CryptLab 密碼實驗室

A cipher's strength has a hard ceiling: the number of keys an attacker must try. Caesar has 25. You just read all of them on one screen. It does not matter how clever the method is or how well it is hidden — 25 guesses is not security, it is a formality.

This is why modern ciphers quote key sizes in bits. AES-128 has roughly 3.4 × 10³⁸ keys. The method is public, exactly as Kerckhoffs demanded; the defence is that exhausting the keyspace is not physically possible. Caesar's defence was that you would not bother.

Except that the number on the box is not the number that protects you. In 2006 a Debian maintainer, tidying up compiler warnings in OpenSSL, commented out two lines that fed entropy into the random number generator. He had even asked on a mailing list whether it was safe, and got an ambiguous answer. The keys still said 1024 or 2048 bits. But only 32,768 distinct values could ever be generated, and every SSH key, SSL certificate and VPN key made on a Debian system for the next twenty months could be enumerated — a keyspace smaller than a Caesar cipher's is large, discovered in 2008 after two years in production. You just broke 25 keys by reading. Someone with a laptop broke 32,768 the same way.

What comes next. Enlarging the key is the obvious repair. Scramble the whole alphabet instead of sliding it and you get 26! ≈ 4 × 10²⁶ keys — far too many to try. That cipher held until a scholar in Baghdad noticed the key space was never the point. Tab ②.

Vigenère resisted for three centuries because it destroys the single-letter fingerprint: the same plaintext letter encrypts differently depending on where it sits. Frequency analysis on the whole message returns mush.

Charles Babbage (around 1854, unpublished) and Friedrich Kasiski (1863) saw the flaw. The cipher is not one alphabet, it is N alphabets used in rotation, where N is the key length. Split the ciphertext into N columns by position and every column has been enciphered with a single Caesar shift — and single-letter frequency analysis works perfectly on each one.

So the whole attack reduces to finding N. Kasiski looked for repeated groups of letters and measured the gaps between them, since a repeat usually means the same plaintext met the same key letters; the key length divides those gaps. The index of coincidence, introduced by William Friedman in 1922, does the same job statistically and is what the bars above measure.

Caesar fails because the key is too short. Vigenère fails because the key repeats — and repetition is structure, which is exactly what a codebreaker eats. Stretch the key until it is as long as the message and never reused, and you get the one-time pad, which is genuinely unbreakable and was proved so by Claude Shannon in 1949.

The catch is that the pad must be truly random, as long as everything you will ever send, and never used twice. Get any of that wrong and it degrades into a Vigenère with a very long key. That is precisely the mistake in the Venona challenge on the next tab.

1. The ciphertext is loaded above, and the bars below count its letters.
2. The tallest bar is this message's most common cipher letter — right now that's ·.
3. In English the most common letter is E. Drag the gold E from the English row up onto ·, and every one of those turns into e.
4. The second tallest is ·. The second most common English letter is T — drag T onto it.
5. Keep working down the English order (E T A O I N S H R…). Short common words fall out fast, and once the appears you have three letters confirmed at once.
6. When two bars are nearly the same height, the ranking is a coin-flip. Drag one letter onto the other's bar to swap them, read the result, and keep whichever is English.
7. Wrong letter? Drag it off the board and it vanishes. Or hit Guess by frequency to fill the whole ranking at once, then hand-fix the few it gets wrong.

The letters above update to match whichever challenge you pick. The method never changes — only the mapping does.

In Baghdad's House of Wisdom, Al-Kindi wrote the first known description of frequency analysis around 850 CE. His insight: a substitution cipher hides which symbol stands for a letter, but not how often it appears. Count the symbols, compare to a language's known letter frequencies, and the mapping unravels. That one idea made every fixed-substitution cipher readable to anyone who knew it — and such ciphers stayed in serious use for centuries afterwards anyway, because the people relying on them did not.

In 1586 Mary plotted against Elizabeth I in letters enciphered with a nomenclator — a substitution alphabet plus a codebook of symbols standing for whole names and phrases. Walsingham's codebreaker Thomas Phelippes broke it by counting symbols, then forged a postscript onto Mary's letter asking Babington to name the gentlemen who would act with him. The decrypts were read at her trial. She was executed in 1587.

The counting is the same idea you are using here; the cipher is not the same object. A nomenclator's codebook entries have no letter frequencies to exploit, which is exactly why breaking one took a codebreaker rather than an afternoon.

