Vigenère cipher

<h2 id="history">History</h2>
<p>The very first well-documented description of a polyalphabetic cipher was by <a href="/facts/Leon_Battista_Alberti/CykJ6jJQ">Leon Battista Alberti</a> around 1467 and used a metal <a href="/facts/Cipher_disk/c60fHeKp">cipher disk</a> to switch between cipher alphabets. Alberti's system only switched alphabets after several words, and switches were indicated by writing the letter of the corresponding alphabet in the ciphertext. Later, <a href="/facts/Johannes_Trithemius/lwtRCGWU">Johannes Trithemius</a>, in his work <a href="/facts/Polygraphia_(book)/FGrPup30"><i>Polygraphia</i></a> (which was completed in manuscript form in 1508 but first published in 1518),<a class="footnote-ref" id="fnref:6" href="#fn:6"><sup>6</sup></a> invented the <a href="/facts/Tabula_recta/DflhwLMp">tabula recta</a>, a critical component of the Vigenère cipher.<a class="footnote-ref" id="fnref:7" href="#fn:7"><sup>7</sup></a> The <a href="/facts/Trithemius_cipher/DflhwLMp">Trithemius cipher</a>, however, provided a progressive, rather rigid and predictable system for switching between cipher alphabets.<a class="footnote-ref" id="fnref:8" href="#fn:8"><sup>8</sup></a>
</p><p>In 1586 Blaise de Vigenère published a type of polyalphabetic cipher called an <a href="/facts/Autokey_cipher/ebu1mkDo">autokey cipher</a> – because its key is based on the original plaintext – before the court of <a href="/facts/Henry_III_of_France/AR5xkFLv">Henry III of France</a>.<a class="footnote-ref" id="fnref:9" href="#fn:9"><sup>9</sup></a> The cipher now known as the Vigenère cipher, however, is based on that originally described by <a href="/facts/Giovan_Battista_Bellaso/MYUDs6aT">Giovan Battista Bellaso</a> in his 1553 book <i>La cifra del Sig. Giovan Battista Bellaso</i>.<a class="footnote-ref" id="fnref:10" href="#fn:10"><sup>10</sup></a> He built upon the tabula recta of Trithemius but added a repeating "countersign" (a <a href="/facts/Key_(cryptography)/5W5PAmT4">key</a>) to switch cipher alphabets every letter.
</p><p>Whereas Alberti and Trithemius used a fixed pattern of substitutions, Bellaso's scheme meant the pattern of substitutions could be easily changed, simply by selecting a new key. Keys were typically single words or short phrases, known to both parties in advance, or transmitted "out of band" along with the message, Bellaso's method thus required strong security for only the key. As it is relatively easy to secure a short key phrase, such as by a previous private conversation, Bellaso's system was considerably more secure.
</p><p>Note, however, as opposed to the modern Vigenère cipher, Bellaso's cipher didn't have 26 different "shifts" (different Caesar's ciphers) for every letter, instead having 13 shifts for pairs of letters. In the 19th century, the invention of this cipher, essentially designed by Bellaso, was misattributed to Vigenère. David Kahn, in his book, <i>The Codebreakers</i> lamented this misattribution, saying that history had "ignored this important contribution and instead named a regressive and elementary cipher for him [Vigenère] though he had nothing to do with it".<a class="footnote-ref" id="fnref:11" href="#fn:11"><sup>11</sup></a>
</p><p>The Vigenère cipher gained a reputation for being exceptionally strong. Noted author and mathematician Charles Lutwidge Dodgson (<a href="/facts/Lewis_Carroll/UnDExrlu">Lewis Carroll</a>) called the Vigenère cipher unbreakable in his 1868 piece "<a href="/facts/The_Alphabet_Cipher/6Nw5d7zw">The Alphabet Cipher</a>" in a children's magazine. In 1917, <i><a href="/facts/Scientific_American/jkl8bhUN">Scientific American</a></i> described the Vigenère cipher as "impossible of translation".<a class="footnote-ref" id="fnref:12" href="#fn:12"><sup>12</sup></a><a class="footnote-ref" id="fnref:13" href="#fn:13"><sup>13</sup></a> That reputation was not deserved. <a href="/facts/Charles_Babbage/T3jklQcd">Charles Babbage</a> is known to have broken a variant of the cipher as early as 1854 but did not publish his work.<a class="footnote-ref" id="fnref:14" href="#fn:14"><sup>14</sup></a> Kasiski entirely broke the cipher and published the technique in the 19th century, but even in the 16th century, some skilled cryptanalysts could occasionally break the cipher.<a class="footnote-ref" id="fnref:15" href="#fn:15"><sup>15</sup></a>
</p>

<p>The Vigenère cipher is simple enough to be a field cipher if it is used in conjunction with cipher disks.<a class="footnote-ref" id="fnref:16" href="#fn:16"><sup>16</sup></a> The <a href="/facts/Confederate_States_of_America/jMSDM4q3">Confederate States of America</a>, for example, used a brass cipher disk to implement the Vigenère cipher during the <a href="/facts/American_Civil_War/A9FT3ksD">American Civil War</a>. The Confederacy's messages were far from secret, and the Union regularly cracked its messages. Throughout the war, the Confederate leadership primarily relied upon three key phrases: "Manchester Bluff", "Complete Victory" and, as the war came to a close, "Come Retribution".<a class="footnote-ref" id="fnref:17" href="#fn:17"><sup>17</sup></a>
</p><p>A Vigenère cipher with a completely random (and non-reusable) key which is as long as the message becomes a <a href="/facts/One-time_pad/03hA9XSQ">one-time pad</a>, a theoretically unbreakable cipher.<a class="footnote-ref" id="fnref:18" href="#fn:18"><sup>18</sup></a> <a href="/facts/Gilbert_Vernam/J95jC0ER">Gilbert Vernam</a> tried to repair the broken cipher (creating the Vernam–Vigenère cipher in 1918), but the technology he used was so cumbersome as to be impracticable.<a class="footnote-ref" id="fnref:19" href="#fn:19"><sup>19</sup></a>
</p>
<h2 id="description">Description</h2>

<p>In a <a href="/facts/Caesar_cipher/Pjy93nA5">Caesar cipher</a>, each letter of the alphabet is shifted along some number of places. For example, in a Caesar cipher of shift 3, a would become D, b would become E, y would become B and so on. The Vigenère cipher has several Caesar ciphers in sequence with different shift values.
</p><p>To encrypt, a table of alphabets can be used, termed a <i><a href="/facts/Tabula_recta/DflhwLMp">tabula recta</a></i>, <i>Vigenère square</i> or <i>Vigenère table</i>. It has the alphabet written out 26 times in different rows, each alphabet shifted cyclically to the left compared to the previous alphabet, corresponding to the 26 possible Caesar ciphers. At different points in the encryption process, the cipher uses a different alphabet from one of the rows. The alphabet used at each point depends on a repeating keyword.
</p><p>For example, suppose that the <a href="/facts/Plaintext/tWnBDCgE">plaintext</a> to be encrypted is
</p>
attackatdawn.
<p>The person sending the message chooses a keyword and repeats it until it matches the length of the plaintext, for example, the keyword "LEMON":
</p>
LEMONLEMONLE
<p>Each row starts with a key letter. The rest of the row holds the letters A to Z (in shifted order). Although there are 26 key rows shown, a code will use only as many keys (different alphabets) as there are unique letters in the key string, here just 5 keys: {L, E, M, O, N}. For successive letters of the message, successive letters of the key string will be taken and each message letter enciphered by using its corresponding key row. When a new character of the message is selected, the next letter of the key is chosen, and the row corresponding to that char is gone along to find the column heading that matches the message character. The letter at the intersection of [key-row, msg-col] is the enciphered letter.
</p><p>For example, the first letter of the plaintext, a, is paired with L, the first letter of the key. Therefore, row L and column A of the Vigenère square are used, namely L. Similarly, for the second letter of the plaintext, the second letter of the key is used. The letter at row E and column T is X. The rest of the plaintext is enciphered in a similar fashion:
</p>
<table><tbody><tr><td>Plaintext:</td><td>attackatdawn</td></tr><tr><td>Key:</td><td>LEMONLEMONLE</td></tr><tr><td>Ciphertext:</td><td>LXFOPVEFRNHR</td></tr></tbody></table>
<p>Decryption is performed by going to the row in the table corresponding to the key, finding the position of the ciphertext letter in that row and then using the column's label as the plaintext. For example, in row L (from <i>L</i>EMON), the ciphertext L appears in column A, so a is the first plaintext letter. Next, in row E (from L<i>E</i>MON), the ciphertext X is located in column T. Thus t is the second plaintext letter.
</p>
<h2 id="algebraic-description">Algebraic description</h2>
<p>Vigenère can also be described algebraically. If the letters A–Z are taken to be the numbers 0–25 (
  
