THE CODEBREAKERS

by DAVID KAHN

  Though no known documents attest to such a genesis for Western political cryptanalysis—and none object to it, either—it seems the most probable. The official would have probably effected his solutions at first by guessing at words, much as did the four Irishmen who solved Dubthach’s cryptogram. As through repeated cryptanalyses he became more acquainted with the personalities of the letters, he might have eventually stumbled on the principle of frequency analysis. The same development may have taken place separately in several principalities, and it is not inconceivable that one new solver may have reasoned his way to frequency analysis by wondering why a cryptographer in another city used homophones for vowels!

  What is certain is that, as the secular principalities of Italy began to use cipher regularly in the 1390s and early 1400s, their cipher alphabets gradually began to include homophones for vowels. So slow was cryptology’s development, however, that not until the mid-1500s did consonants begin to get homophones. Likewise, the code lists of the nomenclators did not expand much until well into the 1500s.

  The growth of cryptology resulted directly from the flowering of modern diplomacy. In this, for the first time, states maintained permanent relations with one another. The resident ambassadors sent home regular reports—they have been called “honorable spies”—and the jealousy, suspicion, and intrigues among the Italian city-states made it often necessary to encipher these. As the practice implies, the reports were sometimes opened and read, and, if necessary, cryptanalyzed. By the end of the century, cryptology had become important enough for most states to keep full-time cipher secretaries occupied in making up new keys, enciphering and deciphering messages, and solving intercepted dispatches. Sometimes the cryptanalysts were separate from the cipher secretaries and were called in only when needed.

  Perhaps the most elaborate organization was Venice’s. It fell under the immediate control of the Council of Ten, the powerful and mysterious body that ruled the republic largely through its efficient secret police. Venice owed her preeminence largely to Giovanni Soro, who was perhaps the West’s first great cryptanalyst. Soro, appointed cipher secretary in 1506, enjoyed remarkable success in solving the ciphers of numerous principalities. His solution of a dispatch of Mark Anthony Colonna, chief of the army of the Holy Roman Emperor Maximilian I, requesting 20,000 ducats or the presence of the emperor with the army, gave an insight into Colonna’s problems. So great was Soro’s fame that other courts sharpened their ciphers, and as early as 1510 the papal curia was sending him ciphers that no one in Rome could solve. In 1526, Pope Clement VII (not to be confused with the antipope of the same name) twice sent him intercepts for solution, and Soro twice succeeded—once with three long dispatches from Maximilian I’s successor, the Holy Roman Emperor Charles V of Spain, to his emissary at Rome, and once with letters addressed by the Duke of Ferrara to his ambassador in Spain. When one of Clement’s messages fell into the hands of the Florentines, Clement, exclaiming “Soro can decipher any cipher!” sent him a copy of the message to see whether it was secure. He was reassured when Soro reported that he could not solve it—but one wonders whether Soro was not simply lulling the pope into a false security.

  On May 15, 1542, Soro, who was two years from the grave, was given two assistants, and from then on Venice had three cipher secretaries. Their office was in the Doge’s Palace above the Sala di Segret, and here they worked behind barred doors. When cipher dispatches of foreign powers fell into the hands of the Venetians, their translation was ordered at once. No one was allowed to disturb the cryptanalysts and, reportedly, they were not permitted to leave their office until the solution was obtained. It then had to be delivered without delay to the signory. The cryptologists’ usual salary was ten (later twelve) ducats a month, paid semiannually. The art was taught in a kind of school, which even held examinations each September. The cryptologists also wrote treatises explaining their techniques. That by Soro, written in the early 1500s on the solution of Latin, Italian, Spanish, and French ciphers, is another Lost Book of cryptology, for though he turned it over to the Council of Ten on March 29, 1539, no trace of it can be found in the archives. Fragmentary notes written by his successor, Giovanni Battista de Ludovicis, survive, and so do careful thorough surveys of the field by other cipher secretaries, Girolamo Franceschi, Giovanni Francesco Marin, and Agostino Amadi, whose manual is especially fine and whose work was so outstanding that Venice rewarded him by giving his two sons pensions of ten ducats a month for life. The Council of Ten held contests in ciphers, and advances in the art were rewarded: a Marco Rafael, later a favorite of Henry VIII of England, received 100 ducats in 1525 for a new method of invisible writing. If the cipher secretaries made valuable suggestions, they would get a raise. On the other hand, if they betrayed any of the state cryptologic secrets, they could be put to death.

