Scytale

IPhenomenon

Take the plaintext and write it in rows of n letters, where n is the number of faces on the staff. Then read it off in columns instead of rows.

With n = 4 and the message LOOM KEEPS ITS OWN COUNSEL:

Reading down each column and left to right gives LKSOOE OEITWUL OETNN MPSCS — every letter is still present, and not one of them means what it used to.

The crucial difference from Caesar: letter frequencies are unchanged. The count of E in the ciphertext is exactly the count of E in the plaintext. Only the positions were attacked.

IIKey space

The key is the diameter of the staff — a piece of wood, not a number. That is charming and impractical in equal measure.

Because the diameter is continuous in principle, the effective key space is the set of divisors of the message length. For a 60-letter message, the divisors are 1, 2, 3, 4, 5, 6, 10, 12, 15, 20, 30, 60; discard 1 and 60 (they are the identity) and 10 remain. That is under three and a half bits — smaller than the Caesar space.

Worse, the attacker does not need to guess. Each plausible diameter produces a candidate plaintext, and language is instantly recognisable. Fifteen guesses is a coffee break.

This is the recurring lesson of transposition: the keyspace is not the number of physical objects, it is the number of distinctions those objects can make about this particular message.

IIIEnciphering

• Choose the diameter, n. Historically this was the actual staff you owned.
• Strip spaces and punctuation; write the plaintext as one continuous run of capitals.
• Write the run into a table of n columns, filling left to right, top to bottom.
• Pad the final row with filler letters if the table does not close — the receiver must know which letters to discard.
• Read the table top to bottom, column by column, left to right. That is the ciphertext.
• Wind the strip back onto the staff and write it on; the physical act and the table are equivalent.

IVDeciphering

• Count the ciphertext letters. If the staff diameter is n, divide the length by n to get the number of rows.
• Write the ciphertext into a table of n columns by reading down the columns this time — the same table the sender used.
• Read across the rows to recover the plaintext.
• Discard the padding letters at the tail.
• If you do not know n, try every divisor of the length. Read each candidate across the rows and keep the one that is language.

VWeakness

Anagramming. A cryptanalyst who knows only the ciphertext can lay the letters out in a rectangle of every plausible width and read the columns. The correct width announces itself: the columns suddenly form words.

Frequency is untouched. Caesar at least scrambles which letter is common. The scytale leaves the frequency profile as a fingerprint of the language, which means every statistical tool works without modification.

Length is a giveaway. The number of columns that will produce a complete rectangle is a short list, and the attacker can compute it from the message length alone without any key material at all.

The physical key is fragile. A staff can be stolen, measured, or copied. There is no way to change the key without changing the hardware, and no way to use a different key for a different message in the same campaign.

VIPractice

·History note

Plutarch, in his Life of Lysander, describes the Spartan skytale: a strip of leather wound around a staff, written across, and sent to a general who owned an identical staff. The report credits it with keeping a Persian campaign secret, and it is the earliest recorded use of a device specifically designed for cryptography rather than for writing. Its weakness — that the key is a physical object which must be transported, duplicated and protected — is the same weakness every key distribution system has had ever since.

·Further reading

The scytale is a transposition cipher, and transposition never dies — it only gets composed with other things. The First World War German ADFGVX field cipher is a fractionating substitution followed by a columnar transposition; the Second World War double transposition systems used by SOE agents are scytale thinking applied twice.

The modern descendant is the permutation box in a block cipher. AES performs substitution (the S-box) and transposition (ShiftRows and MixColumns) in alternating rounds, on the assumption that neither operation is strong alone but the pair is — which is precisely the intuition the Spartan staff failed to have.

Next on the loom: pigpen-cipher returns to substitution, but replaces the alphabet with a drawn frame.

+Weave into