Autokey cipher

<h2 id="history">History</h2>
This cipher was invented in 1586 by <a href="/facts/Blaise_de_Vigen%C3%A8re/CfQgRjxd">Blaise de Vigenère</a> with a reciprocal table of ten alphabets. Vigenère's version used an agreed-upon letter of the alphabet as a primer, making the key by writing down that letter and then the rest of the message.<a class="footnote-ref" id="fnref:1" href="#fn:1">1</a>
More popular autokeys use a <a href="/facts/Tabula_recta/DflhwLMp">tabula recta</a>, a square with 26 copies of the alphabet, the first line starting with 'A', the next line starting with 'B' etc. Instead of a single letter, a short agreed-upon keyword is used, and the key is generated by writing down the primer and then the rest of the message, as in Vigenère's version. To encrypt a plaintext, the row with the first letter of the message and the column with the first letter of the key are located. The letter in which the row and the column cross is the ciphertext letter.

<h2 id="method">Method</h2>
The autokey cipher, as used by members of the <a href="/facts/American_Cryptogram_Association/nyECD4Ik">American Cryptogram Association</a>, starts with a relatively-short keyword, the primer, and appends the message to it. For example, if the keyword is QUEENLY and the message is attack at dawn, then the key would be QUEENLYATTACKATDAWN.<a class="footnote-ref" id="fnref:2" href="#fn:2">2</a>

Plaintext: attackatdawn
Key: QUEENLYATTACKATDAWN
Ciphertext: QNXEPVYTWTWP

The ciphertext message would thus be "QNXEPVYTWTWP".
To decrypt the message, the recipient would start by writing down the agreed-upon keyword.

QNXEPVYTWTWP
QUEENLY

The first letter of the key, Q, would then be taken, and that row would be found in a tabula recta. That column for the first letter of the ciphertext would be looked across, also Q in this case, and the letter to the top would be retrieved, A. Now, that letter would be added to the end of the key:

QNXEPVYTWTWP
QUEENLYA
a

Then, since the next letter in the key is U and the next letter in the ciphertext is N, the U row is looked across to find the N to retrieve T:

QNXEPVYTWTWP
QUEENLYAT
at

That continues until the entire key is reconstructed, when the primer can be removed from the start.

QNXEPVYTWTWP
QUEENLYATTACKATDAWN
attackatdawn

With Vigenère's autokey cipher, a single mistake in encryption renders the rest of the message unintelligible.<a class="footnote-ref" id="fnref:3" href="#fn:3">3</a>

<h2 id="cryptanalysis">Cryptanalysis</h2>
Autokey ciphers are somewhat more secure than polyalphabetic ciphers that use fixed keys since the key does not repeat within a single message. Therefore, methods like the <a href="/facts/Kasiski_examination/2mH65Arp">Kasiski examination</a> or <a href="/facts/Index_of_coincidence/7uW1sGer">index of coincidence</a> analysis will not work on the ciphertext, unlike for similar ciphers that use a single repeated key.<a class="footnote-ref" id="fnref:4" href="#fn:4">4</a>
A crucial weakness of the system, however, is that the plaintext is part of the key. That means that the key will likely contain common words at various points. The key can be attacked by using a dictionary of common words, <a href="/facts/Bigram/HBbBokaM">bigrams</a>, <a href="/facts/Trigram/HGRCvc7j">trigrams</a> etc. and by attempting the decryption of the message by moving that word through the key until potentially-readable text appears.
Consider an example message meet at the fountain encrypted with the primer keyword KILT:<a class="footnote-ref" id="fnref:5" href="#fn:5">5</a> To start, the autokey would be constructed by placing the primer at the front of the message:

plaintext: meetatthefountain
primer: KILT
autokey: KILTMEETATTHEFOUN

The message is then encrypted by using the key and the substitution alphabets, here a tabula recta:

plaintext: meetatthefountain
key: KILTMEETATTHEFOUN
ciphertext: WMPMMXXAEYHBRYOCA

The attacker receives only the ciphertext and can attack the text by selecting a word that is likely to appear in the plaintext. In this example, the attacker selects the word the as a potential part of the original message and then attempts to decode it by placing THE at every possible location in the key:

cipher: WMP MMX XAE YHB RYO CA 
key: THE THE THE THE THE ..
plain: dfl tft eta fax yrk ..

cipher: W MPM MXX AEY HBR YOC A
key:    . THE THE THE THE THE .
plain:  . tii tqt hxu oun fhy .

cipher: WM PMM XXA EYH BRY OCA
key:    .. THE THE THE THE THE
plain:  .. wfi eqw lrd iku vvw