    
      
        A
        
        
          
            
              =
              ^
            
          
        
        
        0
      
    
    {\displaystyle A\,{\widehat {=}}\,0}
  
, 
  
    
      
        B
        
        
          
            
              =
              ^
            
          
        
        
        1
      
    
    {\displaystyle B\,{\widehat {=}}\,1}
  
, etc.), and addition is performed <a href="/facts/Modular_arithmetic/0wtRa5dU">modulo</a> 26, Vigenère encryption 
  
    
      
        E
      
    
    {\displaystyle E}
  
 using the key 
  
    
      
        K
      
    
    {\displaystyle K}
  
 can be written as
</p>

C
          
            i
          
        
        =
        
          E
          
            K
          
        
        (
        
          M
          
            i
          
        
        )
        =
        (
        
          M
          
            i
          
        
        +
        
          K
          
            i
          
        
        )
        
          mod
          
            2
          
        
        6
      
    
    {\displaystyle C_{i}=E_{K}(M_{i})=(M_{i}+K_{i}){\bmod {2}}6}

<p>and decryption 
  
    
      
        D
      
    
    {\displaystyle D}
  
 using the key 
  
    
      
        K
      
    
    {\displaystyle K}
  
 as
</p>

M
          
            i
          
        
        =
        
          D
          
            K
          
        
        (
        
          C
          
            i
          
        
        )
        =
        (
        
          C
          
            i
          
        
        −
        
          K
          
            i
          
        
        )
        
          mod
          
            2
          
        
        6
        ,
      
    
    {\displaystyle M_{i}=D_{K}(C_{i})=(C_{i}-K_{i}){\bmod {2}}6,}

<p>in which 
  
    
      
        M
        =
        
          M
          
            1
          
        
        …
        
          M
          
            n
          
        
      
    
    {\displaystyle M=M_{1}\dots M_{n}}
  
 is the message, 
  
    
      
        C
        =
        
          C
          
            1
          
        
        …
        
          C
          
            n
          
        
      
    
    {\displaystyle C=C_{1}\dots C_{n}}
  
 is the ciphertext and 
  
    
      
        K
        =
        
          K
          
            1
          
        
        …
        
          K
          
            n
          
        
      
    
    {\displaystyle K=K_{1}\dots K_{n}}
  
 is the key obtained by repeating the keyword 
  
    
      
        ⌈
        n
        
          /
        
        m
        ⌉
      
    
    {\displaystyle \lceil n/m\rceil }
  
 times in which 
  
    
      
        m
      
    
    {\displaystyle m}
  
 is the keyword length.
</p><p>Thus, by using the previous example, to encrypt 
  
    
      
        A
        
        
          
            
              =
              ^
            
          
        
        
        0
      
    
    {\displaystyle A\,{\widehat {=}}\,0}
  
 with key letter 
  
    
      
        L
        
        
          
            
              =
              ^
            
          
        
        
        11
      
    
    {\displaystyle L\,{\widehat {=}}\,11}
  
 the calculation would result in 
  
    
      
        11
        
        
          
            
              =
              ^
            
          
        
        
        L
      
    
    {\displaystyle 11\,{\widehat {=}}\,L}
  
.
</p>

11
        =
        (
        0
        +
        11
        )
        
          mod
          
            2
          
        
        6
      
    
    {\displaystyle 11=(0+11){\bmod {2}}6}

<p>Therefore, to decrypt 
  
    
      
        R
        
        
          
            
              =
              ^
            
          
        
        
        17
      
    
    {\displaystyle R\,{\widehat {=}}\,17}
  
 with key letter 
  
    
      
        E
        
        
          
            
              =
              ^
            
          
        
        
        4
      
    
    {\displaystyle E\,{\widehat {=}}\,4}
  
, the calculation would result in 
  
    
      
        13
        
        
          
            
              =
              ^
            
          
        
        
        N
      
    
    {\displaystyle 13\,{\widehat {=}}\,N}
  
.
</p>

13
        =
        (
        17
        −
        4
        )
        
          mod
          
            2
          
        
        6
      
    
    {\displaystyle 13=(17-4){\bmod {2}}6}

<p>In general, if 
  
    
      
        Σ
      
    
    {\displaystyle \Sigma }
  
 is the alphabet of length 
  
    
      
        ℓ
      
    
    {\displaystyle \ell }
  
, and 
  
    
      
        m
      
    
    {\displaystyle m}
  
 is the length of key, Vigenère encryption and decryption can be written:
</p>

C
          
            i
          
        
        =
        
          E
          
            K
          
        
        (
        
          M
          
            i
          
        
        )
        =
        (
        
          M
          
            i
          
        
        +
        
          K
          
            (
            i
            
              mod
              
                m
              
            
            )
          
        
        )
        
          mod
          
            ℓ
          
        
        ,
      
    
    {\displaystyle C_{i}=E_{K}(M_{i})=(M_{i}+K_{(i{\bmod {m}})}){\bmod {\ell }},}

M
          
            i
          
        
        =
        
          D
          
            K
          
        
        (
        
          C
          
            i
          
        
        )
        =
        (
        
          C
          
            i
          
        
        −
        
          K
          
            (
            i
            
              mod
              
                m
              
            
            )
          
        
        )
        
          mod
          
            ℓ
          
        
        .
      
    
    {\displaystyle M_{i}=D_{K}(C_{i})=(C_{i}-K_{(i{\bmod {m}})}){\bmod {\ell }}.}

<p>
  
    
      
        
          M
          
            i
          
        
      
    
    {\displaystyle M_{i}}
  
 denotes the offset of the <i>i</i>-th character of the plaintext 
  
    
      
        M
      
    
    {\displaystyle M}
  
 in the alphabet 
  
    
      
        Σ
      
    
    {\displaystyle \Sigma }
  
. For example, by taking the 26 English characters as the alphabet 
  
    
      
        Σ
        =
        (
        A
        ,
        B
        ,
        C
        ,
        …
        ,
        X
        ,
        Y
        ,
        Z
        )
      
    
    {\displaystyle \Sigma =(A,B,C,\ldots ,X,Y,Z)}
  
, the offset of A is 0, the offset of B is 1 etc. 
  
