THE CODEBREAKERS

by DAVID KAHN

  The cryptanalyst then writes out the cryptogram in lines six letters wide, thus setting beneath one another all the letters presumed enciphered with the same keyletter. He segregates each column and attempts to find the plaintext equivalents of the letters in each one. With the above cryptogram, he finds the following 48 letters in the first column. These represent all the letters homogeneously enciphered by the first keyletter (if the period of 6 is correct) and constitute the 1st, 7th, 13th, 19th, 25th, 31st, and so on, letters in the cryptogram: ASLKVHUWZLJUKHMSGMSZKUWWSLHZWUTJAZSJ MVEWUYJGJJSY.

  Meager though its frequency count is, it indubitably reflects a monalphabetic substitution; a polyalphabetic count would be much smoother:

  This is an encouraging sign to the cryptanalyst, for only if his deduction about the period is correct will such a count be monalphabetic.

  To the experienced eye, the little hills and dales of that frequency count limn one thing: the normal profile. This is the outline made by the standard frequency count (of English). It does not have to start at a; it preserves its shape even in cyclical form, and, when dealing with the Caesar alphabets of the Vigenère family, this is the form in which the cryptanalyst will most often meet it. The single most durable and detectable feature of the normal profile is the long, low peneplane of uvwxyz, which extends almost a quarter of the profile and is extremely depressed. This basin is sharply walled off by the rst cordillera at one end and the single peak of a at the other. The other features of the profile are more easily eroded by decreases in size of sample. The pinnacle of e normally soars midway between a and the double tower of hi, which is followed by the severe drop to jk. High-frequency n and o also rise to twin peaks. In short samples, however, the troughs of the profile are often more reliable indicators than the crests.

  This physiognomy appears, in stunted form, in the count above. The low-frequency depression is unmistakable at NOPQR. The rst group cannot bematched with KLM, for then high-frequency J would represent q and the high-frequency S would represent z. It must thus coincide with JKL, and though this gives plaintext u a slightly disproportionate frequency, it is one well within the allowable limits. Plaintext c also has too high a frequency, but this is one of the normal abnormalities that the cryptanalyst must expect. In general, then, the match is satisfactory. If both the plain and cipher alphabets are known, as they are here, being both normal alphabets, the identification of a single plaintext letter will align the cipher alphabet with the plain alphabet and thus instantaneously yield the identification of every other cipher letter. In this case, the cryptanalyst fixes the alignment of the plain and the cipher components at the “point” uvwxyz = MNOPQR, with this result:

  This can be cycled to bring the plaintext a to the head, which is the more usual arrangement, but the plain-to-cipher equivalencies will remain the same. These equivalents are, for the 48 letters enciphered by the first keyletter:

  This is quite an acceptable aggregation of plaintext letters, and the solution picks up momentum.

  Perhaps the most important thing that the cryptanalyst learned from the identification of the alphabet as the normal profile was that the cipher belonged to the Vigenère family. This opens the door to a whole variety of special techniques. These are based on the fact that the alphabet, in this family of ciphers, is known. The techniques would work as well for any other polyalphabetic cipher in which the cipher alphabet is known to the cryptanalyst, but such situations arise far more frequently with the Vigenère family because the standard A-to-Z arrangement that it employs is universally known and extensively applied.

  One of these special techniques identifies plaintext letters mechanically. It employs cardboard strips with the alphabet printed on them twice, the nine high-frequency letters (e, t, a, o, n, i, r, s, h) in red, the others in black. The cryptanalyst aligns the strips under one another to bring the ciphertext letters into a column. The other columns that are automatically formed out to the right represent all the possible solutions for that aggregation of ciphertext letters. The cryptanalyst scans them to see which one is the reddest by virtue of having the most high-frequency letters. Probability theory can predict how likely it is that the reddest column will be the correct one: with nine cipher-text letters, 42 per cent; with twelve, 61 per cent; with fifteen, 74 per cent. If the next-to-reddest column is included, the probabilities that either it or the reddest will prove the correct plaintext rise to 74, 85, and 90 per cent, respectively.

