COMMUNICATION TIIKORV ()!■ SJ-XRECV SVSTIiMS 707 



bits, and each trial yields logo 3 hits of information; thus, when there is no 

 "diophantine trouble," log2 27/log2 3 or 3 trials are sufficient. 



This method of solution is feasible only if the key space can be divided 

 into a small number of subsets, with a simi)le method of determining the 

 subset to which the correct key belongs. One does not need to assume a 

 complete key in order to apply a consistency test and determine if the 

 assumption is justilied^an assumption on a part of the key (or as to whether 

 the key is in some large section of the key space) can be tested. In other words 

 it is possible to solve for the key bit by bit. 



The possibility of this method of analysis is the crucial weakness of most 

 ciphering systems. For example, in simple substitution, an assumption on 

 a single letter can be checked against its frequency, variety of contact, 

 doubles or reversals, etc. In determining a single letter the key space is 

 reduced by 1.4 decimal digits from the original 26. The same effect is seen 

 in all the elementary types of ciphers. In the Vigenere, the assumption of 

 two or three letters of the key is easily checked by deciphering at other 

 points with this fragment and noting whether clear emerges. The com- 

 pound Vigenere is much better from this point of view, if we assume a 

 fairly large number of component periods, producing a repetition rate larger 

 than will be intercepted. In this case as many key letters are used in en- 

 ciphering each letter as there are periods. Although this is only a fraction 

 of the entire key, at least a fair number of letters must be assumed before 

 a consistency check can be applied. 



Our first conclusion then, regarding practical small key cipher design, is 

 that a considerable amount of key should be used in enciphering each small 

 element of the message. 



23. Statistical Methods 



It is possible to solve many kinds of ciphers by statistical analysis. 

 Consider again simple substitution. The first thing a cryptanalyst does with 

 an intercepted cryptogram is to make a frequency count. If the cryptogram 

 contains, say, 200 letters it is safe to assume that few, if any, of the letters 

 are out of their frequency groups, this being a division into 4 sets of well 

 defined frequency limits. The logarithm of the number of keys within this 

 limitation may be calculated as 



log 2! 9! 9! 6! = 14.28 



and the simple frequency count thus reduces the key uncertaint}' by 12 

 decimal digits, a tremendous gain. 



In general, a statistical attack proceeds as follows: A certain statistic is 

 measured on the intercepted cryptogram E. This statistic is such that for 

 all reasonable messages M it assumes about the same value, Sk, the value 