A warning about the shape of this page. The tabs are chronological, but they are not a ladder where each tool supersedes the last. Every tool below attacks a different weakness under different assumptions. Bigrams do not replace the Vigenère procedure — they cannot touch a repeating key. A crib is not universally stronger than counting; it buys power by assuming you know a word. And nothing in tabs ①–⑤ touches a correctly used one-time pad. What actually accumulates is not power but options: more ways for a cipher to leak, and more kinds of evidence worth collecting.

1. ① Caesar · antiquity. Twenty-five keys. Exhaust them. No technique required, and none was ever invented, because none was needed.
2. ② Single letters · c. 850. Al-Kindi in Baghdad. Scrambling the whole alphabet defeats exhaustion — 4 × 10²⁶ keys — but not counting. This is the first cryptanalysis known to history.
3. ③ Vigenère · 1863. Babbage and Kasiski. Changing the alphabet on every letter defeats counting, until you notice the key repeats and split the message into columns.
4. ④ Letter pairs · 1922. Friedman's statistical cryptanalysis, later run at machine speed by Baldwin's Crypt Breaker's Workbench in 1985. Single letters give 26 facts; pairs give 676.
5. ⑤ Cribs · 1940. Bletchley Park. When statistics run out, guess a word. One correct crib yields several letters at once and rescues messages no amount of counting can touch.

Notice what never changes: the ciphers on this page are exactly as strong as they always were. What improved was the attacker. That is the uncomfortable asymmetry at the heart of cryptography — you must defend against every future technique, while an attacker need only wait for one.

Letter frequencies are only reliable on average. In a short message the counts wobble, so the tallest bar is not guaranteed to be E and near-ties are genuine coin-flips. Intercept more text and the counts settle toward their true frequencies. Same reason a poll of 10,000 beats a poll of 10.

You can measure it here rather than take it on faith, and the result is blunter than the textbook version. Run Tool 1 on anything on this page and it scores somewhere between nothing and about a third of the letters — even on the longest passage. Counting single letters gets you the shape of the plaintext, never the plaintext. That is the wall, and it is where Tool 2 exists.

Now run Tool 2 down the list. On the long and medium passages it usually finishes the job outright. On the short ones it lands somewhere between helpful and embarrassing. On the very short ones it fails completely — and tells you it succeeded. Same algorithm, same English statistics, no extra cleverness anywhere: only the amount of ciphertext changed.

That is the whole lesson of this page. Volume is a weapon. A codebreaker who cannot break your message today may simply need more of it — which is the entire business model of the next section.

Robert W. Baldwin built CBW at MIT in 1984–85 to attack files scrambled by the Unix crypt command; it was released publicly on Usenet in 1987. The workflow is the one you are using: the program proposes a plaintext guess, you accept, reject or correct part of it, and it runs again with your correction locked in. Baldwin reported that a practised user broke a mail message in about twenty minutes.

Two honest differences. Unix crypt was a one-rotor machine, not a fixed substitution — the alphabet moved. And CBW leaned on bigram statistics, the frequency of letter pairs, which carries far more signal than single letters. But the governing law was identical: enough ciphertext, and the statistics do the work. Files encrypted with crypt have not been considered secret since.

Tool 2 on this page is that idea, kept deliberately small. It scores letter pairs, proposes swaps, and refuses to touch anything you placed by hand — so you stay the judge and it stays the assistant. Baldwin's design principle was that the machine should be fast at counting and the human fast at recognising English. Neither is good at the other's job.

Single letters give you 26 numbers. Letter pairs give you 676, and English uses them very unevenly: TH is everywhere, QJ essentially never. So a candidate decryption can be scored by adding up how probable each of its letter pairs is in ordinary English. A good mapping produces a high score; a scrambled one produces a terrible score. That number is the fit shown under the button, rescaled so that 100 means "as English as the reference text" and 0 means "no better than random".

Pressing Refine with pairs runs a simple search: try exchanging two plaintext letters, keep the exchange if the fit improves, repeat until no exchange helps. Letters you placed yourself are frozen, so every correction you make narrows what the search may consider. That is the human-in-the-loop part, and it is where the method gets its power.

Where it lies, and you can watch it happen. Load a very short challenge and run the pair pass. The fit climbs to 100 — a perfect score — while the plaintext is complete nonsense and the letters are essentially all wrong. Nothing is broken. With that few pairs, dozens of mappings fit the statistics equally well, so the search finds one and reports total confidence. A score is a statement about statistics, not about meaning. Read the plaintext, never the number.