    
      
        
          C
          
            i
          
        
      
    
    {\displaystyle C_{i}}
  
 and 
  
    
      
        
          K
          
            i
          
        
      
    
    {\displaystyle K_{i}}
  
 are similar.
</p>
<h2 id="cryptanalysis">Cryptanalysis</h2>
<p>The idea behind the Vigenère cipher, like all other polyalphabetic ciphers, is to disguise the plaintext <a href="/facts/Letter_frequency/IyvrB9eT">letter frequency</a> to interfere with a straightforward application of <a href="/facts/Frequency_analysis/7bbymDaN">frequency analysis</a>. For instance, if P is the most frequent letter in a ciphertext whose plaintext is in <a href="/facts/English_language/tpkxGt7b">English</a>, one might suspect that P corresponds to e since e is the most frequently used letter in English. However, by using the Vigenère cipher, e can be enciphered as different ciphertext letters at different points in the message, which defeats simple frequency analysis.
</p><p>The primary weakness of the Vigenère cipher is the repeating nature of its <a href="/facts/Key_(cryptography)/5W5PAmT4">key</a>. If a cryptanalyst correctly guesses the key's length <i>n</i>, the cipher text can be treated as <i>n</i> interleaved <a href="/facts/Caesar_cipher/Pjy93nA5">Caesar ciphers</a>, which can easily be broken individually. The key length may be discovered by <a href="/facts/Brute-force_attack/TXl8pkfb">brute force</a> testing each possible value of <i>n</i>, or Kasiski examination and the Friedman test can help to determine the key length (see below: § Kasiski examination and § Friedman test).
</p>
<h3>Kasiski examination</h3>
<p class="note">Further information: <a href="/facts/Kasiski_examination/2mH65Arp">Kasiski examination</a></p>
<p>In 1863, <a href="/facts/Friedrich_Kasiski/V1xqjEbh">Friedrich Kasiski</a> was the first to publish a successful general attack on the Vigenère cipher.<a class="footnote-ref" id="fnref:20" href="#fn:20"><sup>20</sup></a> Earlier attacks relied on knowledge of the plaintext or the use of a recognizable word as a key. Kasiski's method had no such dependencies. Although Kasiski was the first to publish an account of the attack, it is clear that others had been aware of it. In 1854, <a href="/facts/Charles_Babbage/T3jklQcd">Charles Babbage</a> was goaded into breaking the Vigenère cipher when John Hall Brock Thwaites submitted a "new" cipher to the <i>Journal of the Society of the Arts</i>.<a class="footnote-ref" id="fnref:21" href="#fn:21"><sup>21</sup></a><a class="footnote-ref" id="fnref:22" href="#fn:22"><sup>22</sup></a> When Babbage showed that Thwaites' cipher was essentially just another recreation of the Vigenère cipher, Thwaites presented a challenge to Babbage: given an original text (from Shakespeare's <i><a href="/facts/The_Tempest/4YL1Jajf">The Tempest</a></i>: Act 1, Scene 2) and its enciphered version, he was to find the key words that Thwaites had used to encipher the original text. Babbage soon found the key words: "two" and "combined".  Babbage then enciphered the same passage from Shakespeare using different key words and challenged Thwaites to find Babbage's key words.<a class="footnote-ref" id="fnref:23" href="#fn:23"><sup>23</sup></a> Babbage never explained the method that he used. Studies of Babbage's notes reveal that he had used the method later published by Kasiski and suggest that he had been using the method as early as 1846.<a class="footnote-ref" id="fnref:24" href="#fn:24"><sup>24</sup></a>
</p><p>The <a href="/facts/Kasiski_examination/2mH65Arp">Kasiski examination</a>, also called the Kasiski test, takes advantage of the fact that repeated words are, by chance, sometimes encrypted using the same key letters, leading to repeated groups in the ciphertext. For example, consider the following encryption using the keyword ABCD:
</p>
Key:        <i>ABCDAB</i>CDABCDABCD<i>ABCDAB</i>CDABCD
Plaintext:  <i>crypto</i>isshortfor<i>crypto</i>graphy
Ciphertext: <i>CSASTP</i>KVSIQUTGQU<i>CSASTP</i>IUAQJB

<p>There is an easily noticed repetition in the ciphertext, and so the Kasiski test will be effective.
</p><p>The distance between the repetitions of CSASTP is 16. If it is assumed that the repeated segments represent the same plaintext segments, that implies that the key is 16, 8, 4, 2, or 1 characters long. (All <a href="/facts/Factorization/tXrBXFh1">factors</a> of the distance are possible key lengths; a key of length one is just a simple <a href="/facts/Caesar_cipher/Pjy93nA5">Caesar cipher</a>, and its <a href="/facts/Cryptanalysis/7CPEQlJI">cryptanalysis</a> is much easier.) Since key lengths 2 and 1 are unrealistically short, one needs to try only lengths 16, 8, and 4. Longer messages make the test more accurate because they usually contain more repeated ciphertext segments. The following ciphertext has two segments that are repeated:
</p>
Ciphertext: <i>VHVS</i>SP<i>QUCE</i>MRVBVBBB<i>VHVS</i>URQGIBDUGRNICJ<i>QUCE</i>RVUAXSSR

<p>The distance between the repetitions of VHVS is 18. If it is assumed that the repeated segments represent the same plaintext segments, that implies that the key is 18, 9, 6, 3, 2, or 1 characters long. The distance between the repetitions of QUCE is 30 characters. That means that the key length could be 30, 15, 10, 6, 5, 3, 2, or 1 characters long. By taking the <a href="/facts/Intersection_(set_theory)/RPfUNJh9">intersection</a> of those sets, one could safely conclude that the most likely key length is 6 since 3, 2, and 1 are unrealistically short.
</p>
<h3>Friedman test</h3>
<p>The Friedman test (sometimes known as the kappa test) was invented during the 1920s by <a href="/facts/William_F._Friedman/Qt1TLRpz">William F. Friedman</a>, who used the <a href="/facts/Index_of_coincidence/7uW1sGer">index of coincidence</a>, which measures the unevenness of the cipher letter frequencies to break the cipher. By knowing the probability 
  
    
      
        
          κ
          
            p
          
        
      
    
    {\displaystyle \kappa _{\text{p}}}
  
 that any two randomly chosen source language letters are the same (around 0.067 for <a href="/facts/Case_sensitivity/VS2eGDmY">case-insensitive</a> English) and the probability of a coincidence for a uniform random selection from the alphabet 
  
    
      
        
          κ
          
            r
          
        
      
    
    {\displaystyle \kappa _{\text{r}}}
  
 (1⁄26 = 0.0385 for English), the key length can be estimated as the following:
</p>

κ
                
                  p
                
              
              −
              
                κ
                
                  r
                
              
            
            
              
                κ
                
                  o
                
              
              −
              
                κ
                
                  r
                
              
            
          
        
      
    
    {\displaystyle {\frac {\kappa _{\text{p}}-\kappa _{\text{r}}}{\kappa _{\text{o}}-\kappa _{\text{r}}}}}

<p>from the observed coincidence rate
</p>

κ
          
            o
          
        
        =
        
          
            
              
                ∑
                
                  i
                  =
                  1
                
                
                  c
                
              
              
                n
                
                  i
                
              
              (
              
                n
                
                  i
                
              
              −
              1
              )
            
            
              N
              (
              N
              −
              1
              )
            
          
        
      
    
