Solving Classical Ciphers with CrypTool 2 Nils Kopal Applied Information Security – University of Kassel Pfannkuchstr. 1, 34121 Kassel, Germany [email protected] Abstract torians. In such cases, cryptanalysts and image- processing experts are needed to support decipher- The difficulty of solving classical ciphers ing the books, thus, enabling the historians to con- varies between very easy and very hard. tinue their research. For example, monoalphabetic substitution The ciphers used in historical books (from ciphers can be solved easily by hand. the early antiquity over the Middle Ages to the More complex ciphers like the polyalpha- early modern times) include simple monoalpha- betic Vigenere` cipher, are harder to solve betic substitution and transposition ciphers, code- and the solution by hand takes much more books and homophone ciphers. time. Machine ciphers like the Enigma With the open-source tool CrypTool 2 (CT2) rotor machine, are nearly impossible to (Kopal et al., 2014) historians and cryptanalysts be solved only by hand. To support have a powerful tool for the analysis as well as researchers, cryptanalysts, and historians for the (automatic) decryption of encrypted texts. analyzing ciphers, the open-source soft- Throughout this paper, we present how CT2 can ware CrypTool 2 (CT2) was implemented. be used to actually break real world ciphertexts. It contains a broad set of tools and meth- The following parts of this paper are structured ods to automate the cryptanalysis of dif- as follows: The next section gives a short introduc- ferent (classical and modern) ciphers. In tion to classical ciphers, as well as an overview of this paper, we present a step-by-step ap- cryptanalysis. In Section 3, we briefly introduce proach for analyzing classical ciphers and the CT2. In Section 4, we present a general step- breaking these with the help of the tools in by-step approach for the analysis of ciphers with CT2. The primary goals of this paper are: CT2. Section 5 shows real example analyses done (1) Introduce historians and non-computer with the help of CT2. Section 6 gives an overview scientists to classical encryption, (2) give of cryptanalysis components (for classical ciphers) an introduction to CT2, enabling them to already implemented in CT2 as well as compo- break ciphers by their own, and (3) present nents planned for the future. Finally, Section 7 our future plans for CT2 with respect to summarizes the paper. (automatic) cryptanalysis of classical ci- phers. This paper does not describe the 2 Foundations of Classical Ciphers and used analysis methods in detail, but gives Cryptanalysis the according references. After a brief introduction to classical ciphers we 1 Motivation discuss the cryptanalysis of classical ciphers. There are several historical documents contain- 2.1 Classical Ciphers ing text enciphered with different encryption al- Ciphers encrypt plaintext into ciphertext based on gorithms. Such books can be found for instance in a set of rules, i.e. the encryption algorithm, and a the secret archives of the Vatican. Often, histori- secret key only known to the sender and intended ans who find such encrypted books during their receiver of a message. research are not able to decipher and reveal the Classical ciphers, as well as ciphers in general, plaintext. Nevertheless, these books can contain can be divided into two different main classes: secret information being of high interest for his- substitution ciphers and transposition ciphers. A Proceedings of the 1st Conference on Historical Cryptology, pages 29– 38, Uppsala, Sweden, 18-20 June, 2018 substitution cipher replaces letters or groups of let- ation, a plaintext symbol (here a bigram) is af- ters of the plaintext alphabet with letters based on terwards fractionated into two different symbols, a ciphertext alphabet. Transposition ciphers do making cryptanalysis even harder. not change the letters themselves but their posi- Ciphers based on codebooks were often super- tion in the text, i.e. plaintext alphabet and cipher- enciphered, thus, first the words were substituted, text alphabet are equal. There also exist ciphers for instance with numbers. Then, the resulted that combine both, substitution and transposition, ciphertexts were additionally super-encrypted by to create a composed cipher, e.g. the ADFGVX ci- changing them according to special rules. pher (Lasry et al., 2017). Many encrypted historical books that survived Substitution ciphers can be furthermore di- history are available. Most of them are encrypted vided into monoalphabetic and polyalphabetic ci- either with simple monoalphabetic substitutions or phers (Forsyth and Safavi-Naini, 1993). With with homophone substitutions. For some books monoalphabetic ciphers, only one ciphertext al- the type of cipher is unknown. phabet exists. Thus, every plaintext letter is al- Many encrypted historical messages are en- ways replaced with the same letter of the ci- crypted with simple substitution ciphers, homo- phertext alphabet. If there are more possibilities phone substitution