Chapter VI

Chapter VIExamination of Substitution CiphersWhen an unknown cipher has been put into the substitution class by the methods already described we may proceed to decide on the variety of substitution cipher which has been used.There are a few purely mechanical ways of solving some of the simple cases of substitution ciphers but as a general rule some or all of the following determinations must be made:1. By preparation of a frequency table for the message we determine whether one or more substitution alphabets have been used and, if one only has been used, this table leads to the solution.2. By certain rules we determine how many alphabets have been used, if there are more than one, and then isolate and analyze each alphabet by means of a frequency table.3. If the two preceding steps give no results we have to deal with a cipher with a running key, a cipher of the Playfair type, or a cipher where two or more characters are substituted for each letter of the text. Some special cases under this third head will be given but, in general, military ciphers of the substitution class will usually be found to come under the first two heads, on account of the time and care required in the preparation and deciphering of messages by the last named methods and the necessity, in many cases, of using complicated machines for these processes.Case4-a.MessageOBQFO BPBRP QBAML OBHIF PILFQ FJBOX OFLNR BIXOZ ELFrom the recurrence ofB,FandO, we may conclude that a single substitution alphabet was used for this message. If so and if the alphabet runs in the same order and direction as the regular alphabet, the simplest way to discover the meaning of the message is to take the first two words and write alphabets under each letter as follows, until some line makes sense:O B Q F O B P B R PP C R G P C Q C S QQ D S H Q D R D T RR E T I R E S E U SThe wordRETIRESEoccurs in the fourth line, and, if the whole message be handled in this way we find the rest of the fourth line to readUSTED POR EL MISMO ITINERARIO QUE MARCHO. The message was enciphered using an alphabet whereA=X,B=Y,C=Z,D=A, etc. noting that as this message is in Spanish the lettersKandWdo not appear in the alphabet.Case 4-b.MessageHUJZH UIUPN OZYTS VQXMI SMOMX MQHUD UMREI SESJU AGThis is a message in Spanish. We will handle it as incase 4-a, setting down the whole message.HUJZHUIUPNOZYTSVQXMISMOMXMQHUDUMREISESJUAGIVLAIVJVQOPAZUTXRYA=ANYNRIVEVNSFJTFTLVBHJXMBJXLXRPQBAVUYSZOZOSJXFXOTGLUGUMXCILYNCLYMYSQRCBXVZTAPAPTLYGYPUHMVHVNYDJMZODMZNZTRSDCYXAUBQBQUMZHZQVINXIXOZELNAPENAOAUSTEDZYBVCRCRVNAIARXJOYJYPAFMOBQFOBPBA=UAZCXDSDSXOBJBSYLPZLZQBGNPCRGPCQCBADYETETYPCLCTZMQAMARCHOQDSHQDRDCBEZFUFUZQDMDUANRBA=SRETIRESEDCFAGVGVARENEVBOSCA=QEDGBHXHXBSFOFXCPTDFEHCIYIYCTGPGYDQUEGFIDJZJZDUHQHZEA=OHGJELALAEVIRIAFIHLA=MBMBFXJSJBGJIMCNCGYLTLCHLJNDODHZMUMDIMLOEPEIANVNEJNMPFQFJBOXOFLONQGRGLCPYPGMPORHSHMDQZQHNA=EITINERARIOA=DHere each word of the message comes out on a different line, and noting in each case the letter corresponding toA, we have the wordQUEMADOSwhich is the key. The cipher alphabet changed with each word of the message.A variation of this case is where the cipher alphabet changes according to a key word but the change comes every five letters or every ten letters of the message instead of every word. The text of the message can be picked up in this case with a little study.Note in using case 4 that if we are deciphering a Spanish message we use the alphabet withoutKorWas a rule, altho if the lettersKorWappear inthe cipher it is evidence that the regular English alphabet is used.Case5-a.MessageDNWLW MXYQJ ANRSA RLPTE CABCQ RLNEC LMIWL XZQTT QIWRY ZWNSM BKNWR YMAPL ASDANThis message containsKandWand therefore we expect the English alphabet to be used. The frequency of occurrence ofA,L,N,RandWhas lead us to examine it under case4but without result. Let us set down the first two words and decipher them with a cipher disk setAtoAand then proceed as in case4.Cipher messageDNWLWMXYQJDecipheredAtoAXNEPEODCKRBYOFQFPEDLSCZPGRGQFEMTDAQHSHRGFNUEBRITISHGOVThe message is thus found to be enciphered with a cipher disk setAtoEand the text is:BRITISH GOVERNMENT PLACED CONTRACTS WITH FOLLOWING FIRMS DURING SEPTEMBER.Case5-b.Same ascase 4-bexcept that the cipher message must be deciphered by means of a cipher disk setAtoAbefore proceeding to make up the columns of alphabets. The words of the deciphered message will be found on separate lines, the lines being indicated as a rule by a key word which can be determined as incase 4-b.The question of alphabetic frequency has already been discussed in considering the mechanism of language. It is a convenient thing to put the frequency tables in a graphic form and to use a similar graphic form in comparing unknown alphabets with the standard frequency tables. For instance the standard Spanish frequency table put in graphicform is here presented in order to compare with it the frequency table for the message discussed incase 4-a.Standard Spanish frequency tableTable for Message Case 4-aA11111111111111111111111111127A11B112B11111117C1111111119CD111111111110DE111111111111111111111111111128E11F112F111115G1113GH112H11I11111111111112I1113J11J11L111111111110L1113M1111116M11N11111111111112N11O111111111111111116O1111116P111115P1113Q112Q1113R11111111111111115R112S1111111111111114ST111111118TU11111117UV112VXX112Y112YZ11Z11Our first assumption might be thatB=AandF=Ebut it is evident at once that in that case,S,T,UandV(equal toR,S,TandU) do not occur and a message even this short withoutR,S,TorUis practically impossible. By tryingB=Ewe find that the two tables agree in a general way very well and this is all that can be expected with such a short message. The longer the message the nearer would its frequency table agree with the standard table. Note that if a cipher disk has been used, the alphabet runs the other way and we must count upward in working with a graphic table. Note also that if, in a fairly long message, it is impossible to coördinate the graphic table, reading either up or down, with the standard table and yet some letters occur much more frequently than others and some do not occur at all, we have a mixed alphabet to deal with. The example chosen forcase 6-ais of this character. An examination of the frequency table given under that case shows that it bears no graphic resemblance tothe standard table. However, as will be seen incase 7-b, the preparation of graphic tables enables us to state definitely that the same order of letters is followed in each of a number of mixed alphabets.General RemarksAny substitution cipher, enciphered by a single alphabet composed of letters, figures or conventional signs, can be handled by the methods of case 6. For example, the messages under case 4-a and 5-a are easily solved by these methods. But note that the messages under case 4-b and 5-b cannot so be solved because several alphabets are used. We will see later that there are methods of segregating the different alphabets in some cases where several are used and then each of the alphabets is to be handled as below.Case6-a.MessageQDBYP BXHYS OXPCP YSHCS EDRBS ZPTPB BSCSB PSHSZ AJHCD OSEXV HPODA PBPSZ BSVXY XSHCDThis message was received from a source which makes us sure it is in Spanish. The occurrence ofB,H,PandShas tempted us to try the first two words as in case 