by DAVID KAHN
The U.S. Army form of Jefferson’s wheel cypher
Jefferson’s wheel cypher was far and away the most advanced devised in its day. It seems to have come out of the blue rather than as a result of mature reflection upon cryptology. Jefferson continued to use the nomenclator while he was Secretary of State, and the only indication of any cryptographic originality is his selection of a Vigenère as the official cipher for the Lewis and Clark expedition. Moreover, on March 22, 1802, he wrote Dr. Patterson, who had submitted a cipher to Jefferson as president of the American Philosophical Society, that “I have thoroughly considered your cypher, and find it so much more convenient in practice than my wheel cypher, that I am proposing it to the Secretary of state for use in his office,” a month later adding that “We are introducing your cypher into our foreign correspondences.” Patterson’s cipher was a columnar transposition with nulls at the heads of the columns, of a security in no way comparable to Jefferson’s. That Jefferson did not see this does not speak too highly of his cryptologic perceptions.
Had the President recommended his own system to Secretary of State James Madison, he would have endowed his country with a method of secret communication that would almost certainly have withstood any cryptanalytic attack of those days. Instead he appears to have filed and forgotten it. It was not rediscovered among his papers in the Library of Congress until 1922, coincidentally the year the U.S. Army adopted an almost identical device that had been independently invented. Later, other branches of the American government used the Jefferson system, generally slightly modified, and it often defeated the best efforts of the 20th-century cryptanalysts who tried to break it down! To this day the Navy uses it. This is a remarkable longevity. So important is his system that it confers upon Jefferson the title of Father of American Cryptography. And so original is it that it sets Jefferson upon a pedestal far more prominent than those accorded to men like Vigenère and Cardano, whose names are usually thought to be household words in the history of secret writing.
In 1817, another American constructed a cryptograph that, like Jefferson’s, introduced a new principle into cryptology. Colonel Decius Wadsworth, then 49, was a Yale graduate who twice quit the Army (once to seek his fortune in the fur trade) and twice rejoined when wars with France and Britain threatened; how and why he became interested in secret writing remains unknown. But his attraction to mechanical devices may well have fostered his friendship with Eli Whitney, whose cotton gin he admired and whose muskets with interchangeable parts he inspected and approved for use by the Army. When, in 1812, he became the first chief of ordnance of the U.S. Army, he again backed Whitney strongly. Illness forced him to resign this post and his commission in June of 1821, and Whitney, remembering, brought him to New Haven. Here Whitney could visit him daily and ensure his good care. But on November 8 Wadsworth died.
His innovation was to make the plaintext and ciphertext alphabets different lengths. The device in which he realized this is a brass cipher disk set in a polished wooden case six and a half inches in diameter and almost three inches high. It may have been built for him by Whitney. Its outer alphabet consists of the 26 letters plus the digits from 2 to 8 for a total of 33 elements; the inner alphabet consists of just the 26 letters. A little brass plate marks the one point around the two rings of alphabets at which they are in exact conjunction; two apertures in this plate expose the two letters, one on each ring, that are to be taken as plaintext and cipher equivalents. (No records indicate which alphabet Wads worth meant to serve as plain and which as cipher; this account assumes the inner to be the plain alphabet.) These two rings of the disk, both of which revolve, are connected to one another inside the case by two gears, one with 33, the other with 26 teeth. The letters and numbers of the outer ring are stamped on brass plugs which may be assembled in any order. Before enciphering, the correspondents agree on a mixed sequence for the ciphertext ring and on a starting juxtaposition for the two sections, such as, say, R in the outer disk opposite V in the inner; the gears may be disengaged to permit this setting.
