Caesar Shift

IPhenomenon

Take the sentence ATTACK AT DAWN and push every letter three places forward: A becomes D, T becomes W, and the message leaves the room as DWWDFN DW GDZQ.

Nothing about the letters changed except their labels. The word lengths survive, the punctuation survives, and any letter that repeated in the plaintext repeats in the ciphertext at exactly the same distance. ATTACK has a doubled T at positions 2 and 3; DWWDFN has a doubled W at positions 2 and 3.

That survival of shape is what makes the cipher readable to an attacker. The ciphertext is not a new language, it is the same language wearing a uniform.

IIKey space

The key is one integer, and only 25 of them do anything. A shift of 26 returns the plaintext, a shift of 27 is identical to a shift of 1, so 25 is the whole universe of distinct keys.

log2(25) is roughly 4.64 bits. For comparison, a modern symmetric key is 128 bits: the Caesar keyspace is smaller than a coin flip repeated five times.

The square matters more than the number. Because the encryption of any letter depends only on that letter, the cipher has no memory. Encrypting AAAA with shift 3 always produces DDDD; there is no context, no chaining, no state. A cipher with no state can be attacked one letter at a time.

Rule of thumb learned here: if the key is smaller than the message, the message is the key.

IIIEnciphering

• Write the plaintext in capitals: ATTACK AT DAWN.
• Choose the shift. Caesar's own reported setting was three.
• Write the alphabet twice, the second copy shifted by the key: A B C D E ... / D E F G H ...
• Replace each plaintext letter with the letter directly beneath it in the shifted row.
• Keep the word breaks. Remove or keep the spaces as the convention requires — either way it makes no difference to security.
• Group the result in fives if the message is long: DWWDF NDWGD ZQ.

IVDeciphering

• Count the letters in the ciphertext and record the frequencies.
• Compare against the frequency profile of the language. In English the tallest bar is E, the second is usually T or A.
• Subtract to get the shift. If the tallest ciphertext letter is H, the shift is 3.
• Shift the whole ciphertext backwards by that amount and read it.
• If the result is nonsense, try the second and third tallest bars — short messages are noisy and the top bar is not always E.

VWeakness

Frequency analysis. In English prose, E, T, A, O and I together account for roughly 40% of all letters. Count the letters in a few hundred characters of Caesar ciphertext, find the tallest bar, and you have almost certainly located E — which hands you the shift by subtraction.

Brute force is trivial. Twenty-five keys can be run by hand in a quarter of an hour. Write the ciphertext once, shift it once per line, and read down the column until a line makes sense.

Known plaintext is fatal. If an attacker knows a single expected word — a signature, a date, the word ATTACK in a military dispatch — comparing one letter gives the shift immediately.

It never dies. The ROT13 variant of this cipher is still used on Usenet and in online forums to hide spoilers, not because it is secure but because it is one-line reversible and everyone can read it in their head.

VIPractice

·History note

Suetonius, writing in the second century, records that Julius Caesar used a shift of three for confidential correspondence and that his nephew Augustus used a different shift and never wrote a letter in cipher where he could write one in plain text. The cipher predates the name: shifting alphabets appear in Hebrew and Greek material centuries earlier. The technique was never broken in its own time — what killed it was the invention of frequency analysis, attributed to the ninth-century Arab polymath al-Kindi in his Manuscript on Deciphering Cryptographic Messages, the earliest known written account of cryptanalysis.

·Further reading

Two lessons carry forward into every later entry on this loom.

First: a substitution cipher is only as strong as the number of distinct substitutions available. Twenty-five shifts is a substitution alphabet set of 25; a full mixed alphabet gives 26! keys, which is where the real arms race begins.

Second: the attack that kills Caesar — counting letters — is the same attack that kills almost every monoalphabetic cipher, and it is the reason every polyalphabetic entry in this collection exists. Once you can count, you need a cipher where the count stops meaning anything.

Next on the loom: atbash-cipher uses a mirror rather than a shift, and unlike Caesar it is its own inverse.

+Weave into