ciphers, polyalphabetic sub- to choose from the ciphertext alphabet the sub- stitution ciphers, nomenclatures, or codebooks. stitution cipher is a homophone substitution ci- Transposition ciphers were also used, but not as pher (Dhavare et al., 2013). If there are more much as substitution ciphers since transpositions than one ciphertext alphabet which are exchanged are more complex with respect to the encryption after each encrypted letter, the substitution is a procedures. Additionally, performing a transpo- polyalphabetic substitution, e.g. the Vigenere` ci- sition cipher is more prone to errors. In modern pher (Schrodel,¨ 2008). Substitution may also not times, transposition was used by the IRA (Mahon only be based on single letters but on multiple let- and Gillogly, 2008) and during World War II by ters, e.g. the Playfair cipher (Cowan, 2008). In his- the Germans and the British. tory, for military and diplomatic communication, In World War II, rotor cipher machines like codebooks and nomenclatures were used. With the German Enigma (Gillogly, 1995) performing a nomenclature, not only letters were substituted, polyalphabetic encryptions were introduced and but additionally, complete words were substituted. widely used. Codebooks contained substitutions for nearly all words of a language. 2.2 Cryptanalysis Transposition ciphers change the positions of Cryptanalysis is the science and art of breaking ci- each letter in the plaintext based on a pattern that phers without the knowledge of the used key. To- is based on a key. The most used transposition ci- day, cryptanalysis is used to evaluate the security pher is the columnar transposition cipher (Lasry et of modern encryption algorithms and protocols. al., 2016c). Here, a plaintext is written in a grid of We divide the cryptanalysis of classical ciphers columns. Then, the columns are reordered based into two different approaches: the classical paper- on the lexicographical order of a keyword written based cryptanalysis and the modern computer- above the columns. Finally, the ciphertext is read based cryptanalysis. In his paper we focus on out of the transposed text column-wise. Decryp- modern computer-based cryptanalysis which can tion is done the same way but in the reverse order. be done with CT2. Composed ciphers execute different cipher Substitution ciphers can be broken with the help types in a consecutive order to strengthen the en- of language and text statistics. Since every letter cryption. One famous composed cipher is AD- in a language as well as in the plaintext alpha- FGVX. Here in the first step, each plaintext char- bet of a cipher has its unique frequency it can be acter is substituted by a bigram only consisting of used to guess and identify putative plaintext let- the 6 letters A,D,F,G,V, and X. After that, the in- ters. With monoalphabetic substitutions, plaintext termediate ciphertext is encrypted with a colum- and ciphertext frequencies are identical, but the nar transposition cipher. ADFGVX was used by letters differ. For example an ’E’ is substituted by the Germans during World War I. It introduced a an ’X’ – ’X’ has then the same frequency in ci- new concept, called fractionation. With fraction- phertext as ’E’ has in plaintext. Thus, an algorithm 30 to break a substitution ciphers aims at recovering we have either a plaintext, a monoalphabetic sub- the original letter distribution. stituted text, or a transposed text. And it is prob- Homophone substitutions as well as polyalpha- ably German. On the other hand, having an IC betic substitutions flatten the distribution of let- close to 3.8% indicates that we have a polyalpha- ters, hence, aiming to destroy the possibility to betic encrypted text. Clearly, the IC is more ac- break the cipher with statistics. Nevertheless, hav- curate having long ciphertexts. Identification of ing enough ciphertext and using sophisticated al- homophone ciphers can be done by counting the gorithms, e.g. hill climbing and simulated anneal- number of different used letters or symbols. If the ing, it is still possible to break them. number is above the expected alphabet size, it is Transposition ciphers can also be attacked with probably a homophone substitution. the help of statistics. Since transposition ciphers State-of-the-art for breaking classical ciphers do not change the letters, the frequency of the un- are search metaheuristics (Lasry, 2018). Because igrams in plaintext and ciphertext are exactly the with classical ciphers, a “better guessed key” often same. Thus, to break transposition ciphers, text yields a “better decryption” of a ciphertext, such statistics of higher orders (bigrams, trigrams, tetra- algorithms are able to “improve” a key to come grams, or n-grams in general) are used to break close to the correct key and often finally reveal them. Besides that, similar sophisticated algo- the correct key. “Better” in this context means, rithms, e.g. hill climbing and simulated annealing, that the putative plaintext that is obtained by de- are used to break transposition ciphers.