Lesson №01 1st century BC 15 min

The Caesar cipher

The most famous cipher in history, and the most defenceless one. How it works, and how to break it in a minute without the key.

In this lesson

what a cipher, a key and an algorithm are
how to encrypt and decrypt with a shift
why 25 keys are nothing, and how to brute-force them
what ROT13 is and where you still meet it

Picture yourself as Gaius Julius Caesar in the middle of the first century BC. You are at war in Gaul, and your letters to Rome travel with a messenger across hostile land. The messenger can be caught. The letter can be read. How do you make sure that a stranger holding your letter understands nothing?

Caesar's answer was simple: replace every letter with the one three places further along the alphabet. Write D for A, E for B, F for C. “Rome” becomes “Urph”. We know this from the historian Suetonius, who saw Caesar's letters with his own eyes about 150 years later.

If he had anything confidential to say, he wrote it in cipher, that is, by so changing the order of the letters of the alphabet, that not a word could be made out.
Suetonius, The Lives of the Twelve Caesars, c. AD 121

Three words you'll need from here on

All of cryptography rests on three ideas. They are easy to see in the Caesar cipher, so let's start there.

Plaintext is what you want to say: “attack at dawn”.
Ciphertext is what the interceptor sees: “dwwdfn dw gdzq”.
The key is the small secret that turns one into the other. Caesar's key is the number 3.

The method itself, “shift every letter by some amount”, is the algorithm. You don't need to hide it: let the enemy know you shift letters. As long as they don't know by how much, the letter is safe. Or so it seems.

The Dutch cryptographer Auguste Kerckhoffs put this into a rule in 1883: a cipher's security must depend only on keeping the key secret, not on the enemy not knowing how it works. Every modern cipher is built this way: the algorithms are published, and the key is the only secret.

A disc that does all the work

The easiest way to picture a Caesar cipher is two rings of letters. The outer ring is the plaintext, the inner one the cipher. Turn the inner ring three steps and you have key 3: under every outer letter sits its replacement.

Drag the inner ring, or press “−” and “+”. The window at the top shows a “letter → cipher” pair. Try to find the shift that turns A into Z.

Watch what happens at the end of the alphabet. There is nothing after Z, so counting carries on from the start: X → A, Y → B, Z → C. The alphabet is closed into a ring, like a clock face, where 1 follows 12. Mathematicians call this modular arithmetic: the Latin alphabet has 26 letters, so everything is counted modulo 26.

Encrypt it yourself

Type anything you like. Each letter sits above its cipher letter. The red ones have “wrapped”: they ran past the end of the alphabet and started again from A.

To decrypt, do the same thing backwards: shift every letter back by the key. Or, equivalently, forward by 26 − 3 = 23. A shift of 3 and a shift of 23 add up to a full turn, and the letter is back where it started.

Your agent has been handed a note. You know it was encrypted “like Caesar”, with a shift of 3. Where is the meeting?

Phhw ph dw wkh rog oljkwkrxvh dw plgqljkw.

To decrypt, move every letter three steps back: P → M, H → E, W → T.

The first word is “Meet”. Carry on the same way. You can also use the disc above: set the shift to 3 and read from the inner ring to the outer one.

Shift every letter three back: P→M, H→E, W→T… and you get “Meet me at the old lighthouse at midnight”. The answer is the old lighthouse.

Notice that the cipher leaves spaces and punctuation alone. For a real spy that's a gift: word lengths are visible at once, and short words like “at” and “me” hint at what goes where.

Why it fails: only 25 keys

Now swap roles. You are the enemy, holding an intercepted message. You don't know the key. Can you read it?

You can, and quickly. The Latin alphabet allows only 25 real shifts: a shift of 0 changes nothing, and a shift of 26 is a full turn. So you just try each one. This is called a brute-force attack: try every possible key until one fits.

A person does this in a couple of minutes, a computer in a millionth of a second. But how do you tell which line is “right”? We can simply see that it reads. A machine can't, but it can count letters. Meaningful English is full of E, T and A and has very few Q, X and Z. Press “How would a machine pick?” to see that comparison at work.

A cipher with so few keys that you can try them all protects nothing. A good cipher needs so many keys that trying them all would take longer than the universe has existed.

So why was it good enough for Caesar? Most of his enemies couldn't read Latin, let alone had heard of the idea of a cipher. A weak cipher works as long as the enemy doesn't realise it's a cipher. Nearly 900 years later the Arab scholar al-Kindi described frequency analysis, and from then on such ciphers fell in minutes.

ROT13: a cipher that hides nothing

The Latin alphabet has 26 letters. Shift by 13, exactly half, and something neat happens: encrypting and decrypting become the same operation. Shift by 13 to encrypt, shift by 13 again and you're back where you started.

This variant is called ROT13 (from “rotate”). In the 1980s, online forums used it to hide spoilers and punchlines: you had to make an effort to read them, but anyone could. Here's a question in ROT13:

Jul qvq gur puvpxra pebff gur ebnq?

Try it in the Caesar tool: it has a ROT13 button. The Russian alphabet has no such pretty symmetry: 33 letters don't split in half.

Why does ROT13 both encrypt and decrypt?

The alphabet has 26 letters. Shifting by 13 twice is shifting by 26, which brings you back to the same letter. So the same operation both hides and reveals the text.

What if you encrypt twice?

A natural thought: if one shift is weak, use two. First shift by 5, then shift the result by 7. Surely the codebreaker now has to guess both keys?

A clerk shifted a text by 5, then by 7. How many keys does a codebreaker need to try? More precisely: which single shift decrypts such a text in one go? Enter a number.

Take one letter, say A. Where does it land after a shift of 5? And then after 7 more?

A → F (shift 5) → M (7 more). One shift of 5 + 7 = 12 does exactly the same. Two Caesars in a row are just one Caesar with a different key. There are still only 25 keys, and brute force takes just as long.

Cryptographers took a while to learn this lesson: repeating a weak cipher doesn't make it stronger. To add strength, the ciphers must not combine into one more cipher of the same kind.

What to take with you

A Caesar cipher replaces every letter with the one a fixed number of places further on. That number is the key.
The alphabet is closed into a ring: after Z comes A again. Everything is counted modulo 26 (or 33 for Russian).
There are only 25 keys, so the cipher falls to brute force in a minute. To spot the right line, a machine compares letter frequencies with real language.
Two shifts in a row are one shift. Repeating a weak cipher doesn't strengthen it.

In the next lesson we'll try to fix the main weakness: what if each letter is replaced not by a shifted one, but by any letter at all? There will be more keys than there are stars in the observable universe. And yet that cipher will fall too, to nothing more than counting letters. Next: the substitution cipher →

Tools for this lesson

Everything from the lesson, working: paste your own text.