4 and 5 but without result. We now prepare a frequency table, noting at the same time theprecedingand following letter. This latter proceeding takes little longer than the preparation of an ordinary frequency table and gives most valuable information.Frequency TablePrefixSuffixA112ZDJPB111111118DPRPBSPZYXSBSPPSC111115PHSHHPSSDDD111115QECOCBROAE112SSDXFGH1111116XSSJVSYCSCPCIJ11AHLMNO1113SDPXSDP1111111119YXCZTBHABBCYTBSOBSQ11DR11DBS11111111111112YYCBBCPHOPBXOHEZCBHZEZVHT11PPUV112XSHXX111115BOEVYHPVYSY11114BHPXPSSXZ1113SSSPABIt is clear from an examination of this table that we have to deal with a single alphabet but one in which the letters do not occur in their regular order.We may assume thatPandSare probablyAandE, both on account of the frequency with which they occur and the variety of their prefixes and suffixes. If this is so, thenBandH, are probably consonants and may representRandNrespectively.DandXare then vowels by the same method of analysis. Noting thatHCoccurs three times and takingHasNwe conclude thatCis probablyT. Substitute these values in the last three words ofthe message because the letters assumed occur rather frequently there.PBPSZBSVXYXSHCDIIIARAE_RE__ENTOOONowZis always prefixed bySand may beL. TakingX=IandD=O, (they are certainly vowels),V=GandY=M, we haveARA EL REGIMIENTOSubstituting these values in the rest of the message we haveQDBYPBXHYSOXPCPYSHCSEDRBSZPTPB_ORMARINME_IATAMENTE_O_RELA_ARBSCSBPSHSZAJHCDOSEXVHPODARETERAENEL__NTO_E_IGNA_O_We may now takeQ=F,O=D,E=S,R=B,T=C,A=PandJ=Uand the message is complete. We are assisted in our last assumption by noting thatS=EandE=S, etc., and we may on that basis reconstruct the entire alphabet. The letters in parenthesis do not occur in the message but may be safely assumed to be correct.OrdinaryABCDEFGHIJLMNOPQRSTUVXYZCipherPRTOS(Q)(V)N(X)(U)(Z)(Y)(H)DAFBECJGIMLIt is always well to attempt the reconstruction of the entire alphabet for use in case any more cipher messages written in it are received.——Case6-b.MessageLt. J. B. Smith, Royal Flying Corps, Calais, France.DACFTRRBHAMOOUEAENOIZTIETASMOSEOHIEYOCKFNOHOENOUTHOMEAHNILGOOSAHUOHOUEAPCHSTLNDACFTENINTWNBAFOHGROHTAEIOHABRISODACFTRRENOSTSMAYBISDFTENEFAPHOSMNIZTIEAHLILLTWSOUGDENOUTHOMEAHBHAMOOUEAYOEQISUUOLEHADENOENHOOQOBBORTSLHOBAHEOUBHOBIHTSWENOHOPAHIHITUASBIHTLGraham-White.The address and signature indicate that this message is in English.There are 250 letters in the cipher; the vowelsAEIOUoccur 109 times or 43.6%, the lettersLNRSToccur 62 times or 24.8%, and the lettersKQVXZoccur 5 times or 2%. The proportion in the case of the vowels is somewhat too large and, in the case of the lettersLRNST, it is too small. It is then questionable whether this is a transposition cipher altho, at first glance it might appear to be one.On examination for parts of possible words we are at once struck by the occurrence at irregular intervals of recurring groups, viz:DACFTRRENOBHAMOOUEADACFTENENOUTHOMEAHBHAMOOUEAENODACFTRRDENOUTHOMEAHIZTIEFTENDENOIZTIEENOThis is a strong indication that the cipher is a substitution cipher, so, to make an examination a frequency table will be constructed.Frequency TableABCDEFGHIJKLMNOPQRSTUVWXYZ231176247326160188153632814171113032Superficially, this looks like a normal frequency table, butOis the dominant letter, followed byH,E,A,T,I,N,S, in the order named. It is certainly Case 6 if it is a substitution cipher at all.Let us see what can be done by assumingO=E; the tripletENO, occurring six times might well beTHEandE=TandN=H. A glance at the frequency table shows this to be reasonable. Now substitute these letters in some likely groups.FNOHOENObecomes_HE_ETHE;FTENbecomes_TH;ENOENHObecomesTHETH_E;ENOHObecomesTHE_E. A bit of study will show thatF=W,T=IandH=Rand the frequency table bears this out except thatH(=R)seems to occur too frequently. The recurring groups containingDAC(see above) occur in such a way that we may be sureDACis one word,FTRRis another andFTEN(=WITH)is a third. NowFTRRbecomesWI__, which can only be completed by a double letter.LLfills the bill and we may sayR=L. AsDACstarts the message and is followed byFTRR (=WILL)it is reasonable to tryDAC=YOU. Looking upDACin the frequency table it is evident that we strain nothing by this assumption. We now have:Letters of cipherONTAHECFDLetters of messageEHIORTUWYNow take the groupENOUTHOMEAHwhich occurs twice. This becomesTHE_IRE_TORand if we substituteU=DandM=Cwe haveTHE DIRECTOR. Next the group(FTRR)BHAMOOUEAbecomes(WILL) _ROCEEDTOand the context gives word with missing letter asPROCEED, from whichB=P. Next the group(ENO) IZTIETASMOSEOHIEYOCK(FNOHO)becomes(THE)__I_TIO_CE_TER_T_EU_(WHERE)and the group(FTEN)EFAPHOSMNIZTIEAHLbecomes(WITH)TWO_RE_CH__I_TOR_.The substitution ofAforI,VforZ,NforSandFforPmakes the latter group read(WITH TWO FRENCH AVIATORSand the former read(THE)AVIATION CENTER AT _EU_(WHERE).Now the wordYOCK = (_EU_)is the name of a place, evidently.Wefind another group containingY, viz:ENOSTSMAYBISDwhich becomesTHENINCO_PANYso that evidently we should substituteMforY. The other occurrence ofY (=M)is in the groupEAYOEQISUwhich becomesTOMET_AND. A reasonable knowledge of geography gives us the wordsMEUXandMETZso thatXshould be substituted forKandZforQ.We now have sufficient letters for a complete deciphering of the message.Letters of cipherABCDEFGHIKLMNOPQRSTUVWYZLetters of messageOPUYTW_RAXSCHEFZLNID__MVThe message deciphers:YOU WILL PROCEED TO THE AVIATION CENTER AT MEUX WHERE THE DIRECTOR HAS _EEN ORDERED TO FURNISH YOU WITH A HI_H POWER _LERIOT AEROPLANE. YOU WILL THEN IN COMPANY WITH TWO FRENCH AVIATORS ASSI_NED _Y THE DIRECTOR PROCEED TO METZ AND DESTROY THE THREE ZEPPELINS REPORTED PREPARIN_ THERE FOR A RAID ON PARIS.The substitution ofBforG,GforWandKforVcompletes the cipher. This cipher is difficult only because the cipher alphabet is made up, not haphazard, but scientifically with proper consideration for the natural frequency of occurrence of the letters. In cipher work it is dangerous to neglect proper analysis and jump at conclusions.In the study of Mexican substitution ciphers, several alphabets have been found which are made up in a general way, like the one discussed in this case.Case6-c.—It is a convenience in dealing with ciphers made up of numbers or conventional signs to substitute arbitrary letters for the numbers and signs. Suppose we have the message:”??2&45x15)“8&#&&1x4%&4&%6x?&”8&*x46°*°&%“4&”By arbitrary substitution of letters this is madeABBCDEFGHFIJKDLDDHGEMDEDMNGBDAKDOGENPOPDMAEDAThis message is now in convenient shape to handle as Case 6-a and on solution is found to read:ALL PERSONS HAVE BEEN ORDERED TO LEAVE FORTIFIED AREA.In the same way the message1723322328251828363023361423282723243120231731233036212024153029151228311721271528112715192330301215113021283623is found to be made up entirely of numbers between 11 and 36 with the numbers 23, 28 and 30 occurring most frequently. This immediately suggests an alphabet made up of the numbers from 11 to 36 inclusive and each cipher group of figures represents two letters. By arbitrary substitution of letters for groups of two numbers we obtain:ABCBDEFDGHBGIBDJBKLMBALBHGNMOPHQPRDLANJPDSJPTBHHRPSHNDGBand this message is also in shape to handle as Case 6-a. It reads, on solution,SEVEN HUNDRED MEN LEFT YESTERDAY FOR POINTS ON LOWER RIO GRANDE.

