by DAVID KAHN
What neither Mary nor Babington knew was that, despite their elaborate precautions, their correspondence was being delivered to Walsingham and Phelippes as quickly as they wrote it. Gilbert Gifford was a double-agent, a ne’er-do-well who had offered his services to Walsingham. Walsingham, seeing an unparalleled opportunity to insinuate his antennae into Mary’s circles, employed Gifford to turn over to him all Mary’s letters, which he copied and then passed on. It included the two-year backlog entrusted to Gifford by the French ambassador, and the rapidly growing volume of traffic generated by Babington’s festering plot. These enciphered missives were being solved by Phelippes almost as quickly as he got his hands on them. As the conspiracy reached a crescendo of preparation in the middle of July, he was sometimes reading two or more in a day: two letters from the queen bear notations “decifred 18 July 1586,” two others are marked as deciphered July 21, and there are still other cipher letters in the same packet in the records that bear no notations.
During these three months, Walsingham cannily made no arrests, but simply let the plot develop and the correspondence accumulate in the hope that Mary would incriminate herself. His expectations were fulfilled. Early in July, Babington specified the details of the plan in a letter to Mary, referring to the Spanish invasion, her own deliverance, and “the dispatch of the usurping competitor.” Mary considered her reply for a week and, after composing it carefully, had Curll encipher it; she sent it off to Babington on July 17. It was to prove fatal, for in it Mary acknowledged “this enterprise” and advised Babington of ways “to bring it to good success.” Phelippes, on solving it, immediately endorsed it with the gallows mark.
But Walsingham still lacked the names of the six young courtiers who were to commit the actual assassination. So when the letter reached Babington, it bore a postscript that was not on it when it left Mary’s hands; in it Babington was asked for “the names and qualities of the six gentlemen which are to accomplish the designment.” Both the forgery and the encipherment in the correct key seem to be the work of Phelippes.
It proved unnecessary. Babington needed to go abroad to organize the invasion; at Walsingham’s suggestion, there was a mix-up in the passports. Babington, suspecting nothing, boldly came to the minister for help in cutting the red tape. While he was dining at the nearby tavern with one of Walsingham’s men, a note came, calling for his arrest. He caught a glimpse of it and, saying he was going to pay the bar bill and leaving his cloak and sword on the back of his chair, he slipped out and escaped. The hue and cry set up by his pursuers panicked the six young men. They fled for their lives, but within a month both they and Babington were caught and condemned to death after a two-day trial. Before they were executed, the authorities prudently extracted from Babington the cipher alphabets he had used with Mary.
Enciphered postscript to letter of Mary, Queen of Scots, forged by Thomas Phelippes
These, and Mary’s letters, served as thoroughly incriminatory evidence in the Star Chamber proceedings that convicted her of high treason. Mary received the announcement that Elizabeth had signed her death warrant with majestic tranquillity, and at eight on the morning of February 8, 1587, after eloquently reiterating her innocence and praying aloud for her church, for Elizabeth, for her son, and for all her enemies, mounted the platform with solemn dignity, knelt, and received the axeman’s three strokes with the courage that had marked every other action of her life. Thus did Mary, Queen of Scots, exit this transient life and enter the more enduring one of legend, as her motto had prophesied: “In my end is my beginning.” There seems little doubt that she would have died before her time, the politics of the day being what they were. But there seems equally little doubt that cryptology hastened her unnatural end.
* It is quite possible to solve a cryptogram in a language that one “does not know,” provided that “not knowing” means only that one does not understand the sense of the words, which is the case here. For a solution, the cryptanalyst must have only a general idea of the formation and structure of the words of a language. Solutions of this kind are not at all uncommon. Obviously, the more the cryptanalyst knows about a language, the more easily he can solve cryptograms in it. If he has never seen a sentence in the language, then the solution is virtually impossible…“virtually” because the alternations of vowels and consonants common to all languages may yet afford some clues.
4
ON THE ORIGIN OF A SPECIES
“DATO and I were strolling in the Supreme Pontiff’s gardens at the Vatican and we got to talking about literature as we so often do, and we found ourselves greatly admiring the German inventor who today can take up to three original works of an author and, by means of movable type characters, can within 100 days turn out more than 200 copies. In a single contact of his press he can reproduce a copy of an entire page of a large manuscript. And so we went from topic to topic marveling at the ingenuity that men showed in various enterprises, till Dato gave expression to his warm admiration for those men who can exploit what are called ‘ciphers.’ ”
So wrote Leon Battista Alberti near the beginning of the succinct but suggestive work that earned him the title of Father of Western Cryptology. Alberti was the first of a group of writers who, element by element, developed a type of cipher to which most of today’s systems of cryptography belong. The species is polyalphabetic substitution.
