Cryptology – Lab 1

Cryptoanalysis of the Vigenere cipher

Frédéric Haziza <daz@it.uu.se>

Department of Computer Systems

Uppsala University

Spring 2008
Deliveries Cipher Crack it

Deliveries

Work in group of 2
Oral examination
• Show your code and tests
• Describe your implementation
• Demonstrate your working version
Date: February 7th and 8th
Deadline: February 13th at 17.00
Examination: February 14th and 15th at 10.00

Goal
Find plaintexts and keys for the 6 given cryptotexts

Help files and description in [HOMEPAGEcryptology ]/labs

2
OSKomp’08 | Cryptology – Lab 1 (Cryptoanalysis of the Vigenere cipher)
Deliveries Cipher Crack it

Lab 1 – Vigenère Cipher

Encrypts m characters at a time

Key word K = (k1 , k2 , . . . , km )
Encryption:
EK (x1 , x2 , . . . , xm ) = (x1 + k1 , x2 + k2 , . . . , xm + km )
Decryption:
DK (x1 , x2 , . . . , xm ) = (x1 − k1 , x2 − k2 , . . . , xm − km )
Operations modulo 26

3
OSKomp’08 | Cryptology – Lab 1 (Cryptoanalysis of the Vigenere cipher)
Deliveries Cipher Crack it

Example

Plaintext: “Renaissance”
Key word: “Band”

Plaintext RENA ISSA NCE

Key BAND BAND BAN
Ciphertext SEAD JSFD OCR

4
OSKomp’08 | Cryptology – Lab 1 (Cryptoanalysis of the Vigenere cipher)
Deliveries Cipher Crack it

Cryptoanalysis

Step 1
Determines the key length m

Step 2
Determines the key K = (k1 , k2 , . . . , km )

5
OSKomp’08 | Cryptology – Lab 1 (Cryptoanalysis of the Vigenere cipher)
Deliveries Cipher Crack it

Determining the key length

Method 1: Kasiski test

1863 - Major F.W. Kasiski, German cryptologist

Length of keyword is a divisor of the gcd of the distances

between identical strings of length at least 3.

6
OSKomp’08 | Cryptology – Lab 1 (Cryptoanalysis of the Vigenere cipher)
Deliveries Cipher Crack it

Kasiski test

Observation
2 identical segments of plaintext will be encrypted to the same
ciphertext whenever their occurence in the plaintext in δ
positions apart, where δ ≡ 0[m]

Search the cipher for pairs of identical segments of length

at least three
Record the distance between the starting positions of the 2
segments
if we obtain then δ1 , δ2 , . . .
then we conjuncture that m divides each δi and hence m
divides their gcd.

7
OSKomp’08 | Cryptology – Lab 1 (Cryptoanalysis of the Vigenere cipher)
Deliveries Cipher Crack it

Determining the key length

Method 2: Sliding stripes

Write the entire cryptogram on two separate strips of
paper.
Line up the strips, one above the other and slide the top
strip one position at a time.
At each step count the number of agreements of letters in
the two strips.
The slide position that gives the greatest number of
agreements is usually the key length

8
OSKomp’08 | Cryptology – Lab 1 (Cryptoanalysis of the Vigenere cipher)
Deliveries Cipher Crack it

Determining the key length

Method 3: Kappa test

Friedman Test (1925, Colonel William Frederick Friedman
(1891-1969))

Uses the index of coincidence

We’ll use that one

9
OSKomp’08 | Cryptology – Lab 1 (Cryptoanalysis of the Vigenere cipher)
Deliveries Cipher Crack it

Index of Coincidence

index of coincidence of a text Ic (X)

probability that a randomly chosen pair of letters in the
message are equal.

Text: X = (x1 , x2 , . . . , xn )
Text length: n
ni number of occurrences of the i th letter in X
P25 ni (ni −1)
Ic (X) = i=0 n(n−1)

10
OSKomp’08 | Cryptology – Lab 1 (Cryptoanalysis of the Vigenere cipher)
Deliveries Cipher Crack it

Index of Coincidence

We can also calculate this index for any language source:

pa = probability of occurrence of the letter a
its frequency in the alphabet
P25 2
Isource = pa pa + pb pb + . . . + pz pz = i=0 pi

IEnglish ∼ 0.065
1 2 1 2
IRandom = 25
P 2
P25

1
i=0 pi = i=0 26 = 26 26 = 26 ∼ 0.038

11
OSKomp’08 | Cryptology – Lab 1 (Cryptoanalysis of the Vigenere cipher)
Deliveries Cipher Crack it

Using the Index of Coincidence

This index can give information about a message.

For instance, if a ciphered message was either a transposition

or a monoalphabetic substitution then one would expect to have
IMessage ∼ IEnglish , but if a polyalphabetic substitution was used
then this value should decrease (but no lower than 0.038) since
the polyalphabetic procedure tends to randomize the
occurrences of the letters.

12
OSKomp’08 | Cryptology – Lab 1 (Cryptoanalysis of the Vigenere cipher)
Deliveries Cipher Crack it

Rearrange the text

y1 = x1 xm+1 x2m+1 . . . ,
y2 = x2 xm+2 x2m+2 . . . ,
.. .. ..
. . .
ym = xm x2m x3m . . .

If m was indeed the key length, Ic (yi ) ∼ 0.065

However,

0.027∗n
m= (n−1)∗Ic (X)−0.038∗n+0.065
13
OSKomp’08 | Cryptology – Lab 1 (Cryptoanalysis of the Vigenere cipher)
Deliveries Cipher Crack it

Assume we know the key length

To find key K = (k1 , k2 , . . . , km )

For each yi and for each letter α from A to Z
• Decrypt yi with α using the Ceasar method,
• Measure frequencies of letters in the decrypted substring
• Compare it to the english distribution
(define your distance, for eg, sum of squares)
For the minimal deviation, ki = α
Repeat for each ki

14
OSKomp’08 | Cryptology – Lab 1 (Cryptoanalysis of the Vigenere cipher)
Deliveries Cipher Crack it

When we get the key

Decrypt the cipher X using the key K,

Check the IC (X)
If it differs too much from IEnglish ∼ 0.065
• try the suggested key length ±1
• Repeat until we get close to 0.065
Suggested range: 0.056 – 0.075

15
OSKomp’08 | Cryptology – Lab 1 (Cryptoanalysis of the Vigenere cipher)