Suppose, now, that the correspondents are in the Peruvian wool trade and that their message begins with llama—a word admirably suited to demonstrate the cryptographic workings of their device. The encipherer will spin the inner disk by means of a little knob on it until the first l appears in the inner aperture of the brass plate; he will write down the letter in the outer aperture as the first cipher letter. Then he will turn the inner disk until l appears again in the inner aperture. The gears will have transmitted this motion to the outer ring, but because of the difference in the size of the alphabets, the outer disk will have gone through only 26⁄33rds of a revolution while the inner has completed a full revolution. Consequently, the second ciphertext letter will stand seven places farther forward in the outer alphabet than the first, even though both represent the same plaintext letter. If this process is kept up, the cipher equivalents for l would not begin to repeat until all 33 letters and digits of the outer alphabet had been used. This is because 26 and 33 have no factors in common to bring them into conjunction earlier.
The encipherment thus constitutes a progressive system in which all the cipher alphabets are used, like Trithemius’ original polyalphabetic encipherment. But the disparity in length between the plain and the cipher alphabets results in two crucial differences. One is that the Wadsworth device employs 33 cipher alphabets instead of the 24 of Trithemius. The other is that these alphabets are brought into play, not one right after another, but in an irregular manner—a manner that depends on the letters of the plaintext. This irregularity defends the cipher much better than Trithemius’ regular progression.
Knowledge of Wadsworth’s device, which could not have been widely disseminated even while he lived, faded completely soon after he died. Consequently, credit for the discovery of the principle of sliding two alphabets of different lengths against one another has usually been awarded to a widely known British scientist who independently devised a mechanism based on it.
Charles Wheatstone had a remarkably fertile mind. He constructed an electric telegraph before Morse did, invented the concertina, improved the dynamo, studied underwater telegraphy, produced some of the first stereoscopic drawings, published half a dozen papers on acoustics, discussed phonetics and hypothetical speaking machines in print, conducted numerous electrical experiments, and popularized a method for the extremely accurate measurement of electrical resistance now in frequent use and called the “Wheatstone bridge.” His work was highly enough regarded for him to be elected a fellow of the Royal Society and to be knighted. He was nominally professor of experimental philosophy at King’s College, London, but was so excessively shy that he hardly ever actually lectured. Around 1860, in his late fifties, he solved a long cipher letter of Charles I. It consisted of seven folio pages filled with numerals, each page signed at the top by the king; it proved to be instructions in French for the Sieur de Goffe, enciphered in a small one-part nomenclator (a = 12, 13, 14, 15, 16, 17; b = 18, 19; France = 478).
Wheatstone first displayed his Cryptograph at the Exposition Universelle at Paris in 1867. It differed only in detail from Wadsworth’s. The Wheatstone apparatus had an outer plaintext alphabet of 27 elements—the 26 letters in normal order plus a blank for a word space—and an inner, mixed ciphertext alphabet of the 26 letters. Over these alphabets swung two clocklike hands, which were connected by gears. “At the commencement [of encipherment],” Wheatstone’s instructions read, “the long hand must correspond with the blank of the outer circle and the short hand be directly under it. The long hand must be brought successively to the letters of the despatch (outer circle), and the letters indicated on the inner circle by the short hand must be written down. At the termination of each word the long hand must be brought to the blank, and the letter indicated by the short hand also written down. By this arrangement, the cipher is continuous, no intimation being given of the separation of the words. Whenever a double letter occurs, some unused letter (as, fo
r instance, q) must always be substituted for the repeated letter; or the latter may be omitted.” The variation in the length of the two alphabets means that as the larger hand is completing a revolution, the smaller is already one cell into its second.
The Wheatstone cipher machine, with plaintext alphabet outside, cipher inside
The device’s simplicity, automaticity, apparent insolubility, and compactness impressed many visitors to the exposition. One of them was Colonel Laussedat of the French commission that looked for military possibilities among the exhibits; he reported favorably on the Wheatstone Cryptograph, even to the point of stating that it “assures the most absolute secrecy.”