Chapter VIExamination of Substitution Ciphers

When an unknown cipher has been put into the substitution class by the methods already described we may proceed to decide on the variety of substitution cipher which has been used.There are a few purely mechanical ways of solving some of the simple cases of substitution ciphers but as a general rule some or all of the following determinations must be made:1. By preparation of a frequency table for the message we determine whether one or more substitution alphabets have been used and, if one only has been used, this table leads to the solution.2. By certain rules we determine how many alphabets have been used, if there are more than one, and then isolate and analyze each alphabet by means of a frequency table.3. If the two preceding steps give no results we have to deal with a cipher with a running key, a cipher of the Playfair type, or a cipher where two or more characters are substituted for each letter of the text. Some special cases under this third head will be given but, in general, military ciphers of the substitution class will usually be found to come under the first two heads, on account of the time and care required in the preparation and deciphering of messages by the last named methods and the necessity, in many cases, of using complicated machines for these processes.Case4-a.MessageOBQFO BPBRP QBAML OBHIF PILFQ FJBOX OFLNR BIXOZ ELFrom the recurrence ofB,FandO, we may conclude that a single substitution alphabet was used for this message. If so and if the alphabet runs in the same order and direction as the regular alphabet, the simplest way to discover the meaning of the message is to take the first two words and write alphabets under each letter as follows, until some line makes sense:O B Q F O B P B R PP C R G P C Q C S QQ D S H Q D R D T RR E T I R E S E U SThe wordRETIRESEoccurs in the fourth line, and, if the whole message be handled in this way we find the rest of the fourth line to readUSTED POR EL MISMO ITINERARIO QUE MARCHO. The message was enciphered using an alphabet whereA=X,B=Y,C=Z,D=A, etc. noting that as this message is in Spanish the lettersKandWdo not appear in the alphabet.Case 4-b.MessageHUJZH UIUPN OZYTS VQXMI SMOMX MQHUD UMREI SESJU AGThis is a message in Spanish. We will handle it as incase 4-a, setting down the whole message.HUJZHUIUPNOZYTSVQXMISMOMXMQHUDUMREISESJUAGIVLAIVJVQOPAZUTXRYA=ANYNRIVEVNSFJTFTLVBHJXMBJXLXRPQBAVUYSZOZOSJXFXOTGLUGUMXCILYNCLYMYSQRCBXVZTAPAPTLYGYPUHMVHVNYDJMZODMZNZTRSDCYXAUBQBQUMZHZQVINXIXOZELNAPENAOAUSTEDZYBVCRCRVNAIARXJOYJYPAFMOBQFOBPBA=UAZCXDSDSXOBJBSYLPZLZQBGNPCRGPCQCBADYETETYPCLCTZMQAMARCHOQDSHQDRDCBEZFUFUZQDMDUANRBA=SRETIRESEDCFAGVGVARENEVBOSCA=QEDGBHXHXBSFOFXCPTDFEHCIYIYCTGPGYDQUEGFIDJZJZDUHQHZEA=OHGJELALAEVIRIAFIHLA=MBMBFXJSJBGJIMCNCGYLTLCHLJNDODHZMUMDIMLOEPEIANVNEJNMPFQFJBOXOFLONQGRGLCPYPGMPORHSHMDQZQHNA=EITINERARIOA=DHere each word of the message comes out on a different line, and noting in each case the letter corresponding toA, we have the wordQUEMADOSwhich is the key. The cipher alphabet changed with each word of the message.A variation of this case is where the cipher alphabet changes according to a key word but the change comes every five letters or every ten letters of the message instead of every word. The text of the message can be picked up in this case with a little study.Note in using case 4 that if we are deciphering a Spanish message we use the alphabet withoutKorWas a rule, altho if the lettersKorWappear inthe cipher it is evidence that the regular English alphabet is used.Case5-a.MessageDNWLW MXYQJ ANRSA RLPTE CABCQ RLNEC LMIWL XZQTT QIWRY ZWNSM BKNWR YMAPL ASDANThis message containsKandWand therefore we expect the English alphabet to be used. The frequency of occurrence ofA,L,N,RandWhas lead us to examine it under case4but without result. Let us set down the first two words and decipher them with a cipher disk setAtoAand then proceed as in case4.Cipher messageDNWLWMXYQJDecipheredAtoAXNEPEODCKRBYOFQFPEDLSCZPGRGQFEMTDAQHSHRGFNUEBRITISHGOVThe message is thus found to be enciphered with a cipher disk setAtoEand the text is:BRITISH GOVERNMENT PLACED CONTRACTS WITH FOLLOWING FIRMS DURING SEPTEMBER.Case5-b.Same ascase 4-bexcept that the cipher message must be deciphered by means of a cipher disk setAtoAbefore proceeding to make up the columns of alphabets. The words of the deciphered message will be found on separate lines, the lines being indicated as a rule by a key word which can be determined as incase 4-b.The question of alphabetic frequency has already been discussed in considering the mechanism of language. It is a convenient thing to put the frequency tables in a graphic form and to use a similar graphic form in comparing unknown alphabets with the standard frequency tables. For instance the standard Spanish frequency table put in graphicform is here presented in order to compare with it the frequency table for the message discussed incase 4-a.Standard Spanish frequency tableTable for Message Case 4-aA11111111111111111111111111127A11B112B11111117C1111111119CD111111111110DE111111111111111111111111111128E11F112F111115G1113GH112H11I11111111111112I1113J11J11L111111111110L1113M1111116M11N11111111111112N11O111111111111111116O1111116P111115P1113Q112Q1113R11111111111111115R112S1111111111111114ST111111118TU11111117UV112VXX112Y112YZ11Z11Our first assumption might be thatB=AandF=Ebut it is evident at once that in that case,S,T,UandV(equal toR,S,TandU) do not occur and a message even this short withoutR,S,TorUis practically impossible. By tryingB=Ewe find that the two tables agree in a general way very well and this is all that can be expected with such a short message. The longer the message the nearer would its frequency table agree with the standard table. Note that if a cipher disk has been used, the alphabet runs the other way and we must count upward in working with a graphic table. Note also that if, in a fairly long message, it is impossible to coördinate the graphic table, reading either up or down, with the standard table and yet some letters occur much more frequently than others and some do not occur at all, we have a mixed alphabet to deal with. The example chosen forcase 6-ais of this character. An examination of the frequency table given under that case shows that it bears no graphic resemblance tothe standard table. However, as will be seen incase 7-b, the preparation of graphic tables enables us to state definitely that the same order of letters is followed in each of a number of mixed alphabets.General RemarksAny substitution cipher, enciphered by a single alphabet composed of letters, figures or conventional signs, can be handled by the methods of case 6. For example, the messages under case 4-a and 5-a are easily solved by these methods. But note that the messages under case 4-b and 5-b cannot so be solved because several alphabets are used. We will see later that there are methods of segregating the different alphabets in some cases where several are used and then each of the alphabets is to be handled as below.Case6-a.MessageQDBYP BXHYS OXPCP YSHCS EDRBS ZPTPB BSCSB PSHSZ AJHCD OSEXV HPODA PBPSZ BSVXY XSHCDThis message was received from a source which makes us sure it is in Spanish. The occurrence ofB,H,PandShas tempted us to try the first two words as in case 4 and 5 but without result. We now prepare a frequency table, noting at the same time theprecedingand following letter. This latter proceeding takes little longer than the preparation of an ordinary frequency table and gives most valuable information.Frequency TablePrefixSuffixA112ZDJPB111111118DPRPBSPZYXSBSPPSC111115PHSHHPSSDDD111115QECOCBROAE112SSDXFGH1111116XSSJVSYCSCPCIJ11AHLMNO1113SDPXSDP1111111119YXCZTBHABBCYTBSOBSQ11DR11DBS11111111111112YYCBBCPHOPBXOHEZCBHZEZVHT11PPUV112XSHXX111115BOEVYHPVYSY11114BHPXPSSXZ1113SSSPABIt is clear from an examination of this table that we have to deal with a single alphabet but one in which the letters do not occur in their regular order.We may assume thatPandSare probablyAandE, both on account of the frequency with which they occur and the variety of their prefixes and suffixes. If this is so, thenBandH, are probably consonants and may representRandNrespectively.DandXare then vowels by the same method of analysis. Noting thatHCoccurs three times and takingHasNwe conclude thatCis probablyT. Substitute these values in the last three words ofthe message because the letters assumed occur rather frequently there.PBPSZBSVXYXSHCDIIIARAE_RE__ENTOOONowZis always prefixed bySand may beL. TakingX=IandD=O, (they are certainly vowels),V=GandY=M, we haveARA EL REGIMIENTOSubstituting these values in the rest of the message we haveQDBYPBXHYSOXPCPYSHCSEDRBSZPTPB_ORMARINME_IATAMENTE_O_RELA_ARBSCSBPSHSZAJHCDOSEXVHPODARETERAENEL__NTO_E_IGNA_O_We may now takeQ=F,O=D,E=S,R=B,T=C,A=PandJ=Uand the message is complete. We are assisted in our last assumption by noting thatS=EandE=S, etc., and we may on that basis reconstruct the entire alphabet. The letters in parenthesis do not occur in the message but may be safely assumed to be correct.OrdinaryABCDEFGHIJLMNOPQRSTUVXYZCipherPRTOS(Q)(V)N(X)(U)(Z)(Y)(H)DAFBECJGIMLIt is always well to attempt the reconstruction of the entire alphabet for use in case any more cipher messages written in it are received.——Case6-b.MessageLt. J. B. Smith, Royal Flying Corps, Calais, France.DACFTRRBHAMOOUEAENOIZTIETASMOSEOHIEYOCKFNOHOENOUTHOMEAHNILGOOSAHUOHOUEAPCHSTLNDACFTENINTWNBAFOHGROHTAEIOHABRISODACFTRRENOSTSMAYBISDFTENEFAPHOSMNIZTIEAHLILLTWSOUGDENOUTHOMEAHBHAMOOUEAYOEQISUUOLEHADENOENHOOQOBBORTSLHOBAHEOUBHOBIHTSWENOHOPAHIHITUASBIHTLGraham-White.The address and signature indicate that this message is in English.There are 250 letters in the cipher; the vowelsAEIOUoccur 109 times or 43.6%, the lettersLNRSToccur 62 times or 24.8%, and the lettersKQVXZoccur 5 times or 2%. The proportion in the case of the vowels is somewhat too large and, in the case of the lettersLRNST, it is too small. It is then questionable whether this is a transposition cipher altho, at first glance it might appear to be one.On examination for parts of possible words we are at once struck by the occurrence at irregular intervals of recurring groups, viz:DACFTRRENOBHAMOOUEADACFTENENOUTHOMEAHBHAMOOUEAENODACFTRRDENOUTHOMEAHIZTIEFTENDENOIZTIEENOThis is a strong indication that the cipher is a substitution cipher, so, to make an examination a frequency table will be constructed.Frequency TableABCDEFGHIJKLMNOPQRSTUVWXYZ231176247326160188153632814171113032Superficially, this looks like a normal frequency table, butOis the dominant letter, followed byH,E,A,T,I,N,S, in the order named. It is certainly Case 6 if it is a substitution cipher at all.Let us see what can be done by assumingO=E; the tripletENO, occurring six times might well beTHEandE=TandN=H. A glance at the frequency table shows this to be reasonable. Now substitute these letters in some likely groups.FNOHOENObecomes_HE_ETHE;FTENbecomes_TH;ENOENHObecomesTHETH_E;ENOHObecomesTHE_E. A bit of study will show thatF=W,T=IandH=Rand the frequency table bears this out except thatH(=R)seems to occur too frequently. The recurring groups containingDAC(see above) occur in such a way that we may be sureDACis one word,FTRRis another andFTEN(=WITH)is a third. NowFTRRbecomesWI__, which can only be completed by a double letter.LLfills the bill and we may sayR=L. AsDACstarts the message and is followed byFTRR (=WILL)it is reasonable to tryDAC=YOU. Looking upDACin the frequency table it is evident that we strain nothing by this assumption. We now have:Letters of cipherONTAHECFDLetters of messageEHIORTUWYNow take the groupENOUTHOMEAHwhich occurs twice. This becomesTHE_IRE_TORand if we substituteU=DandM=Cwe haveTHE DIRECTOR. Next the group(FTRR)BHAMOOUEAbecomes(WILL) _ROCEEDTOand the context gives word with missing letter asPROCEED, from whichB=P. Next the group(ENO) IZTIETASMOSEOHIEYOCK(FNOHO)becomes(THE)__I_TIO_CE_TER_T_EU_(WHERE)and the group(FTEN)EFAPHOSMNIZTIEAHLbecomes(WITH)TWO_RE_CH__I_TOR_.The substitution ofAforI,VforZ,NforSandFforPmakes the latter group read(WITH TWO FRENCH AVIATORSand the former read(THE)AVIATION CENTER AT _EU_(WHERE).Now the wordYOCK = (_EU_)is the name of a place, evidently.Wefind another group containingY, viz:ENOSTSMAYBISDwhich becomesTHENINCO_PANYso that evidently we should substituteMforY. The other occurrence ofY (=M)is in the groupEAYOEQISUwhich becomesTOMET_AND. A reasonable knowledge of geography gives us the wordsMEUXandMETZso thatXshould be substituted forKandZforQ.We now have sufficient letters for a complete deciphering of the message.Letters of cipherABCDEFGHIKLMNOPQRSTUVWYZLetters of messageOPUYTW_RAXSCHEFZLNID__MVThe message deciphers:YOU WILL PROCEED TO THE AVIATION CENTER AT MEUX WHERE THE DIRECTOR HAS _EEN ORDERED TO FURNISH YOU WITH A HI_H POWER _LERIOT AEROPLANE. YOU WILL THEN IN COMPANY WITH TWO FRENCH AVIATORS ASSI_NED _Y THE DIRECTOR PROCEED TO METZ AND DESTROY THE THREE ZEPPELINS REPORTED PREPARIN_ THERE FOR A RAID ON PARIS.The substitution ofBforG,GforWandKforVcompletes the cipher. This cipher is difficult only because the cipher alphabet is made up, not haphazard, but scientifically with proper consideration for the natural frequency of occurrence of the letters. In cipher work it is dangerous to neglect proper analysis and jump at conclusions.In the study of Mexican substitution ciphers, several alphabets have been found which are made up in a general way, like the one discussed in this case.Case6-c.—It is a convenience in dealing with ciphers made up of numbers or conventional signs to substitute arbitrary letters for the numbers and signs. Suppose we have the message:”??2&45x15)“8&#&&1x4%&4&%6x?&”8&*x46°*°&%“4&”By arbitrary substitution of letters this is madeABBCDEFGHFIJKDLDDHGEMDEDMNGBDAKDOGENPOPDMAEDAThis message is now in convenient shape to handle as Case 6-a and on solution is found to read:ALL PERSONS HAVE BEEN ORDERED TO LEAVE FORTIFIED AREA.In the same way the message1723322328251828363023361423282723243120231731233036212024153029151228311721271528112715192330301215113021283623is found to be made up entirely of numbers between 11 and 36 with the numbers 23, 28 and 30 occurring most frequently. This immediately suggests an alphabet made up of the numbers from 11 to 36 inclusive and each cipher group of figures represents two letters. By arbitrary substitution of letters for groups of two numbers we obtain:ABCBDEFDGHBGIBDJBKLMBALBHGNMOPHQPRDLANJPDSJPTBHHRPSHNDGBand this message is also in shape to handle as Case 6-a. It reads, on solution,SEVEN HUNDRED MEN LEFT YESTERDAY FOR POINTS ON LOWER RIO GRANDE.