    {\displaystyle \kappa _{\text{o}}={\frac {\sum _{i=1}^{c}n_{i}(n_{i}-1)}{N(N-1)}}}

<p>in which <i>c</i> is the size of the alphabet (26 for English), <i>N</i> is the length of the text and <i>n</i>1 to <i>n</i><i>c</i> are the observed ciphertext <a href="/facts/Letter_frequencies/IyvrB9eT">letter frequencies</a>, as integers.
</p><p>That is, however, only an approximation; its accuracy increases with the length of the text. It would, in practice, be necessary to try various key lengths that are close to the estimate.<a class="footnote-ref" id="fnref:25" href="#fn:25"><sup>25</sup></a> A better approach for repeating-key ciphers is to copy the ciphertext into rows of a matrix with as many columns as an assumed key length and then to compute the average <a href="/facts/Index_of_coincidence/7uW1sGer">index of coincidence</a> with each column considered separately. When that is done for each possible key length, the highest average index of coincidence then corresponds to the most-likely key length.<a class="footnote-ref" id="fnref:26" href="#fn:26"><sup>26</sup></a> Such tests may be supplemented by information from the Kasiski examination.
</p>
<h3>Frequency analysis</h3>
<p class="note">Main article: <a href="/facts/Frequency_analysis/7bbymDaN">Frequency analysis</a></p>
<p>Once the length of the key is known, the ciphertext can be rewritten into that many columns, with each column corresponding to a single letter of the key. Each column consists of plaintext that has been encrypted by a single <a href="/facts/Caesar_cipher/Pjy93nA5">Caesar cipher</a>. The Caesar key (shift) is just the letter of the Vigenère key that was used for that column. Using methods similar to those used to break the Caesar cipher, the letters in the ciphertext can be discovered.
</p><p>An improvement to the Kasiski examination, known as <a href="/facts/Auguste_Kerckhoffs/KE3WBuJP">Kerckhoffs</a>' method, matches each column's letter frequencies to shifted plaintext frequencies to discover the key letter (Caesar shift) for that column. Once every letter in the key is known, all the cryptanalyst has to do is to decrypt the ciphertext and reveal the plaintext.<a class="footnote-ref" id="fnref:27" href="#fn:27"><sup>27</sup></a> Kerckhoffs' method is not applicable if the Vigenère table has been scrambled, rather than using normal alphabetic sequences, but Kasiski examination and coincidence tests can still be used to determine key length.
</p>
<h3>Key elimination</h3>
<p>The Vigenère cipher, with normal alphabets, essentially uses modulo arithmetic, which is commutative. Therefore, if the key length is known (or guessed), subtracting the cipher text from itself, offset by the key length, will produce the plain text subtracted from itself, also offset by the key length. If any "probable word" in the plain text is known or can be guessed, its self-subtraction can be recognized, which allows recovery of the key by subtracting the known plaintext from the cipher text. Key elimination is especially useful against short messages. For example, using LION as the key below:
</p>
<table><tbody><tr><td>Plaintext:</td><td>thequickbrownfoxjumpsoverthelazydog</td></tr><tr><td>Key:</td><td>LIONLIONLIONLIONLIONLIONLIONLIONLIO</td></tr><tr><td>Ciphertext:</td><td>EPSDFQQXMZCJYNCKUCACDWJRCBVRWINLOWU</td></tr></tbody></table>
<p>Then subtract the ciphertext from itself with a shift of the key length 4 for LION.
</p>
<table><tbody><tr><td>Ciphertext (original):</td><td>EPSDFQQXMZCJYNCKUCACDWJRCBVRWINLOWU</td></tr><tr><td>Ciphertext (shifted):</td><td>FQQXMZCJYNCKUCACDWJRCBVRWINLOWU____</td></tr><tr><td>Result (difference):</td><td>ZZCGTROOOMAZELCIRGRLBVOAGTIGIMTLOWU</td></tr></tbody></table>
<p>Which is nearly equivalent to subtracting the plaintext from itself by the same shift.
</p>
<table><tbody><tr><td>Plaintext (original):</td><td>thequickbrownfoxjumpsoverthelazydog</td></tr><tr><td>Plaintext (shifted):</td><td>uickbrownfoxjumpsoverthelazydog____</td></tr><tr><td>Result (difference):</td><td>zzcgtrooomazelcirgrlbvoagtigimtydog</td></tr></tbody></table>
<p>Which is algebraically represented for 
  
    
      
        i
        ∈
        [
        1
        ,
        n
        −
        m
        ]
      
    
    {\displaystyle i\in [1,n-m]}
  
 as:
</p>

(
                
                  C
                  
                    i
                  
                
                −
                
                  C
                  
                    (
                    i
                    +
                    m
                    )
                  
                
                )
                
                  mod
                  
                    ℓ
                  
                
              
              
                
                =
                (
                
                  E
                  
                    K
                  
                
                (
                
                  M
                  
                    i
                  
                
                )
                −
                
                  E
                  
                    K
                  
                
                (
                
                  M
                  
                    (
                    i
                    +
                    m
                    )
                  
                
                )
                )
                
                  mod
                  
                    ℓ
                  
                
              
            
            
              
              
                
                =
                (
                (
                
                  M
                  
                    i
                  
                
                +
                
                  K
                  
                    (
                    i
                    
                      mod
                      
                        m
                      
                    
                    )
                  
                
                )
                
                  mod
                  
                    ℓ
                  
                
                −
                (
                
                  M
                  
                    (
                    i
                    +
                    m
                    )
                  
                
                +
                
                  K
                  
                    (
                    (
                    i
                    +
                    m
                    )
                    
                      mod
                      
                        m
                      
                    
                    )
                  
                
                )
                
                  mod
                  
                    ℓ
                  
                
                )
                
                  mod
                  
                    ℓ
                  
                
              
            
            
              
              
                
                =
                (
                (
                
                  M
                  
                    i
                  
                
                +
                
                  K
                  
                    (
                    i
                    
                      mod
                      
                        m
                      
                    
                    )
                  
                
                )
                −
                (
                
                  M
                  
                    (
                    i
                    +
                    m
                    )
                  
                
                +
                
                  K
                  
                    (
                    (
                    i
                    +
                    m
                    )
                    
                      mod
                      
                        m
                      
                    
                    )
                  
                
                )
                )
                
                  mod
                  
                    ℓ
                  
                
              
            
            
              
              
                
                =
                (
                
                  M
                  
                    i
                  
                
                +
                
                  K
                  
                    (
                    i
                    
                      mod
                      
                        m
                      
                    
                    )
                  
                
                −
                
                  M
                  
                    (
                    i
                    +
                    m
                    )
                  
                
                −
                
                  K
                  
                    (
                    (
                    i
                    +
                    m
                    )
                    
                      mod
                      
                        m
                      
                    
                    )
                  
                
                )
                
                  mod
                  
                    ℓ
                  
                
              
            
            
              
              
                
                =
                (
                
                  M
                  
                    i
                  
                
                −
                
                  M
                  
                    (
                    i
                    +
                    m
                    )
                  
                
                +
                
                  K
                  
                    (
                    i
                    
                      mod
                      
                        m
                      
                    
                    )
                  
                
                −
                
                  K
                  
                    (
                    (
                    i
                    +
                    m
                    )
                    
                      mod
                      
                        m
                      
                    
                    )
                  
                
                )
                
                  mod
                  
                    ℓ
                  
                
              
            
            
              
              
                
                =
                (
                
                  M
                  
                    i
                  
                
                −
                
                  M
                  
                    (
                    i
                    +
                    m
                    )
                  
