Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Simple version:

Create software that takes a database of the dictionary, alphabet, and phrases. Randomly generate a database of random strings of letters/numbers/symbols of varying length. Randomly assign different strings to different words/letters/phrases.

Frequency analysis should already be hard because you're operating at a higher level than letters. But to make it more difficult, randomly assign multiple strings to the same word.

Throw in a good assortment of null strings for good measure. Certain strings would indicate that X number of strings following it are to be discarded, or various strings could indicate to disregard everything in between, thus adding gibberish to the mix.

Sophisticated version:

Create multiple versions where the same strings are assigned to different words/letters/phrases across each version. Have strings that signal that the following strings are to be interpreted with a certain version. A single version could be used for a whole message, or it could be changed throughout the message.

For example, in one version, f&1nl8(a#v4 could mean car.
In another version it could mean mountain.

Suppose v19g31dfs meant use version 13.
Then f&1nl8(a#v4 v19g31dfs [...] f&1nl8(a#v4 would appear to repeat the same word.

Assume that the software is secure, and the only means of attack is direct cryptanalysis on intercepted messages.


How secure would this code be against cryptanalysis?

share|improve this question
How is the decryption happening? – user93353 Aug 6 '13 at 6:55
On Crypto.SE we always assume the software is secure (which means we don't care about the implementation too much, there's another site for that). How is your cipher different from a keyed substitution cipher? – rath Aug 6 '13 at 9:31
@rath Are you saying side-channel attacks are off-topic?! – Thomas Aug 6 '13 at 21:59
Not at all. A side channel is on topic when it attacks the cryptography, eg. AES timing attacks. I assume that by assume the software is secure the OP means RAM dumps, keyloggers etc. Apologies to the OP if I got this wrong and yes, I could have phrased it better. @Thomas – rath Aug 6 '13 at 22:21
@rath Ah, that makes sense, thanks. – Thomas Aug 6 '13 at 22:25

What you have is a type of substitution cipher, at the level of words rather than letters. Using multiple ciphertexts to correspond with the same plaintext atoms is called homophonic substitution. Homophonic substitution does make frequency analysis on atoms more difficult, but by no means impossible. You merely need more ciphertext to analyze.

Frequency analysis can also be performed on digrams (i.e. pairs of words) or longer sequences. For example, a word that usually precedes a noun has a high probability of being a or the.

Compared with an alphabetic substitution cipher, yours requires a huge key: the key needs to describe all possible substitutions, so it must contain one or more entry per word. Rather than apply complex rules based on such a large key, you'd do better to generate a random key of the same length and use it as a one-time pad. That one-time pad would be good for a plaintext that's as long as your dictionary, whereas frequency attacks would begin in practice long before your dictionary was exhausted.

Adding instructions such as “skip” or “rotate key” in the stream doesn't fundamentally improve things, It does make frequency analysis a lot more difficult if you use them correctly, but not impossible the way modern cryptography does (every byte has exactly the same chance of having any given value, to someone who doesn't know the key). You need to describe the rules in the key, making it even larger.

share|improve this answer
@JamesChristopher Frequency analysis for words requires more sample text than for letters, because there are more distinct words than distinct letters, and the homophony significantly increases the amount of necessary sample text. But it still works. For example all the ciphertexts for “the” are going to have roughly the same frequency. If you know that a word is “the”, then the previous word has some chance of being a preposition and the next word is definitely not a preposition or a verb. – Gilles Aug 7 '13 at 7:44
@JamesChristopher If you randomly change the assignment, the information as to what you're changing appears as part of the ciphertext, so you're exposing that information. You're trading insight for visible information. – Gilles Aug 7 '13 at 7:45
@Giles How does knowing which string is "the" help you here? The previous and following words could be anything. Knowing that its not a preposition or verb leaves plenty of possibilities, and since the same cipher isn't used to encode all the words, you can come up with any number of plausible possibilities. – James Christopher Aug 7 '13 at 7:54
@JamesChristopher I feel I'm repeating myself here. “Most words can be used in all sorts of combinations” is plain wrong. Just like the letter after Q is almost always U in English, the word after “the” is almost always a noun or an adjective. And if you know one part of the plaintext, that automatically gives you all occurrences (or some occurrences, with homophony) in the whole text. – Gilles Aug 7 '13 at 10:14
@JamesChristopher Please avoid extended discussions in comments. Extended discussions are not what this network was created for. This is a Q&A Site. You might want to check Why must we “avoid discussions in comments”? – e-sushi Aug 7 '13 at 11:08

At first glimpse, your idea reads like you're blowing up a substitution cypher from "byte-level" to "word/sentence level". Also, I detect an initial but important security problem: you are weakening the crypto using your "blowup" strategy.

Example: encoding "attack at dawn" using your crypto I would end up in 2 substitutions, while even a simple XOR-based crypto would mix up all 14 characters.

MSG:    attack at dawn
YOU:    green leaf          (where "green" means "attack" and "leaf" means "at dawn")
XOR:    A_%2G6&§sxH%&d      

As you can see: in this case your crypto idea provides only 2/14 of the security compared to a simple XOR approach, which already gives ample indication that it will be pretty easy to analyze and break.

In the end, your idea is probably a good example to show why it's never a good idea to create your own crypto (that is, unless you know what you are doing).


Based on the comments OP posted at @Gilles' and my answer, I would like to advise OP to start learning cryptography from scratch, before diving into useless discussions that lead to nowhere. Personally, I am convinced that it simply doesn't make sense to dive into crypto-analytics as long as OP is missing basic knowledge in the field of cryptography...

A good starting point would be the "Handbook of Applied Cryptography" by Ronald L. Rivest.

share|improve this answer
Not really an answer to the question "how difficult would this be to cryptanalyse" – poncho Aug 6 '13 at 15:34
@poncho I updated it a bit, but looking at the pretty long discussion in the comment area of Gilles' answer, I doubt OP is actually willing to accept any answer that doesn't read "hey, your idea is the best ever". Whatever... – e-sushi Aug 7 '13 at 11:19
@e-sushi. Not trying to create my own crypto. Just trying to learn by seeing how various ideas would be attacked, and Giles' answers didn't help me to understand how it would work. I searched around for the better part of a day trying to see how something like this would be attacked, but could find nothing. As for your example, how would you analyze 'green leaf', if this wasn't based on an algorithmic cipher, but was random or arbitrary? 'green' and 'leaf' could mean anything. It could mean "meet at 3 o'clock' or 'buy a car', etc, whereas a wrong guess at a cipher produces gibberish. – James Christopher Aug 7 '13 at 11:19
@JamesChristopher (1) I was under the impression your question was about crypto-analysis, not about attacking a self-made cypher. There is a BIG difference between "Attacks" and "Analytics" and to be clear: I will never help you attack anything. (2) Looking at what happened in the comment area of Gilles' answer, let me repeat my comment: Please avoid extended discussions in comments. Extended discussions are not what this network was created for. This is a Q&A Site. You might want to check Why must we “avoid discussions in comments”? – e-sushi Aug 7 '13 at 11:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.