When an unknown cipher has been put into the substitution class by the methods already described we may proceed to decide on the variety of substitution cipher which has been used.

There are a few purely mechanical ways of solving some of the simple cases of substitution ciphers but as a general rule some or all of the following determinations must be made:

1. By preparation of a frequency table for the message we determine whether one or more substitution alphabets have been used and, if one only has been used, this table leads to the solution.

2. By certain rules we determine how many alphabets have been used, if there are more than one, and then isolate and analyze each alphabet by means of a frequency table.

3. If the two preceding steps give no results we have to deal with a cipher with a running key, a cipher of the Playfair type, or a cipher where two or more characters are substituted for each letter of the text. Some special cases under this third head will be given but, in general, military ciphers of the substitution class will usually be found to come under the first two heads, on account of the time and care required in the preparation and deciphering of messages by the last named methods and the necessity, in many cases, of using complicated machines for these processes.

Case4-a.MessageOBQFO BPBRP QBAML OBHIF PILFQ FJBOX OFLNR BIXOZ ELFrom the recurrence ofB,FandO, we may conclude that a single substitution alphabet was used for this message. If so and if the alphabet runs in the same order and direction as the regular alphabet, the simplest way to discover the meaning of the message is to take the first two words and write alphabets under each letter as follows, until some line makes sense:O B Q F O B P B R PP C R G P C Q C S QQ D S H Q D R D T RR E T I R E S E U SThe wordRETIRESEoccurs in the fourth line, and, if the whole message be handled in this way we find the rest of the fourth line to readUSTED POR EL MISMO ITINERARIO QUE MARCHO. The message was enciphered using an alphabet whereA=X,B=Y,C=Z,D=A, etc. noting that as this message is in Spanish the lettersKandWdo not appear in the alphabet.

