Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Some ciphers are talked about at “Is there a secure cryptosystem that can be performed mentally?”, but (at the time of writing) I don't see an answer.

Are they strong enough, or are non-computer ciphers more or less just a toy and one should abandon using them for practical purposes?

share|improve this question
So basically you want to know how strong RC4 or Solitaire is? – rath May 4 '13 at 22:24
RC4 doesn't have good reputation, though I don't know if it's completely broken yet. According to answer, Solitaire seems to be a weaker version of RC4. – Smit Johnth May 5 '13 at 7:55
I wonder how long it would take to do AES-256 with pen and paper? :-) – Roland Smith May 5 '13 at 12:41
I think that the suggestion to use RC4-52 in this answer can be made reasonably secure, and practicable with a deck of card by a trained operator. Devil is in the details, in particular the key and nounce/salt setup. I add that much less than 52 symbols should be used for plain and ciphertext, and keystream outside that range should be discarded (I conjecture it strengthen the keystream generator significantly). – fgrieu May 6 '13 at 10:54
possible duplicate of Is there a secure cryptosystem that can be performed mentally? – e-sushi Dec 22 '13 at 17:40

None of them are both strong enough and practical enough to be reasonable to carry out in real life. The strong ones aren't really practical; the practical ones aren't very strong.

share|improve this answer

The only serious cypher you can do with pen and paper is One Time Pad -

share|improve this answer
IMHO it's not possible to remember the keys. – Smit Johnth May 5 '13 at 8:18
The OTP is a perfectly strong encryption system, simple enough to be performed with pen and paper, but is neither a cipher by some theoretical definitions thereof; and is not practical, for the pad is hard to generate, impossible to remember, and hard to conceal. – fgrieu May 5 '13 at 14:24
It can be generated with a computer, but it will be hard to remember it. – Smit Johnth May 13 '13 at 22:34
+1. As the question didn't mandate you had to remember the key in your head; and 'cipher' terminology excluding one-time-pads is splitting hairs for this question. – LateralFractal Oct 18 '13 at 0:20
I wonder if its possible to mentally derive a sufficiently random OTP using a text input, eg. a novel. – Jeff-Inventor ChromeOS Aug 10 '14 at 1:58

"Strong enough" is a broad term. Some things that you need to keep in mind are entropy size and cryptanalysis. "Strong ciphers" are ciphers that have shown to have enough entropy to withstand practical attacks over time from public scrutiny.

With that said, the Solitaire cipher has a keyspace of roughly 238 bits. By comparison, many SSL keys on the internet are 128 bit AES. is currently working on cracking a 72 bit key, via brute force, at a pace of about 300 billion keys per second, and they have well over 100 years before the keyspace is fully exhausted.

So, for the Solitaire cipher to not be taken seriously, it needs to show practical weaknesses outside of brute force searching. So far, the only weakness that has been demonstrated is that the output has a bias of 22.5:1 rather than 26:1 pure random output would have. This isn't severe enough to mount a practical attack.

As such, until other attacks are made known, to Solitaire cipher is a "strong" hand cipher, that doesn't have NSA influence, can be used without incriminating tools and is easy to learn and remember.

share|improve this answer

You can implement a linear feedback shift register using nothing but a series of coins. Define 1 to be heads, 0 for tails. Line them up in to a series 128 coins in length. Then follow the algorithm exactly as you would on a computer.

From this basic generator, you can construct a self-shrunk generator. Self-shrinking generators have somewhat suspect security. You'd probably be fine for a pencil and paper scheme because you can't generate enough ciphertext to run many of the attacks.

The problems are that it is very laborious to encrypt even a small message. Worse, a mistake anywhere in the process will probably completely destroy the security of the scheme.

I have to agree with @D.W. here. This is probably among the better suggestions for a pencil and paper cipher and yet it still poor.

Secure cryptography just requires too much (tedious!) work to be reliably done by hand.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.