                
                +
                
                  K
                  
                    (
                    i
                    
                      mod
                      
                        m
                      
                    
                    )
                  
                
                −
                
                  K
                  
                    (
                    i
                    
                      mod
                      
                        m
                      
                    
                    )
                  
                
                )
                
                  mod
                  
                    ℓ
                  
                
              
            
            
              
              
                
                =
                (
                
                  M
                  
                    i
                  
                
                −
                
                  M
                  
                    (
                    i
                    +
                    m
                    )
                  
                
                )
                
                  mod
                  
                    ℓ
                  
                
              
            
          
        
      
    
    {\displaystyle {\begin{aligned}(C_{i}-C_{(i+m)}){\bmod {\ell }}&=(E_{K}(M_{i})-E_{K}(M_{(i+m)})){\bmod {\ell }}\\&=((M_{i}+K_{(i{\bmod {m}})}){\bmod {\ell }}-(M_{(i+m)}+K_{((i+m){\bmod {m}})}){\bmod {\ell }}){\bmod {\ell }}\\&=((M_{i}+K_{(i{\bmod {m}})})-(M_{(i+m)}+K_{((i+m){\bmod {m}})})){\bmod {\ell }}\\&=(M_{i}+K_{(i{\bmod {m}})}-M_{(i+m)}-K_{((i+m){\bmod {m}})}){\bmod {\ell }}\\&=(M_{i}-M_{(i+m)}+K_{(i{\bmod {m}})}-K_{((i+m){\bmod {m}})}){\bmod {\ell }}\\&=(M_{i}-M_{(i+m)}+K_{(i{\bmod {m}})}-K_{(i{\bmod {m}})}){\bmod {\ell }}\\&=(M_{i}-M_{(i+m)}){\bmod {\ell }}\\\end{aligned}}}

<p>In this example, the words brownfox are known.
</p>
<table><tbody><tr><td>Plaintext (original):</td><td>brownfox</td></tr><tr><td>Plaintext (shifted):</td><td>nfox____</td></tr><tr><td>Result (difference):</td><td>omaznfox</td></tr></tbody></table>
<p>This result omaz corresponds with the 9th through 12th letters in the result of the larger examples above. The known section and its location is verified.
</p><p>Subtract brow from that range of the ciphertext.
</p>
<table><tbody><tr><td>Ciphertext:</td><td>EPSDFQQXMZCJYNCKUCACDWJRCBVRWINLOWU</td></tr><tr><td>Plaintext:</td><td>________brow_______________________</td></tr><tr><td>Key:</td><td>EPSDFQQXLIONYNCKUCACDWJRCBVRWINLOWU</td></tr></tbody></table>
<p>This produces the final result, the reveal of the key LION.
</p>
<h2 id="variants">Variants</h2>
<h3>Running key</h3>
<p>The <a href="/facts/Running_key_cipher/McnJp607">running key</a> variant of the Vigenère cipher was also considered unbreakable at one time. For the key, this version uses a block of text as long as the plaintext. Since the key is as long as the message, the Friedman and Kasiski tests no longer work, as the key is not repeated.
</p><p>If multiple keys are used, the effective key length is the <a href="/facts/Least_common_multiple/AX1jIUnw">least common multiple</a> of the lengths of the individual keys.  For example, using the two keys GO and CAT, whose lengths are 2 and 3, one obtains an effective key length of 6 (the least common multiple of 2 and 3).  This can be understood as the point where both keys line up.
</p>
<table><tbody><tr><td>Plaintext:</td><td>attackatdawn</td></tr><tr><td>Key 1:</td><td>GOGOGOGOGOGO</td></tr><tr><td>Key 2:</td><td>CATCATCATCAT</td></tr><tr><td>Ciphertext:</td><td>IHSQIRIHCQCU</td></tr></tbody></table>
<p>Encrypting twice, first with the key GO and then with the key CAT is the same as encrypting once with a key produced by encrypting one key with the other.
</p>
<table><tbody><tr><td>Plaintext:</td><td>gogogo</td></tr><tr><td>Key:</td><td>CATCAT</td></tr><tr><td>Ciphertext:</td><td>IOZQGH</td></tr></tbody></table>
<p>This is demonstrated by encrypting attackatdawn with IOZQGH, to produce the same ciphertext as in the original example.
</p>
<table><tbody><tr><td>Plaintext:</td><td>attackatdawn</td></tr><tr><td>Key:</td><td>IOZQGHIOZQGH</td></tr><tr><td>Ciphertext:</td><td>IHSQIRIHCQCU</td></tr></tbody></table>
<p>If key lengths are relatively prime, the effective key length is the product of the key lengths, and hence grows quickly as the individual key lengths are increased. For example, while the effective length of combined key lengths of 10, 12, and 15 characters is only 60 (2x2x3x5), that of key lengths of 8, 11, and 15 characters is 1320 (8x11x15).  If this effective key length is longer than the ciphertext, it achieves the same immunity to the Friedman and Kasiski tests as the running key variant.
</p><p>If one uses a key that is truly random, is at least as long as the encrypted message, and is used only once, the Vigenère cipher is theoretically unbreakable.  However, in that case, the key, not the cipher, provides cryptographic strength, and such systems are properly referred to collectively as <a href="/facts/One-time_pad/03hA9XSQ">one-time pad</a> systems, irrespective of the ciphers employed.
</p>

<h3>Variant Beaufort</h3>
<p>A simple variant is to encrypt by using the Vigenère decryption method and to decrypt by using Vigenère encryption. That method is sometimes referred to as "Variant Beaufort". It is different from the <a href="/facts/Beaufort_cipher/3n3AmbMl">Beaufort cipher</a>, created by <a href="/facts/Francis_Beaufort/QkNx1Jcg">Francis Beaufort</a>, which is similar to Vigenère but uses a slightly modified enciphering mechanism and tableau. The Beaufort cipher is a <a href="/facts/Reciprocal_cipher/5zfe0b76">reciprocal cipher</a>.
</p>
<h3>Gronsfeld cipher</h3>
<p>Despite the Vigenère cipher's apparent strength, it never became widely used throughout Europe. The Gronsfeld cipher is a variant attributed by <a href="/facts/Gaspar_Schott/CxLSGGGj">Gaspar Schott</a> to Count Gronsfeld (Josse Maximilaan van <a href="/facts/Gronsveld/53eHhkIQ">Gronsveld</a> né van Bronckhorst) but was actually used much earlier by an ambassador of Duke of Mantua in 1560s-1570s. It is identical to the Vigenère cipher except that it uses just a cipher alphabet of 10 characters, corresponding to the digits 0 to 9: a Gronsfeld key of 0123 is the same as a Vigenere key of ABCD. The Gronsfeld cipher is strengthened because its key is not a word, but it is weakened because it has just a cipher alphabet of 10 characters. It is Gronsfeld's cipher that became widely used throughout Germany and Europe, despite its weaknesses.
</p>
<h3>Vigenèreʼs autokey cipher</h3>
<p>Vigenère actually invented a stronger cipher, an <a href="/facts/Autokey_cipher/ebu1mkDo">autokey cipher</a>. The name "Vigenère cipher" became associated with a simpler polyalphabetic cipher instead. In fact, the two ciphers were often confused, and both were sometimes called <i>le chiffre indéchiffrable</i>. Babbage actually broke the much-stronger autokey cipher, but Kasiski is generally credited with the first published solution to the fixed-key polyalphabetic ciphers.
</p>
<h2 id="see-also">See also</h2>
<ul><li><a href="/facts/Roger_Frontenac/5zUF8kna">Roger Frontenac</a> (<a href="/facts/Nostradamus/T6LmaDrz">Nostradamus</a> quatrain decryptor, 1950)</li></ul>