Case4-a.

Message

OBQFO BPBRP QBAML OBHIF PILFQ FJBOX OFLNR BIXOZ EL

From the recurrence ofB,FandO, we may conclude that a single substitution alphabet was used for this message. If so and if the alphabet runs in the same order and direction as the regular alphabet, the simplest way to discover the meaning of the message is to take the first two words and write alphabets under each letter as follows, until some line makes sense:

O B Q F O B P B R PP C R G P C Q C S QQ D S H Q D R D T RR E T I R E S E U S

The wordRETIRESEoccurs in the fourth line, and, if the whole message be handled in this way we find the rest of the fourth line to readUSTED POR EL MISMO ITINERARIO QUE MARCHO. The message was enciphered using an alphabet whereA=X,B=Y,C=Z,D=A, etc. noting that as this message is in Spanish the lettersKandWdo not appear in the alphabet.

Case 4-b.MessageHUJZH UIUPN OZYTS VQXMI SMOMX MQHUD UMREI SESJU AGThis is a message in Spanish. We will handle it as incase 4-a, setting down the whole message.HUJZHUIUPNOZYTSVQXMISMOMXMQHUDUMREISESJUAGIVLAIVJVQOPAZUTXRYA=ANYNRIVEVNSFJTFTLVBHJXMBJXLXRPQBAVUYSZOZOSJXFXOTGLUGUMXCILYNCLYMYSQRCBXVZTAPAPTLYGYPUHMVHVNYDJMZODMZNZTRSDCYXAUBQBQUMZHZQVINXIXOZELNAPENAOAUSTEDZYBVCRCRVNAIARXJOYJYPAFMOBQFOBPBA=UAZCXDSDSXOBJBSYLPZLZQBGNPCRGPCQCBADYETETYPCLCTZMQAMARCHOQDSHQDRDCBEZFUFUZQDMDUANRBA=SRETIRESEDCFAGVGVARENEVBOSCA=QEDGBHXHXBSFOFXCPTDFEHCIYIYCTGPGYDQUEGFIDJZJZDUHQHZEA=OHGJELALAEVIRIAFIHLA=MBMBFXJSJBGJIMCNCGYLTLCHLJNDODHZMUMDIMLOEPEIANVNEJNMPFQFJBOXOFLONQGRGLCPYPGMPORHSHMDQZQHNA=EITINERARIOA=DHere each word of the message comes out on a different line, and noting in each case the letter corresponding toA, we have the wordQUEMADOSwhich is the key. The cipher alphabet changed with each word of the message.A variation of this case is where the cipher alphabet changes according to a key word but the change comes every five letters or every ten letters of the message instead of every word. The text of the message can be picked up in this case with a little study.Note in using case 4 that if we are deciphering a Spanish message we use the alphabet withoutKorWas a rule, altho if the lettersKorWappear inthe cipher it is evidence that the regular English alphabet is used.

Case 4-b.

Message

HUJZH UIUPN OZYTS VQXMI SMOMX MQHUD UMREI SESJU AG

This is a message in Spanish. We will handle it as incase 4-a, setting down the whole message.

HUJZHUIUPNOZYTSVQXMISMOMXMQHUDUMREISESJUAGIVLAIVJVQOPAZUTXRYA=ANYNRIVEVNSFJTFTLVBHJXMBJXLXRPQBAVUYSZOZOSJXFXOTGLUGUMXCILYNCLYMYSQRCBXVZTAPAPTLYGYPUHMVHVNYDJMZODMZNZTRSDCYXAUBQBQUMZHZQVINXIXOZELNAPENAOAUSTEDZYBVCRCRVNAIARXJOYJYPAFMOBQFOBPBA=UAZCXDSDSXOBJBSYLPZLZQBGNPCRGPCQCBADYETETYPCLCTZMQAMARCHOQDSHQDRDCBEZFUFUZQDMDUANRBA=SRETIRESEDCFAGVGVARENEVBOSCA=QEDGBHXHXBSFOFXCPTDFEHCIYIYCTGPGYDQUEGFIDJZJZDUHQHZEA=OHGJELALAEVIRIAFIHLA=MBMBFXJSJBGJIMCNCGYLTLCHLJNDODHZMUMDIMLOEPEIANVNEJNMPFQFJBOXOFLONQGRGLCPYPGMPORHSHMDQZQHNA=EITINERARIOA=D

Here each word of the message comes out on a different line, and noting in each case the letter corresponding toA, we have the wordQUEMADOSwhich is the key. The cipher alphabet changed with each word of the message.

A variation of this case is where the cipher alphabet changes according to a key word but the change comes every five letters or every ten letters of the message instead of every word. The text of the message can be picked up in this case with a little study.

Note in using case 4 that if we are deciphering a Spanish message we use the alphabet withoutKorWas a rule, altho if the lettersKorWappear inthe cipher it is evidence that the regular English alphabet is used.

Case5-a.MessageDNWLW MXYQJ ANRSA RLPTE CABCQ RLNEC LMIWL XZQTT QIWRY ZWNSM BKNWR YMAPL ASDANThis message containsKandWand therefore we expect the English alphabet to be used. The frequency of occurrence ofA,L,N,RandWhas lead us to examine it under case4but without result. Let us set down the first two words and decipher them with a cipher disk setAtoAand then proceed as in case4.Cipher messageDNWLWMXYQJDecipheredAtoAXNEPEODCKRBYOFQFPEDLSCZPGRGQFEMTDAQHSHRGFNUEBRITISHGOVThe message is thus found to be enciphered with a cipher disk setAtoEand the text is:BRITISH GOVERNMENT PLACED CONTRACTS WITH FOLLOWING FIRMS DURING SEPTEMBER.

Case5-a.

Message

DNWLW MXYQJ ANRSA RLPTE CABCQ RLNEC LMIWL XZQTT QIWRY ZWNSM BKNWR YMAPL ASDAN

This message containsKandWand therefore we expect the English alphabet to be used. The frequency of occurrence ofA,L,N,RandWhas lead us to examine it under case4but without result. Let us set down the first two words and decipher them with a cipher disk setAtoAand then proceed as in case4.

Cipher messageDNWLWMXYQJDecipheredAtoAXNEPEODCKRBYOFQFPEDLSCZPGRGQFEMTDAQHSHRGFNUEBRITISHGOV

The message is thus found to be enciphered with a cipher disk setAtoEand the text is:BRITISH GOVERNMENT PLACED CONTRACTS WITH FOLLOWING FIRMS DURING SEPTEMBER.

Case5-b.Same ascase 4-bexcept that the cipher message must be deciphered by means of a cipher disk setAtoAbefore proceeding to make up the columns of alphabets. The words of the deciphered message will be found on separate lines, the lines being indicated as a rule by a key word which can be determined as incase 4-b.The question of alphabetic frequency has already been discussed in considering the mechanism of language. It is a convenient thing to put the frequency tables in a graphic form and to use a similar graphic form in comparing unknown alphabets with the standard frequency tables. For instance the standard Spanish frequency table put in graphicform is here presented in order to compare with it the frequency table for the message discussed incase 4-a.Standard Spanish frequency tableTable for Message Case 4-aA11111111111111111111111111127A11B112B11111117C1111111119CD111111111110DE111111111111111111111111111128E11F112F111115G1113GH112H11I11111111111112I1113J11J11L111111111110L1113M1111116M11N11111111111112N11O111111111111111116O1111116P111115P1113Q112Q1113R11111111111111115R112S1111111111111114ST111111118TU11111117UV112VXX112Y112YZ11Z11Our first assumption might be thatB=AandF=Ebut it is evident at once that in that case,S,T,UandV(equal toR,S,TandU) do not occur and a message even this short withoutR,S,TorUis practically impossible. By tryingB=Ewe find that the two tables agree in a general way very well and this is all that can be expected with such a short message. The longer the message the nearer would its frequency table agree with the standard table. Note that if a cipher disk has been used, the alphabet runs the other way and we must count upward in working with a graphic table. Note also that if, in a fairly long message, it is impossible to coördinate the graphic table, reading either up or down, with the standard table and yet some letters occur much more frequently than others and some do not occur at all, we have a mixed alphabet to deal with. The example chosen forcase 6-ais of this character. An examination of the frequency table given under that case shows that it bears no graphic resemblance tothe standard table. However, as will be seen incase 7-b, the preparation of graphic tables enables us to state definitely that the same order of letters is followed in each of a number of mixed alphabets.