  The council was as alert to protect its own ciphers as it was to solve those of its rivals. It kept a number of nomenclators ready to replace compromised ones, and it did not hesitate to use them. For example, new ciphers were sent on August 31, 1547, to the Venetian envoys to Rome, England, France, Turkey, Milan, and the Holy Roman Emperor. On June 5, 1595, a returning ambassador reported that Venetian ciphers had been solved and on June 12, the council ordered a wholesale replacement of the ambassadorial nomenclators with new ones prepared by Pietro Partenio, then the most expert of the cipher secretaries. Earlier, Soro had instituted a “general cipher” (a nomenclator) to permit the ambassadors to communicate among themselves; this was in addition to the “special cipher” each ambassador held for messages to and from home.

  But Venice was not the only locale of expert cryptanalysts during the Renaissance. In Florence, Pirrho Musefili, Conte della Sasseta, solved literally scores of messages during the decade from 1546 to 1557, reconstructing, among others, nomenclators used between Henry II of France and his envoy in Denmark, another between the same king and his emissary at Siena, a cipher of Cardinal di Mendoze of Naples. His expertise was so renowned that others came to him, as they had to Soro, to solve ciphers for them. A papal cryptologist, discussing contemporaries, said that to Musefili “is due first place and all honor.” Among his clients were the Duke of Alba and the King of England, who sent him a cryptogram that had been found in a sole of a pair of golden shoes from France. Musefili’s successor, Camillo Giusti, was reputed to be even more expert. They extended a fine tradition, since the ciphers devised by their predecessors for the ruling Medici family, particularly those of Lorenzo the Magnificent, display a lively appreciation of the methods of cryptanalysis. Further attesting to cryptology’s importance is its mention in a book, The Art of War, by another well-known Florentine—Niccolò Machiavelli.

  The cruel, sinister, and resolute dukes of Sforza, oligarchs of Milan, were also well served in their cryptology. One of their secretaries, Cicco Simonetta, wrote the world’s first tract devoted entirely to cryptanalysis. In Pavia on July 4, 1474, he set down thirteen rules for solving monalphabetic substitution ciphers in which word divisions are preserved. The manuscript, on two narrow strips of paper, begins: “The first requisite is to see whether the document is in Latin or in the vernacular, and this can be determined in the following manner: See whether the words of the document in question have only five different terminations, or less, or more; if there are only five or less, you are justified in concluding that it is in the vernacular….” Nine years later, Milanese cryptology was boasting the clever trick of using two symbols to mark as nulls all the ciphertext signs between them. The greatest compliment to Milan came in a backhanded fashion from the cryptologists of Modena, who early in the 15th century provided a more elaborate nomenclator for their envoy to Milan than for any other.

  Courts outside Italy had cryptanalysts as well. In France, Philibert Babou, sieur de la Bourdaisière, who held the post of first secretary of state, solved intercepted dispatches for Francis I. One observer saw Babou “oft-times decipher, without the alphabet, it must be understood, many intercepted dispatch
es, in Spanish, Italian, German, although he did not understand any of it, or very little,* with patience to work at it three weeks continually day and night, before getting a single word out of it: that first breach made, all the rest came very soon after, quite like in a demolition of walls.” While Babou was thus slaving for the king, it might be noted, the king was enthusiastically taking Babou’s pretty wife as his mistress. Babou received many

  A typical early nomenclator, compiled at Florence, in 1554, during the reign of Cosimo de’Medici

  England opened the letters of the Venetian ambassador to the court of Henry VIII—presumably those of other ambassadors as well—and undoubtedly solved or tried to solve their ciphers. The Venetian ambassador, however, well schooled by the excellent cryptologists of his city, paraphrased the enciphered sections of his instructions before communicating them to the English to prevent their serving as a massive crib to the key.

