Section 3: Classical Cryptography

Classical cryptography is the pen-and-paper era: every cipher in this section could be run by a clerk with a pencil, a keyword, and a bit of patience. Julius Caesar shifted letters to protect military orders; Renaissance diplomats used the Vigenère cipher; the British army carried Playfair into the field as late as World War I. Every single one of these ciphers is completely broken today — a laptop breaks any of them in milliseconds, and most fall to careful hand analysis. So why study them?

Because they teach the core ideas of the whole field in miniature. Classical ciphers introduce the two fundamental operations that all modern ciphers still combine — substitution (replace symbols with other symbols) and transposition (rearrange symbols without changing them). They force you to think about key management: how do sender and receiver agree on a secret, and how much secret is enough? And they are the birthplace of cryptanalysis — the art of breaking ciphers — which is where you learn the most important lesson in cryptography: a cipher is only as strong as the statistical fingerprints it fails to erase.

The Caesar cipher

The Caesar cipher is the simplest possible substitution cipher: pick a shift value k, and replace every letter with the letter k positions later in the alphabet, wrapping around at Z. Encryption is C = (P + k) mod 26 and decryption is P = (C − k) mod 26, where letters are numbered A=0 through Z=25. Suetonius reports that Caesar himself used a shift of 3.

Worked example with shift 3, encrypting ATTACK AT DAWN:

plain : A T T A C K   A T   D A W N
shift : +3 each letter, wrap Z -> A
cipher: D W W D F N   D W   G D Z Q

A shifts to D, T shifts to W, and so on. To decrypt, shift back by 3 (or equivalently forward by 23, since −3 ≡ 23 (mod 26)).

The fatal flaw is the keyspace: there are only 25 useful shifts (shift 0 changes nothing). An attacker does not need cleverness — they try all 25 and read off the one that looks like language. This is a brute-force attack, and it works whenever the keyspace is small enough to enumerate. Try it yourself with the button below.

Monoalphabetic substitution

If 25 keys is too few, why not use any scrambled alphabet as the key? A monoalphabetic substitution cipher maps each plaintext letter to a fixed, arbitrary ciphertext letter — for example A→Q, B→X, C→M, and so on through all 26 letters. The key is the whole permutation, and the number of possible permutations is

26! = 403,291,461,126,605,635,584,000,000  (about 4 x 10^26, roughly 2^88)

That is comparable to the keyspace of a modern 88-bit cipher — far beyond any brute-force search, then or now. And yet monoalphabetic substitution has been routinely broken since the 9th century. Newspaper readers solve them for fun as "cryptograms."

This is one of the most important lessons in cryptography: keyspace size is necessary but nowhere near sufficient for security. A large keyspace only rules out one specific attack (exhaustive search). If the cipher leaks structure — if patterns in the plaintext survive into the ciphertext — an attacker can exploit that structure and never search the keyspace at all. Monoalphabetic substitution leaks structure catastrophically: every E in the plaintext becomes the same ciphertext letter, every T becomes the same letter, and so on. The disguise changes the letters but perfectly preserves their statistics. Which brings us to the attack that kills it.

Frequency analysis

Letters in natural language are wildly non-uniform. In typical English text, E accounts for about 12.7% of all letters, while Z is under 0.1%. The distribution is so stable that a few hundred characters of text is usually enough to identify the most common letters reliably.

The method was first described by the Arab polymath Al-Kindi in the 9th century, in his Manuscript on Deciphering Cryptographic Messages — arguably the founding document of cryptanalysis. His procedure still works today:

1. Count the frequency of every letter in the ciphertext.
2. Match the most frequent ciphertext letters to the most frequent letters of the language (the top cipher letter is probably E, the next probably T, and so on).
3. Fill in tentative guesses and look for word patterns — a three-letter word ending in your guessed E is very likely THE; a one-letter word is A or I.
4. Iterate: each confirmed letter constrains the rest, and the solution snowballs.

Digraph frequencies help too: TH, HE, IN, ER, AN are the most common English letter pairs, and doubled letters are usually LL, EE, SS, OO, or TT. The widget below counts letter frequencies in any text you paste and charts them against expected English. It is preloaded with a genuine monoalphabetic ciphertext — analyze it and notice how the shape of the bar chart still screams "English," just with the labels shuffled.

The Vigenère cipher: polyalphabetic substitution

The obvious fix for frequency analysis: stop using one substitution alphabet. The Vigenère cipher (16th century, named for Blaise de Vigenère though the strongest form is due to Giovan Battista Bellaso) uses a keyword to select a different Caesar shift for each letter. Conceptually you use the tableau: a 26×26 grid whose row i is the alphabet shifted by i. To encrypt, write the keyword repeatedly over the plaintext; each key letter picks a row, and each plaintext letter picks a column; the cell where they meet is the ciphertext letter. Numerically: C = (P + K) mod 26, with K cycling through the keyword.

Worked example: encrypt HELLO with key KEY.

plain : H  E  L  L  O        H=7  E=4  L=11 L=11 O=14
key   : K  E  Y  K  E        K=10 E=4  Y=24 K=10 E=4
sum   : 17 8  35 21 18       mod 26 -> 17 8 9 21 18
cipher: R  I  J  V  S

Notice the crucial property: the two Ls in HELLO encrypt to different letters (J and V), because they line up with different key letters. Simple frequency analysis is smeared flat — each plaintext letter can appear as several ciphertext letters. For roughly 300 years the Vigenère was known as le chiffre indéchiffrable, the unbreakable cipher.