Case5-b.

Same ascase 4-bexcept that the cipher message must be deciphered by means of a cipher disk setAtoAbefore proceeding to make up the columns of alphabets. The words of the deciphered message will be found on separate lines, the lines being indicated as a rule by a key word which can be determined as incase 4-b.

The question of alphabetic frequency has already been discussed in considering the mechanism of language. It is a convenient thing to put the frequency tables in a graphic form and to use a similar graphic form in comparing unknown alphabets with the standard frequency tables. For instance the standard Spanish frequency table put in graphicform is here presented in order to compare with it the frequency table for the message discussed incase 4-a.

Standard Spanish frequency tableTable for Message Case 4-aA11111111111111111111111111127A11B112B11111117C1111111119CD111111111110DE111111111111111111111111111128E11F112F111115G1113GH112H11I11111111111112I1113J11J11L111111111110L1113M1111116M11N11111111111112N11O111111111111111116O1111116P111115P1113Q112Q1113R11111111111111115R112S1111111111111114ST111111118TU11111117UV112VXX112Y112YZ11Z11

Our first assumption might be thatB=AandF=Ebut it is evident at once that in that case,S,T,UandV(equal toR,S,TandU) do not occur and a message even this short withoutR,S,TorUis practically impossible. By tryingB=Ewe find that the two tables agree in a general way very well and this is all that can be expected with such a short message. The longer the message the nearer would its frequency table agree with the standard table. Note that if a cipher disk has been used, the alphabet runs the other way and we must count upward in working with a graphic table. Note also that if, in a fairly long message, it is impossible to coördinate the graphic table, reading either up or down, with the standard table and yet some letters occur much more frequently than others and some do not occur at all, we have a mixed alphabet to deal with. The example chosen forcase 6-ais of this character. An examination of the frequency table given under that case shows that it bears no graphic resemblance tothe standard table. However, as will be seen incase 7-b, the preparation of graphic tables enables us to state definitely that the same order of letters is followed in each of a number of mixed alphabets.

General RemarksAny substitution cipher, enciphered by a single alphabet composed of letters, figures or conventional signs, can be handled by the methods of case 6. For example, the messages under case 4-a and 5-a are easily solved by these methods. But note that the messages under case 4-b and 5-b cannot so be solved because several alphabets are used. We will see later that there are methods of segregating the different alphabets in some cases where several are used and then each of the alphabets is to be handled as below.

General Remarks

Any substitution cipher, enciphered by a single alphabet composed of letters, figures or conventional signs, can be handled by the methods of case 6. For example, the messages under case 4-a and 5-a are easily solved by these methods. But note that the messages under case 4-b and 5-b cannot so be solved because several alphabets are used. We will see later that there are methods of segregating the different alphabets in some cases where several are used and then each of the alphabets is to be handled as below.

Case6-a.MessageQDBYP BXHYS OXPCP YSHCS EDRBS ZPTPB BSCSB PSHSZ AJHCD OSEXV HPODA PBPSZ BSVXY XSHCDThis message was received from a source which makes us sure it is in Spanish. The occurrence ofB,H,PandShas tempted us to try the first two words as in case 4 and 5 but without result. We now prepare a frequency table, noting at the same time theprecedingand following letter. This latter proceeding takes little longer than the preparation of an ordinary frequency table and gives most valuable information.Frequency TablePrefixSuffixA112ZDJPB111111118DPRPBSPZYXSBSPPSC111115PHSHHPSSDDD111115QECOCBROAE112SSDXFGH1111116XSSJVSYCSCPCIJ11AHLMNO1113SDPXSDP1111111119YXCZTBHABBCYTBSOBSQ11DR11DBS11111111111112YYCBBCPHOPBXOHEZCBHZEZVHT11PPUV112XSHXX111115BOEVYHPVYSY11114BHPXPSSXZ1113SSSPABIt is clear from an examination of this table that we have to deal with a single alphabet but one in which the letters do not occur in their regular order.We may assume thatPandSare probablyAandE, both on account of the frequency with which they occur and the variety of their prefixes and suffixes. If this is so, thenBandH, are probably consonants and may representRandNrespectively.DandXare then vowels by the same method of analysis. Noting thatHCoccurs three times and takingHasNwe conclude thatCis probablyT. Substitute these values in the last three words ofthe message because the letters assumed occur rather frequently there.PBPSZBSVXYXSHCDIIIARAE_RE__ENTOOONowZis always prefixed bySand may beL. TakingX=IandD=O, (they are certainly vowels),V=GandY=M, we haveARA EL REGIMIENTOSubstituting these values in the rest of the message we haveQDBYPBXHYSOXPCPYSHCSEDRBSZPTPB_ORMARINME_IATAMENTE_O_RELA_ARBSCSBPSHSZAJHCDOSEXVHPODARETERAENEL__NTO_E_IGNA_O_We may now takeQ=F,O=D,E=S,R=B,T=C,A=PandJ=Uand the message is complete. We are assisted in our last assumption by noting thatS=EandE=S, etc., and we may on that basis reconstruct the entire alphabet. The letters in parenthesis do not occur in the message but may be safely assumed to be correct.OrdinaryABCDEFGHIJLMNOPQRSTUVXYZCipherPRTOS(Q)(V)N(X)(U)(Z)(Y)(H)DAFBECJGIMLIt is always well to attempt the reconstruction of the entire alphabet for use in case any more cipher messages written in it are received.——

Case6-a.

Message

QDBYP BXHYS OXPCP YSHCS EDRBS ZPTPB BSCSB PSHSZ AJHCD OSEXV HPODA PBPSZ BSVXY XSHCD

This message was received from a source which makes us sure it is in Spanish. The occurrence ofB,H,PandShas tempted us to try the first two words as in case 4 and 5 but without result. We now prepare a frequency table, noting at the same time theprecedingand following letter. This latter proceeding takes little longer than the preparation of an ordinary frequency table and gives most valuable information.

Frequency Table

PrefixSuffixA112ZDJPB111111118DPRPBSPZYXSBSPPSC111115PHSHHPSSDDD111115QECOCBROAE112SSDXFGH1111116XSSJVSYCSCPCIJ11AHLMNO1113SDPXSDP1111111119YXCZTBHABBCYTBSOBSQ11DR11DBS11111111111112YYCBBCPHOPBXOHEZCBHZEZVHT11PPUV112XSHXX111115BOEVYHPVYSY11114BHPXPSSXZ1113SSSPAB

It is clear from an examination of this table that we have to deal with a single alphabet but one in which the letters do not occur in their regular order.

We may assume thatPandSare probablyAandE, both on account of the frequency with which they occur and the variety of their prefixes and suffixes. If this is so, thenBandH, are probably consonants and may representRandNrespectively.DandXare then vowels by the same method of analysis. Noting thatHCoccurs three times and takingHasNwe conclude thatCis probablyT. Substitute these values in the last three words ofthe message because the letters assumed occur rather frequently there.

PBPSZBSVXYXSHCDIIIARAE_RE__ENTOOO

NowZis always prefixed bySand may beL. TakingX=IandD=O, (they are certainly vowels),V=GandY=M, we have

ARA EL REGIMIENTO

Substituting these values in the rest of the message we have

QDBYPBXHYSOXPCPYSHCSEDRBSZPTPB_ORMARINME_IATAMENTE_O_RELA_ARBSCSBPSHSZAJHCDOSEXVHPODARETERAENEL__NTO_E_IGNA_O_

We may now takeQ=F,O=D,E=S,R=B,T=C,A=PandJ=Uand the message is complete. We are assisted in our last assumption by noting thatS=EandE=S, etc., and we may on that basis reconstruct the entire alphabet. The letters in parenthesis do not occur in the message but may be safely assumed to be correct.