As the name implies, it involves two or more cipher alphabets. Because the different alphabets use the same symbols (usually letters) for ciphertext, a given symbol can represent different plaintext letters, depending on which alphabet is being used. This naturally will confuse the cryptanalyst, which of course is the point. But it could also confuse the cryptographer, unless he knew which alphabet was then in use, and this knowledge implies some kind of rotation or rule for bringing the alphabets into play. All this differs from the simple use of homophones or their much rarer opposites, polyphones. A given homophone always represents the same plaintext letter, and a given polyphone always represents the same choice of plaintext letters, usually two or three at the most. Their relation to their plaintext elements remains fixed. In polyalphabetic substitution the relationship is variable. It thus marked a great stride forward in cryptology, though it did not supplant the nomenclator in political cryptography for more than 400 years. In the 20th century, the ways of varying the plain-to-cipher relationship reached such proportions of complexity as to afford cryptographers guarantees of extraordinary security.
It was the amateurs of cryptology who created the species. The professionals, who almost certainly surpassed them in cryptanalytic expertise, concentrated on the down-to-earth problems of the systems that were then in use but are now outdated. The amateurs, unfettered to these realities, soared into the empyrean of theory. There were four whose thought took wings: a famous architect, an intellectual cleric, an ecclesiastical courtier, and a natural scientist.
The architect was Alberti, a man who, perhaps better than anyone except Leonardo da Vinci, epitomizes the Renaissance ideal of the universal man. Born in 1404, the illegitimate but favored son of a family of rich Florentine merchants, Alberti enjoyed extraordinary intellectual and athletic aptitudes. His family cultivated these with lavish care, educating him in the law at the University of Bologna and sending him on a grand tour of Europe in his mid-twenties. A severe illness that caused a partial loss of memory interrupted a career which might have led to a bishopric, and Alberti turned his attention from law to arts and sciences. As an architect, he completed the Pitti Palace, erected the first Fountain of Trevi in Rome (since replaced in a renovation), and constructed, among many other buildings, the church of Sant’Andrea at Mantua, which served as the model for many Renaissance churches, and the temple of Malatesta at Rimini.
His talent was universal. He painted, composed music, and was regarded as one of the best organists of his day. He was given one of the leading roles in an imaginary philosophical dialogue. Writings poured from his pen: poems, fables, comedies, a t
reatise on the fly, a funeral oration for his dog, a misogynistic essay on cosmetics and coquetry, the first scientific investigation of perspective, books on morality, law, philosophy, family life, sculpture, and painting. His De Re Aedificatoria, the first printed book on architecture, written while Gothic churches were still being built, helped shape the thoughts of those who built such utterly non-Gothic structures as St. Peter’s Basilica in Rome. It stands as “the theoretical cornerstone of the architecture of the Renaissance.” Alberti was a superb athlete, supposedly able to fling a coin so it rang against the high vault of a cathedral and capable of riding the wildest horses. Jacob Burckhardt, author of the classic The Civilization of the Renaissance in Italy, singled out Alberti as one of the truly all-sided men who tower above their numerous many-sided contemporaries. And another great Renaissance scholar, John Symonds, declared that “He presents the spirit of the 15th century at its very best.”
Among his friends was the pontifical secretary, Leonardo Dato, one of the learned men of his age, who during that memorable stroll in the Vatican gardens brought the conversation around to cryptology. “You’ve always been interested in these secrets of nature,” Dato said. “What do you think of these decipherers? Have you tried your hand at it, as much as you know how to?”
Alberti smiled. He knew that Dato’s duties included ciphers (it was before the curia had a separate cipher secretary). “You’re the head of the papal secretariat,” he teased. “Could it be that you had to use these things a few times in matters of great importance to His Holiness?”
“That’s why I brought it up,” Dato replied candidly. “And because of the post I have, I want to be able to do it myself without having to use outside interpreters. For when they bring me letters in cipher intercepted by spies, it’s no joking matter. So please—if you’ve thought up any new ideas having to do with this business, tell me about them.” So Alberti promised that he would do some work on it so that Dato would see that it was profitable to have asked him, and the result was the essay that he wrote in 1466 or early 1467, when he was 62 or 63.
He implied that he thought up the idea of frequency analysis all by himself, but the conception that he set forth is far too matured for that. Nevertheless, his remarkably lucid Latin essay, totaling about 25 manuscript pages, constitutes the West’s oldest extant text on cryptanalysis. “First I shall consider the number of letters and the phenomena which depend on the rules of number,” he wrote at the start of his analysis. “Here the vowels claim first place…. Without a vowel there is no syllable. It follows that if you take a page of some [Latin] poet or dramatist and make separate counts of the vowels and consonants in the lines, you will be sure to find the vowels very numerous…. If all the vowels of a page were put together, to the number of, say, 300, the number of all the consonants together will be about 400. Among the vowels I have noticed that the letter o, while not less frequent than the consonants, occurs less often than the other vowels.” He continued in this vein through a detailed description of the characteristics of Latin: “When the consonants follow a vowel at the end of the word, this final consonant will never be any except t, s, and x, to which c may be added.” He touched briefly upon Italian and pointed out that if a cipher message has more than 20 different elements, nulls and homophones may be present because Latin and Italian use only 20 letters.