  Among the more expert of the cryptologic experts of the Renaissance were those who labored in the service of His Holiness, the Supreme Pontiff, who in those days wielded as much temporal as spiritual power. The popes had long had their own cryptographers, and finally Paul III, who succeeded Clement VII, realized that it was not to the curia’s advantage to have to send to Venice for solutions. He delegated all cryptology to Antonio Elio, who was able to “decipher with much facility” and who later rose to pontifical secretary, Bishop of Pola, and finally Patriarch of Jerusalem. In 1555 the title of Cipher Secretary was created, and conferred upon Triphon Bencio de Assisi; it was in 1557, during his tenure, that cryptanalysts working for the pope solved a cipher of King Philip II of Spain, then warring briefly upon the pontiff. In 1567, the Great Vicar of St. Peter solved in less than six hours a cryptogram on “a large sheet of paper in the Turkish language, of which he did not understand four words.” Late in the 1580s, the cipher secretaryship finally came into the hands of a remarkable family of cryptologists who held it for less than 20 years, but left their impress upon cryptology.

  These were the Argentis. Their forebears had come to Rome from Savona about 1475 in the hope of finding a sinecure under Pope Sixtus IV, a fellow townsman; the family lived in a house that they had built opposite the cloister of San Giacomo della Muratte in Rome, near the Fountain of Trevi. Giovanni Batista Argenti entered the papal service as a personal clerk to Antonio Elio, who taught him cryptology. Though Giovanni Batista burned to become papal secretary of ciphers, he had to give way before some nepotistic claims, and it was not until he was well into his fifties, after Sixtus V became pope, that Giovanni Batista finally got his wish. By then it was almost too late: when Pope Gregory XIV ascended the throne of St. Peter in 1590, he had to persuade Argenti to retain the office because of the irksome trips to France and Germany that it entailed. Giovanni Batista realized that he was weakening; he hastened to teach cryptology to his nephew, Matteo Argenti, and expired April 24, 1591.

  Matteo, 30, succeeded to his uncle’s office. Five popes renewed his appointment. He taught cryptology to his younger brother, Marcello, who was cipher secretary to a cardinal, in the evident hope of perpetuating the family in the job. But Matteo was unexpectedly relieved of his office on June 15, 1605—apparently the victim of a power play in the curia, for the pope called him in to tell him that he was not at fault and to give him a pension of 100 ducats. Matteo used his new leisure to compile a 135-page, calf-bound manual of cryptology that lists many of the nomenclators devised by his uncle and that, out of his own experience, summarizes the best in Renaissance cryptology.

  The Argentis were the first to use a word as a mnemonic key to mix a cipher alphabet, a practice that became widespread. They wrote out the keyword, omitting any repeated letters, then followed it with the remaining letters of the alphabet:

  Knowing that the invariable sequence of u after q in plaintext advertises the identity of both letters, the Argentis merged the two into a single unit for encipherment purposes. Noticing that the frequent doubled letters within (Italian) words were always consonants, they deleted the second of such a pair: sigillo would be written sigilo. They realized, of course, that the basic method of solving ciphers using homophones, or homophonic substitutions, is to search for partial repetitions, such as:

  If these result from the similar but not identical encipherments of the same word, then 49 stands for the same letter as 81. Given sufficient text, whole sets of these equivalencies can be built up, and the cryptogram then solved by the ordinary method of letter-frequency. To impede such comparisons, the Argentis ordered nulls larded throughout the cryptogram at a rate of no less than three to eight per line.

  By prohibiting word separations, punctuation and accentuation, and words in clear, they eliminated all clues stemming from these highly fertile sources. They ran all the ciphertext digits together and, to make it difficult even to determine the proper ciphertext numbers, they mixed single digits with pairs, so that a cryptanalyst dividing the text into straight pairs would get a totally false picture. They prevented confusion in deciphering by making sure that digits used as singles were excluded from those composing the pairs. Moreover, they cleverly assigned the single digits to high-frequency plaintext equivalents that would raise the single digits’ frequency in the ciphertext high enough that they would not stand out by their rarity. For example, from a cipher by Matteo:

  Thus Argenti might be enciphered 5128068285480377. They sometimes made use of polyphones—cipher symbols that have two or three plaintext meanings. These plaintext equivalents were chosen so as not to mislead the decipherer, but their mutual symbol, simultaneously reflecting two different letter personalities, would behave in a very schizoid manner, quite puzzling to the cryptanalyst.

