Deciphering text encrypted with a changing cipher

Question

I know there are many ways to crack basic ciphers were each letter is mapped to some other letter, but what ways are there to decode something that was encrypted using a cipher that changed after every letter, in a way that is based on the letter just coded?

For example, imagine using a Caesar cipher where the number of letters the alphabet was shifted over changes by $n$ after every letter coded, where $n$ is the position in the alphabet of the letter just encoded.

That would seem to null the efficacy of observing letter frequency, double letter patters, common short words, etc. How would a code like this be cracked?

Sorry, I might have been unclear. The Caesar cipher was just an example, but say that the positions shift over $f(n)$ letters instead of just $n$, how would $f(n)$ be determined?

possible duplicate of How to attack a general polyalphabetic cipher? — yyyyyyy, Mar 19 '15 at 00:35
@yyyyyyy Based on the accepted answer there, that seems to be about where the key is periodic; this system need not have periodic key. — cpast, Mar 19 '15 at 02:48
In general I don't think you want to (directly) mix the plaintext with the algorithm or key. That kind of security is ruled out by chosen plaintext attacks anyway. — Maarten Bodewes, Mar 19 '15 at 15:22

score 1 · Answer 1 · answered Mar 19 '15 at 04:06

It's insecure because the algorithm you described has essentially no key. You just have to try 25 different offsets for the first character, then run the algorithm and see if plaintext comes out.

Have a look at Kerckhoff's Principle, and try to understand why there needs to be a secret key in addition to an algorithm.

score 1 · Answer 2 · answered Mar 19 '15 at 14:54

This is a variant of the Vigenere cipher, which is called autokey cipher most of the time. See Wikipedia.

Your assumption, that frequency analysis is nullified is quite wrong. Bigram and trigram analysis still works, the basic principle is: The chances are relatively high, that both the key and the cipher belong to the most frequent bigrams or trigrams. Just because the key does not repeat does not mean, you can't find characteristics of natural language.

Ow, and like pretty much any classical cipher: A single known pair of plaintext & ciphertext fully breaks the system (reveals the key). In today's understanding this is really, really bad. But for toy encryption and practice, it is okay.

score 0 · Answer 3 · answered Mar 19 '15 at 19:42

Sorry, I might have been unclear. The Caesar cipher was just an example, but say that the positions shift over $f(n)$ letters instead of just $n$, how would $f(n)$ be determined?

In general, you may not be able to. For example, consider the following cipher:

$$c_i = (p_i + f_K(c_{i-1}, c_{i-2}, \dotsc, c_{i-k})) \bmod N,$$

where $N$ is the alphabet size, $k$ is the number of previous ciphertext letters to consider, $f_K: \mathbb Z_N^k \to \mathbb Z_N$ is a function chosen from some family of functions based on a secret key $K$, and $V = (c_{-k}, \dotsc, c_{-2}, c_{-1})$ is a string of $k$ random letters prepended to the ciphertext before the first actual message character $c_0$.

The scheme I just described is essentially equivalent to CFB mode encryption. If $k$ is sufficiently large (say, $k \log_2 N \ge 128$) and $f_K$ is chosen from a pseudorandom function family, then this scheme is provably semantically secure.

Of course, if you don't use a secure PRF for $f_K$, or vary the scheme in some other random way, the resulting scheme may or may not be secure anymore. But in general, there is no practical attack that could effectively break all encryption schemes of this type.

It is not exactly CFB (for $k > 1$), as it doesn't really use blocks. But I guess the proof might be transferable (and might need a large enough $k$). — Paŭlo Ebermann, Mar 19 '15 at 20:32
@Paŭlo: Specifically, it's equivalent to the rarely used shift-register variant of CFB, where the encryption unit is smaller than a full cipher block. There are security proofs for that variant, too, although the IV requirements are slightly stricter. (Also, just noticed that my link was broken; fixed.) — Ilmari Karonen, Mar 19 '15 at 21:09

Deciphering text encrypted with a changing cipher

3 Answers3