  A practical drawback is that since nine letters comprise fully a third of the alphabet, most columns will look fairly red. It is easier to cast out the wrong columns than to choose the right one, and the best criterion for rejection is the presence of too many rare letters. The color principle may be applied to them: blue for the five low-frequency letters. This technique illustrated in printed form in the accompanying table by using boldface for j, k, q, x, and z. The ciphertext letters shown are the first ten that have been enciphered by the second keyletter (the 2nd, 8th, 14th, 20th, 26th, and so on, letters of the cryptogram). Now the five low-frequency letters combined have a frequency of about 2 per cent. In a text of 48 letters like this, then, the five should have a total frequency of one letter. The cryptanalyst will be playing it safe if he passes over any full column with three or more boldface letters.

  On this basis, only the column beginning flop is acceptable. When these letters are paired with those that would precede them in the plaintext, the correctness of both choices becomes incontrovertible:

  From this point on, the cryptanalyst can complete the solution by guessing at words and seeing what effects they produce. For example, the he screams for a t to precede it; this would be the E in column 6. A test decipherment with the alphabet in which t = E, which, in Vigenère, is the alphabet of keyletter L, proves eminently satisfactory: e, e, n, t, a, r, m, ….

  In the end, the key turns out to be SIGNAL and the plaintext to be as follows: If signals are to be displayed in the presence of an enemy, they must be guarded by ciphers. The ciphers must be capable of frequent changes. The rules by which these changes are made must be simple. Ciphers are undiscoverable in proportion as their changes are frequent and as the messages in each change are brief. From Albert J. Myer’s Manual of Signals.

  The longest repetition, LEEBMMTG, resulted from the coincidence of the repeated frequent with the key GNALSIGN, and the next longest, ZUDLJK, from the coincidence of the two must be’s with the key NALSIG. On the other hand, the threefold repetition of ciphers and the fourfold repetition of change did not pole through the fabric of the ciphertext because each encountered different sections of the key. The accidental repetition YVGYS resulted from a freak situation in which the key GNALS enciphered signa and then the key SIGNA enciphered gnals. Accidental repetitions longer than trigraphs are extremely rare, though they have been known to occur.

  What if the alphabets used in the repeating-key system are unknown? The cryptanalyst is faced with the problem of quarrying out plaintext letter after letter, since a single identification will not carry all with it. Usually he conducts a linguistic analysis, and on the basis of contacts, frequency, and so forth, makes a few tentative assumptions. These follow the lines laid down for monalphabetic substitutions. He substitutes these assumptions back into the cryptogram and reconstructs the plaintext bit by bit, often aided by a recovery of the key and reconstruction of the cipher alphabets. The process usually requires 40 to 60 letters per keyletter for success.

  * Porta’s digraphic table was not literal: it used signs.

  7

  CRISES OF THE UNION

  SHORTLY AFTER the fateful guns spoke at Fort Sumter, a 36-year-old telegrapher was summoned to the Cincinnati house of the commander of the military Department of the Ohio. Anson Stager had risen rapidly to become the first general superintendent of the newly formed Western Union Telegraph Company; on mobilization, he had been given charge of the Department of the Ohio’s military telegraphs. He had previously devised a cipher for Ohio’s Governor Denni
son that had worked just fine in communication with his gubernatorial colleagues in Indiana and Illinois, and Major General George B. McClellan wanted Stager to draw up a military cipher along these lines.

  Stager complied. Soon McClellan was relying on the cipher to protect his communications during his successful campaign in West Virginia, and Major General John C. Frémont, commander of the Western Department, transmitted orders for his operations in it. One of its very first users was the detective Allan Pinkerton, founder of the agency that bears his name. The key of the cipher was so short that one colonel carried it on the back of a business card. Its brevity and dependability endeared it to McClellan, who brought it with him later in 1861 when he came east to assume command of the Army of the Potomac. From there it spread rapidly throughout the Union forces, becoming the best as well as the best-known cipher of the Civil War. It was the first military cipher to be used extensively, largely because the Civil War first employed the telegraph on a large scale.