The same failure wears a subtler disguise on longer text: the search stops at the first arrangement it cannot improve, which sometimes is not the right one. Pin a letter you are sure of and run it again — every pin removes a whole region of wrong answers from the search.

One more caveat worth stating plainly: the reference statistics here are counted from this page's own English passages, excluding whichever message you are attacking. A tool trained on its own answer key would look far cleverer than it is.

If volume is a weapon, the obvious move is to collect everything and break it whenever you can. Intelligence services have done exactly that for as long as there has been traffic to collect — the Venona project stored Soviet cables in the 1940s and read some of them years later. Storage is cheap and patience is free. Your encrypted traffic today is someone's plaintext later.

What changed is the expected date. In 1994 Peter Shor showed that a large quantum computer could factor integers and compute discrete logarithms in polynomial time — which is to say it breaks RSA, Diffie–Hellman and elliptic curve outright, not by wearing them down but by dissolving the mathematics they stand on. No such machine exists today, and forecasts of when one might arrive range from roughly a decade to never; treat any single number, ten years included, as an opinion rather than a measurement.

Two things soften it. Shor's algorithm does not break symmetric ciphers — Grover's gives only a square-root speedup, so AES-256 stays comfortable. And the replacements are already standards: NIST published ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) with effect from 14 August 2024, adding the code-based HQC as a backup in March 2025. NIST and NSA guidance deprecates today's public-key algorithms by 2030 and disallows them by 2035.

The uncomfortable part is that harvest-now-decrypt-later makes those deadlines retroactive. Anything you send today that must stay secret into the 2040s is already exposed, because the interception happens now and the decryption happens on the attacker's schedule. That is the argument for migrating early rather than on the deadline.

The plaintext of the ciphertext you picked is:

…

Work out the letter mapping yourself, or hit Guess by frequency and fix the near-ties.

In 1949 Claude Shannon defined perfect secrecy: a ciphertext gives an attacker no information whatsoever about the plaintext beyond its length. Formally, the probability of any message given the ciphertext equals its probability beforehand. He proved the one-time pad achieves it — and, more brutally, that any cipher achieving it needs a key at least as long as the message. There is no clever scheme waiting to be found that gives perfect secrecy on a short key. That door is closed by arithmetic.

This is the only cipher on this page that is not merely unbroken but unbreakable, and it is the reason the arms race had to move somewhere else entirely.

American aircraft were being lost over North Vietnam at a rate nobody could explain. The enemy seemed to know mission plans in advance, down to the exact time on target. The obvious conclusion was that the codes had been broken, and Admiral U. S. Grant Sharp Jr. stood up a joint NSA and Defense Department team to find out how. It was codenamed Purple Dragon.

The codes were fine. The team found 50 separate non-secure communications carrying specific operational detail — time-on-target information going out in clear between 75 minutes and 15 hours before missions. Nobody was decrypting anything. They were listening to the chatter around the cipher and watching the patterns: the refuelling requests, the schedules, the sudden bursts of routine traffic before a raid.

The team needed a name for what they were doing, and picked operations security — OPSEC — partly because the acronym got attention. It worked well enough that the Joint Chiefs mandated it across every US command, and in 1988 Reagan's NSDD-298 made it national policy.

Why this belongs on the one-time pad tab. Everything above proves a mathematical statement: under its assumptions, this ciphertext tells an attacker nothing. Purple Dragon is the reminder that the ciphertext is not the only thing you emit. Shannon's proof is about the message. It says nothing about when you sent it, how often, to whom, or how much — and that is frequently enough.

Three requirements, and all three are operational rather than mathematical:

1. As long as everything you will ever send. To exchange a gigabyte secretly you must first exchange a gigabyte secretly — which is the problem you were trying to solve.
2. Truly random. Not "looks random" — generated randomly. This is a property of the process, never of the string, and you cannot inspect a key and tell. Cloudflare's answer is a wall of about a hundred lava lamps in their San Francisco lobby, filmed continuously since 2017, with people walking past adding to the chaos rather than spoiling it; London gets a double pendulum, Lisbon fifty wave machines. That feeds a cryptographic generator as seed material. Note what that is not: they are not couriering lava-lamp pads to anybody. A good generator plus real entropy gives computational security from a short key — which is what modern encryption actually is, and a different thing from the pad's information-theoretic guarantee.
3. Used exactly once. Part 2 is what "once" means. Soviet cable traffic in the 1940s reused duplicated pad pages, and the Venona project read the results for decades.

Pads are still used where those costs are acceptable — a diplomat carrying a sealed book, a hotline between two capitals. For everyone else the question became: can two strangers agree a key over a wire an enemy is listening to? That question stayed open until 1976. Tab ⑦.