Only after he had explained how ciphers are solved did he proceed to ways of preventing solution—a wise procedure which is ordinarily neglected by the inventors of cipher systems. Alberti first reviewed different systems of en-cipherment: substitutions of various kinds, transposition of the letters within a word, placing dots above the letters of a cover text to spell out a secret message, and invisible inks. He capped his work with a cipher of his own invention that he called “worthy of kings” and, like all inventors, claimed was unbreakable. This was the cipher disk that founded polyalphabeticity. With this invention, the West, which up to this point had equaled but had never surpassed the East in cryptology, took the lead that it has never lost.
“I make two circles out of copper plates. One, the larger, is called stationary, the smaller is called movable. The diameter of the stationary plate is one-ninth greater than that of the movable plate. I divide the circumference of each circle into 24 equal parts. These parts are called cells. In the various cells of the larger circle I write the capital letters, one at a time in red, in the usual order of the letters, A first, B second, C third, and then the rest, omitting H and K [and Y] because they are not necessary.” This gave him 20 letters, since J, U, and W were not in his alphabet, and in the remaining four spaces he inscribed the numbers 1 to 4 in black. (The red and black seem to signify only that Alberti liked colors.) In each of the 24 cells of the movable circle he inscribed “a small letter in black, and not in regular order like the stationary characters, but scattered at random. Thus we may suppose the first of them to be a, the second g, the third q, and so on with the rest until the 24 cells of the circle are full; for there are 24 characters in the Latin alphabet, the last being et [probably meaning “&”]. After completing these arrangements we place the smaller circle upon the larger so that a needle driven through the centers of both may serve as the axis of both and the movable plate may be revolved around it.”
Leon Battista Albert’s cipher disk
The two correspondents—who, Alberti carefully pointed out, must each have identical disks—agree upon an index letter in the movable disk, say k. Then, to encipher, the sender places this prearranged index letter against any letter of the outer disk. He informs his correspondent of this position of the disk by writing, as the first letter of the ciphertext, this letter of the outer ring. Alberti gave the example of k being placed against B. “From this as a starting point all the other characters of the message will acquire the force and sounds of the stationary characters above them.”* So far nothing remarkable had happened. But in his next sentence Alberti placed cryptography’s feet on the road to its modern complexity. “After writing three or four words, I shall change the position of the index in our formula by turning the circle, so that the index k may be, say, under D. So in my message I shall write a capital D, and from this point on [ciphertext] k will signify no longer b but d, and all the other stationary letters at the top will receive new meanings.”
There is the crucial point: “new meanings.” Each new position of the inner disk brings different letters opposite one another in the inner and outer rings. Consequently, each shift means that plaintext letters would be replaced with different ciphertext equivalents. For example, the plaintext word NO might be enciphered to fc at one setting and to ze at another. Equally, at each shift a given ciphertext letter would stand for a different plaintext letter than it did at the previous setting. Thus, the fc that formerly represented NO might, at the new setting, stand for plaintext TU. This shift in both plain and cipher equivalents differentiates polyalphabetic from homophonic or polyphonic substitution. In homophonic substitution, plaintext E might be represented by 89, 43, 57, and 64—but those four numbers would always and invariably refer to the same plaintext, whereas in polyalphabetic substitution cipher equivalents have different plaintext meanings. Moreover, while E in homophonic substitution is limited to that group of cipher equivalents, in polyalphabetic substitution it may be replaced by any one of the ciphertext letters. In substitution using polyphones, ciphertext 24 may stand for both plaintext R and plaintext G. But it will invariably stand for just those two letters, whereas a ciphertext symbol in polyalphabetic substitution may stand for any one of all the plaintext letters. To a cryptanalyst, the quicksilver, impermanent nature of cipher symbols in polyalphabetic substitution, which mean one thing here and another there, can be exceedingly baffling; at the same time, the collapse of his expectations of seeing a plaintext A being again represented by the ciphertext symbol that he previously extracted for it can be very frustrating.
Each new setting of Alberti’s disk brought into play a new cipher alphabet, i
n which both the plaintext and the ciphertext equivalents are changed in regard to one another. There are as many of these alphabets as there are positions of his disk, and this multiplicity means that Alberti here devised the first polyalphabetic cipher.
This achievement—critical in the history of cryptology—Alberti then adorned by another remarkable invention: enciphered code. It was for this that he had put numbers in the outer ring. In a table he permuted the numbers 1 to 4 in two-, three-, and four-digit groups, from 11 to 4444, and used these as 336 codegroups for a small code. “In this table, according to agreement, we shall enter in the various lines at the numbers whatever complete phrases we please, for example, corresponding to 12, ‘We have made ready the ships which we promised and supplied them with troops and grain.’” These code values did not change, any more than the mixed alphabet of the disk did. But the digits resulting from an encoding were then enciphered with the disk just as if they were plaintext letters. In Alberti’s words, “These numbers I then insert in my message according to the formula of the cipher, representing them by the letters that denote these numbers.” These numbers thus changed their ciphertext equivalents as the disk turned. Hence 341, perhaps meaning “Pope,” might become mrp at one position and fco at another. This constitutes an excellent form of enciphered code, and just how precocious Alberti was may be seen by the fact that the major powers of the earth did not begin to encipher their code messages until 400 years later, near the end of the 19th century, and even then their systems were much simpler than this.