  The cipher was a word transposition. Stager’s telegraphic experience evidently led him to a system in which the ciphertext consisted—as in the new telegraph codes—of ordinary words, which are far less subject to dangerous garbles than groups of incoherent letters. The system also had an appealing simplicity: the plaintext was written out in lines and transcribed by columns, up some and down others in a specified order. As the war progressed, some simple improvements noticeably strengthened it. Nulls ruffled the transcription. Routes traced mazes of diagonals and interrupted columns through ever larger rectangles. Samuel H. Beckwith, Ulysses S. Grant’s cipher operator, suggested that important terms be represented by codewords which he carefully chose to minimize telegraphic error. The cipher expanded from one that could be contained on a single card to one that, at the end of the war, required 12 pages to list routes and 36 for the 1,608 codewords. This was Cipher No. 4, the last of a series of 12 that the North employed at various times.*

  A good example of the system is given by the encipherment of this message sent by Abraham Lincoln on June 1, 1863: “For Colonel Ludlow. Richardson and Brown, correspondents of the Tribune, captured at Vicksburg, are detained at Richmond. Please ascertain why they are detained and get them off if you can. The President.” Cipher No. 9 was in use, and it provided the following codeword substitutions: VENUS for colonel, WAYLAND for captured, ODOR for Vicksburg, NEPTUNE for Richmond, ADAM for President of U.S., and NELLY for 4:30 p.m., the time of dispatch. The encipherer chose to write out the message in seven lines of five words each with three nulls to complete the rectangle:

  For VENUS Ludlow Richardson and

  Brown correspondents of the Tribune

  WAYLAND at ODOR are detained

  at NEPTUNE please ascertain why

  they are detained and get

  them off if you can

  ADAM NELLY THIS FILLS UP

  The route for this configuration ran up the first column, down the second, up the fifth, down the fourth, up the third. Nulls were inserted at the end of each column. With the keyword GUARD heading the message to indicate the size of the rectangle and its route, this ciphertext resulted: GUARD ADAM THEM THEY AT WAYLAND BROWN FOR KISSING VENUS CORRESPONDENTS AT NEPTUNE ARE OFF NELLY TURNING UP CAN GET WHY DETAINED TRIBUNE AND TIMES RICHARDSON THE ARE ASCERTAIN AND YOU FILLS BELLY THIS IF DETAINED PLEASE ODOR OF LUDLOW COMMISSIONER.

  This particular telegram was sent from the War Department over the signature of Major Thomas T. Eckert, the general superintendent of military telegraphs, who later became chairman of the board of the Western Union Telegraph Company. Because the flow of orders and reports through Eckert’s office gave a more detailed and up-to-the-minute picture of the war than any other source, Lincoln paid it frequent visits. He virtually lived there during battles. The telegraph office and its adjunct, the cipher quarters, were located in a converted library and its anteroom, respectively, on the second floor of the War Department building, which stood next to the White House. Here Lincoln relaxed and chatted daily with the three young telegrapher-cipher-operators, David Homer Bates, Charles A. Tinker, and Albert B. Chandler. Bates, who was only 18 when the war started, told about it years later:

  “Outside the members of his cabinet and his private secretaries, none were brought into closer or more confidential relations with Lincoln than the cipher-operators,… for during the Civil War the President spent more of his waking hours in the War Department telegraph office than in any other place, except the White House…. His tall, homely form could be seen crossing the well-shaded lawn between the White House and the War Department day after day with unvaried regularity.” When Lincoln entered the cipher room he would open a little drawer in one of the desks and read the carbon copies of messages that the operators had made on lettersize tissue paper and placed, unfolded, in that drawer for the President’s information.

