Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

By "hand cipher", I mean a symmetric cipher for which encryption and decryption can can both be performed with a pencil on graph paper, consuming about 10-20 seconds per character by a proficient user. Additional simple tools, e.g. a deck of cards or a multiplication table, may be used to expedite the process. No mathematical proficiency is required other than mental addition, subtraction, and maybe multiplication.

Basically, it should be a cipher that someone of average mathematical abilities can master, and it should require no digital technology or cryptographic tools that cannot be constructed out of paper.

For example, four-square in CBC mode seems secure to me because CBC is a well established mode of operation and four-square seems to be a good block cipher as it accommodates large keys and seems to produce a random-looking output. However, the fact that four-square in CBC was never widely adopted before digital encryption became a consumer technology leads me to believe that someone broke the cipher and thus discouraged people from using it.

So is there any hand cipher that the best supercomputers would take years to cryptanalyze? If not, then for which hand cipher is the best known attack the most complex?

share|improve this question
This is very similar to… – mikeazo Jan 13 '12 at 2:20
Thanks for the link. I'll give the RC4 implementation mentioned by Ilmari a try, although it seems a bit too cumbersome to meet my criterion of a hand cipher, especially if it is implemented without the pitfalls of WEP and other broken systems. I'm also interested in other systems that weren't mentioned. – Jordan Jan 13 '12 at 6:46
I'd tend to agree with @mikeazo that this question seems almost identical to the previous question in terms of likely answers. Would it be worth clarifying (via an edit) in what way that question doesn't meet your needs? There should be a link under your question for editing, just beneath the classical cipher tag. – user46 Jan 13 '12 at 13:14
up vote 9 down vote accepted

So the one's i'd bet on are either solitaire.

Solitaire by Bruce schneier is probably your best bet. It has a few issues but it will work well for most things. It ends up having a small bias, but it takes about 15 seconds per character after the initial keystream has been generated.

It is not nearly as widely studied a field since most people are assumed to be able to get some computer or something to compute with. The only other one I can think of is VIC. It is based on a lagged Fibonacci generator which is a bit of a different place to start from.

I'd strongly suggest looking long and hard at solitaire. It's really a cool design.

share|improve this answer
Is it really strong, or is it a toy cipher with no real strength? – Smit Johnth May 4 '13 at 21:30
It is strong. First off, it's a stream cipher, similar to other stream ciphers like RC4. Second, it has an initial keyspace of 54!, which is roughly the same as a 237-bit symmetric key. The small bias referred to has an output of 22.5:1 rather than 26:1 as random text would exhibit. However, this is hardly a practical attack on the cipher. For all intents and purposes, this is a strong, but slow and error-prone cipher, that can be used today. – Aaron Toponce Dec 23 '13 at 23:17
That isn't a small bias! That's a rather large bias and it would be trivial to win the semantic security game with high probability after only a few hundred queries. It's completely insecure! – Simon Johnson Jan 4 '14 at 10:46
It is small. If the same top card is shown twice in the same operation, the likelihood of the output card being the same is about 34%. However, the chances of the top card duplicating itself throughout the operation is less than 2%. So, for about ever 50 characters on average, the probability that an output character repeats is 34%. This means that you have a strong probability of the bias revealing itself in the length of a tweet, or about 150 characters. But you can't be sure, unless you have more ciphertext. Due to the slowness of the algorithm, this is unpractical. – Aaron Toponce Aug 23 '14 at 19:01
@AaronToponce: by "this", do you mean the cipher is impractical, or that the cipher is practically secure against this attack because this particular attack is impractical? – David Cary Aug 29 '14 at 15:25

The VIC cipher and for something not as secure but easier for encryption and decryption, the double transposition cipher.

VIC cipher: The VIC (short for VICTOR) was used by the Soviet spy Reino Häyhänen - a pencil paper cipher. To quote the wikipedia page:

Although certainly not as complex or secure as modern computer operated stream ciphers or block ciphers, in practice messages protected by it resisted all attempts at cryptanalysis by at least NSA from its discovery in 1953 until Häyhänen's defection in 1957.

A good article on the Double Transposition cipher can be found on the pbs site, from where I quote:

This was one of the most secure hand ciphers used in the Second World War.

share|improve this answer
re edits: yes, more helpful [downvote removed] – figlesquidge Jan 3 '14 at 16:08

The One Time Pad can be considered a secure hand executed cipher as long as you meet the security requirements of same, but why are you interested in such a method in this wonderfull age of high speed digital electronics???

share|improve this answer
1. Purely academic interest; 2. For the rest of the forseeable future, there will be situations in which people are denied access to private computers. – Jordan Jan 13 '12 at 16:07
+1: The [one-time pad[( is the most secure cipher, period. – David Cary Aug 20 '12 at 16:20
@DavidCary only if it's used properly. Otherwise it quickly mutates to the most unsecure. – Smit Johnth May 4 '13 at 21:31
@DavidCary isn't OTP subject to statistical analysis if something like ASCII is used? – LamonteCristo Oct 23 '13 at 15:17
@makerofthings7: if it is used properly, as Smit Johnth pointed out, then OTP is completely immune to statistical analysis and every other kind of ciphertext-only analysis, no matter how the letters are encoded into numbers -- ASCII, Baudot code, Morse code, etc. See Wikibooks: one time pads for more details. – David Cary Oct 23 '13 at 15:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.