OrdinaryABCDEFGHIJLMNOPQRSTUVXYZCipherPRTOS(Q)(V)N(X)(U)(Z)(Y)(H)DAFBECJGIML

It is always well to attempt the reconstruction of the entire alphabet for use in case any more cipher messages written in it are received.——

Case6-b.MessageLt. J. B. Smith, Royal Flying Corps, Calais, France.DACFTRRBHAMOOUEAENOIZTIETASMOSEOHIEYOCKFNOHOENOUTHOMEAHNILGOOSAHUOHOUEAPCHSTLNDACFTENINTWNBAFOHGROHTAEIOHABRISODACFTRRENOSTSMAYBISDFTENEFAPHOSMNIZTIEAHLILLTWSOUGDENOUTHOMEAHBHAMOOUEAYOEQISUUOLEHADENOENHOOQOBBORTSLHOBAHEOUBHOBIHTSWENOHOPAHIHITUASBIHTLGraham-White.The address and signature indicate that this message is in English.There are 250 letters in the cipher; the vowelsAEIOUoccur 109 times or 43.6%, the lettersLNRSToccur 62 times or 24.8%, and the lettersKQVXZoccur 5 times or 2%. The proportion in the case of the vowels is somewhat too large and, in the case of the lettersLRNST, it is too small. It is then questionable whether this is a transposition cipher altho, at first glance it might appear to be one.On examination for parts of possible words we are at once struck by the occurrence at irregular intervals of recurring groups, viz:DACFTRRENOBHAMOOUEADACFTENENOUTHOMEAHBHAMOOUEAENODACFTRRDENOUTHOMEAHIZTIEFTENDENOIZTIEENOThis is a strong indication that the cipher is a substitution cipher, so, to make an examination a frequency table will be constructed.

Case6-b.

Message

Lt. J. B. Smith, Royal Flying Corps, Calais, France.DACFTRRBHAMOOUEAENOIZTIETASMOSEOHIEYOCKFNOHOENOUTHOMEAHNILGOOSAHUOHOUEAPCHSTLNDACFTENINTWNBAFOHGROHTAEIOHABRISODACFTRRENOSTSMAYBISDFTENEFAPHOSMNIZTIEAHLILLTWSOUGDENOUTHOMEAHBHAMOOUEAYOEQISUUOLEHADENOENHOOQOBBORTSLHOBAHEOUBHOBIHTSWENOHOPAHIHITUASBIHTLGraham-White.

Lt. J. B. Smith, Royal Flying Corps, Calais, France.

DACFTRRBHAMOOUEAENOIZTIETASMOSEOHIEYOCKFNOHOENOUTHOMEAHNILGOOSAHUOHOUEAPCHSTLNDACFTENINTWNBAFOHGROHTAEIOHABRISODACFTRRENOSTSMAYBISDFTENEFAPHOSMNIZTIEAHLILLTWSOUGDENOUTHOMEAHBHAMOOUEAYOEQISUUOLEHADENOENHOOQOBBORTSLHOBAHEOUBHOBIHTSWENOHOPAHIHITUASBIHTL

Graham-White.

The address and signature indicate that this message is in English.

There are 250 letters in the cipher; the vowelsAEIOUoccur 109 times or 43.6%, the lettersLNRSToccur 62 times or 24.8%, and the lettersKQVXZoccur 5 times or 2%. The proportion in the case of the vowels is somewhat too large and, in the case of the lettersLRNST, it is too small. It is then questionable whether this is a transposition cipher altho, at first glance it might appear to be one.

On examination for parts of possible words we are at once struck by the occurrence at irregular intervals of recurring groups, viz:

DACFTRRENOBHAMOOUEADACFTENENOUTHOMEAHBHAMOOUEAENODACFTRRDENOUTHOMEAHIZTIEFTENDENOIZTIEENO

This is a strong indication that the cipher is a substitution cipher, so, to make an examination a frequency table will be constructed.

Frequency TableABCDEFGHIJKLMNOPQRSTUVWXYZ231176247326160188153632814171113032Superficially, this looks like a normal frequency table, butOis the dominant letter, followed byH,E,A,T,I,N,S, in the order named. It is certainly Case 6 if it is a substitution cipher at all.Let us see what can be done by assumingO=E; the tripletENO, occurring six times might well beTHEandE=TandN=H. A glance at the frequency table shows this to be reasonable. Now substitute these letters in some likely groups.FNOHOENObecomes_HE_ETHE;FTENbecomes_TH;ENOENHObecomesTHETH_E;ENOHObecomesTHE_E. A bit of study will show thatF=W,T=IandH=Rand the frequency table bears this out except thatH(=R)seems to occur too frequently. The recurring groups containingDAC(see above) occur in such a way that we may be sureDACis one word,FTRRis another andFTEN(=WITH)is a third. NowFTRRbecomesWI__, which can only be completed by a double letter.LLfills the bill and we may sayR=L. AsDACstarts the message and is followed byFTRR (=WILL)it is reasonable to tryDAC=YOU. Looking upDACin the frequency table it is evident that we strain nothing by this assumption. We now have:Letters of cipherONTAHECFDLetters of messageEHIORTUWYNow take the groupENOUTHOMEAHwhich occurs twice. This becomesTHE_IRE_TORand if we substituteU=DandM=Cwe haveTHE DIRECTOR. Next the group(FTRR)BHAMOOUEAbecomes(WILL) _ROCEEDTOand the context gives word with missing letter asPROCEED, from whichB=P. Next the group(ENO) IZTIETASMOSEOHIEYOCK(FNOHO)becomes(THE)__I_TIO_CE_TER_T_EU_(WHERE)and the group(FTEN)EFAPHOSMNIZTIEAHLbecomes(WITH)TWO_RE_CH__I_TOR_.The substitution ofAforI,VforZ,NforSandFforPmakes the latter group read(WITH TWO FRENCH AVIATORSand the former read(THE)AVIATION CENTER AT _EU_(WHERE).Now the wordYOCK = (_EU_)is the name of a place, evidently.Wefind another group containingY, viz:ENOSTSMAYBISDwhich becomesTHENINCO_PANYso that evidently we should substituteMforY. The other occurrence ofY (=M)is in the groupEAYOEQISUwhich becomesTOMET_AND. A reasonable knowledge of geography gives us the wordsMEUXandMETZso thatXshould be substituted forKandZforQ.We now have sufficient letters for a complete deciphering of the message.Letters of cipherABCDEFGHIKLMNOPQRSTUVWYZLetters of messageOPUYTW_RAXSCHEFZLNID__MVThe message deciphers:YOU WILL PROCEED TO THE AVIATION CENTER AT MEUX WHERE THE DIRECTOR HAS _EEN ORDERED TO FURNISH YOU WITH A HI_H POWER _LERIOT AEROPLANE. YOU WILL THEN IN COMPANY WITH TWO FRENCH AVIATORS ASSI_NED _Y THE DIRECTOR PROCEED TO METZ AND DESTROY THE THREE ZEPPELINS REPORTED PREPARIN_ THERE FOR A RAID ON PARIS.The substitution ofBforG,GforWandKforVcompletes the cipher. This cipher is difficult only because the cipher alphabet is made up, not haphazard, but scientifically with proper consideration for the natural frequency of occurrence of the letters. In cipher work it is dangerous to neglect proper analysis and jump at conclusions.In the study of Mexican substitution ciphers, several alphabets have been found which are made up in a general way, like the one discussed in this case.

