted message contains a lot of “g”s and the parties are French, the attacker can hypothesize a shift of 2 and easily recover the original text.

Brute-force attack

For a 26-letter alphabet, there are 26 possible combinations. It’s really not hard to test them all.

Testing all combinations is called a brute-force attack. It’s the dumbest (the most brute) approach: you test every possibility. But it’s also the attack that requires the most resources, since you’re testing everything.