In fact, a cryptogram produced by this instrument is less secure than a Wadsworth because the Wheatstone difference in alphabet sizes amounts to only one unit. As a result, a doubled ciphertext letter can mean only that their two plaintext letters represent letters in reverse alphabetical order, such as the common digraph on or ts. These may afford a break into the system. Indeed, this very observation was made, and a solution elucidated by attacking sentences as probably starting with the, in an extremely perceptive article signed only “C.P.B.” and published in Macmillan’s Magazine just four years after Wheatstone exhibited his apparatus.
It is another of the many ironies of cryptologic history that Wheatstone’s name adheres to a device that owes its priority to another and that never achieved importance, while a cipher that he did originate, and that served with distinction for many years, bears the name of another. Wheatstone invented the cipher for secrecy in telegraphy, but it carries the name of his friend Lyon Playfair, first Baron Playfair of St. Andrews. A scientist and public figure of Victorian England, Playfair was at one time or another deputy speaker of the House of Commons, postmaster general, and president of the British Association for the Advancement of Science. As a commissioner on the public health of towns, he helped lay the foundations of modern sanitation. He lived across London’s Hammersmith Bridge from Wheatstone. Because both were short and bespectacled, they were frequently mistaken for one another—once even by Lady Wheatstone. They walked together on Sundays and amused themselves by solving the enciphered personal messages in the London Times. They easily read the correspondence of an Oxford student with his young lady in London, and when the student proposed an elopement, Wheatstone inserted an advertisement in the same cipher remonstrating with her. There followed a frantic “Dear Charlie: Write no more. Our cipher is discovered!”—and then silence.
Playfair demonstrated what he called “Wheatstone’s newly-discovered symmetrical cipher” at a dinner in January, 1854, given by the president of the governing council, Lord Granville. One of the guests was Queen Victoria’s husband, Prince Albert; another was the Home Secretary and future Prime Minister, Lord Palmerston. Playfair explained the system to him, and, while in Dublin a few days later, received two short letters in the cipher from Palmerston and Granville, showing that both had readily mastered it.
The earliest known description of the Playfair cipher, signed by its inventor, Charles Wheatstone, March 26, 1854
The cipher is the first literal one in cryptologic history to be digraphic*—that is, to encipher two letters so that the result depends upon both together. Wheatstone recognized that the cipher would work as well with a rectangle as with a square, but it soon petrified into the latter form. Wheatstone also employed a thoroughly mixed cipher alphabet, which he generated by a keyword transposition—one of the earliest instances of such a method. Beneath a keyword he would write the remaining letters of the alphabet, and then derive the mixed alphabet by reading the columns vertically:
Which yields: MBPYADQZGFRNHSEJUTKVILWCOX. This important feature soon slipped out of the picture as the cipher fell to the lowest common denominator, just like Vigenère’s. The keyword was instead inscribed directly into a 5 × 5 square with the remaining letters of the alphabet following. (I and J are merged in a single cell.) The practice lessened security but facilitated operation. It may well have been the way Playfair hastily constructed a keysquare based on PALMERSTON to illustrate the cipher at Granville’s dinner:
To encipher, the plaintext is divided into pairs. Double letters occurring together in a pair must be separated with an x, so that balloon would be enciphered as ba lx lo on; i and j are regarded as identical, so that adjacent will be enciphered as if it were adiacent. Now the letters of each pair may stand in only three relationships to one another with the key square: the two may appear in the same row, in the same column, or in neither. Letters that fall in the same row are each replaced by the letter to its right. Thus, am = LE, hi = IK, os = NT. Each row is considered cyclical, so that the letter to the right of the last letter in a row is the first letter at the left of that row. Thus, le = MP, ui = HK. Letters that appear in the same column are each replaced by the letter beneath it; the cyclical provision holds. Thus, ac = SJ (or SI, as the encipherer wishes); of = FQ, wi = AW, br = HB.
