Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Chaocipher was invented by John F. Byrne in 1919.

The algorithm was recently revealed -- see Moshe Rubin's Chaocipher Revealed, the Algorithm

While a known plaintext attack successfully finds the keys, nobody has been able to put forward a general solution to this cipher. Is that possible?

share|improve this question
Any cipher than suffers key-recovery under known plaintext is horrifically weak under modern requirements. Nowadays, we tend to require that an attacker cannot even recognise the ciphertext (compared to random data), even if they can choose the plaintext to encrypt and even ask for the decryption of some messages of their own choice –  figlesquidge Apr 8 at 9:40
Ciphertext-only attacks virtually always assume some a priori distribution of plaintexts; otherwise all keys are equally probable. –  Dmitry Khovratovich Apr 8 at 10:20
Thank you both form your responses. I have a follow-up for figlesquidge please. Given that the cipher text from Chaocipher shows some deviation from randomness in one respect (which it does!) how then does the cryptanalyst go about solving the cipher? He knows the algorithm, but has no idea of the two 26-character keys. –  user2256790 Apr 8 at 13:26
Because the key is relatively large [ $2\log_2(26!)>176\text{ bits}$ ], and since the cipher is not trivially bad, a ciphertext-only attack can only be carried with significant amount of ciphertext corresponding to redundant plaintext. If we consider there is 2 bit/letter of exploitable redundancy in English text, and IF the cipher was perfect, we would need about 90-letter ciphertext to have any hope of solving it. Are there large Chaocipher challenges around? (or course it is easy to make some). –  fgrieu Apr 9 at 8:24
There are some lengthy Chaocipher ciphertexts here: mountainvistasoft.com/chaocipher/Chaocipher-ASCII-versions.htm I (and several others) have broken some of these with a known plaintext attack. But nobody (to my knowledge) has developed a method to solve using a ciphertext attack. Such a method would be of great interest. –  user2256790 Apr 27 at 15:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.