  The Argentis did not stop there, however. They fit the cipher to the occasion. If a cipher were to be used to encipher Italian, it would not waste cipher equivalents on plaintext k, w, and y, which Italian does not use. But ambassadors in Germany and Poland got alphabets with k and w, and those in Spain had y in their ciphers. Matteo remarked in a note that few dangers existed for the papal ciphers in Poland, Sweden, and Switzerland, and that the Germans knew so little of cryptology that they preferred to burn intercepted cryptograms instead of trying to solve them. Consequently he recommended—and used—only simple systems in those countries. But Matteo exercised great prudence in constructing ciphers intended for use in France, England, Venice, and Florence—states for whose cryptology he professed great admiration.

  Cryptology was used quite as widely as Matteo Argenti’s comments indicate. The carefully guarded sheets of folio-sized paper on which the nomenclators were neatly engrossed were as much an instrument of war as the arquebus and, like any other weapon, they followed their flags to all parts of the world, multiplying in direct proportion to conquests. Nowhere is this more evident than with Spain. Her ascent to power can be traced in the proliferation of her ciphers, and these project an interesting image of the cryptology of the day, as practiced by the richest and mightiest nation in Europe.

  Knowledge of cryptology had filtered into Iberia at just about the time that Ferdinand and Isabella expelled the Moors and set their unified country on the road to world supremacy. The first systems, introduced in 1480 by councilor Miguel Perez Alzamán, transformed plaintext into Roman numerals. These proved so clumsy that many decipherments bear such marginal notes as “Nonsense,” “Impossible,” “Cannot be understood,” and “Order the ambassador to send another dispatch.” It may have been in one of these systems that Christopher Columbus in the New World in 1498 reportedly wrote to his brother to fight off a governor sent from Spain—a cipher letter that was used as a reason for the governor’s sending Columbus back to Spain in chains. After Isabella died in 1504, simpler systems were instituted for the increasing number of Spanish envoys. Nothing much was done thereafter until the shrewd, morose, arrogant, and fanatic Philip II ascended the throne of Spain. On May 24, 1556, four months after he became king and three days after his 29th birthday, Philip, who personal
ly supervised the minutest details of his administration, wrote his uncle, the Holy Roman Emperor Ferdinand I, king of Hungary, that he had decided to change the ciphers used during the reign of his father, Charles V, because they had fallen into disuse or had been compromised. He asked his uncle to use a new cipher that he was sending him together with a list of persons who held the key.

  Philip’s first cipher, the new general cipher of 1556, was one of the best nomenclators of the day. It comprised a table of homophonic letter substitutions (two symbols for consonants, three for vowels), a list of equivalents for common digraphs and trigraphs (each digraph was represented by both a symbol and a two-digit number), a small code in which words and titles were represented by two- and three-letter groups, and a provision that symbols with a single dot above them were nulls and that those with two dots above them represented a doubled letter. It set the pattern for Spanish cryptography well into the 17th century, though the separate sections of the nomenclator tended to coalesce, the symbols to give way to numbers, and the code section to enlarge until repertories of 1,000 elements were not uncommon. Not every nomenclator was as complicated, for Philip, like Soro, divided his systems into two classes: the cifra general, used for intercommunication among ambassadors in many countries and with the king; and the cifra particular, used by Philip with an individual envoy. Ciphers were changed every three or four years: the cifra general of 1614 was replaced in 1618, for example, and the cifra particular of 1604 with the ministers in Italy indicated on its face that it was to serve only from 1605 to 1609. Numerous separate nomenclators were compiled for correspondence with the viceroys and governors of the new colonies in the Americas. They hid their reports of impending shipments of gold beneath ciphers to foil pirates who might capture a galleon and its dispatches. This practice began as early as the conquistadores. The oldest instance extant of New World cryptography is a letter from Hernán Cortés, dated June 25, 1532, from the Mexico he had recently subdued. Cortes used a small nomenclator, comprising a homophonic mon alphabetic substitution in which each letter was represented by two or three symbols, together with a few codewords for proper names.