  “It was his habit to read from the top down,” Chandler wrote, “and when he came to those which he had already read, with a smile he said, ‘Well, I guess I have got down to the raisins.’ As I seemed in doubt as to what that might mean, he explained that a little girl, having eaten improperly both in quantity and quality, beginning with a lot of raisins, was made quite ill, and could find relief only in the process which a sick stomach is likely to compel. After an exhausting siege she gave an exclamation of satisfaction that the end of her trouble was near, for she had ‘got down to the raisins.’ ”

  Once when Lincoln entered the telegraph office on a day of national fasting, he noticed that all the operators were busy, and he remarked: “Gentlemen, this is fast day, and I am pleased to observe that you are working as fast as you can; the proclamation was mine, and that is my interpretation of its bearing on you.” When a battle was in progress, the President would look over the shoulders of the young cipher operators as an especially important message was being deciphered. Sometimes he would read the dispatches aloud, and when he reached such codewords as HOSANNA and HUSBAND, both of which meant Jefferson Davis in one cipher, or HUNTER and HAPPY, both meaning Robert E. Lee, he would invariably translate them as “Jeffy D” or “Bobby Lee.”

  War is hell, Sherman said, but he didn’t know Confederate cryptography. In contrast to the close-knit Union organization, the South apparently extended the states’ rights principle into the realm of cryptography and let each commanding officer choose his own codes and ciphers. Thus, just before the Battle of Shiloh, on April 6, 1862, that excellent officer but indifferent cryptographer, General Albert S. Johnston, agreed with his second-in-command, General Pierre Beauregard, upon a Caesar substitution for military use! Two weeks earlier President Jefferson Davis had sent Johnston “a dictionary of which I have the duplicate…. the word junction would be designated by 146. L. 20,” meaning, respectively, page number, left-hand column, and word number. Beauregard, in turn, sent Major General Patton Anderson a monalphabetic cipher to assure the secrecy of their communications. The Secretary of the Navy, Stephen B. Mallory, instructed Lieutenant John N. Maffitt, then in Mobile readying the cruiser Florida for its spectacularly destructive cruise against Northern shipping, to buy two identical copies of a dictionary for use as a codebook. His colleague, the dashing Commander Raphael Semmes, likewise bought copies of Reid’s English Dictionary for the same purpose as part of his preparation for his harassment of merchantmen in Sumter, the Confederacy’s first warship.

  A Confederate cipher telegram, in Vigenère

  The rebels reposed their major trust, however, in the Vigenère, sometimes using it in the form of a brass cipher disk. In theory, it was an excellent choice, for so far as the South knew the cipher was unbreakable. In practice, it proved a dismal failure. For one thing, transmission errors that added or subtracted a letter (American Morse was peculiarly susceptible to this kind) unmeshed the key from the cipher and caused no end of difficulty. Once Major Cunningham of General Kirby Smith’s staff tried for twelve hours to decipher a garbled message; he finally gave up in disgust and galloped around the Union flank to the
sender to find out what it said. For another, it could be solved by intuitive techniques. And if the South had difficulty reading Dixie cipher messages, the North did not. “It would sometimes take too long to make translations of intercepted dispatches for us to receive any benefit from them,” Ulysses S. Grant wrote. “But sometimes they gave useful information.”

  During the siege of Vicksburg, Grant’s troops captured eight rebels who were trying to slip into the beleaguered city with 200,000 percussion caps. On one of them the Federals found the following cryptogram, which Grant sent to Washington “hoping that someone there may be able to make it out”:

  Jackson, May 25, 1863

  Lieutenant General Pemberton: My XAFV. USLX was VVUFLSJP by the BRCYAJ. 200000 VEGT. SUAJ. NERP. ZIFM. It will be GFOECSZOD as they NTYMNX. Bragg MJTPHINZG a QRCMKBSE. When it DZGJX. I will YOIG. AS. QHY. NITWM do you YTIAM the IIKM. VFVEY. How and where is the JSQMLGUGSFTVE. HBFY is your ROEEL.

  J. E. Johnston

  Lincoln’s three young cipher operators—Tinker, Chandler, and Bates—soon solved it. It proved to be a Vigenère, key MANCHESTER BLUFF, and its clear (after corrections) read as follows (with the two words not solved by the trio in brackets);

  J. E. Johnston

  Lieutenant General Pemberton: My [last note] was captured by the picket. 200000 caps have been sent. It will be increased as they arrive. Bragg is sending a division. When it joins I will come to you. Which do you think the best route? How and where is the enemy encamped’? What is your force?