If the plaintext letters appear in neither the same row nor the same column, each is replaced by the letter that lies in its own row and stands in the column occupied by the other plaintext letter. For example, to encipher sq, the encipherer first locates them in the square. Then he runs across the row of the first plaintext letter (s) until he meets the column in which the second plaintext letter (q) stands:
The letter at the junction of row and column (o) becomes the first cipher letter. Then the encipherer traces across the row of the second plaintext letter (q) until he intersects the column in which the first plaintext letter stands:
The letter at the intersection (I) becomes the second cipher letter. Thus sq = OI. Other encipherments are af = MC, at = LS, ed = LG. The letter in the row of the first plaintext letter is always taken first to preserve the order of the letters, so that cl = DA and not AD, which would stand for lc, and we = ZA.
Decipherment in this is precisely the same as encipherment: if ow = SY, then sy = OW. In the other two cases, the plaintext letters are found to the left or above the ciphertext letters. Thus, using the same square, a ciphertext reduces as follows:
The z at the end is a null to complete the final digraph.
Wheatstone and Playfair explained the cipher to the Under Secretary of the Foreign Office, no doubt pointing out its chief advantage—that two plaintext pairs that have a letter in common may not display the slightest resemblance in ciphertext, as le and te above were enciphered to MP and NL. Further, once mastered, it rolls along with remarkable ease and rapidity. When the Under Secretary protested that the system was too complicated, Wheatstone volunteered to show that three out of four boys from the nearest elementary school could be taught it in 15 minutes. The Under Secretary put him off. “That is very possible,” he said, “but you could never teach it to attachés.”
Playfair, reasoning that this reflected more on the diplomats than on the cipher, remained enthusiastic about it. There were good grounds for enthusiasm. In the first place, the cipher’s being digraphic obliterates the single-letter characteristics—e, for example, is no longer identifiable as an entity. This undercuts the usual monographic methods of frequency analysis. Secondly, encipherment by digraphs halves the number of elements available for frequency analysis. A 100-letter text will have only 50 cipher digraphs. In the third place, and most important, the number of digraphs is far greater than the number of single letters, and consequently the linguistic characteristics spread over many more elements and so have much less opportunity to individualize themselves. There are 26 letters but 676 digraphs; the two most frequent English letters, e and t, average frequencies of 12 and 9 per cent; the two most frequent English digraphs, th and he, reach only 3¼and 2½ per cent. In other words, not only are there more units to choose among, the units are less sharply differentiated. The difficulties are doubly doubled.
These properties elevated the cipher above most of its contemporaries purely on cryptographic considerations; it was, probably, regarded as unbreakable. Its many practical excelle
nces—no tables or apparatus required, a keyword that could easily be remembered and changed, great simplicity of operation—commended it as a field cipher. Playfair suggested that it be used as just that in the impending Crimean War when he brought it up at the dinner with Prince Albert. No evidence exists that it was used then, but there are reports that it served in the Boer War. Britain’s War Office apparently kept it secret because it had adopted the cipher as the British Army’s field system. Playfair’s unselfish proselytizing for his friend’s system unwittingly cheated Wheatstone of his cryptographic heritage; though Playfair never claimed the invention as his own, it came to be known in the War Office as Playfair’s Cipher, and his name has stuck to it to this day.
In England in 1857, a 4×5-inch card with an alphabet square printed in red and black went on sale for sixpence. It was a new system of secret writing “adapted for telegrams and postcards,” the latter an even newer form of communication than the telegraph. Admiral Sir Francis Beaufort, R.N., creator of the Beaufort scale with which meteorologists indicate wind velocities by numbers from 0 (calm) to 12 (hurricane), had originated the cipher, and his brother had published it a few months after the admiral’s death. The envelope for the card carried the directions: “Let the key for the foregoing table be a line of poetry or the name of some memorable person or place, which cannot easily be forgotten…. Now look in the side column for the first letter of the text (t) and run the eye across the table until it comes to the first letter of the key (v), then at the top of the column in which v stands will be found the letter c,” which would be the ciphertext.