Public-key cryptography is usually introduced as a solution to a logistics problem, which makes it sound like plumbing. It was not experienced that way. In 1991 Phil Zimmermann released Pretty Good Privacy as free software, and it spread across the internet almost immediately — because for the first time, two people who had never met and shared no secret could exchange something an eavesdropper could not read.

The US government treated strong cryptography as a munition, and Zimmermann spent three years under criminal investigation for export. In April 1993 the Clinton administration proposed the Clipper Chip: encryption for everyone, with every chip's key split in half and held by two federal agencies, reconstructible on demand. The argument was that law enforcement had to keep up. The counter-argument was that a key someone else holds is not a key, and by 1996 Clipper was dead — helped by Matt Blaze demonstrating you could defeat its escrow while still using the chip.

Why this belongs here. Every tab before this one assumed you and your recipient had already shared a secret. That assumption is fine for an admiral with a courier and useless for everyone else. What the next exercise picks apart is the machinery that removed it — and the reason people fought over that machinery for a decade is that removing it changed who gets to have a private conversation.

Pick two primes p and q. Publish N = p × q and a public exponent e. Encrypt with c = mᵉ mod N. Anyone can do that. Decryption needs d, the inverse of e modulo (p−1)(q−1) — and computing it requires knowing p and q, not just their product.

So the public key hands the world everything except the one thing that matters. Multiplying two 300-digit primes takes microseconds; splitting the result back apart is, as far as anyone knows, infeasible. "As far as anyone knows" is doing enormous work in that sentence, and it is the whole of the security.

Two honest qualifications. Recovering d lets you decrypt efficiently, but "only d decrypts" is too strong — the red box above shows a message read with no private key at all. And while factoring is certainly sufficient to break RSA, it has never been proved that breaking RSA requires factoring. They are believed close; they are not known equal.

Tab ① made the point that the algorithm must be public and only the key secret. RSA goes further: half the key is published too. On every certificate that carries an RSA key, N and e are printed for anyone to read. The design is so confident in the difficulty of factoring that it hands the attacker the number to factor.

That confidence has been repaid for fifty years by classical computers. It was never a proof, and in 1994 someone found a different kind of computer for which the bet does not hold. Tab ⑧.

Step 2 is trivial arithmetic. Step 1 is the whole problem. Above, you found the period by computing every power in turn — for a 20-digit N that is fine, and for the 617-digit N protecting your bank it is hopeless, because the number of powers you must try grows with N itself. Classically, period-finding is no easier than factoring.

A quantum computer does not try the powers one at a time. It prepares a superposition over all exponents at once, then applies a quantum Fourier transform, which is an operation that turns a repeating pattern into a sharp spike at its frequency. Measuring gives the period in polynomial time. That is the entire quantum contribution: one step, doing one thing — detecting repetition — that classical machines cannot do at scale.

Breaks outright: RSA, Diffie–Hellman and elliptic curve cryptography. All three rest on factoring or discrete logarithms, and Shor dissolves both. That is essentially every public-key algorithm securing the internet today.

Does not break: symmetric ciphers. The best known quantum attack on a key search is Grover's, which gives a square-root speedup — AES-256 retains around 128 bits against it, still far out of reach. Hashes are less tidy: preimage search gets the same square-root treatment, while collision resistance is a different problem with its own bounds, so "halve the security" is not one rule covering all hash properties. The one-time pad in tab ⑥ remains perfectly secret regardless, because Shannon's proof is information-theoretic and does not care what machine you own.

When: no machine capable of running Shor at these sizes exists, and published expert forecasts range from about a decade to never. Treat any single figure — including ten years — as an opinion rather than a measurement. What is not an opinion is that the replacements are already standards: NIST published ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) with effect from 14 August 2024, adding code-based HQC as a backup in March 2025, and guidance deprecates today's public-key algorithms by 2030 and disallows them by 2035.

This is where tab ⑧ meets the lesson from tab ②. An attacker does not need the machine on the day they intercept your traffic — only on the day they decide to read it. Recording encrypted traffic now and decrypting it whenever the hardware arrives is called harvest now, decrypt later, and storage is cheap while patience is free.

So the migration deadlines are effectively retroactive. Anything you send today that must stay secret into the 2040s is already exposed, because the interception happens now and the decryption happens on somebody else's schedule. Every tab on this page has been a demonstration of the same asymmetry: you must defend against every future technique, while an attacker need only wait for one.