In each case, the resulting plaintext appears almost random because the key is not aligned for most of the ciphertext. However, examining the results can suggest locations of the key being properly aligned. In those cases, the resulting decrypted text is potentially part of a word. In this example, it is highly unlikely that dfl is the start of the original plaintext and so it is highly unlikely either that the first three letters of the key are THE. Examining the results, a number of fragments that are possibly words can be seen and others can be eliminated. Then, the plaintext fragments can be sorted in their order of likelihood:

unlikely ←—————————→ promising
eqw dfl tqt ... ... eta oun fax

A correct plaintext fragment is also going to appear in the key, shifted right by the length of the keyword. Similarly, the guessed key fragment (THE) also appears in the plaintext shifted left. Thus, by guessing keyword lengths (probably between 3 and 12), more plaintext and key can be revealed.
Trying that with oun, possibly after wasting some time with the others, results in the following:

shift by 4:
ciphertext: WMPMMXXAEYHBRYOCA
key: K.LTM.ETA.THE.OUN
plaintext: m.eta.the.oun.ain

shift by 5:
ciphertext: WMPMMXXAEYHBRYOCA
key:        SWT..EQW..THE..OU
plaintext:  eqw..the..oun..og

shift by 6:
ciphertext: WMPMMXXAEYHBRYOCA
key:        D...TQT...THE...O
plaintext:  t...the...oun...m

A shift of 4 can be seen to look good (both of the others have unlikely Qs either in the plaintext or in the keyword).
A lot can be worked with now. The keyword is probably 4 characters long (K.LT), and some of the message is visible:

m.eta.the.oun.ain

Because the plaintext guesses have an effect on the key 4 characters to the left, feedback on correct and incorrect guesses is given. The gaps can quickly be filled in, giving both the plaintext and the keyword:

meetatthefountain
KILT

The ease of <a href="/facts/Cryptanalysis/7CPEQlJI">cryptanalysis</a> is caused by the feedback from the relationship between plaintext and key. A three-character guess reveals six more characters (three on each side), which then reveal further characters, creating a cascade effect. That allows incorrect guesses to be ruled out quickly.

<h2 id="see-also">See also</h2>
<ul><li><a href="/facts/Chaocipher/Y3f6mEYB">Chaocipher</a></li>
<li><a href="/facts/Cipher_Block_Chaining/vIUabB2z">Cipher Block Chaining</a></li></ul>
<h2 id="notes">Notes</h2>

<ul><li>Bellaso, Giovan Battista, Il vero modo di scrivere in cifra con facilità, prestezza, et securezza di Misser Giovan Battista Bellaso, gentil’huomo bresciano, Iacobo Britannico, Bressa 1564.</li>
<li>Vigenère, Blaise de, Traicté des chiffres ou secrètes manières d’escrire, Abel l’Angelier, Paris 1586. ff. 46r-49v.</li>
<li>LABRONICUS (Buonafalce, A), Early Forms of the Porta Table, “The Cryptogram”, vol. LX n. 2, Wilbraham 1994.</li>
<li>Buonafalce, Augusto, Bellaso’s Reciprocal Ciphers, “Cryptologia” 30 (1):39-51, 2006.</li>
<li>LABRONICUS (Buonafalce, A), Vigenère and Autokey. An Update, “The Cryptogram”, vol. LXXIV n. 3, Plano 2008.</li></ul>

<h2 id="external-links">External links</h2>
<ul><li><a href="http://www.secretcodebreaker.com/autokey-cipher.html">Secret Code Breaker</a> - AutoKey Cipher Decoder and Encoder</li>
<li><a href="http://www.practicalcryptography.com/ciphers/autokey-cipher/#javascript-example">A Javascript implementation of the Autokey cipher</a></li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1">"Vigenère Cipher". Crypto Corner. Retrieved 2018-08-13. <a href="http://crypto.interactive-maths.com/vigenegravere-cipher.html" target="_blank">http://crypto.interactive-maths.com/vigenegravere-cipher.html</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></li>
<li id="fn:2">"Autokey Calculator". Asecuritysite.com. Archived from the original on 2013-12-02. Retrieved 2012-12-26. <a href="https://web.archive.org/web/20131202225102/http://asecuritysite.com/security/Coding/autokey?word=attackatdawn%2Cqueenly" target="_blank">https://web.archive.org/web/20131202225102/http://asecuritysite.com/security/Coding/autokey?word=attackatdawn%2Cqueenly</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></li>
<li id="fn:3">Hoffstein, Jeffrey; Pipher, Jill; Silverman, Joseph (2014). An Introduction to Mathematical Cryptography. Springer. p. 288. ISBN 9781493917112. <a href="9781493917112" target="_blank">9781493917112</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></li>
<li id="fn:4">Hoffstein, Jeffrey; Pipher, Jill; Silverman, Joseph (2014). An Introduction to Mathematical Cryptography. Springer. p. 288. ISBN 9781493917112. <a href="9781493917112" target="_blank">9781493917112</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></li>
<li id="fn:5">"Autokey Calculator". Asecuritysite.com. Archived from the original on 2013-12-03. Retrieved 2012-12-26. <a href="https://web.archive.org/web/20131203104209/http://asecuritysite.com/security/Coding/autokey?word=meetatthefountain%2Ckilt" target="_blank">https://web.archive.org/web/20131203104209/http://asecuritysite.com/security/Coding/autokey?word=meetatthefountain%2Ckilt</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></li>
</ol>

Autokey cipher open-in-new

Autokey cipher