<h3>Citations</h3>

<h3>Sources</h3>
<ul><li>Beutelspacher, Albrecht (1994). "Chapter 2". <i>Cryptology</i>. translation from German by J. Chris Fisher. Washington, DC: Mathematical Association of America. pp. 27–41. <a href="/facts/ISBN_(identifier)/15AdSPa9">ISBN</a> 0-883-85504-6.</li>
<li><a href="/facts/Simon_Singh/fFstr4XL">Singh, Simon</a> (1999). "Chapter 2: Le Chiffre Indéchiffrable". <i><a href="/facts/The_Code_Book/4jdHx9U8">The Code Book</a></i>. Anchor Book, <a href="/facts/Random_House/NcR9r1F1">Random House</a>. <a href="/facts/ISBN_(identifier)/15AdSPa9">ISBN</a> 0-385-49532-3.</li>
<li>Helen F. Gaines (18 November 2014). <a href="https://books.google.com/books?id=Zb2RBQAAQBAJ&q=Gaines,+Helen+Fouche+%22Cryptanalysis+a+Study+of+Ciphers+and+Their+Solutions%22+1939+%22The+Gronsfeld,+Porta+and+Beaufort+Ciphers%22&pg=PA117"><i>Cryptanalysis: A Study of Ciphers and Their Solution</i></a>. Courier Corporation. p. 117. <a href="/facts/ISBN_(identifier)/15AdSPa9">ISBN</a> 978-0-486-80059-2.</li>
<li>Mendelsohn, Charles J (1940). "Blaise De Vigenere and The 'Chiffre Carre'". <i>Proceedings of the American Philosophical Society</i>. 82 (2).</li></ul>
<h2 id="notes">Notes</h2>

<h2 id="external-links">External links</h2>
Articles
<ul><li><a href="https://web.archive.org/web/20110624100854/http://www.aolnews.com/2010/12/25/civil-war-message-in-a-bottle-opened-decoded/">History of the cipher from Cryptologia</a></li>
<li><a href="https://www.bbc.co.uk/dna/h2g2/alabaster/A613135">Basic Cryptanalysis</a> at H2G2</li>
<li><a href="http://www.math.ucdenver.edu/~wcherowi/courses/m5410/m5410cc.html">"Lecture Notes on Classical Cryptology"</a> <a href="https://web.archive.org/web/20161005205557/http://www.math.ucdenver.edu/~wcherowi/courses/m5410/m5410cc.html">Archived</a> 2016-10-05 at the <a href="/facts/Wayback_Machine/nmQ3a6JC">Wayback Machine</a> including an explanation and derivation of the Friedman Test</li></ul>
Videos
<ul><li><a href="https://www.youtube.com/watch?v=FTlk-XKlEP4">Encrypting a secret text with the Vigenère cipher and the Tabula recta</a> on <a href="/facts/YouTube_video_(identifier)/db276jst">YouTube</a> - A video that shows and explains Vigenère encryption using a simple example</li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1"><p>"Wolfram Challenges: Programming Puzzles for the Wolfram Language". challenges.wolframcloud.com. Retrieved 2025-03-27. <a href="https://challenges.wolframcloud.com/challenge/vigenere-cipher" target="_blank">https://challenges.wolframcloud.com/challenge/vigenere-cipher</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li>
<li id="fn:2"><p>Bruen, Aiden A.; Forcinito, Mario A. (2011). Cryptography, Information Theory, and Error-Correction: A handbook for the 21st Century. John Wiley & Sons. p. 21. ISBN 978-1-118-03138-4. <a href="978-1-118-03138-4" target="_blank">978-1-118-03138-4</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li>
<li id="fn:3"><p>Martin, Keith M. (2012). Everyday Cryptography. Oxford University Press. p. 142. ISBN 978-0-19-162588-6. <a href="978-0-19-162588-6" target="_blank">978-0-19-162588-6</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li>
<li id="fn:4"><p>Laurence Dwight Smith (1955). Cryptography: The Science of Secret Writing. Courier Corporation. p. 81. ISBN 978-0-486-20247-1. {{cite book}}: ISBN / Date incompatibility (help) <a href="978-0-486-20247-1" target="_blank">978-0-486-20247-1</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li>
<li id="fn:5"><p>Rodriguez-Clark, Dan (2017), Vigenère Cipher, Crypto Corner <a href="https://crypto.interactive-maths.com/vigenegravere-cipher.html" target="_blank">https://crypto.interactive-maths.com/vigenegravere-cipher.html</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li>
<li id="fn:6"><p>Gamer, Maximilian (2015). "Die Polygraphia des Johannes Trithemius. Zwei Fassungen eines frühneuzeitlichen Handbuchs zur Geheimschrift [The Polygraphia of Johannes Trithemius. Two editions of an early modern handbook on cryptography]". In Baier, Thomas; Schultheiß, Jochen (eds.). Würzburger Humanismus [The Humanism of Würzburg] (in German). Tübingen, Germany: Narr Verlag. pp. 121–141. See pp. 121–122. <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li>
<li id="fn:7"><p>Trithemius, Joannis (1518). "Liber quintus exordium capit (Book 5, Ch. 1)". Polygraphiae, libri sex … [Cryptography, in six books …] (in Latin). Reichenau, (Germany): Johann Haselberg. p. 471.  Available at: George Fabyan Collection (Library of Congress; Washington, D.C., U.S.A.) (Note: The pages of this book are not numbered.) <a href="http://lcweb2.loc.gov/cgi-bin/ampage?collId=rbc3&fileName=rbc0001_2009fabyan12345page.db&recNum=470" target="_blank">http://lcweb2.loc.gov/cgi-bin/ampage?collId=rbc3&fileName=rbc0001_2009fabyan12345page.db&recNum=470</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></p></li>
<li id="fn:8"><p>In a separate manuscript that Trithemius called the Clavis Polygraphiae (The Key to the Polygraphia), he explained (among other things) how to encipher messages by using a polyalphabetic cipher and how to decipher such messages.  The Clavis Polygraphiae was not always included in the original 1518 printed copies, and even when it was included, it wasn't always inserted in the same location in the Polygraphiae.  From (Gamer, 2015), p. 129:  "Eine eigene Stellung innerhalb … in den Ausführungen zu Buch VI."  (The Clavis occupies a peculiar place within the text that's been passed down only in print.  Trithemius alludes several times in other places to the existence of a Clavis Polygraphiae as a separate work, contemporaneous with the manuscript of 1508.  However, we know only the edition that is bound with the printed version, which was sporadically adapted to changes during printing, as often as not – as, for example, in the case of the shifted chapter on alphanumeric number notation. The Clavis didn't accompany this relocation: the explanations of the representations of numbers remained in the remarks on Book VI.)