Frequency Table

ABCDEFGHIJKLMNOPQRSTUVWXYZ231176247326160188153632814171113032Superficially, this looks like a normal frequency table, butOis the dominant letter, followed byH,E,A,T,I,N,S, in the order named. It is certainly Case 6 if it is a substitution cipher at all.Let us see what can be done by assumingO=E; the tripletENO, occurring six times might well beTHEandE=TandN=H. A glance at the frequency table shows this to be reasonable. Now substitute these letters in some likely groups.FNOHOENObecomes_HE_ETHE;FTENbecomes_TH;ENOENHObecomesTHETH_E;ENOHObecomesTHE_E. A bit of study will show thatF=W,T=IandH=Rand the frequency table bears this out except thatH(=R)seems to occur too frequently. The recurring groups containingDAC(see above) occur in such a way that we may be sureDACis one word,FTRRis another andFTEN(=WITH)is a third. NowFTRRbecomesWI__, which can only be completed by a double letter.LLfills the bill and we may sayR=L. AsDACstarts the message and is followed byFTRR (=WILL)it is reasonable to tryDAC=YOU. Looking upDACin the frequency table it is evident that we strain nothing by this assumption. We now have:Letters of cipherONTAHECFDLetters of messageEHIORTUWYNow take the groupENOUTHOMEAHwhich occurs twice. This becomesTHE_IRE_TORand if we substituteU=DandM=Cwe haveTHE DIRECTOR. Next the group(FTRR)BHAMOOUEAbecomes(WILL) _ROCEEDTOand the context gives word with missing letter asPROCEED, from whichB=P. Next the group(ENO) IZTIETASMOSEOHIEYOCK(FNOHO)becomes(THE)__I_TIO_CE_TER_T_EU_(WHERE)and the group(FTEN)EFAPHOSMNIZTIEAHLbecomes(WITH)TWO_RE_CH__I_TOR_.The substitution ofAforI,VforZ,NforSandFforPmakes the latter group read(WITH TWO FRENCH AVIATORSand the former read(THE)AVIATION CENTER AT _EU_(WHERE).Now the wordYOCK = (_EU_)is the name of a place, evidently.Wefind another group containingY, viz:ENOSTSMAYBISDwhich becomesTHENINCO_PANYso that evidently we should substituteMforY. The other occurrence ofY (=M)is in the groupEAYOEQISUwhich becomesTOMET_AND. A reasonable knowledge of geography gives us the wordsMEUXandMETZso thatXshould be substituted forKandZforQ.We now have sufficient letters for a complete deciphering of the message.Letters of cipherABCDEFGHIKLMNOPQRSTUVWYZLetters of messageOPUYTW_RAXSCHEFZLNID__MVThe message deciphers:YOU WILL PROCEED TO THE AVIATION CENTER AT MEUX WHERE THE DIRECTOR HAS _EEN ORDERED TO FURNISH YOU WITH A HI_H POWER _LERIOT AEROPLANE. YOU WILL THEN IN COMPANY WITH TWO FRENCH AVIATORS ASSI_NED _Y THE DIRECTOR PROCEED TO METZ AND DESTROY THE THREE ZEPPELINS REPORTED PREPARIN_ THERE FOR A RAID ON PARIS.The substitution ofBforG,GforWandKforVcompletes the cipher. This cipher is difficult only because the cipher alphabet is made up, not haphazard, but scientifically with proper consideration for the natural frequency of occurrence of the letters. In cipher work it is dangerous to neglect proper analysis and jump at conclusions.In the study of Mexican substitution ciphers, several alphabets have been found which are made up in a general way, like the one discussed in this case.

ABCDEFGHIJKLMNOPQRSTUVWXYZ231176247326160188153632814171113032

Superficially, this looks like a normal frequency table, butOis the dominant letter, followed byH,E,A,T,I,N,S, in the order named. It is certainly Case 6 if it is a substitution cipher at all.

Let us see what can be done by assumingO=E; the tripletENO, occurring six times might well beTHEandE=TandN=H. A glance at the frequency table shows this to be reasonable. Now substitute these letters in some likely groups.FNOHOENObecomes_HE_ETHE;FTENbecomes_TH;ENOENHObecomesTHETH_E;ENOHObecomesTHE_E. A bit of study will show thatF=W,T=IandH=Rand the frequency table bears this out except thatH(=R)seems to occur too frequently. The recurring groups containingDAC(see above) occur in such a way that we may be sureDACis one word,FTRRis another andFTEN(=WITH)is a third. NowFTRRbecomesWI__, which can only be completed by a double letter.LLfills the bill and we may sayR=L. AsDACstarts the message and is followed byFTRR (=WILL)it is reasonable to tryDAC=YOU. Looking upDACin the frequency table it is evident that we strain nothing by this assumption. We now have:

Letters of cipherONTAHECFDLetters of messageEHIORTUWY

Now take the groupENOUTHOMEAHwhich occurs twice. This becomesTHE_IRE_TORand if we substituteU=DandM=Cwe haveTHE DIRECTOR. Next the group(FTRR)BHAMOOUEAbecomes(WILL) _ROCEEDTOand the context gives word with missing letter asPROCEED, from whichB=P. Next the group(ENO) IZTIETASMOSEOHIEYOCK(FNOHO)becomes(THE)__I_TIO_CE_TER_T_EU_(WHERE)and the group(FTEN)EFAPHOSMNIZTIEAHLbecomes(WITH)TWO_RE_CH__I_TOR_.The substitution ofAforI,VforZ,NforSandFforPmakes the latter group read(WITH TWO FRENCH AVIATORSand the former read(THE)AVIATION CENTER AT _EU_(WHERE).

Now the wordYOCK = (_EU_)is the name of a place, evidently.Wefind another group containingY, viz:ENOSTSMAYBISDwhich becomesTHENINCO_PANYso that evidently we should substituteMforY. The other occurrence ofY (=M)is in the groupEAYOEQISUwhich becomesTOMET_AND. A reasonable knowledge of geography gives us the wordsMEUXandMETZso thatXshould be substituted forKandZforQ.

We now have sufficient letters for a complete deciphering of the message.

Letters of cipherABCDEFGHIKLMNOPQRSTUVWYZLetters of messageOPUYTW_RAXSCHEFZLNID__MV

The message deciphers:

YOU WILL PROCEED TO THE AVIATION CENTER AT MEUX WHERE THE DIRECTOR HAS _EEN ORDERED TO FURNISH YOU WITH A HI_H POWER _LERIOT AEROPLANE. YOU WILL THEN IN COMPANY WITH TWO FRENCH AVIATORS ASSI_NED _Y THE DIRECTOR PROCEED TO METZ AND DESTROY THE THREE ZEPPELINS REPORTED PREPARIN_ THERE FOR A RAID ON PARIS.

The substitution ofBforG,GforWandKforVcompletes the cipher. This cipher is difficult only because the cipher alphabet is made up, not haphazard, but scientifically with proper consideration for the natural frequency of occurrence of the letters. In cipher work it is dangerous to neglect proper analysis and jump at conclusions.

In the study of Mexican substitution ciphers, several alphabets have been found which are made up in a general way, like the one discussed in this case.

Case6-c.—It is a convenience in dealing with ciphers made up of numbers or conventional signs to substitute arbitrary letters for the numbers and signs. Suppose we have the message:”??2&45x15)“8&#&&1x4%&4&%6x?&”8&*x46°*°&%“4&”By arbitrary substitution of letters this is madeABBCDEFGHFIJKDLDDHGEMDEDMNGBDAKDOGENPOPDMAEDAThis message is now in convenient shape to handle as Case 6-a and on solution is found to read:ALL PERSONS HAVE BEEN ORDERED TO LEAVE FORTIFIED AREA.In the same way the message1723322328251828363023361423282723243120231731233036212024153029151228311721271528112715192330301215113021283623is found to be made up entirely of numbers between 11 and 36 with the numbers 23, 28 and 30 occurring most frequently. This immediately suggests an alphabet made up of the numbers from 11 to 36 inclusive and each cipher group of figures represents two letters. By arbitrary substitution of letters for groups of two numbers we obtain:ABCBDEFDGHBGIBDJBKLMBALBHGNMOPHQPRDLANJPDSJPTBHHRPSHNDGBand this message is also in shape to handle as Case 6-a. It reads, on solution,SEVEN HUNDRED MEN LEFT YESTERDAY FOR POINTS ON LOWER RIO GRANDE.

Case6-c.—It is a convenience in dealing with ciphers made up of numbers or conventional signs to substitute arbitrary letters for the numbers and signs. Suppose we have the message:

”??2&45x15)“8&#&&1x4%&4&%6x?&”8&*x46°*°&%“4&”

By arbitrary substitution of letters this is made

ABBCDEFGHFIJKDLDDHGEMDEDMNGBDAKDOGENPOPDMAEDA

This message is now in convenient shape to handle as Case 6-a and on solution is found to read:

ALL PERSONS HAVE BEEN ORDERED TO LEAVE FORTIFIED AREA.

In the same way the message

1723322328251828363023361423282723243120231731233036212024153029151228311721271528112715192330301215113021283623

is found to be made up entirely of numbers between 11 and 36 with the numbers 23, 28 and 30 occurring most frequently. This immediately suggests an alphabet made up of the numbers from 11 to 36 inclusive and each cipher group of figures represents two letters. By arbitrary substitution of letters for groups of two numbers we obtain:

ABCBDEFDGHBGIBDJBKLMBALBHGNMOPHQPRDLANJPDSJPTBHHRPSHNDGB

and this message is also in shape to handle as Case 6-a. It reads, on solution,

SEVEN HUNDRED MEN LEFT YESTERDAY FOR POINTS ON LOWER RIO GRANDE.

Back to Index Next