It fell to two ideas in the 19th and 20th centuries:

• Kasiski examination (Friedrich Kasiski, 1863; Charles Babbage found it earlier but did not publish). A repeated word in the plaintext that happens to line up with the same part of the repeating key produces a repeated fragment in the ciphertext. The distance between two such repeats must be a multiple of the key length. Collect several repeat distances, take their common factors, and the key length reveals itself. Once you know the key length n, split the ciphertext into n interleaved streams — each stream is just a Caesar cipher, and frequency analysis finishes each one independently.
• The Friedman test / index of coincidence (William Friedman, 1920s). The index of coincidence (IC) measures the probability that two randomly chosen letters of a text are equal. English text has IC ≈ 0.067; uniformly random letters give IC ≈ 0.038. A Vigenère ciphertext with a longer key looks more random, so the measured IC estimates the key length statistically — and testing candidate lengths by computing the IC of each interleaved stream confirms it (the streams of the correct length look like plain English, IC near 0.067).

Either way, the "unbreakable" cipher reduces to a stack of Caesar ciphers. The deep lesson: a repeating key is a periodic structure, and periodic structure is detectable. (Stretch the key to be as long as the message, truly random, and never reused, and you get the one-time pad — genuinely unbreakable, and covered in Section 4.)

Transposition ciphers

Substitution replaces letters; transposition keeps every letter unchanged but shuffles their positions. The ciphertext is an anagram of the plaintext — which means letter frequencies are exactly those of normal English (a quick tell that you are looking at a transposition rather than a substitution cipher).

Rail fence

Write the message diagonally down and up across k "rails," then read the rails off row by row. Encrypting WEAREDISCOVERED with 3 rails:

rail 1: W . . . E . . . C . . . R . . .
rail 2: . E . R . D . S . O . E . E . D
rail 3: . . A . . . I . . . V . . . D

read off rows: WECR + ERDSOEE + AIVD
cipher: WECRERDSOEEAIVD

The key is just the rail count, so the keyspace is tiny — brute force again. Decryption reverses the process: compute how many letters land on each rail, slice the ciphertext into rails, and walk the zigzag reading one letter from the appropriate rail at each step.

Columnar transposition

Stronger and historically important: write the plaintext into a grid under a keyword, then read the columns out in alphabetical order of the keyword letters. Encrypting MEETMEATNOON under the key ZEBRA:

key   :  Z  E  B  R  A
order :  5  3  2  4  1     (alphabetical rank of each key letter)
        ------------------
row 1 :  M  E  E  T  M
row 2 :  E  A  T  N  O
row 3 :  O  N  X  X  X     (X pads the last row)

read columns in order 1,2,3,4,5:
  A-col: MOX   B-col: ETX   E-col: EAN   R-col: TNX   Z-col: MEO
cipher: MOXETXEANTNXMEO

Columnar transposition (often applied twice, as "double transposition") was used seriously into World War II. It falls to anagramming attacks: guess the column count, slice the ciphertext into columns, and rearrange columns until common digraphs like TH and HE appear across the rows.

The Playfair cipher

Invented by Charles Wheatstone in 1854 (and named for Lord Playfair, who promoted it), Playfair was the first widely-used digraph cipher: it encrypts letters two at a time. Attacking pairs is much harder than attacking single letters — there are 26 single letters but about 600 digraphs, so far more ciphertext is needed for frequency analysis. The British army used it as a field cipher in the Boer War and WWI.

Grid construction. Take a keyword, drop duplicate letters, and write it into a 5×5 grid, then fill the rest with the remaining alphabet in order. Since 26 letters do not fit in 25 cells, I and J share a cell (J is written as I). For the keyword MONARCHY:

M O N A R
C H Y B D
E F G I K     (I and J share this cell)
L P Q S T
U V W X Z

Preparing the plaintext. Strip non-letters, replace J with I, and break the text into pairs. If a pair would contain the same letter twice (like the LL in BALLOON), insert an X between them; if the final pair is short one letter, pad with X.

The three digraph rules. For each pair, locate both letters in the grid:

• Same row: replace each letter with the letter to its right (wrapping around the row). Decrypt: take the letter to the left.
• Same column: replace each with the letter below it (wrapping). Decrypt: take the letter above.
• Rectangle (different row and column): each letter is replaced by the letter in its own row but in the other letter's column — the opposite corners of the rectangle they define. This rule is its own inverse.

Worked example with the MONARCHY grid, encrypting HIDE → pairs HI DE:

HI : H at row 2 col 2, I at row 3 col 4  -> rectangle
     H -> same row as H, column of I  = B
     I -> same row as I, column of H  = F
     HI -> BF

DE : D at row 2 col 5, E at row 3 col 1  -> rectangle
     D -> row of D, column of E = C
     E -> row of E, column of D = K
     DE -> CK

HIDE -> BFCK

Playfair still leaks: digraph frequencies survive (TH is still the most common pair), a digraph and its reverse always encrypt to a pair and its reverse (ER/RE become, say, XY/YX), and with a few hundred letters of ciphertext, digraph frequency analysis plus grid reconstruction breaks it by hand. It was considered acceptable for field use only because the information was stale by the time the enemy broke it.

Why classical ciphers fail

Check your understanding

Resources