The Clavis explains how to encipher and decipher messages by using polyalphabetic ciphers.  In Trithemius' examples, he decoded a message by using two Vigenere tables – one in which the letters are in normal alphabetical order and the other in which the letters are in reversed order (see (Gamer, 2015), p. 128).  From (Trithemius, 1518), pp. 19–20:

Original Latin text:  "In primis tabulam descripsimus rectam, alphabeta quatuor & viginti continentem, per cuius intelligentiam tot poterunt alphabeta componi, quot stellae numerantur in firmamento caeli.  Quot enim in ipsa tabula sunt grammata, totiens consurgunt ex arte decies centena milia per ordinem alphabeta.  Post haec tabulam distribuimus aversam, quae totiens consurget in aliam, quotiens literam mutaveris a capite primam.  Est autem litera prima in tabula recta b, & in aversa z.  In quarum locum quotiens reposueris quamlibet aliam variatam totiens invenies tabulam per omnia novam, & ita usque ad infinitum.  Deinde primam tabulam rectam expandimus, unicuique literae transpositae nigrae illam quam repraesentat ad caput eius cum minio collocantes, ut modum scribendi faciliorem lectori praeberemus.  Est autem modus iste scribendi, ut in primo alphabeto nigro, capias occultae sententiae literam unam, de secundo aliam, de tertio tertiam, & sic consequenter usque ad finem.  Quo cum perveneris, totiens ad ordinem primum redeundum memineris, quousque mentis tuae secretum mysterium occultando compleveris.  Verum ut ordinem videas, ponamus exemplum.  Hxpf gfbmcz fueib gmbt gxhsr ege rbd qopmauwu. wfxegk ak tnrqxyx.  Huius mystici sermonis sententia est.  Hunc caveto virum, quia malus est, fur, deceptor, mendax & iniquus.  Cernis iam nunc lector quam mirabilem transpositionem literarum alphabeti haec tabula reddat, cum sit nemo qui sine noticia eius hoc valeat penetrare secretum.  Exedit enim modus iste scribendi omnem transpositionem literarum communem, cum unaquaeque litera semper de una serie alphabeti mutetur in aliam.  Ex tabula quoque aversa quam simili distributione per ordinem expandimus, pro introductione tale ponamus exemplum.  Rdkt, stznyb, tevqz, fnzf, fdrgh, vfd.  Cuius arcani sensus est talis, Hunc caveto virum, quia malus [est]. Et nota quod sub exemplo tabulae recte iam posito seriem occultam a principio per totum eius deduximus, & deinceps continuando similiter per aversam, rursusque circulum facimus, ut cernis ad principium tabulae rectae."
English translation:  In the first [illustration], we have transcribed a regular table [i.e., tabula recta, a table in which the letters of alphabet are listed in their normal order; see (Trithemius, 1518), p. 471.) containing 24 alphabets [Note: Trithemius used alphabets containing only 24 letters by setting j=i and v=u.], by which knowledge they will be able to compose as many alphabets as stars are numbered in the firmament of heaven.  For in the table itself there are as many letters as arise by [applying] skill – a million per alphabetical row. [That is, the letters in the table need not be listed in alphabetical order, so many enciphering tables can be created.]  After this, we arrange [the alphabets in] the reverse table [i.e., tabula aversa, a table in which the letters of the alphabet are listed in reverse order; see (Trithemius, 1518), p. 472.), which will arise in the other [reversed table] as many times as you will have changed [i.e., permuted] the first letter of the top [of the regular table].  And so the first letter in the regular table is b, and z in the reverse [table].  As often as you will have put in its place another changed [table], you will find a new table for everything, and so on indefinitely.  [That is, again, many enciphering tables can be created.]  Next we explain the first regular table: it shows how it is assigning, to each transposed black letter, [a letter] in red [ink along] its [i.e., the table's] top [border], in order to show to the reader an easier way of writing [i.e., of deciphering messages].  And that is a way of writing so that in the first black alphabet [i.e., an alphabet printed in the table using black, not red, ink], you will get one letter of the hidden sentence [i.e., the deciphered message]; from the second [black alphabet], another [deciphered letter]; from the third [black alphabet], a third [deciphered letter]; and thus accordingly until the end.  You will have arrived there [i.e., at the end] when you will have recalled returning many times to the first row, until you will have completed concealing the secret mystery of your thought. [That is, the message is deciphered by deciphering its first 24 letters by using the tabula recta, then repeating the procedure by using the same tabula recta to decipher the next 24 letters of the message, and so on.]  However, so that you [can] see the sequence [i.e., procedure], we present an example:  Hxpf gfbmcz fueib gmbt gxhsr ege rbd qopmauwu wfxegk ak tnrqxyx.  The meaning of this mystical sentence is:  Hunc caveto virum, quia malus est, fur, deceptor, mendax et iniquus. (Beware of this man, who is bad, a thief, a deceiver, a liar, and unjust.)  You already discern now, reader, how this table renders an astonishing transposition of the letters of the alphabet, because there is no one who, without acquaintance of this, can penetrate the secret.  For that method of writing corrodes every transposition of common letters, because each and every letter of one sequence of the alphabet is always changed into another [letter].  Likewise, we explain how [to decipher a message], by means of the sequence [i.e., the deciphering procedure], from the reverse table with a similar arrangement [of letters]; as an introduction, we present such an example:  Rdkt, stznyb, tevqz, fnzf, fdrgh, vfd. The secret meaning of which is such:  Hunc caveto virum, quia malus [est]. (Beware of this man, who is bad.)  And note about the example of the regular table [that was] already presented [i.e., the example that began with Hxpf], that we derived the secret series [i.e., the deciphered message] from the beginning through all of it [i.e., of the regular table], and thereafter by continuing similarly by means of the reverse [table], and again we make a circle, so that you are looking at the beginning of the regular table. [That is, the message is deciphered by using the regular table, but if the message is longer than 24 characters, then the decipherment continues by using the reverse table, and if necessary, one continues to decipher by returning to the regular table – and so forth.] <a href="https://www.digitale-sammlungen.de/de/view/bsb11200432?page=19" target="_blank">https://www.digitale-sammlungen.de/de/view/bsb11200432?page=19</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></p></li>
<li id="fn:9"><p>Vigenère, Blaise de (1586). Traicté des Chiffres, ou Secretes Manieres d'Escrire [Treatise on ciphers, or secret ways of writing] (in French). Paris, France: Abel l'Angelier. <a href="http://gallica.bnf.fr/ark:/12148/bpt6k94009991.image" target="_blank">http://gallica.bnf.fr/ark:/12148/bpt6k94009991.image</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></p></li>
<li id="fn:10"><p>Bellaso, Giovan Battista (1553). La Cifra del Sig. Giovan Battista Belaso … (in Italian). Venice, (Italy).  Available at: Museo Galileo (Florence (Firenze), Italy) <a href="https://bibdig.museogalileo.it/Teca/Viewer;jsessionid=E02FA6976F859981BC4EC1DF5CC3B240?an=976325&vis=D#page/1/mode/2up" target="_blank">https://bibdig.museogalileo.it/Teca/Viewer;jsessionid=E02FA6976F859981BC4EC1DF5CC3B240?an=976325&vis=D#page/1/mode/2up</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></p></li>
<li id="fn:11"><p>David, Kahn (1999). "On the Origin of a Species". The Codebreakers: The Story of Secret Writing. Simon & Schuster. ISBN 0-684-83130-9. <a href="0-684-83130-9" target="_blank">0-684-83130-9</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></p></li>
<li id="fn:12"><p>(Anon.) (27 January 1917). "A new cipher code". Scientific American Supplement. 83 (2143): 61. doi:10.1038/scientificamerican01271917-61csupp.
However, see also:
Borden, Howard A. (3 March 1917). "Letter to the Editor: Cipher codes". Scientific American Supplement. 83 (2148): 139. doi:10.1038/scientificamerican03031917-139csupp.
Holstein, Otto (14 April 1917). "Letter to the Editor: A new cipher". Scientific American Supplement. 83 (2154): 235.
Holstein, Otto (October 1921). "The ciphers of Porta and Vigenère: The original undecipherable code, and how to decipher it". Scientific American Monthly. 4: 332–334.
 <a href="https://babel.hathitrust.org/cgi/pt?id=uc1.31210000211050;view=1up;seq=69" target="_blank">https://babel.hathitrust.org/cgi/pt?id=uc1.31210000211050;view=1up;seq=69</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></p></li>
<li id="fn:13"><p>Knudsen, Lars R. (1998). "Block Ciphers—a survey". In Bart Preneel and Vincent Rijmen (ed.). State of the Art in Applied Cryptography: Course on Computer Security and Industrial Cryptograph Leuven Belgium, June 1997 Revised Lectures. Berlin; London: Springer. pp. 29. ISBN 3-540-65474-7. <a href="3-540-65474-7" target="_blank">3-540-65474-7</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></p></li>
<li id="fn:14"><p>Singh, Simon (1999). "Chapter 2: Le Chiffre Indéchiffrable". The Code Book. Anchor Books, Random House. pp. 63–78. ISBN 0-385-49532-3. <a href="0-385-49532-3" target="_blank">0-385-49532-3</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></p></li>
<li id="fn:15"><p>David, Kahn (1999). "On the Origin of a Species". The Codebreakers: The Story of Secret Writing. Simon & Schuster. ISBN 0-684-83130-9. <a href="0-684-83130-9" target="_blank">0-684-83130-9</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></p></li>
<li id="fn:16"><p>Codes, Ciphers, & Codebreaking[usurped] (The Rise Of Field Ciphers) <a href="https://web.archive.org/web/20051205013154/http://www.vectorsite.net/ttcode_03.html#m2" target="_blank">https://web.archive.org/web/20051205013154/http://www.vectorsite.net/ttcode_03.html#m2</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></p></li>
<li id="fn:17"><p>David, Kahn (1999). "Crises of the Union". The Codebreakers: The Story of Secret Writing. Simon & Schuster. pp. 217–221. ISBN 0-684-83130-9. <a href="0-684-83130-9" target="_blank">0-684-83130-9</a> <a href="#fnref:17" class="footnote-back-ref">↩</a></p></li>
<li id="fn:18"><p>Stanislaw Jarecki, "Crypto Overview, Perfect Secrecy, One-time Pad", University of California, September 28, 2004, Retrieved November 20, 2016 <a href="http://www.ics.uci.edu/~stasio/fall04/lect1.pdf" target="_blank">http://www.ics.uci.edu/~stasio/fall04/lect1.pdf</a> <a href="#fnref:18" class="footnote-back-ref">↩</a></p></li>
<li id="fn:19"><p>Simmons, Gustavus J., Vernam-Vigenère cipher, Encyclopedia Britannica <a href="/wiki/Gustavus_J._Simmons" target="_blank">/wiki/Gustavus_J._Simmons</a> <a href="#fnref:19" class="footnote-back-ref">↩</a></p></li>
<li id="fn:20"><p>Kasiski, F. W. (1863). Die Geheimschriften und die Dechiffrir-Kunst [Cryptograms and the art of deciphering] (in German). Berlin, (Germany): E.S. Mittler und Sohn. <a href="https://books.google.com/books?id=fB5dAAAAcAAJ&pg=PP7" target="_blank">https://books.google.com/books?id=fB5dAAAAcAAJ&pg=PP7</a> <a href="#fnref:20" class="footnote-back-ref">↩</a></p></li>
<li id="fn:21"><p>See:
Thwaites, J.H.B. (11 August 1854). "Secret, or cypher writing". Journal of the Society of Arts. 2 (90): 663–664.
"C." (Charles Babbage) (1 September 1854). "Mr. Thwaites's cypher". Journal of the Society of Arts. 2 (93): 707–708.
Babbage, Charles (1864). Passages from the Life of a Philosopher. London, England: Longman. p. 496.
 <a href="https://books.google.com/books?id=nxw9AQAAIAAJ&pg=PA663" target="_blank">https://books.google.com/books?id=nxw9AQAAIAAJ&pg=PA663</a> <a href="#fnref:21" class="footnote-back-ref">↩</a></p></li>
<li id="fn:22"><p>Thwaites filed for a patent for his "new" cipher system:
"Weekly list of patents sealed. … 1727. John Hall Brock Thwaites, Bristol – Improvements in apparatus to facilitate communication by cypher." in: Journal of the Society of Arts, 2 (99): 792 (13 October 1854).
"Thwaites, John Hall Brock, of Bristol, dentist. Improvements in apparatus to facilitate the communication by cypher.  Application dated August 7, 1854. (No. 1727.)" in:  The Mechanics' Magazine, 62 (1647): 211 (3 March 1855).
 <a href="https://babel.hathitrust.org/cgi/pt?id=gri.ark:/13960/t4gn2h303;view=1up;seq=798" target="_blank">https://babel.hathitrust.org/cgi/pt?id=gri.ark:/13960/t4gn2h303;view=1up;seq=798</a> <a href="#fnref:22" class="footnote-back-ref">↩</a></p></li>
<li id="fn:23"><p>See:
Thwaites, John H.B. (15 September 1854). "Secret or cypher writing". Journal of the Society of Arts. 2 (95): 732–733.
"C" (Charles Babbage) (6 October 1854). "Mr. Thwaites's cypher". Journal of the Society of Arts. 2 (98): 776–777.
 <a href="https://babel.hathitrust.org/cgi/pt?id=gri.ark:/13960/t4gn2h303;view=1up;seq=738" target="_blank">https://babel.hathitrust.org/cgi/pt?id=gri.ark:/13960/t4gn2h303;view=1up;seq=738</a> <a href="#fnref:23" class="footnote-back-ref">↩</a></p></li>
<li id="fn:24"><p>Ole Immanuel Franksen (1985). Mr. Babbage's Secret: The Tale of a Cypher and APL. Prentice Hall. ISBN 978-0-13-604729-2. <a href="978-0-13-604729-2" target="_blank">978-0-13-604729-2</a> <a href="#fnref:24" class="footnote-back-ref">↩</a></p></li>
<li id="fn:25"><p>Henk C.A. van Tilborg, ed. (2005). Encyclopedia of Cryptography and Security (First ed.). Springer. pp. 115. ISBN 0-387-23473-X. <a href="0-387-23473-X" target="_blank">0-387-23473-X</a> <a href="#fnref:25" class="footnote-back-ref">↩</a></p></li>
<li id="fn:26"><p>Mountjoy, Marjorie (1963). "The Bar Statistics". NSA Technical Journal. VII (2, 4).  Published in two parts. <a href="#fnref:26" class="footnote-back-ref">↩</a></p></li>
<li id="fn:27"><p>"Lab exercise: Vigenere, RSA, DES, and Authentication Protocols" (PDF). CS 415: Computer and Network Security. Archived from the original (PDF) on 2011-07-23. Retrieved 2006-11-10. <a href="https://web.archive.org/web/20110723140549/http://courses.umass.edu/cs415/labs/lab1/415-lab1-crypto.pdf" target="_blank">https://web.archive.org/web/20110723140549/http://courses.umass.edu/cs415/labs/lab1/415-lab1-crypto.pdf</a> <a href="#fnref:27" class="footnote-back-ref">↩</a></p></li>
</ol>

Vigenère cipher open-in-new

Vigenère cipher